Personal Data Protection Policy

Website Privacy Notice

1. What Is the Purpose and Scope of This Privacy Notice?

As Bend Yapı (“Bend Yapı” or the “Organization”), we attach importance to the security and protection of the personal data you share with us. Bend Yapı is a “data controller” in the cases specified in this notice. We process your personal data in accordance with the Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and take appropriate, proportionate and adequate administrative and technical measures to protect your personal data. For more detailed information on our scope, context and approach to the processing of personal data as an organization, you may also review our Privacy Policy.

This privacy notice has been prepared to inform visitors of the “bendyapi.com.tr" website operated by Bend Yapı and individuals who contact our organization through the website. Responsibility for websites belonging to third persons and organizations that we refer to or whose information we share on our website lies not with our organization but with the operator and owner of the relevant website.

2. What Are the Basic Concepts Relating to Personal Data?

• Explicit consent: Consent relating to a specific matter, based on information and expressed of free will
• Anonymization: Rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even when matched with other data
• Data subject: The natural person whose personal data are processed
• Personal data: Any information relating to an identified or identifiable natural person
• Employee handling personal data: Employees who, by virtue of their job description, process the personal data of data subjects on behalf of the organization
• Processing of personal data: Any operation performed on data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partially automated means or by non-automated means provided that they form part of a data recording system
• Board: Personal Data Protection Board
• Authority: Personal Data Protection Authority
• KVK: Personal Data Protection Law No. 6698
• Special Categories of Personal Data: Data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data
• Data processor: A natural or legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller
• Data recording system: A recording system in which personal data are structured and processed according to specific criteria
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for establishing and managing the data recording system
• Joint data controller: Means data controllers that jointly use certain personal data and jointly carry out activities with respect to the methods and purposes of processing.
• Independent data controller: Means a data controller that decides on the purposes and methods of processing personal data independently of any other data controller.

3. Who Are We as the Data Controller?

With regard to the personal data of visitors to its websites and users of the services it provides over the internet, Bend Yapı has the status of “Data Controller” vis-à-vis the relevant natural persons. As a data controller, Bend Yapı fulfills its obligations arising from the law and Board decisions by taking administrative measures and technical measures at an appropriate and proportionate level.

Our identification details as the “Data Controller” and the contact details through which you can reach us regarding personal data are as follows:

4. What Is the Scope of Our Obligation to Inform?

Article 10 of Law No. 6698 imposes on data controllers an obligation to inform the persons whose personal data are processed. The obligation to inform requires that you be informed about matters such as your rights listed in Article 11 of the KVK Law, the identity of the data controller, the purposes of processing personal data, the persons to whom they are transferred, the purposes and methods of transfer, the legal grounds for collecting personal data, and how you can apply as a data subject.

As Bend Yapı, we aim to inform you that your personal data are processed within the limits and conditions set forth in the legislation.

5. Which Categories of Personal Data Are Processed?

We process the identity, contact, personnel and transaction security information of our website visitors.

6. For What Purposes Do We Process Personal Data?

Your personal data are processed, in line with the principles of the KVK Law, on our websites and internet services for the purposes of:

• Conducting commercial activities,
• Ensuring business continuity,
• Planning and executing business strategies,
• Making presentations, promotions and providing information,
• Carrying out promotion and communication through electronic channels,
• Conducting press relations,
• Informing the public,
• Conducting business relations,
• Sharing event images,
• Conducting sales and marketing activities,
• Following up on information, support and complaint requests,
• Operating internet services,
• Carrying out the sale of services,
• Conducting dealer operations,
• Carrying out service/product promotions,
• Ensuring the management of services,
• Receiving job applications,

as listed above.

7. By What Means Do We Process and Protect Personal Data?

We process your data in a manner consistent with the principles listed in Article 4 of the Law and, outside the conditions of lawfulness specified in Article 5, by obtaining your explicit consent. We collect your personal data verbally, in writing or electronically, by automated or non-automated methods, through domestic and foreign channels such as offices, the website and social media platforms.

The personal data of visitors and users are processed on the servers hosting our websites and internet services and on the corporate fixed and mobile devices we use for support, operation and development purposes. All necessary technical and administrative measures are taken, provided that they are appropriate and proportionate, to protect the personal data collected by Bend Yapı, to prevent them from falling into the hands of unauthorized persons and to ensure that our customers and prospective customers are not harmed. Within this framework, we take care that our applications, software and information systems comply with standards and are kept up to date, that data transfer agreements are signed with the parties with whom data are shared, and that our Privacy Policy is complied with within the Organization.

8. With Whom and Why Do We Share Personal Data?

The personal data we collect and process as Bend Yapı are transferred, for the purposes of ensuring business continuity and conducting services and in accordance with Article 8 of the Law, to organizations with which we have a business relationship, to organizations located in Türkiye and abroad that are service providers and solution partners whose administrative, legal and technical services we use, and, in cases of legal obligation, to official institutions/organizations. You can access detailed information on with whom and how we share personal data, as a rule, in Türkiye and abroad in our “Privacy Policy”.

As a data controller, Bend Yapı carries out the necessary checks, to the extent possible, to ensure that the institutions and organizations with which it shares data fulfill their obligations arising from the Law, and binds these obligations through data transfer agreements.

8.1 What Is the Nature and Scope of Domestic Sharing?

Personal data are shared, within the framework of the purposes stated below;

• With group companies, business partners and affiliates in Türkiye and abroad, as well as consulting firms and similar service suppliers, for the purpose of planning and carrying out commercial activities,
• With organizations providing services in this field, for use in print and visual media and internet channels for promotion and marketing purposes,
• With organizations providing services in these fields, for ensuring business continuity and for planning and executing human resources, occupational health and safety and emergency processes and strategies;
• With private institutions and organizations such as business partners, consulting firms and suppliers, and with competent authorities such as public institutions and organizations and judicial bodies, in cases where this is necessary to fulfill obligations arising from laws and judicial decisions,
• With banks, insurance organizations, dealers and information technology organizations providing services in this field, for the purposes of electronic mail, customer management, accounting and human resources management,
• With organizations providing services in this field, for vehicle tracking,
• With organizations providing services in the field of information technology, for the purpose of ensuring the infrastructure, applications and security of information systems.

8.2. What Is the Nature and Scope of Sharing Abroad?

Bend Yapı shares personal data with service providers established abroad for the purposes of operating our website, developing services, conducting office work and operations, providing services to users and visitors, ensuring their satisfaction, meeting their expectations and establishing communication. Within this scope, personal data are shared

• With US-based Whatsapp (Facebook) for instant messaging,
• With US-based Google and Wetransfer for file sharing,
• With US-based Apple and Google for mobile operating systems and the services that come with them,
• With US-based Facebook, Twitter, Instagram, Youtube and Google for social media services.

You can access each service provider’s own privacy policies through the following links:

• Microsoft (https://privacy.microsoft.com/en-us/privacystatement)
• Whatsapp (https://www.whatsapp.com/legal/client)
• Google (https://policies.google.com/privacy?hl=en-US)
• Apple (https://www.apple.com/legal/privacy/en-ww/)
• Facebook (https://www.facebook.com/policy.php)
• Instagram (https://help.instagram.com/519522125107875)
• Wetransfer (https://wetransfer.com/legal/privacy)

9. On What Legal Grounds Do We Process Personal Data?

Your personal data, under the Law;

Your personal data, as also specified in Article 5 of the Law;

• Where the person has given explicit consent,
• or on the legal ground that it is “expressly provided for by law”,
  Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications,
  the Regulation on Internet Mass Use Providers dated 11/04/2017 and numbered 30035,
  Turkish Code of Obligations No. 6098,
  Turkish Commercial Code No. 6102,
  
  and similar laws, regulations and communiqués,
• on the legal ground of “the establishment or performance of a contract”, for the fulfillment of the requirements of a contract to which you are a party; on the legal ground that it is necessary for “the data controller to fulfill its legal obligation”, for the fulfillment of legal obligations set forth in the relevant legislation, such as responding to requests from courts and public institutions and organizations requesting information and documents,
• on the ground that the data “have been made public by the data subject”,
• on the legal ground of “the establishment, exercise or protection of a right”, for serving as evidence in possible disputes and for obtaining legal advice and technical support, are processed “without seeking explicit consent”.

10. What Are Your Rights as a Data Subject?

As personal data subjects, as listed in Article 11 of the KVK, you have the right to:

• Learn whether personal data are processed,
• Request information in this regard if personal data have been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data are transferred in Türkiye or abroad,
• Request the rectification of personal data if they have been processed incompletely or inaccurately, and request that the operation carried out in this context be notified to the third parties to whom the personal data have been transferred,
• Request the erasure or destruction of personal data if the reasons requiring their processing no longer exist, even though they have been processed in accordance with the provisions of the KVK and other relevant laws, and request that the operation carried out in this context be notified to the third parties to whom the personal data have been transferred,
• Object to the occurrence of a result to the detriment of the person through the analysis of the processed data exclusively by automated systems,
• Request compensation for damages if you suffer damage due to the unlawful processing of personal data.

11. How Can You Apply for Information?

You may submit your applications regarding your rights under Article 11 of the Law, “which regulates the rights of the data subject”, together with information verifying your identity, in writing to our company address or to info@bendyapi.com.tr.