Privacy and Principles of Personal Data Protection

Privacy and Principles of Personal Data Protection

1. PURPOSE AND SCOPE

These Privacy and Principles of Personal Data Protection (hereinafter referred to as “Principles”) aim to determine the principles adopted by Markalab Giyim Sanayi Ve Ticaret A.Ş. (hereinafter referred to as “Company”) for the protection of personal data and to inform all relevant groups of persons within the scope of Law No. 6698 on Protection of Personal Data (hereinafter referred to as “KVKK”).

1. PRINCIPLES REGARDING PROCESSING OF PERSONAL DATA

As Data Controller, we process your personal data within the framework of the following principles.

2.1 Lawfulness and Honesty In the processing of your personal data, we act in accordance with the principles brought by legal regulations and the general principles of trust and honesty. In accordance with this principle, we take into account your interests and reasonable expectations while trying to reach our personal data processing purposes, we do not misuse our rights and act in accordance with the principle of transparency in our data processing activities.

2.2 Ensuring the Accuracy and Up-to-dateness of Personal Data When Necessary In line with this principle, which emphasizes the importance of the accuracy and up-to-dateness of personal data, periodic controls and updates are made and necessary measures are taken to ensure that the processed data is accurate and up-to-date, taking into account your legitimate interests. In this context, systems for checking the accuracy of personal data and making necessary corrections are established within the Company. In addition, the accuracy of the sources where personal data is collected is checked and requests due to inaccurate personal data are taken into consideration. Therefore, this principle is also applied in compliance with your right to request correction of your personal data under KVKK No. 6698.

2.3 Processing for Specific, Clear and Legitimate Purposes Your personal data is processed based on clear, specific and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by relevant individuals, and we determine and express the purposes and legal processing conditions in accordance with the 3rd article of these Principles.

2.4 Being Relevant, Limited and Proportional to the Purpose for which they are Processed Your personal data is processed in a proportional, purpose-related and limited manner to realize the intended purpose(s), and processing of personal data that is not related to the purpose of realization or not necessary is avoided. Moreover, personal data is not collected or processed for purposes that do not currently exist or are anticipated to occur later, within the scope of this principle.

2.5 Keeping Personal Data for the Duration Specified in Relevant Legislation or for the Period Necessary for the Purpose for which they are Processed Your personal data is kept only for the duration specified in relevant legislation or for the period necessary for the purpose for which it is processed. In this regard, the Company regularly reviews the data retention periods and deletes personal data after the expiry of the specified period or when the purpose of processing ceases to exist. In addition, the Company takes necessary measures to ensure that personal data is protected during storage and destruction processes in accordance with the KVKK and relevant legislation.

1. CONDITIONS FOR PROCESSING PERSONAL DATA

Your personal data can be processed within the scope of Law No. 6698 on the Protection of Personal Data (KVKK) under the following conditions for personal and special categories of personal data:

1.1. Explicit Provision in the Law The basic rule is that personal data cannot be processed without the explicit consent of the data subject, but in cases where personal data processing is explicitly provided for in the law, your personal data may be processed.

1.2. Impossibility of Obtaining the Explicit Consent of the Data Subject Due to Actual Impossibility In cases where the data subject is unable to provide explicit consent due to actual impossibility or where their consent cannot be considered valid for the protection of their own or someone else’s life or physical integrity, personal data may be processed if it is necessary.

1.3. Directly Related to the Establishment or Performance of a Contract If the processing of personal data is necessary for the establishment or performance of a contract directly related to the parties of the contract, your personal data may be processed.

1.4. Fulfillment of Company’s Legal Obligations If the processing of personal data is necessary for the fulfillment of the legal obligations of the Company, which it is responsible for and bound to comply with, your personal data may be processed.

1.5. Publicly Disclosed Personal Data If your personal data has been publicly disclosed by you, i.e. shared with the public by you for a specific purpose, it may be processed in connection with and to the extent necessary for the purpose of the disclosure.

1.6. Necessary for the Establishment, Use, or Protection of a Right If the processing of personal data is necessary for the establishment, use, or protection of a right owned by the Company, it may be processed in this context.

1.7. Processing of Data Based on Legitimate Interests If the processing of personal data is necessary for the legitimate interests of the Company, your personal data may be processed. Our company evaluates and makes decisions based on your fundamental rights and freedoms while adhering to this processing condition.

1.8. Processing Based on Explicit Consent Although processing personal data based on explicit consent is the primary rule, explicit consent of the data subjects is not required if any of the conditions listed in this article exist. Otherwise, it may be considered an abuse of rights. In this context, if your personal data is not processed based on any of the conditions stated in these Principles, it is processed based on your explicit consent.

1.9. Processing of Special Categories of Personal Data We process your special categories of personal data based on your explicit consent in accordance with Article 6 of the KVKK No. 6698. Similarly, your special categories of personal data, except for those related to health and sexual life, can only be processed in cases foreseen by law, or for the purposes of protecting the vital interests of the data subject or another person, provided that adequate measures are taken for data security and the Board is informed.

1. RIGHTS OF THE DATA SUBJECT, APPLICATION PROCEDURES AND PRINCIPLES

As a data subject, if you have a request regarding your rights under Article 11 of Law No. 6698, and if you are an EU citizen, your rights under GDPR, including withdrawing your explicit consent, obtaining information about and accessing your personal data, rectifying, erasing or restricting the processing of your personal data in certain cases, data portability under certain conditions, objecting to the processing of your personal data, and similar rights, you can submit your requests to us through the Personal Data Protection Application Form, which you can obtain from our website, by filling it out or by submitting your application that meets the minimum conditions prescribed by the Communiqué on Application Procedures and Principles to the Data Controller using the following methods. As the Company, we will respond to your request as soon as possible and at the latest within thirty days free of charge, depending on the nature of your request. However, if the process also requires a cost, the Company will charge the fee specified in the tariff determined by the Personal Data Protection Board. In case your application is rejected, the response is found to be insufficient, or there is no response to your application within the specified time, you can inform us about this matter. As a data subject, you also have the right to apply to the competent data protection authority in your country within thirty days from the date you learn our response, and in any case within sixty days from the date you made your application in accordance with the procedures and principles.