Law on the Protection of Personal Data

General information about the Law on Personal Data

The Law on the Protection of Personal Data No. 6698 (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette dated April 7, 2016, numbered 29677. A portion of the KVKK entered into force on the date of its publication, while another portion entered into force on October 7, 2016.

Information in the capacity of Data Controller

In accordance with the KVKK No. 6698 and in the capacity of Data Controller, your personal data may be recorded, stored, updated, disclosed/transferred to third parties in cases permitted by legislation, classified, and processed in the manners listed in the KVKK, within the framework explained on this page.

How your personal data may be processed

In accordance with the KVKK No. 6698, the personal data you share with our Company may be processed by us by obtaining, recording, storing, modifying, re-arranging—in short, as a subject of any kind of operation performed on the data—whether fully or partially automatically, or non-automatically provided that it is part of any data recording system. Any operation performed on data within the scope of the KVKK is considered as "processing of personal data."

Purposes and legal grounds for processing your personal data

The personal data you share will be processed in accordance with the KVKK No. 6698 and relevant secondary regulations for:
• To fulfill the requirements of the services we provide to our customers in accordance with the requirements of the contract and technology, and to improve our products and services offered;

• To record identity, address, and other necessary information to identify the transaction owner within the scope of the Law on the Regulation of Electronic Commerce No. 6563, the Law on the Protection of the Consumer No. 6502, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce published in the Official Gazette dated 26.08.2015, numbered 29457, the Regulation on Distance Contracts published in the Official Gazette dated 27.11.2014, numbered 29188, and other relevant legislation;

• To regulate all records and documents that will serve as the basis for transactions in banking and electronic payment systems, electronic contracts, or paper media; and to comply with the information retention, reporting, and disclosure obligations stipulated by legislation and other authorities;

• To be able to provide information to public prosecutor's offices, courts, and relevant public officials upon request and in accordance with legislation regarding matters of public security and legal disputes. Information regarding third parties or organizations to which your personal data may be transferred: For the purposes mentioned above, the persons/organizations to which your personal data you share with our Company may be transferred include, but are not limited to, Ticimax Bilişim Teknolojileri A.Ş., which provides our Company's e-commerce infrastructure, suppliers, cargo companies, and other relevant persons and organizations related to the services provided, partner program organizations from which we receive services and/or with which we cooperate in the capacity of Data Processor, domestic/international organizations, and other 3rd parties.

Method of collection of your personal data

Your personal data can be processed and collected as follows:
• Through forms on our company's website and mobile applications, including information such as name, surname, national identity number, address, phone number, work or personal email address; preferences on pages accessed using a username and password, IP logs of transactions performed, data containing navigation duration and details collected via cookies, and location data;

• Verbally, in writing, or electronically through our sales and marketing department staff, our branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call center channels;

• Received from individuals who share their personal data for purposes such as establishing a commercial relationship with our company, applying for a job, or submitting a proposal, via business cards, resumes (CVs), proposals, and other means, in a physical or virtual environment, face-to-face or remotely, verbally, in writing, or electronically;

• Furthermore, data obtained indirectly through different channels, including websites, blogs, contests, surveys, games, campaigns, and similar (micro) websites, social media, e-newsletter open or click-through actions, data provided by publicly available databases, and publicly accessible profiles and data from social media platforms; can be processed and collected.

Your personal data obtained before the KVKK (Personal Data Protection Law) entered into force

Your personal data that was lawfully obtained prior to April 7, 2016, the effective date of the KVKK, through membership, electronic communication consent, product/service purchases, and other means, is also processed and stored in accordance with the terms and conditions set forth in this document.

Transfer of your personal data abroad

Your personal data, collected via any of the methods listed above to be processed in Turkey or processed and stored outside Turkey, may also be transferred to service intermediaries located abroad (in countries accredited by the Personal Data Protection Board as having adequate protection for personal data), provided that it remains within the scope of the KVKK and in accordance with contractual purposes.

Storage and protection of personal data

Your personal data will be kept confidential in the database and systems within our company in accordance with Article 12 of the KVKK and will not be shared with third parties under any circumstances, except for legal obligations and the regulations specified in this document. Our company is obligated to take software measures such as access management and physical security precautions for the systems and databases where your personal data is hosted, in order to prevent unlawful processing of personal data and to block unauthorized access, as required by Article 12 of the KVKK. In the event that it is learned that personal data has been obtained by others through unlawful means, the situation will be notified to the Personal Data Protection Board immediately, in writing and in accordance with legal regulations.

Keeping personal data accurate and up-to-date

In accordance with Article 4 of the KVKK, our company has an obligation to keep your personal data accurate and up-to-date. In this context, for our company to fulfill its obligations arising from current legislation, our Customers are required to share their accurate and up-to-date data or update it via the website/mobile application.

Rights of the personal data subject pursuant to the Law No. 6698 on the Protection of Personal Data (KVKK)

Article 11 of the Law on Protection of Personal Data (KVKK) No. 6698 entered into force on October 7, 2016, and in accordance with the relevant article, the rights of the Personal Data Subject after this date are as follows: By applying to our Company (data controller), the Personal Data Subject has the right to:

1. Learn whether personal data is processed,
2. Request information if personal data has been processed,
3. Learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of personal data in case of incomplete or incorrect processing,
6. Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,
7. Request notification of the operations performed to third parties to whom personal data has been transferred in the event of correction, deletion, or destruction,
8. Object to the occurrence of a result against the person themselves by analyzing the processed data exclusively through automated systems,
9. Request compensation for damages in case of loss due to unlawful processing of personal data,

Data Controller: COSMOPUBLIC İÇ VE DIŞ TİCARET A.Ş.
Tax ID Number (VKN): 2120795575
Data Controllers Registry Date: 12.05.2020
Contact Person: Hakan Şahindere
Email address: hakansahindere@cosmopublic.com