1. Purpose of the Personal Data Protection Policy
The purpose of the Personal Data Protection Policy is to provide information about the personal data processing activities carried out by Prince Group in accordance with the Personal Data Protection Law No. 6698 ("KVKK") and the relevant legislation and the systems adopted for the protection of personal data. In this context, it is aimed to enlighten the persons whose personal data are processed, especially our employees, candidates, suppliers, visitors and employees, shareholders and officials of the organizations we cooperate with and third parties.
2. Scope of the Policy
This policy text contains explanations about the content, categories, usage and processing methods, storage conditions, rights of personal data owners and measures taken to protect personal data.
3. Purpose of Processing Personal Data
Prince Group undertakes to process personal data in accordance with the principles set out in Article 4 of the KVKK and for the following purposes:
a) For clients and business partners;
i. Performing all kinds of advocacy and legal consultancy activities,
ii. Performing or providing additional/complementary services (external and internal audit, accounting, tax consultancy, IT, translation, etc.) for the fulfillment of these activities,
iii. Providing information on various legal developments and providing scientific articles,
iv. Providing legal trainings organized by Prince Group, relevant documents and informing about future trainings to be organized by Prince Group,
v. Storing the data previously obtained in this context so that it can be used in future transactions.
b) For employees;
i. Exercise of rights and fulfillment of obligations arising from labor, social security, tax, etc. legislation,
ii. Private health insurance,
iii. Placing personal data on the website for informational purposes,
iv. Settlement of disputes arising from labor law,
v. Institutional planning,
vi. Ensuring order, control, safety, management and harmony in the workplace,
vii. Archiving data obtained from office activities such as cameras, video recordings and photographs,
viii. Realization of the recruitment process.
4. Data Collection Method
Prince Group may collect personal data through methods such as verbal communication, electronic mail, fax, telephone, mail, courier, hand delivery.
5. Processing and Transfer Authorization
Domestic processing and transfer of personal data to third real and legal persons is possible with the explicit consent of the data subject. Pursuant to Article 5 of the LPPD, in the absence of explicit consent, personal data
a. In case it is explicitly stipulated in the laws,
b. When it is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid,
c. When it is necessary to process personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of a contract,
d. if it is necessary for Prince Group to fulfill its legal obligations,
e. When personal data is made public by the data subject,
f. When necessary for the establishment, exercise or protection of a right,
g. It may be processed if necessary for the legitimate interests of Prince Group, provided that it does not harm the fundamental rights and freedoms of the person concerned.
Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are sensitive personal data. The processing and transfer of sensitive personal data is possible with the explicit consent of the data subjects. In the absence of explicit consent;
a. Personal data not related to health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law.
b. Personal data relating to health and sexual life can only be processed by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services, without seeking the explicit consent of the person concerned.
The processing of personal data abroad and the transfer of personal data to third real and legal persons is possible with the explicit consent of the data subject, and if there is no explicit consent, it is realized in the presence of one of the conditions in Art. 5/2 and Art. 6/3 of the KVKK and the following conditions.
a. In case there is adequate protection as determined and announced by the Personal Data Protection Board ("Board"),
b. In the absence of adequate protection, in the event that the data controllers in Turkey and the relevant foreign country undertake in writing to provide adequate protection and the Board's authorization is obtained.
Personal data may also be transferred abroad, without prejudice to the provisions of international agreements, in cases where the interests of the country or the person concerned would be seriously harmed, only with the permission of the Board by obtaining the opinion of the relevant public institution or organization.
6. Observing the Rights of the Data Subject
Data subjects may exercise the following rights in relation to themselves by contacting Prince Group:
a. To learn whether their personal data is being processed,
b. Request information if personal data has been processed,
c. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
d. Learning the third parties to whom personal data are transferred domestically or abroad,
e. To request correction of personal data in case of incomplete or incorrect processing,
f. To request the deletion or destruction of personal data within the framework of Article 7 of the KVKK,
g. To request notification of correction, deletion and destruction to third parties to whom personal data are transferred,
h. To object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed personal data exclusively through automated systems and
i. In case of damage due to unlawful processing of personal data, to demand compensation for the damage.
In order to exercise the above-mentioned rights, data subjects shall submit their requests in writing or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address previously notified to Prince Group by the data subject and registered in Prince Group's system, or by using a software or application developed for the purpose of application, to Prince Group's electronic mail address info@princegroup.com.tr or to the postal address Yeşilova, Aspendos Blv. No:168/C Muratpaşa/Antalya
In the applications of data subjects; name, surname and signature if the application is in writing, Turkish Republic identification number for citizens of the Republic of Turkey, nationality, passport number or identification number, if any, for foreigners, residential or workplace address for notification, e-mail address, telephone and fax number, if any, for notification, and the subject of the request must be included.
7. Measures for the Accurate and Up-to-date Storage, Security and Protection of Personal Data
Prince Group takes the following administrative and technical measures to ensure that personal data is kept accurate and up-to-date, stored in secure environments and to prevent loss, alteration or unlawful use.
Prince Group is jointly responsible with other data processors in the event that personal data is processed by another natural or legal person on its behalf and for taking the measures specified in this section.
Prince Group and its employees shall not disclose the personal data they have learned to anyone else in violation of the provisions of the KVKK and shall not use it for purposes other than processing. This obligation will continue after they leave their duties.
In the event that the processed personal data is obtained by others illegally, Prince Group will notify the relevant person and the Board within 72 hours in order to take the necessary measures.
Personal data processing activities are defined within the Quality Management System, and legal compliance requirements are addressed specifically for these activities and developed through implementation rules and audit methods.
Information and trainings are organized regularly to increase the awareness of Prince Group employees about the relevant legislation on the protection of personal data.
The obligations of employees to process and protect personal data within the legal framework are included in the confidentiality statement between employees and Prince Group.
In cases where it is necessary to receive a service from outside the organization, organizations and individuals who process personal data are informed with a "Privacy Commitment for Data Processor". Thus, the processing of personal data by institutions and organizations that process personal data is taken under control.
The printed versions of the documents are stored in password-protected rooms and cabinets in order to ensure confidentiality. Only authorized persons have the passwords of the aforementioned rooms.
Personal data is kept separately, retention periods for this data are systematically monitored and destruction processes are supervised.
The processing of personal data is carried out on Outlook and a special software program, the Document Management System.
Regular system reports are obtained for network security, and information systems are renewed and updated by monitoring technological developments.
Internet security is ensured by firewall and internet infrastructure, secure network connection between locations and various antivirus programs determined according to needs and requirements.
8. Amendments to the Personal Data Protection Policy
Prince Group may make changes to this policy to the extent required by its activities or when legally required. Such changes become effective upon the publication of the amended policy text on www.princegroup.com.tr. In addition, clients, business partners and employees will be notified of any changes by e-mail.
