In accordance with Personal Data Protection Law (“KVKK”) no. 6698 and related regulations, your personal data shall be recorded, stored, updated and disclosed to 3rd parties, classified and processed as described in KVKK, where allowed by regulations and/or applicable to the purpose of processing, by our Company Peyman Kuruyemiş Gıda Aktariye Kimyevi Maddeler Tarım Ürünleri Sanayi ve Ticaret A.Ş. (the Company) situated at Organize Sanayi Bölgesi Teknoloji Bulvarı 9. Cadde No: 9 Odunpazarı/Eskişehir under the title of Data Controller in compliance with the law and in good faith, to the extent described below.
1) Why do we process your personal data and what's the legal justification behind this?
The personal data pertaining to the products, goods and services we offer and demands and requests received regarding these, as well that of our business partners may be processed in order to provide quick solutions appropriate for the complaints and demands and for other legal purposes under the terms and conditions specified in the relevant articles in KVKK.
2) Who do we transfer your personal data to and what purposes does this serve?
For the purposes of conducting evaluations and workss to enable you to take full advantage of the services offered within our Company, offering consumer satisfaction by customizing the products offered by our Company based on your complaints and suggestions, ensuring legal and commercial safety of our Company and of those that have a business affiliation with our Company, determining the commercial and business strategies for our Company, determining the human resources policies of the Company and providing commercial and legal guidance for these policies, your personal data collected within the scope of regulation terms may be transferred to related individuals and/or organizations, our partners, our employees, our suppliers, our distributors, related Company officials, our stakeholders and other relevant private persons and upon being anonymized, this data may be transferred to centers within the scope of Peyman Kuruyemiş Gıda Aktariye Kimyevi Maddeler Tarım Ürünleri Sanayi ve Ticaret A.Ş. for statistical analyses. This transfer will be made in compliance with KVKK article 8 and 9.
3) How do we collect your personal data?
Your express consent regarding the personal data and/or private personal data will be collected in verbal, written or electronic form via automated and non-automated methods by our Company units, social media accounts, website, e-mail addresses and call center.
In situations where express consent is necessary regarding collected and/or processed personal data or private personal data in detail, your express consent will be collected in electronic form. As such, upon collection of the express consent statements, the personal data and/or private personal data collected through our website will be processed, stored for legal periods as per the purposes of our services and if necessary, transferred to 3rd persons.
As per KVKK, the persons/organizations to which personal data can be transferred are the organizations permitted by the Turkish Commercial Code, Tax Procedural Law and other regulatory terms, as well as judicial authorities.
As such, you accept and state that the personal information you transmit to Peyman Kuruyemiş Gıda Aktariye Kimyevi Maddeler Tarım Ürünleri Sanayi ve Ticaret A.Ş. may be processed in order to enable you to access products, practices and campaigns suitable for you, to be used to provide general information and to that end, enable Peyman Kuruyemiş Gıda Aktariye Kimyevi Maddeler Tarım Ürünleri Sanayi ve Ticaret A.Ş. to send you informatory, promotional and marketing messages with data, audio and video/image content directly or via SMS, MMS containing images, animations, text messages, multimedia objects, phone, fax, auto-calling machines, e-mail and similar communication channels, and that you know you have the right to reject the sending of all messages whether data, audio, video/image and other based on product and channel.
Cookies are small text files transferred to your hard drive by a web server and stored in your computer. Cookies help us better understand customer/user behavior and provide us with information about usage and visit data when you visit our website and use our internet application. As such, your personal and sensitive personal data may be stored in cookies and shared with other applications or persons.
4) As our customers whose personal data is processed, what rights do you have as a "concerned party" under KVKK?
As per article 11 of KVKK, you have the right to contact us to;
– inquire if your data has been processed,
– if it has, request information,
– inquire about the purpose for processing and if it has been used in compliance with the purpose,
– inquire to learn about the domestic/foreign 3rd parties your data has been transferred to,
– request a correction in case the personal data was processed partially/inaccurately and request that the action taken in this regard to be conveyed to the 3rd parties the personal data was transferred to, request that the personal data be deleted/destroyed as per the conditions in KVKK, article 7*,
– request that the personal data processed in compliance with the terms of KVKK and other relevant regulations be deleted or destroyed in the case that data processing conditions are no longer valid and request that the action taken in this regard to be conveyed to the 3rd parties the data was transferred to,
– object to an outcome against you stemming from the analysis of the data exclusively with automated systems,
– in the case that you receive damages due to illegal processing of this data, to request that your damages be compansated.
Your requests included in your application will be concluded as soon as possible and at the very latest in 30 days, depending on the nature of the request. In the event that the action causes additional costs for Peyman Kuruyemiş Gıda Aktariye Kimyevi Maddeler Tarım Ürünleri Sanayi ve Ticaret A.Ş., the fee included in the tariff determined by the Personal Data Protection Authority may be demanded.
(*) We are under legal obligations as per the relevant regulation regarding keeping the documents pertaining to the actions we are taking with you. In the event that you request that your personal data be deleted or destroyed, it may be possible for us to fulfil your request at the end of the term determined as per legal obligations.
If you want to contact us, provide feedback or ask questions within the terms of KVKK and other relevant regulations you may submit your signed letter of application that includes documents validating your identity and your request directly in person to Organize Sanayi Bölgesi Teknoloji Bulvarı 9, Cadde No. 9 Odunpazarı/Eskişehir with authentication, via a notary, by calling 0222 236 13 22/23/24/25 or using your safe e-signed or registered e-mail (KEP) address to kvkk@peyman.com.tr or peymankuruyemis@hs02.kep.tr.
We shall accept applications on the subject upon conducting authentication and return to concerned parties within the legal periods.
Policy on Protection and Processing of Personal Data
Website Privacy Agreement
How the information we acquire on you and services you request will be used and protected when you visit Peyman's website and reach us via this website is subject to the conditions specified in this Personal Data Policy. By visiting this website, you acknowledge the conditions specified in this Personal Data Policy.
I. The Purpose of Personal Data Protection
As it has become easier than ever to access, process and transfer personal data partially thanks to the developments in information technology, a necessity has emerged for protecting personal data related to the personal privacy, a basic human right. In parallel to the international regulations on the subject, the protection of personal data has gained constitutional grounds with the third clause appended to article 20 of the Constitution in 2010 and later on April 7th, 2016, Personal Data Protection Law ("KVKK") no. 6698 was established upon being published on the official gazette. The Peyman family strives to act in compliance with the duly signed international agreements our country is a party to, the KVKK and other relevant regulations regarding protection of personal data in all its operations. As such, by preparing this "Peyman Company Policy Document on Personal Data Protection" ("Policy"), our Company aims to turn the contents of this document into an internal company regulation. Therefore, we aim to inform the relevant persons whose personal data is to be processed by us due to their legal affiliations with our Company and Company employees on protection of personal data. As such, it has been decided that this Policy document prepared by taking into account mainly KVKK and its secondary regulation, as well as the Authority's declarations and guides on the subject in order to comply with the terms on protection of personal data in relevant regulations be accepted by our Company and declared to relevant parties. This Policy acts as a guiding text pertaining to Company practices.
II. The Scope of Policy on Protection and Processing of Personal Data
This Policy applies to all personal data of our employees, prospective employees, company stakeholders and executives, visitors, our affiliated third parties which has been processed via automated or non-automated methods as part of any data logging system.
III. Processing of Personal Data
Processing of personal data is defined in KVKK, article 3, clause 1, sub-clause (e) as "All processing made on the data such as obtaining, recording, storage, retaining, modification, reorganization, declaration, transfer, inheritance, making attainable, classification or preventing use of personal data in an entirely or partially automated or non-automated manner as part of a data logging system."
Under the title of the Peyman family, our Company processes the personal data it obtains in compliance with the basic principles regarding personal data processing as per article 20 of the Constitution and KVKK, article 4, and based on one or more of the data protection conditions contained in KVKK, article 5.
a. Basic Principles in Processing Personal Data
i.Processing in Compliance with Law and Good Faith: Peyman puts emphasis on obtaining and processing personal data that it collects or that otherwise comes to its possession in compliance with law and good faith by questioning the source of such data. As such, it provides the necessary warnings and notifications to third parties selling Peyman's products (distributors, suppliers, points of sale and other intermediaries).
ii.Making Sure Personal Data is Accurate and Up-to-Date As Needed: Peyman has taken steps to establish the necessary system for making sure the personal data contained in the Company is accurate and for updating the information that comes to its possession when there's a change in personal data.
iii.Processing for Specific, Express and Legitimate Purposes: Peyman expressly and absolutely declares its personal data processing purpose that is legitimate and lawful. Thus, Peyman processes personal data under the limitation of the declared purposes within the confines of the consent it received from concerned parties and its obligation for clarification. It does not process, use and transfer data illegally beyond the scope of these purposes. The personal data not required as per the data minimization policy is not logged in the system, is deleted and anonymized.
iv.Retention for the Period Specified in the Applicable Regulation and Required for the Purpose of Processing: Peyman retains personal data for the periods specified by legitimate interest and law as per KVVK and the relevant regulation; in the event that no period is specified, it retains personal data for the period required for the purpose of processing. If the period ends or the reasons for processing are no longer valid, personal data is deleted, destroyed or anonymized.
b. Conditions for Processing Personal Data
Conditions for processing personal data are specified in KVKK, article 5. As a rule, the concerned party's "express consent" must be present for the personal data to be processed. KVKK, article 5, clause 2 includes the exceptions to this rule. These exceptions are valid when it is:
expressly stated in law
mandatory for the preservation of life or physical integrity of the person whose consent is not declarable due to actual impossibility or whose consent is legally invalid or that of someone else
mandatory that the personal data for the parties of an agreement be processed if it is directly related to the establishment or execution of an agreement
mandatory for the data controller to fulfil its legal obligations
personally made public by the concerned party
mandatory that data processing be executed for the establishment, use or protection of a right
mandatory that data processing be executed for the legitimate interest of the data controller, provided it does not damage the basic rights and liberties of the concerned party
These exceptions are established on a numerus clausus basis and are not expandable. Therefore, our Company shall observe adherence to the conditions for processing and in the case that non-adherence to these conditions is detected, shall not process this personal data and only process such information when the conditions are met.
c. Processing of Private Personal Data
Private personal data may lead to discrimination or aggrievement to the concerned person if disclosed and requires special protection. In KVVK, article 6, private personal data is defined as;
"The race, ethnicity, political view, philosophical belief, religion, religious sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal record and data regarding security measures and biometric and genetic data of people"
Private personal data may only be processed with express consent from the concerned party or in the limited situations required under law. Private personal data besides health and sexual life may only be processed if required by law, data on health and sexual life may only be processed for the purposes of;
preservation of public health
execution of preventive medicine, medical diagnosis, treatment and care services
planning and management of health services and financing
by persons or authorized institutions and organizations under confidentiality obligation without seeking express consent from the concerned party.
In addition, as per KVKK, article 6, clause 4, sufficient measures specified by Personal Data Protection Authority should be taken in processing of private personal data. As such, Peyman processes private personal data in compliance with such measures established as per the Authority Decision no. 2018/10 established on 31.01.2018.
IV. Domestic and International Transfer of Personal Data
As per KVKK, article 8, clause 1, as a rule personal data may not be transferred without the consent of the concerned party. However,
if there is a regulation in law regarding transfer of Personal Data it may be transferred without express consent of the concerned party if it is mandatory for the preservation of life or physical integrity of the owner of the Personal Data or that of someone else
the owner of the Personal Data is unable to declare consent due to actual impossibility or if their consent is legally invalid
it is mandatory that the Personal Data for the parties of an agreement be transferred if it is directly related to the establishment or execution of the agreement
Personal Data transfer is mandatory for our Company to fulfil its legal obligations
Personal Data was personally made public by the owner of the Personal Data
Personal Data transfer is mandatory for the establishment, use or protection of a right
Personal Data transfer is mandatory for the legitimate interest of our Company, provided it does not damage the basic rights and liberties of the owner of the Private Data.
Again, private personal data besides health and sexual life may only be processed if required by law, data on health and sexual life may only be processed for the purposes of;
preservation of public health
execution of preventive medicine, medical diagnosis, treatment and care services
planning and management of health services and financing
by persons or authorized institutions and organizations under confidentiality obligation without seeking express consent from the concerned party. Clearly, the exceptions for the transfer of personal data is identical to those for processing of personal data.
As per KVKK, article 9, the rule for international transfer of personal data is also subject to the express consent from the concerned party. In addition, in situations where express consent is not mandatory for the transfer and processing of personal data, if sufficient protection is present in the country to which the data is to be transferred or if sufficient protection is not present, yet data controllers in Turkey and the relevant foreign country confirm in wiring that sufficient protection is to be provided and a Committee approval is obtained, personal data may be internationally transferred without the express consent of the concerned party. The Authority shall declare which country provides sufficient protection. In the event that personal data is transferred to a foreign party, our Company shall take the required measures for protection of personal data.
V.Categorization of Personal Data Processed by Our Company, Purposes for Processing and Retention Periods
As per KVKK, article 10, under the disclosure obligation, Peyman notifies the concerned party of which concerned party groups process which personal data, purposes for processing of the personal data of the concerned party and retention periods.
a. Categorization of Personal Data
For Peyman; as per Peyman's legitimate and lawful personal data processing purposes, based on and limited by one or more of the conditions for personal data processing in KVKK, article 5, personal data in the following categories is processed with notification to concerned parties as per KVKK, article 10 with compliance to all obligations under KVKK and the principles specified in KVKK, particularly those in article 4 regarding personal data processing and with the subjects (Distributors, Suppliers, Visitors, Third Parties, Prospective Employees, Company Stakeholder, Employees, Stakeholders and Officials of Our Business Affiliates) within the scope of this Policy.
i. Identity Information
Data that clearly belongs to a natural person whose identity is known or who is identifiable and automatically processed partially or entirely or manually as a part of a data logging system.
Examples of identity information include documents such as driver's license, id card and passport which include information like first and last name, Turkish Republic identification number, nationality, parents' names, place of birth, date of birth, sex, as well as tax id, SSI number, signature, vehicle license plate etc.
ii. Contact Information
Examples of contact information include phone number, address, e-mail address, fax number, IP address etc. that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system.
iii. Location Information
Information that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, identifies the location of the concerned party within the framework of Peyman business units' operations, during the use of Peyman's products and services or the location of the employees of our affiliated organizations during the use of Peyman vehicles or sales-assisting tablets and phones. Examples of location data include GPS location, trip data etc.
iv. Family Members and Relatives
Examples of family and relative information include information that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, information about the concerned party's family members (eg. partner, mother, father, child), relatives or others which can be reached in emergencies within the framework of Peyman business units' operations, pertaining to the products and services offered by Peyman and in order to protect the legal and other interests of Peyman and the concerned party.
v. Physical Space Security Information
Physical space security information includes information that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, personal data regarding logs and documents taken during presence inside the physical space. Physical space security information includes camera recordings, fingerprint logs and logs taken at security check points.
vi. Financial Information
Personal data processed in relation to the information, documents and logs that clearly belong to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, that shows any financial outcomes created based on the legal relationship established by Peyman with the concerned party.
Examples of financial information includes data such as bank account number, IBAN number, credit card information, financial profile, property tax, income tax.
vii. Audiovisual Information
Examples of audiovisual data includes data that clearly belongs to a natural person whose identity is known or who is identifiable; included in photographs and camera recordings (excluding logs within the scope of Physical Space Security Information), audio recordings and documents that are copies of documents containing personal data.
viii.Personnel Information
Personnel data is any personal data that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, processed for obtaining information that will serve as a foundation to creating the personnel rights of natural persons who have an employment affiliation with Peyman.
ix. Private Personal Data
Private personal information is data that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, specified in KVKK, article 6 (e.g. health information including blood type, biometric data, religion and association membership information etc.)
x. Demand/Complaint Management Information
Demand/complaint management information is personal data that clearly belongs to a natural person whose identity is known or who is identifiable; processed partially or entirely in an automated manner or in a non-automated manner as part of a data logging system, pertaining to the receipt and evaluation of any demands and complaints submitted to Peyman.
b. Purposes for Processing Personal Data
Peyman processes personal data limited to the purposes and conditions within the personal data processing conditions specified in KVKK, article 5, clause 2 and article 6, clause 3. These purposes and conditions are;
the express requirement by law that Peyman take relevant action regarding the processing of your personal data
the processing of your personal data by Peyman being directly related to and necessary for the establishment and execution of an agreement
the processing of your personal data being mandatory for Peyman's execution of its legal obligations
With the condition that your personal data was personally made public by you; it being processed by Peyman in a limited fashion for the purpose of making it public
the processing of your personal data being mandatory for the establishment, use or protection of Peyman's, your or third parties' rights
personal data processing being mandatory for the legitimate interest of Peyman, provided it does not damage the basic rights and liberties of the concerned party
the processing of personal data by Peyman being mandatory for the preservation of life or physical integrity of the concerned party or that of someone else and in this event, the concerned party not being able to declare their consent due to actual or legal invalidity
requirement by law regarding the processing of the private personal data of the concerned party, except for their health and sexual life
regarding private personal data of the concerned party pertaining to their health and sexual life, processing of said data for purposes of preservation of public health, execution of preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing by persons or authorized institutions and organizations under confidentiality obligation without seeking express consent from the concerned party.
As such Peyman processes your personal data for the following purposes:
Planning and execution of corporate sustainability operations
Efficiency management
Management of partner and supplier relations
Conducting the personnel recruitment processes of the Company
Execution/Follow-up of the Company's financial reporting and risk management operations
Execution/Follow-up of the Company's legal operations
Planning and execution of corporate communication operations
Execution of corporate management operations
Executions of corporations law and legislation operations
Demands and complaints management
Ensuring compliance to Company values
Supporting compliance to corporate regulations
Executing operations towards preserving Company reputation
Management of investor relations
Providing regulation-based information to authorities
Creation and follow-up of visitor and client registrations
In the event that processing for the purposes listed does not meet any one of the conditions included in KVKK and the express consent exceptions, Peyman shall acquire your express consent pertaining to the applicable processing operation.
c. Retention Period for Personal Data
If required by applicable law and regulations, Peyman retains personal data for the period specified in these regulations.
If no period is established in the regulation regarding for how long personal data is to be retained, personal data is deleted, destroyed or anonymized after the necessary time for Peyman to process the data as per its practices and precedents of its commercial life, depending on the operation being executed during Peyman's processing of said data.
If the purpose for processing the personal data is no longer valid, the applicable regulation and the retention periods determined by Peyman has ended, personal data may only be retained for the purposes of providing evidence in potential legal disputes or for making it possible to claim relevant rights or establishing defense based on the personal data. For establishment of the periods mentioned here, retention periods are determined based on statute of limitation periods for claiming said right and taking into account the examples in demands previously submitted to Peyman on the same subjects, despite statute of limitation periods being over. Personal data retained in this case may not be accessed for any other purposes and when necessary for relevant legal disputes, access to relevant personal data is provided. After the period mentioned here ends, personal data is deleted, destroyed or anonymized.
VI. Categorization Regarding Concerned Parties of Personal Data Processed by Peyman
The personal data of the following personal concerned party categories is processed by Peyman and the application scope of this Policy is limited to Company Clients, Distributors, Suppliers, Visitors, Third Parties, Prospective Employees, Company Stakeholders, Company Officials, Employees, Stakeholders and Officials of Our Business Affiliates.
The categories of persons whose personal data is processed by Peyman are included in the scope specified above and in the event that persons outside of this scope may submit their requests to Peyman as per KVKK; their requests shall also be evaluated within the scope of this Policy.
a. Concerned Party Category Description
i.Company Client
Natural persons whose personal data is obtained through the Company's business affiliations within the scope of the operations of Peyman's business units, regardless of having any contractual agreement with Peyman
ii.Visitor
Natural persons who entered physical premises owned by Peyman or visited our websites
iii.Third Party
Other natural persons who are not within the scope of this Policy and Policy for Protection and Processing of the Personal Data of Peyman Employees (eg. guarantor, attendant, family members and relatives, former employees)
iv. Prospective Employee
Natural persons who in any way applied for a position at Peyman or made their resume and related information available for review by our Company
v. Company Stakeholder and Representitive
Natural persons that are Peyman's stakeholders and their representatives
vi.Company Official
Natural persons that are members of Peyman's board of directors, authorized signatories and other authorized natural persons
vii. Employees, Stakeholders and Officials of Our Business Affiliates
Natural persons who are employees of organizations (including but not limited to business partners, suppliers) that have a business affiliation with Peyman, including the stakeholders and officials of these organizations
VII. Conditions for Deleting, Destroying and Anonymizing Personal Data
As per Turkish Criminal Law, article 138 and KVKK, article 7, Peyman deletes, destroys or anonymizes personal data at Peyman's sole discretion or upon the request of the concerned party in the event that the reasons for processing of such data are no longer valid, despite the data being processed in compliance with terms of the applicable law. As such, Peyman fulfills its applicable obligations via the methods described in this section.
a. Techniques for Deleting, Destroying and Anonymizing Personal Data
i.Techniques for Deleting and Destroying Personal Data
Despite being processed as per the terms of the applicable law, Peyman
