Protection of personal data

As the Data Controller, it complies with the relevant legislation in order to comply with the Personal Data Protection Law No. 6698 (“KVKK”) and the European Union General Data Protection Regulation (“GDPR”). ) no. 2016/679. It fulfills its obligations by adopting the principles stipulated in the processing, deletion, destruction, anonymization and transfer of personal data, informing the relevant person and ensuring data security. In this context, the Privacy and Personal Data Protection Policy ("Policy") has been prepared and made available to natural persons whose personal data are processed ("Data Owner").

Purpose and Scope of the Policy This Privacy and Personal Data Protection Policy aims to inform relevant persons by regulating the following issues.
Principles regarding the processing of personal data
Conditions for processing personal data
Conditions for processing special personal data
Description and information about the group of individuals
Classification of personal data
Purposes of processing personal data
Transfer of personal data to local and international third parties
Method and legal basis of processing personal data
Storage periods of personal data
Security of personal data
Use of cookies
Contact information regarding legal rights and usage methods for individual authorized groups
Updatability
Personal Data Processing Principles 2.1. Processing in accordance with the principles of law, fairness and transparency: When processing personal data, we act in accordance with the principles specified in legal regulations and the general principles of trust, justice and transparency.

2.2. Ensuring the Accuracy and Update of Personal Data: Regular checks and updates are required to ensure that the personal data processed specifically for groups is accurate and up-to-date, and all reasonable measures are taken in this regard. In this context, systems are established within Almasa to verify the accuracy of personal data and make the necessary corrections. Members can make these changes and updates from their account pages on the www.hmaks.com website.

2.3. Processing for specific, specific and legitimate purposes: Personal data is processed based on clear, specific and legitimate processing purposes. The purposes for which the data will be processed are explained in detail in this Policy.

2.4. Being connected, limited and proportionate to the purpose for which it is processed: Personal data is the processing of personal data that is calculated and purpose-related, limited to the achievement of the intended purpose and irrelevant or unnecessary for the achievement of the purpose. The purpose has been avoided.

2.5. Retention for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed: hmaks retains personal data only for the period foreseen in the relevant legislation or necessary for the purpose for which they are processed. In this context, first of all, it is determined whether the relevant legislation determines a period for storing personal data, and if a period is determined, this period is ensured. Unless a period is specified, personal data are stored for the period necessary for the purpose for which they are processed. If the period expires or the reasons requiring processing disappear, personal data will be deleted, destroyed or anonymized in accordance with hmaks Personal Data Storage and Destruction Policy, unless there is a legal reason that allows it to be processed for a longer period of time. Retention periods are detailed in this Policy.

2.6. Processing in accordance with data integrity and confidentiality: Personal data is processed in a way that ensures the security of personal data using appropriate technical or administrative measures, including protection against unauthorized or unlawful processing, accidental loss, destruction or damage.

Conditions Regarding the Processing of Personal Data

The basis for processing personal data may be only one of the legal reasons listed below, or more than one of these conditions may form the basis of the same personal data processing activity. If the personal data processed is of a special nature, the conditions under the heading "Situations in which special personal data may be processed" below apply. Explicit consent of the relevant person groups is only one of the legal bases that ensure the lawful processing of personal data. Personal data may be processed if there is another legal reason stated below, other than explicit consent.

Processing of personal data regarding relevant persons is carried out within the framework of the processing conditions specified below.

3.1. In cases where the processing of personal data is expressly provided for by law: hmaks processes personal data for individual groups for whom data processing is expressly provided for by law.



Obtaining their explicit consent. For example, in accordance with the Electronic Commerce Regulation, the processing of personal data in transactions such as membership to hmaks, giving electronic commercial approval, order, payment, delivery, cancellation or product return is a processing activity that takes place if clearly stated. in the law.