PDPL

As UNİFO GIDA VE SAVUNMA SANAYİ VE TİCARET ANONİM ŞİRKETİ, we value the privacy and security of you personal data.

This disclosure statement has been prepared to inform you about the processing of your personal data within the scope of Article 10 of the Law on the Protection of Personal Data No. 6698 (KVKK).
‍
‍TERMS AND DEFINITIONS
Personal Data: Any information relating to an identified or identifiable natural person.
‍Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, whether fully or partially automated or non-automated provided that it is part of any data recording system.
‍Data Subject: The natural person whose personal data is processed.
‍KVKK Legislation: The Law on the Protection of Personal Data (KVKK), the regulations issued based on the KVKK, the communiqués published by the Personal Data Protection Authority, the decisions of the Personal Data Protection Board (“Board”), undertakings, and other legislative provisions related to personal data.
‍Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
‍Explicit Consent: Consent that is based on being informed and expressed freely regarding a specific subject.
‍Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.
‍
a)   Data Controller
‍Pursuant to the Law on the Protection of Personal Data No. 6698 (“Law”), your personal data is collected and processed by UNİFO GIDA VE SAVUNMA SANAYİ VE TİCARET ANONİM ŞİRKETİ (“UNİFO” or the “COMPANY”) in its capacity as the data controller, within the scope described below.
‍b)   Purpose and Legal Grounds of Processing of Personal Data
‍Your personal data collected may be processed for the purposes (“Purposes”) and legal grounds set out below, and within the personal data processing conditions and purposes specified in Article 5 of the Law.
‍Provided that it is directly related to the conclusion or performance of a contract, and on the basis of the legal ground regarding the requirement to process the personal data of the contracting parties;
‍·      To provide the Company’s products and services to you, fulfill our obligations towards you, and organize records and documents.
·      To receive your orders, process your payments, and coordinate with third parties for logistics to ensure product delivery.
·      To comply with information retention, reporting, and notification obligations required by official authorities, and to fulfill the requirements of contracts.
‍
‍Based on the legal grounds that it is expressly prescribed in the laws and that it is mandatory for the data controller to fulfill its legal obligation;
‍·      To examine, evaluate, and respond to requests from official authorities or from you.
·      To comply with information retention, reporting, notification, tax, and other obligations required by local and international legal regulations.
·      To fulfill the legal obligations of contracts and services.
‍
‍Provided that it does not infringe upon fundamental rights and freedoms of the data subject; based on the legal ground that data processing is mandatory for legitimate interests of the data controller;
‍·      Sales and marketing activities aimed at improving the quality of services and products.
·      Information regarding IT requirements, system structure, the necessity of support services, and information about services and products.
·      Traffic measurement, statistical analysis, segmentation/profiling, and CRM activities
·      Measuring and enhancing customer satisfaction, complaint management, obtaining opinions and suggestions regarding new services and products, receiving problem/error notifications, and providing information related to products, services, complaints, and requests.
·      Recommending products and services that may interest you, online behavioral advertising and marketing, customer portfolio management, measuring and improving service quality, communication, optimization, auditing, risk management and control, promotion, analysis, interest determination, scoring, profiling, marketing, sales, advertising, and communication activities.
·      Managing customer relations, evaluating complaints/questions/likes/suggestions and requests, conducting promotion/marketing/promotion/discount/campaign activities, preparing all kinds of reports and presentations, performing necessary activities regarding the customer portfolio, and ensuring and improving communication.
·      Financial operations, communication, market research, and social responsibility activities, procurement operations, internal system and application management, and legal operations carried out for determining and implementing the Company’s commercial and business strategies.

‍Based on the legal ground that data processing is mandatory for the establishment, exercise, or protection of a right;
‍·      The retention of personal data for the general statute of limitations period in order to serve as evidence in potential future disputes.

‍Upon your explicit consent;
‍·      Processing of the products and services offered within the Company for the purpose of tailoring and personalizing them to suit you.

‍c)    To Whom and For What Purpose the Processed Personal Data may be Transferred
‍Your collected personal data, within the scope of achieving the purposes specified in section b) above;
·      The Company’s affiliates and subsidiaries: for the purpose of coordinating and managing business processes.
·      Business partners, suppliers, and contracted organizations we work with: for the purpose of collaboration and carrying out operational processes.
·      Legally authorized public institutions and organizations: for the purpose of fulfilling legal obligations.
·      Cargo and logistics companies: for the purpose of delivering orders or documents.
·      Organizations cooperating in analysis, advertising, and marketing activities: for the purpose of product/service offers, analysis, and communication.It may be transferred in accordance with the rules on the transfer of personal data set out in Article 8 of the Law, within the framework of the personal data processing purposes specified in Article 5 of the Law.

‍d)   Method and Legal Basis of Personal Data Collection
‍Your personal data is collected within the scope of fulfilling the above-mentioned Purposes through electronic means such as our website and the forms available on our website, via call center, SMS, email channels, and in physical environments during communications with our Company, as well as through mail, cargo, and forms. As specified in Articles 5 and 6 of the Law;
‍·      Being explicitly stipulated by law.
·      Being necessary for the Company to fulfill its legal obligations.
·      Being directly related to the establishment or performance of a contract and necessary for its execution.
·      Being necessary for the Company’s customer relations and commercial activities, provided that it does not violate your fundamental rights and freedoms.
·      Being made public by you.
·      Being necessary for the establishment, exercise, or protection of a right.
·      Your explicit consent.It is collected based on the above-mentioned legal grounds.

‍e)    Rights of the Data Subject as Stated in Article 11 of the Law
‍As data subjects, if you submit your requests regarding your rights through the methods outlined below, the Company will process your request as soon as possible and no later than thirty days, free of charge, depending on the nature of the request. However, if the process incurs an additional cost, a fee determined in the tariff set by the Personal Data Protection Board may be charged by our Company.
‍Within this scope, data subjects;
‍·      To learn whether their personal data is being processed,
·      To request information if their personal data has been processed,
·      To learn the purpose of the processing of personal data and whether it is being used in accordance with that purpose
·      To know the third parties to whom personal data has been transferred, domestically or abroad
·      To request the correction of personal data if it has been processed incompletely or inaccurately, and to request that this correction be communicated to third parties to whom the personal data has been transferred
·      To request the deletion or destruction of personal data, even if processed in accordance with Law No. 6698 and other relevant legislation, when the reasons requiring its processing no longer exist, and to request that this action be communicated to third parties to whom the personal data has been transferred,
·      To object to the emergence of a result against the individual through the exclusive analysis of processed data by automated systems.
·      To claim compensation in case of damage arising from the unlawful processing of personal data.
‍
‍You can submit your request to exercise the rights mentioned above in Turkish and in writing, or via a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the email address previously notified to the Company and registered in our system, in accordance with Article 13, paragraph 1 of Law No. 6698 and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller numbered 30356 and dated 10.03.2018. In applications, information will be provided only regarding the applicant, and it will not be possible to obtain information about other family members or third parties. The Company reserves the right to verify your identity before responding.

In your application;
a) Your name, surname, and if the application is in writing, your signature;
b) For Turkish citizens, your Turkish ID number; for foreigners, your nationality, passport number, or, if available, your ID number;
c) Your residential or business address for notification purposes;
ç) If available, your email address, phone, and fax numbers for notification purposes;
d) The subject of your request;

These are mandatory, and if available, any information and documents related to the subject should also be attached to the application.

You can submit your applications in writing, attaching the necessary documents, to our Company as the data controller at the address: Halkalı Merkez Mahallesi, Çalışkan Sokak No:4, Küçükçekmece/Istanbul. You can access the application form via this link.

You can submit your applications via email to kvkk@uyarholding.com. Applications submitted via registered electronic mail (KEP) can be sent to our KEP address unifogidaas@hs01.kep.tr.Depending on the nature of your request, it is necessary to provide us with complete and accurate information and documents that allow for identity verification. If the requested information and documents are not provided properly, there may be obstacles in carrying out the investigations related to your request fully and effectively. In this case, the Company declares that it reserves its legal rights. Therefore, your application must be submitted in a complete manner, including all the requested information and documents according to the nature of your request.

‍f)     Exceptions Specified in Article 28 of the Relevant Law In the presence of the cases specified in the first paragraph of Article 28 of the Personal Data Protection Law (KVK Law), it is stipulated that the provisions of the KVKK Law shall not apply; within this scope, it is not possible for data subjects to exercise the rights set forth in the KVK Law regarding the personal data processed by the Company. In the cases specified in the second paragraph of Article 28 of the Personal Data Protection Law (KVK Law), data subjects cannot claim the other rights specified in the KVK Law, except for the right to request compensation for damages.

‍g)   Retention Period of Personal DataThe Company destroys personal data (deletes, erases, or anonymizes them) once the purpose of processing the personal data no longer exists or when the mandatory retention periods specified in laws and other relevant legislation have expired.