Our Privacy Policy under the Personal Data Protection Law No. 6698
At NORM KAMA, we place great importance on the security of our valued customers. Pursuant to the Personal Data
Protection Law No. 6698, enacted to protect fundamental rights and freedoms, particularly the right to privacy, we would
like to inform you about matters concerning your personal data.
Purpose:
In line with our commitment to customer satisfaction, our aim is to inform you transparently about how your personal
data is collected, the purposes and legal grounds for processing, and your rights.
Processing of Personal Data:
All personal data, biometric data and other special categories of personal data (“Data”) that you provide to our Company
or that our Company obtains within the scope of its business procedures and operations may be collected, recorded,
stored, retained, updated, modified, reorganized, disclosed to third parties, transferred, transmitted, shared, classified,
anonymized and otherwise processed by NORM KAMA, acting as the data controller under the Personal Data
Protection Law No. 6698 (“the Law” or “KVKK”), within the limits and under the conditions permitted by applicable
legislation, for the purpose of continuing to provide its services.
Purposes and Legal Grounds for Processing Personal Data:
Your personal data may be processed for the following purposes: providing services connected with our commercial
activities under the Turkish Commercial Code and other applicable legislation; fulfilling the requirements of contracts
entered into by you and/or our Company; ensuring security; complying with anti-money-laundering legislation and
domestic and international regulations; fulfilling record-retention, reporting and disclosure obligations imposed by public
authorities; providing you with better and more reliable services; developing services and new products suited to your
needs; and ensuring the uninterrupted continuation of these activities.
Methods of Collecting Personal Data:
Your personal data may be collected through our Company’s head office, liaison offices, website, public institutions and
organizations, contracted organizations, support-service providers, parties from which the Company receives services
that complement or extend its activities, and similar channels. Data may be collected by automated or non-automated
means and in written, oral or electronic form.
Persons and Organizations to Which Personal Data May Be Transferred:
Your personal data may be transferred to our employees and company officers; legal, financial and tax advisers; IT
consultants; auditors; business partners; consultants, organizations and other parties with which the Company
cooperates or from which it receives complementary, ancillary or support services; contracted organizations; the
Chamber of Shipping; insurance companies; banks; Joint Health and Safety Units (OSGB); the Banking Regulation and
Supervision Agency (BDDK); the Capital Markets Board (SPK); the Central Bank of the Republic of Türkiye (TCMB); the
Financial Crimes Investigation Board (MASAK); the Banks Association of Türkiye (TBB); the Small and Medium
Enterprises Development Organization of Türkiye (KOSGEB); the Revenue Administration (GİB); the Undersecretariat
of Treasury; the Social Security Institution (SGK); ministries; judicial authorities; and other authorized public institutions
and organizations. Where necessary, the Data may also be transferred to domestic or overseas financial institutions,
domestic or overseas member merchants, and other third parties for whom you have provided explicit consent.
Your Rights under Article 11 of the Law:
By applying to our Company, you have the right to:
-
learn whether your personal data has been processed;
-
request information if your personal data has been processed;
-
learn the purpose of processing and whether your personal data has been used in accordance with that purpose;
-
know the third parties in Türkiye or abroad to whom your personal data has been transferred;
-
request correction if your personal data has been processed incompletely or inaccurately;
-
request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law;
-
request that operations carried out under the preceding correction, erasure or destruction rights be notified to third parties to whom your personal data has been transferred;
-
object to a result arising against you because your personal data has been analyzed exclusively through automated systems; and
-
claim compensation if you suffer damage because your personal data has been processed unlawfully.
You may exercise these rights as of 7 October 2016. In accordance with the tariff referred to in Article 13 of the Law,
entitled “Application to the Data Controller,” we reserve the right to charge you for costs incurred by our Company in
fulfilling your requests.
Circumstances Not Requiring Explicit Consent:
Under Article 5(2) of the Personal Data Protection Law No. 6698, the Company may process personal data without
obtaining explicit consent where:
-
processing is expressly provided for by law;
-
processing personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract;
-
processing is necessary for NORM KAMA, as data controller, to comply with a legal obligation;
-
the personal data has been made public by the data subject;
-
processing is necessary for the establishment, exercise or protection of a right; or
-
processing is necessary for the Company’s legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject.
Data that has been published or made public; data appearing in official registers, balance sheets or annual reports
under the principle of openness; data that must be disclosed to the public under applicable law; and disclosures, uses
or transfers required for the Company to fulfil statutory obligations, legal requirements or obligations to provide Data to
persons legally authorized to request it are not subject to the Company’s duty of confidentiality. The Company is
authorized to disclose, provide, process and transfer such Data without obtaining a separate consent form.
Our Statutory Data-Retention Obligation:
Under applicable legislation and the provisions governing companies’ accounting practices and the retention of
documents, our Company is legally required to retain your information and documents for ten years. If you request the
erasure or destruction of your personal data, the request may be fulfilled at the end of that ten-year period. Even after
the relevant periods have expired, your data may be anonymized in line with the Company’s legitimate interests in
improving its services and making them more secure. Personal data that falls outside the scope described above may
be erased upon your request.