1. INTRODUCTION

Proctecting Personal Data has a great importance for our company and Bonna Porselen Sanayi Ve Ticaret Limited Sirketi (“Company”) has a maximum sensitivity in this regard. Accordingly, processing the personal data consistent with the expectations of persons and processing them in accordance with the Laws are only some of the fundamental building blocks of our company.

Our Company stores and disposes the personal data, which have been collected by our company during her activies, in accordance with the specified general principles and regulations of the Storage and Disposal Policy on the Personal Data of Bonna Porselen Sanayi Ve Ticaret Limited Sirketi (“Policy”) that has been prepared in accordance -notably- with the Constitution , the Law on the Protection of Personal Data, No: 6698 (“KVKK” and/or “Law”), By-Law on Erasure, Destruction or Anonymization of Personal Data (“By-Law”) and the other related regulation.

2. THE PURPOSE AND THE SCOPE OF THE POLICY

The Company, hereby with this Policy, intended to fulfill the obligations determined by the legislation related to these matters

Hereby, Policy contains all of the personal data subject to the activities on personal data within the context of KVKK. Likewise, documents referred by the Policy include both the physical and the digital copies of them, unless otherwise specified in the Policy.

3. DEFINITIONS
Unless the context requires the opposite hereby in this Policy, the following mean:

  • “Explicit Consent” Freely given, specific and informed consent,
  • “Recipient Group” Category of natural or legal persons to which the personal data are transferred by the data controller,
  • “Constitution” The Constitution of The Republic of Turkey,
  • “User Concerned” Persons who process personal data within the organization of the data controller or upon authorization and instructions received from the data controller, other than the person or department which is responsible for the technical storage, protection and back up of personal data,
  • “Disposal” Erasure, destruction or anonymizing of personal data,
  • “Recording Medium” Any type of media that keeps the personal data processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system,
  • “Personal Data” All the information relating to an identified or identifiable natural person (e.g. name-surname, T.R Id. No., e-mail, address, date of birth, credit card no., bank account no. – Therefore, the processing of information related to legal persons are not within the scope of KVKK.),
  • “Data Subject” The natural person, whose personal data is processed,
  • “Processing of Personal Data” Any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data try system, through non-automatic means,
  • “Board” Personal Data Protection Board,
  • “Personal Data of Special Nature” Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic,
  • “Periodic Disposal” Erasure, destruction or anonymization process which is determined in the personal data storage and disposal policy and to be carried out periodically ex officio, in the event that all of the conditions for processing laid down in the Law no longer exist
  • “[Data] Controller” The natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system.

4. RECORDING MEDIUM REGULATED BY THE POLITICS

Any media that has been acquired by Company and which are processed completely or partially or which are processed by non-automatic means provided that it is part of any data recording system are considered as the recording medium. All of the Personal Data that are within the body of Company is kept and stored in maximum security in the following systems:
Databases of our Company, databases of the third party, e-mail accounts, desktop
computers, the gadgets of the employees of the Company (e.g. mobile phones), backup areas, paper files etc.

5. THE REASONS REQUIRE STORAGE AND DISPOSAL OF PERSONAL DATA

Company considers the principles below while processing data;

  • Lawfulness and conformity with rules of bona fides.
    Accuracy and being up to date, where necessary.
    Being processed for specific, explicit and legitimate purposes.
    Being relevant with, limited to and proportionate to the purposes for which they are processed.
    Being retained for the period of time stipulated by relevant legislation or the purpose for which they are processed.

Company, in accordance with the principles that have been specified above, stores and uses the personal data by based on the conditions for processing of personal data regulated by the Article 5 and 6 of KVKK, on the purposes of the related articles of the Policy on the Protection and the Processing of the Personal Data of Bonna Porselen Sanayi Ve Ticaret Limited Sirketi; and, the personal data are disposed by the Data Controller, ex officio or upon demand by the data subject, upon disappearance of reasons which require the process.

a. Having the Explicit Consent of the Data Subject

The primary condition for processing of the personal data is the explicit consent of of the data subject. The explicit consent of the data subject has to be given freely, specific and informed consent.

b. It Must Clearly Provided For By The Laws

Personal data of the data subject may be processed in accordance with the law without seeking the explicit consent of the data subject in cases where they are clearly provided for by the Laws.

c. Where it is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his / her consent or whose consent is not deemed legally valid.

Personal Data of the data subject might be processed in cases where it is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his / her consent or whose consent is not deemed legally valid.

d. Direct relation with the conclusion or fulfilment of the contract

Personal Data of the data subject might be processed in cases where processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfilment of contract

e. Legal Obligation

Personal Data of the data subject might be processed in cases where it is mandatory for the controller to be able to perform our Company’s legal obligations

f. Making the data available to the public by the data subject himself / herself

Within the boundaries of making the personal data available to the public, personal Data of the data subject might be processed in cases where the data concerned is made available to the public by the data subject himself

g. Where data processing is mandatory for the establishment, exercise or protection of any right.

Personal Data of the data subject might be processed in cases where data processing is mandatory for the establishment, exercise or protection of any right.

h. Where data processing is mandatory for the legitimate interests of our Company

Personal Data of the data subject might be processed in cases where it is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

Accordingly, the basis of the personal data processing activity might be only one of the conditions mentioned above, and more than one of these conditions might be the basis of the same personal data processing activity.

6. THE PROCEDURES ON CONDUCTING THE DISPOSAL OF PERSONAL DATA AND THE TECHNICAL AND THE ADMINISTRATIVE MEASURE ON CONDUCTING THE DISPOSAL OF PERSONAL DATA PROCEDURES IN COMPLIANCE WITH THE LAW

If all the conditions written in the Articles 5 and 6 of KVKK disappear; our Company disposes them with subjets’s request or on its own motion by erasure, destruction or anonymizing. Our company has maximum sensitivity in this regard. Within this context, according to the Article 12 of KVKK, and the provisions of By-Law, our company, pursuant to the above-mentioned general principles and the decisions of this Policy and Personal Data Protection Board, takes the necessary technical and administrative measures according to the technological possibilities and implementation cost related to the following issues. All operations within the scope of disposal being recorded by our Company and saved for 3 years (except other legal obligations). Our company, chooses the suitable method according to application cost of personal data erasure, destruction and to the technological possibilities, unless an opposite decision taken by Personal Data Protection Board, and makes the reasoning of such chosen suitable method clear upon the request of a data subject.

a. Erasure Methods of Personal Data

Erasure of personal data is the process of rendering personal data inaccessible and non-reusable for the users concerned, by no means. Our Company takes all necessary technical and administrative measures. Our Company takes all necessary technical and organizational measures required for ensuring erased data to be inaccessible and non-reusable for its users concerned. In this context, our Company applies the following methods for the erasure of personal data.

b. Destruction Method of Personal Data

Destruction means the process of rendering personal data inaccessible, irretrievable or non-reusable by anyone, by no means.
Our Company takes any type of technical and organizational measures required for ensuring destruction of personal data.
During the application of above-mentioned situations, Our Company takes all necessary administrative and technical measures and fully complies with KVKK, the Regulations and other relevant legislative provisions in order to ensure the security of data.

c. Anonymization Methods of Personal Data

Anonymization is the process of rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data. In order for the personal data to be anonymized by our Company, personal data shall be rendered impossible to relate to identified or identifiable person, even through using appropriate techniques in respect of the recording medium and relevant field of activity, such as recovery of data by the data controller, recipient or recipient groups and matching data with other data. Our Company takes any type of technical and organizational measures required for related technological possibilities and application costs related to anonymization of personal data.

7. THE TECHNICAL AND ORGANIZATIONAL METHODS ON THE PREVENTION OF UNLAWFUL STORAGE OF, PROCESSING OF AND ACCESSION TO THE PERSONAL DATA

Our company pays utmost attention to the safe storage of personal data and preventing their illegal processing and access, and in accordance with the above-mentioned general principles and the decisions of this Policy and Personal Data Protection Board, She takes the necessary technical and organizational measures according to the technological possibilities and application costs related to the specified matters:

8. DEFINEMENT OF THE TITLES, UNITS AND THE DUTIES OF THOSE WHO PARTICIPATED IN THE PROCESS OF THE STORAGE AND THE DISPOSAL OF THE PERSONAL DATA

Our company informs and trains the persons involved in the processes of storage and disposal in accordance with the law on the protection of personal data and with the processing of personal data. In this context, the employees of our Company and the persons who obtain personal data because of their duties, store and dispose the information in accordance with KVKK and other relevant legislative provision. This obligation continues after the relevant persons leave their positions.

9. LEGAL PERIOD FOR STORAGE AND DISPOSAL

Our Company stores and dispoes personal data for legal period according the related law. If the personal data subject applies to our Company for disposal of his/her personal data, our Company;

  1. If all the conditions for processing personal data have disappeared

    1. She finalizes the personal data subject’s request within thirty days at the latest and informs the data subject and,
    2. If the personal data has been transferred to third parties, company notifies the third person; and provides making transactions in the eye of third parties
  2.  If all the conditions for processing personal data have disappeared; according to KVKK art.13/3 can be rejected by explaining the reason and reports the data subject written or at digital media in thirty days at the latest.

10. LEGAL PERIOD OF PERIODIC DISPOSAL

Our company disposes personal data in the first periodic disposal process following the date when the obligation to dispose personal data occurred. In this context, our Company is subject to disposal in personal 3-months periods.

In mandatory cases, this period can be extended for a maximum of 3 months. Our company acknowledges that the Board may shorten the periods set forth in this article in the events that irreparable or impossible losses arise and that there is clearly unlawfulness.

11. EFFECTIVENESS

Hereby, this policy come into force at 12/10/2021 Policy may be updated from time to time to comply changing conditions with the legislation. Up-to-date policy will be updated at https://bonna.com.tr/ same day. Hereby, if there is any contradiction between Policy and KVKK and ve Bonna Porselen Sanayi Ticaret Limited Şirketi Incorporated Company Personal Data Storage and Process Policy; provisions will prevail according to KVKK and Bonna Porselen Sanayi Ticaret Limited Sirketi Personal Data Storage and Process Policy.