GDPR
Black Group Tekstil Ticaret Limited Şirketi
Personal Data Protection, Processing and Privacy Policy
1. Introduction
Black Group Tekstil Ticaret Limited Şirketi (hereinafter referred to as Black Fashion) makes every effort to comply with all legislation regarding the protection of personal data. Within the framework of this Black Group Tekstil Ticaret Limited Şirketi Personal Data Protection, Processing and Privacy Policy, the principles adopted in the execution of personal data processing activities carried out by our company and the fundamental principles adopted in terms of our company's compliance with the regulations in Law No. 6698 on the Protection of Personal Data are explained, thereby ensuring the necessary transparency by informing data subjects. With full awareness of our responsibility in this regard, your personal data is processed and protected within the scope of this Policy. With this Policy, Black Fashion, acting as the data controller, aims to inform the data subject.
1.1. Definitions
For the purposes of the Law, the following definitions shall apply:
a. Personal Data: Any information relating to an identified or identifiable natural person;
b. Processing of Personal Data: Any operation performed upon personal data, wholly or partly by automatic means or non-automatic means as part of a data recording system, such as collection, recording, storage, retention, alteration, re-organization, disclosure, transfer, acquisition, making available, classification or preventing the use thereof;
c. Special Categories of Personal Data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, dress and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data;
d. Data Controller: Any natural or legal person who determines the purposes and means of processing personal data, and is responsible for the establishment and management of the data recording system;
e. Data Processor: A third natural or legal person who processes Personal Data on behalf of Black Fashion, based on the authorization given by Black Fashion;
f. Data Subject: The natural person whose Personal Data is processed;
g. Data Recording System: The recording system used by Black Fashion where Personal Data is processed by structuring it according to specific criteria;
h. Board: The Personal Data Protection Board;
i. Institution: The Personal Data Protection Authority;
j. Law: Refers to Law No. 6698 on the Protection of Personal Data, published in the Official Gazette dated April 7, 2016, and numbered 29677.
2. Principles Regarding the Processing of Personal Data
2.1. Processing of Personal Data in Accordance with Principles Stipulated in Legislation
2.1.1 Processing in Accordance with Law and Principles of Fairness
Black Fashion acts in accordance with the principles set forth by legal regulations and the general rule of trust and honesty in the processing of personal data. In this context, personal data is processed to the extent required by our company's business activities and limited to these activities.
2.1.1 Ensuring Personal Data is Accurate and Up-to-Date When Necessary
Black Fashion takes necessary measures to ensure that personal data is accurate and up-to-date throughout the processing period and establishes necessary mechanisms to ensure the accuracy and currency of personal data at certain intervals.
2.1.2 Processing for Specific, Explicit and Legitimate Purposes
Black Fashion clearly states the purposes for processing personal data and processes it within the scope of purposes related to these activities in line with its business activities.
2.1.3 Being Relevant, Limited, and Proportionate to the Purposes for which they are Processed
Black Fashion collects personal data only in the nature and to the extent required by its business activities and processes it limited to the specified purposes.
2.1.4 Retaining for the Period Stipulated by Relevant Legislation or Required for the Purpose for which they are Processed
Black Fashion retains personal data for the period necessary for the purpose for which they are processed and for the minimum period stipulated in the legal regulations to which the relevant activity is subject. In this context, our Company first determines whether a period is stipulated in the relevant legislation for the storage of personal data; if a period is determined, it acts accordingly. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the specified retention periods, personal data is destroyed in accordance with periodic destruction periods or data subject applications and by specified destruction methods.
2.2. Personal Data Processing Conditions
Apart from the explicit consent of the data subject, the basis for personal data processing activity may be only one of the conditions stated below, or more than one condition may be the basis for the same personal data processing activity. If the processed data is special categories of personal data, the conditions set forth in heading 2.3 of this policy (Processing of Special Categories of Personal Data) shall apply.
2.2.1 Existence of Explicit Consent of the Data Subject
One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the data subject must be related to a specific matter, based on information, and declared with free will. In the event that the personal data processing conditions listed below exist, personal data may be processed without the explicit consent of the data subject.
2.2.2 Clearly Stipulated in Laws
If the personal data of the data subject is clearly stipulated in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, the existence of this data processing condition can be mentioned.
2.2.3 Inability to Obtain Explicit Consent of the Data Subject Due to Factual Impossibility
If it is mandatory to process personal data to protect the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent cannot be recognized as valid, or of another person, the personal data of the data subject may be processed.
2.2.4 Directly Related to the Establishment and Performance of a Contract
If the processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract to which the data subject is a party, this condition may be deemed to have been met.
2.2.5 Performance of the Company's Legal Obligation
If processing is mandatory for our Company to fulfill its legal obligations, the personal data of the data subject may be processed.
2.2.6 Public Disclosure of Personal Data by the Data Subject
If the data subject has publicly disclosed their personal data, the relevant personal data may be processed limited to the purpose of public disclosure.
2.2.7 Mandatory Data Processing for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.
2.2.8 Mandatory Data Processing for the Legitimate Interest of the Company
If data processing is mandatory for the legitimate interests of our company, provided that it does not harm the fundamental rights and freedoms of the data subject, the personal data of the data subject may be processed.
2.3. Processing of Special Categories of Personal Data
Special Categories of Personal Data may be processed by the company in accordance with the principles specified in this policy and by taking all necessary administrative and technical measures, including methods to be determined by the Board, and if the following conditions exist:
2.3.1 Special categories of personal data other than health and sexual life may be processed without seeking the explicit consent of the data subject if it is clearly stipulated in the laws, in other words, if there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data subject will be obtained for the processing of such special categories of personal data.
2.3.2 Special categories of personal data relating to health and sexual life may be processed without seeking explicit consent by persons under an obligation of secrecy or by authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing. Otherwise, the explicit consent of the data subject will be obtained for the processing of such special categories of personal data.
2.4. Informing the Data Subject
Black Fashion informs data subjects in accordance with Article 10 of the Law and secondary legislation. In this context, Black Fashion informs data subjects about who processes personal data as the data controller, for what purposes, with whom it is shared for what purposes, by what methods it is collected and its legal basis, and the rights of data subjects regarding the processing of their personal data.
2.5. Transfer of Personal Data
Black Fashion may transfer the personal data and special categories of personal data of the data subject to third parties established in Turkey (third-party companies, official and private authorities, third-party natural persons) by taking the necessary security measures in line with legitimate personal data processing purposes. Our Company acts in accordance with the regulations stipulated in Article 8 of the Law.
2.5.1. Transfer of Personal Data
Even without the explicit consent of the data subject, if one or more of the conditions stated below exist, personal data may be transferred to third parties established in Turkey by the company, with due diligence and by taking all necessary security measures, including methods stipulated by the Board.
The relevant activities regarding the transfer of personal data are clearly stipulated in the laws, the transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
The transfer of personal data is mandatory for our Company to fulfill its legal obligation,
The personal data has been made public by the data subject, provided that our company transfers it in a manner limited to the purpose of public disclosure,
The transfer of personal data by the company is mandatory for the establishment, exercise or protection of the rights of the company or the data subject or third parties,
It is mandatory to carry out personal data transfer activities for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject,
It is mandatory to protect the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally recognized, or of another person.
2.5.2. Transfer of Special Categories of Personal Data
Special categories of personal data may be transferred by our company in accordance with the principles specified in this policy and by taking all necessary administrative and technical measures, including methods to be determined by the Board, and if the following conditions exist:
Special categories of personal data other than health and sexual life may be processed without seeking the explicit consent of the data subject if it is clearly stipulated in the laws, in other words, if there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data subject will be obtained.
Special categories of personal data relating to health and sexual life may be processed without seeking explicit consent by persons under an obligation of secrecy or by authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing. Otherwise, the explicit consent of the data subject will be obtained.
2.6. Personal Data that may be Processed
The purpose of Black Fashion is the entirety of the purposes stated in the commercial registers. In relation to Black Fashion's purpose, the personal data that can be collected and processed belonging to employees, employee relatives, job applicants, interns, supplier employees and supplier authorities, direct or indirect natural person shareholders/partners, potential product and service buyers, customers and other third parties are listed below, and this list may be expanded in line with Black Fashion's purposes:
• Identity data,
• Contact data,
• Location data,
Personal data is backed up, and the security of backed-up personal data is also ensured.
User account management and authorization control system are implemented and monitored.
6.2. Administrative Measures
An authorization matrix has been created for employees.
Corporate policies on access, information security, use, storage, and destruction have been prepared and put into practice.
The authorizations of employees whose duties change or who leave the job in this area are removed.
Confidentiality agreements are made.
Signed contracts include data security provisions.
Personal data security policies and procedures have been determined.
Personal data security is monitored.
Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
Personal data is minimized as much as possible.
Personal data security policies and procedures have been determined.
The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
Personal data is minimized as much as possible.
Protocols and procedures for the security of special categories of personal data have been determined and implemented.
If special categories of personal data are to be sent via email, they must be sent encrypted and using a registered electronic mail (KEP) or corporate email account.
7. Amendments to the Personal Data Protection Policy
Black Fashion may make changes to this policy as required by its activities or as legally necessary. The amended policy text will become effective upon its publication on the website https://www.blackfashion.com.tr/. Black Fashion will also notify all relevant groups via email regarding the changes to be made.
BLACK GROUP TEXTILE TRADE LIMITED COMPANY
PERSONAL DATA RETENTION AND DESTRUCTION POLICY
1. Introduction
1.1 Purpose
This Personal Data Retention and Destruction Policy has been prepared by Black Group Tekstil Ticaret Limited Şirketi (hereinafter referred to as “Black Fashion”) as the data controller, in accordance with the Law on the Protection of Personal Data No. 6698, the Regulation on the Deletion, Destruction or Anonymization of Personal Data which constitutes the secondary regulation of the law and entered into force upon publication in the Official Gazette on October 28, 2017, and other relevant legislation. It aims to determine the procedures and principles regarding the processes of retaining, deleting, destroying, and anonymizing personal data, to inform individuals whose personal data is processed by Black Fashion, and to fulfill the obligations under the law and relevant legislation.
In line with its fundamental principles, Black Fashion has prioritized the processing of all personal data belonging to its employees, their relatives, job applicants, interns, supplier officials, supplier employees, direct or indirect individual shareholders/partners, potential product and service buyers, customers, visitors, and other third parties, in accordance with the Turkish Constitution, international agreements, Law No. 6698 on the Protection of Personal Data, and other relevant legislation, and ensuring that relevant individuals can effectively exercise their rights.
The procedures and operations related to the retention and destruction of personal data are carried out by Black Fashion in accordance with this Policy.
1.2 Scope
All personal data belonging to Black Fashion’s employees, their relatives, job applicants, interns, supplier officials, supplier employees, direct or indirect individual shareholders/partners, potential product and service buyers, customers, visitors, and other third parties are within the scope of this Policy. This Policy applies to all recording environments owned or managed by Black Fashion where personal data is processed, and to all activities related to personal data processing.
1.3 Abbreviations and Definitions
| Explicit Consent | Consent given on a specific matter, based on information, and expressed with free will. |
| Anonymization | Making personal data unable to be associated with an identified or identifiable natural person in any way, even by matching with other data. |
| Recipient Group | The term referring to the category of natural or legal persons to whom personal data is transferred by the data controller. |
| Employee | An employee of Black Fashion. |
| Electronic Environment | Environments where personal data can be created, read, modified, and stored using electronic devices. |
| Non-Electronic Environment | All other written, printed, visual, etc. environments outside of electronic environments. |
| Supplier | A natural or legal person who provides goods and services to Black Fashion within the framework of a specific contract. |
| Data Subject | The natural person whose personal data is processed. |
| Relevant User | Persons who process personal data within the data controller's organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection, and backup of data. |
| Personal Data Processing Inventory | The inventory prepared by Black Fashion detailing its personal data processing activities based on its business processes; by associating them with personal data processing purposes and legal reasons, data categories, recipient groups transferred to, and data subject groups, and explaining the maximum retention period required for the purposes for which personal data is processed, transfers to foreign countries, foreseen personal data, and measures taken for data security. |
| Destruction | Deletion, destruction, or anonymization of personal data. |
| Law | Law on the Protection of Personal Data No. 6698 |
| Recording Medium | Any environment where personal data processed wholly or partly by automatic means, or by non-automatic means as part of any data recording system, is located. |
| Personal Data | Any information relating to an identified or identifiable natural person. |
|
Processing of Personal Data |
Any operation performed upon personal data, wholly or partly by automatic means, or by non-automatic means as part of any data recording system, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of such data. |
| Special Categories of Personal Data | Data concerning racial or ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, dress and appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data of individuals. |
| Periodic Destruction | The process of deletion, destruction, or anonymization to be carried out ex officio at recurring intervals, as specified in the personal data retention and destruction policy, when all conditions for processing personal data specified in the Law cease to exist. |
| Policy | Personal Data Retention and Destruction Policy |
| Data Processor | A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller. |
| Data Recording System | The natural or legal person responsible for establishing and managing the data recording system, determining the purposes and means of processing personal data. |
| Data Controller | The recording system in which personal data is processed by being structured according to specific criteria. |
| Data Controllers' Registry Information System | (VERBİS) An information system created and managed by the Personal Data Protection Authority, accessible via the internet, which data controllers will use for applying to the Data Controllers' Registry and for other related operations concerning the Data Controllers' Registry. |
| Regulation | Regulation on the Deletion, Destruction, and Anonymization of Personal Data published in the Official Gazette dated October 28, 2017. |
| Internal Management Directive |
Black Fashion Company Board of Directors Internal Directive.
|
2. Responsibilities and Allocation of Duties
Black Fashion employees are obliged to comply with the rules set out in this policy and to provide the necessary support to the units responsible for processing personal data. Company employees who process personal data act in accordance with the fundamental principles, personal data processing conditions, and special categories of personal data processing conditions while carrying out data processing activities.
Accordingly, the responsibilities selected from the Personal Data Protection Committee members listed below, their units, and their duties in the personal data retention and destruction processes are explained in detail.
3. Recording Environments
Personal data is stored securely by Black Fashion in the environments listed in Table 2, in accordance with the law.
| Electronic environments | Non-electronic environments |
|
|
Table 2: Personal data retention environments
4. Explanations Regarding Retention and Destruction
Black Fashion acts within the following principles for the retention and destruction of personal data:
4.1 Explanations Regarding Retention
Article 4 of the Law states that personal data must be processed in connection with, limited to, and proportionate to the purpose for which they are processed, and must be retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they are processed. Articles 5 and 6 list the conditions for processing personal data.
Accordingly, personal data within the scope of our activities is retained for a period subject to relevant legislation and/or appropriate to our processing purposes.
4.1.1 Legal Reasons Requiring Retention
Personal data processed by Black Fashion is retained for a period subject to relevant legislation in its field of activity and/or appropriate to our processing purposes. In this context, personal data will be retained under the provisions of the legislation listed below, and other current or future legislative provisions, including but not limited to:
a. Turkish Constitution
b. Turkish Code of Obligations No. 6098
c. Law on the Protection of Personal Data No. 6698
d. Social Security and General Health Insurance Law No. 5510
e. Occupational Health and Safety Law No. 6331
f. Labor Law No. 4857
g. Remaining articles of Labor Law No. 1475
h. Tax Procedure Law No. 213
i. Regulation on Health and Safety Measures to be Taken in Workplaces and Annexes
j. Turkish Commercial Code No. 6102
It is retained for the retention periods stipulated within the scope of other existing legislative provisions, not limited to these laws.
4.1.2 Processing Purposes Requiring Retention
Personal data is securely stored by Black Fashion in physical or electronic environments within the limits specified in KVKK and other relevant legislation, particularly for the purposes of continuing commercial activities, fulfilling legal obligations, planning and managing personnel processes, and managing legal disputes, including lawsuits and enforcement proceedings.
Personal data is processed for the following purposes:
• Execution of Information Security Processes
• Execution of Job Applicant / Intern / Student Selection and Placement Processes
• Execution of Job Applicant Application Processes
• Execution of Employee Satisfaction and Loyalty Processes
• Fulfillment of Obligations Arising from Employment Contracts and Legislation for Employees
• Execution of Fringe Benefits and Benefits Processes for Employees
• Execution of Training Activities
GDPR - Black Fashion