INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA FOR MARKETING ACTIVITIES

SH Online İletişim A.Ş. (“Company”) places great importance on processing your personal data in compliance with the law and principles of honesty, and in a secure and transparent manner. This Information Notice has been prepared to explain how and for what purposes your personal data is processed, as well as how you can manage your preferences in this regard.

1.    PURPOSES OF PROCESSING PERSONAL DATA

Below you can find detailed explanations regarding the purposes for which your personal data is processed and transferred, and your rights related to your personal data, within the scope of various activities such as marketing, satisfaction surveys, and any personal contact information scanned into the system by our Company, which is the data controller pursuant to the Personal Data Protection Law No. 6698 (“Law”).

2.    PROCESSING AND SCOPE OF PERSONAL DATA

Not limited to those listed; we process, store, and transfer personal data acquired during our activities, such as those of our employees, subscribers, consumers, visitors, business contacts, business partners, customers, resellers, and users visiting our website, in accordance with our Personal Data Protection and Processing Policy (“Policy”).

2.1 Which personal data does our Company process and for what purposes?

Your personal data obtained on the basis of Articles 5 and 6 of the Law are processed in a manner that is relevant, limited, and proportionate to the processing purposes listed below, and in accordance with the law, principles of honesty, and fairness.

a) Customer Satisfaction Surveys;

Your identity information, contact details, customer transaction data, marketing data, transaction security information, and call center voice recordings are processed for the following purposes within the scope of conducting customer satisfaction survey activities.

With regard to you:

· Measuring customers’ satisfaction with the services they have received,

· Evaluating customer feedback,

· Gathering information regarding complaints expressed in surveys,

· Contacting you for the purpose of conducting customer satisfaction surveys,

· Evaluating and reporting the responses you provide in surveys,

· Planning and executing improvement efforts to enhance satisfaction based on your survey responses regarding our products and services.

b) Discount, campaign, promotional activities, and market research and analysis;

Your identity information, contact details, marketing data, employment information, customer transaction data, and call center voice recordings are processed for the following purposes within the scope of discount, campaign, and promotional activities conducted by our Company, along with market research and analysis:

• Planning and execution of product and service promotion and marketing processes,

• Planning and execution of discounts, campaigns, and other marketing benefits for products and services,

• Planning and execution of direct marketing activities and campaigns targeted at specific professions or audience groups for special occasions,

• Planning and execution of customer loyalty and retention programs,

• Conducting market research and analysis activities and planning marketing strategies for product and service sales and promotion,

• Contacting you to provide information regarding discounts, campaigns, promotions, market research, and analysis activities conducted by our Company.

c) Personalized Marketing Activities;

Your identity information, contact details, marketing data, employment information, customer transaction data, and call center voice recordings are processed for the following purposes within the scope of personalized marketing activities:

• Personalizing products and services according to customers’ preferences, interests, usage habits, and needs,

• Conducting segmentation/profiling and analysis studies.

d) Event Management;

Your identity information, contact details, marketing data, employment information, customer transaction data, and call center voice recordings are processed for the following purposes within the scope of events organized by our Company:

• Planning and organizing customer-oriented events, fairs, and organizations,

• Contacting you to inform you about events, fairs, and organizations organized for customers.

e) Management and Regulatory Compliance Activities;

Your personal data is processed for the following purposes within the scope of conducting business and management activities and ensuring compliance with current legislation as part of our Company's marketing activities:

• Ensuring all above-mentioned marketing activities are carried out in accordance with the current legislation,

• Providing information to legally authorized institutions and organizations, including İleti Yönetim Sistemi A.Ş. and relevant ministries,

• Following up legal proceedings and exercising our right of defense when necessary,

• Conducting data retention activities within the scope of marketing processes for which personal data is collected,

• Managing information security processes in environments where personal data collected as part of marketing activities is stored.

You can access detailed information about the purposes for which your personal data is processed by our Company in the Personal Data Protection and Processing Policy at http://www.........................

3.    TRANSFER OF PERSONAL DATA;

3.1 To whom and for what purposes can our Company transfer your personal data?

All personal data collected in accordance with this Information Notice may be transferred to the following persons and organizations, in line with the conditions of personal data processing specified in Articles 8 and 9 of the Law:

a) Transfers related to customer satisfaction surveys;

Your identity information, contact details, customer transaction data, marketing data, and transaction security information are transferred to domestic supplier companies that provide services for the execution of customer satisfaction survey activities carried out by our Company and for contacting you within this scope.

b) Transfers within the scope of discounts, campaigns, promotional activities, market research and analysis:

Your identity information, contact details, marketing data, employment information, customer transaction data, and call center voice recordings may be transferred to other domestic firms that our Company works with, as well as advertising and marketing agencies, within the scope of promotional and analytical efforts including personalized marketing.

c) Transfers within the scope of management and regulatory compliance activities;

Your identity information, contact details, marketing data, employment information, customer transaction data, and call center voice recordings may be transferred to the cloud-based Microsoft Dynamics system located abroad, for the purpose of improving the efficiency of marketing processes and carrying out data retention activities.

Your above-mentioned personal data may also be transferred to legally authorized public institutions and organizations, such as relevant ministries, courts, and enforcement offices, as well as legally authorized private persons and organizations, in order to ensure compliance with legal regulations, fulfill legal obligations, follow legal proceedings, and exercise our right of defense when necessary.

5.1. Our Obligation to Inform

a) When collecting personal data as a data controller;

· The purpose of processing your personal data,

· Our identity and, if applicable, the identity of our representative,

· The recipients of the personal data and the purposes of such transfers,

· The method and legal reason for collecting the data,

· The rights arising from the law are disclosed to relevant parties,

· We have an obligation to inform the data subject whose personal data is being processed,

· We ensure that this Policy, which is open to the public, is clear, understandable, and easily accessible.

 

6. RIGHTS OF PERSONAL DATA SUBJECTS

6.1 Rights of the Personal Data Subject as Listed in Article 11 of the Law;

a) According to Article 11 of the Law, personal data subjects have the right to:

· Learn whether personal data is being processed,

· Request information if personal data has been processed,

· Learn the purpose of processing personal data and whether they are used appropriately for their purpose,

· Know the third parties to whom personal data is transferred domestically or abroad,

· Request correction of personal data if it is incomplete or incorrectly processed and request that the process carried out in this context be notified to the third parties to whom the personal data has been transferred,

· Request deletion or destruction of personal data within the framework of the conditions set forth in the Law and request that the transaction carried out in this context be notified to the third parties to whom the personal data has been transferred,

· Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

· Request compensation in case of damage due to unlawful processing of personal data.

· As personal data owners, you may submit your requests regarding your rights through the Personal Data Protection Application Form made available to the public.

 

7. SECURITY OF PERSONAL DATA

a) Our Obligations Regarding the Security of Personal Data:

· To prevent the unlawful processing of personal data,

· To prevent unlawful access to personal data,

· To ensure the lawful storage of personal data, we implement administrative and technical measures by personnel and lawyers employed specifically for this purpose, considering technological possibilities and implementation costs.

8. MEASURES TAKEN AND ACTIONS PERFORMED TO PREVENT THE UNLAWFUL PROCESSING OF PERSONAL DATA:

· We conduct and have conducted necessary audits within the Company,

· We educate and inform our employees on the lawful processing of personal data,

· The activities conducted by our Company and Group companies are assessed in detail by each business unit, and personal data is processed specifically according to the commercial activities of the respective units,

· In cases where cooperation with third parties is established for the purpose of processing personal data, we include provisions in contracts signed with data processors requiring them to take necessary security measures,

· In the event that personal data is unlawfully disclosed or a data breach occurs, we notify the Personal Data Protection Authority and conduct the necessary investigations and take measures as required by the legislation.

Our Company will fulfill the requests of personal data subjects free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request. However, if the process requires additional costs, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.