KVKK Notice

Purpose and Scope

The Personal Data Retention and Destruction Policy ("Policy") sets out and announces the business rules of Piga Yazılım Limited Şirketi (the "Company") for retaining and destroying personal data — belonging to employees, job candidates, dealer staff, dealer representatives, apprentices, suppliers, customers, and website visitors — in accordance with the Turkish Constitution, international agreements, Law No. 6698 on the Protection of Personal Data (the "Law"), and other applicable legislation.

General Principles in the Processing of Personal Data

The Company processes Personal Data in accordance with the procedures and principles set out in the Law and this Policy. The Company acts according to the following principles when processing Personal Data:

• Personal Data is processed in accordance with the law and the requirements of good faith.
• The accuracy and currency of Personal Data is ensured. In this context, matters such as the certainty of the sources from which the data was obtained, verification of its accuracy, and assessment of whether it needs updating are carefully considered.
• Personal Data is processed for specified, explicit, and legitimate purposes. A legitimate purpose means that the Personal Data processed by the Company is connected to, and necessary for, the business it conducts or the service it provides.
• Personal Data processing is limited to what is connected with the purposes determined by the Company; the processing of personal data that is unrelated to or not needed for achieving the purpose is avoided. The data processed is limited to what is necessary to achieve the purpose. In this context, the personal data processed is relevant, limited, and proportionate to the purposes for which it is processed.
• Where the applicable legislation sets a retention period for the data, that period is observed; otherwise, personal data is retained only for as long as necessary for the purpose for which it is processed. Where there is no longer a valid reason to retain the personal data further, that data is deleted, destroyed, or anonymized.

Conditions for Processing Personal Data

Personal data may not be processed without the Data Subject's explicit consent pursuant to Article 5 of the Law. However, under the same article, personal data may be processed without seeking the Data Subject's explicit consent where one of the following conditions exists.

Express Provision in Law
Where the processing of the data subject's personal data is expressly provided for by law — in other words, where the relevant law contains an explicit provision regarding the processing of personal data — this processing condition applies. Example: maintaining an employee's personnel file pursuant to the Labor Law or the Occupational Health and Social Security Law.

Inability to Obtain the Data Subject's Explicit Consent Due to Actual Impossibility
Where it is necessary to process the personal data of a person who is factually unable to express consent, or whose consent would not be legally valid, or of another person, in order to protect the life or physical integrity of that person or another, their personal data may be processed.

Direct Connection to the Establishment or Performance of a Contract
Where directly connected to the establishment or performance of a contract, and necessary for the processing of personal data belonging to the parties to that contract, personal data may be processed by the Company without the data subjects' explicit consent.

Necessity for the Company (as Data Controller) to Fulfil a Legal Obligation
Where processing is necessary for the Company to fulfil its legal obligations, the data subject's personal data may be processed. Example: obtaining an employee's bank and account details in order to pay their salary, or asking whether they are married, who their dependents are, whether their spouse is employed, and their social security information.

The Personal Data Having Been Made Public by the Data Subject Themselves
Where the data subject has made their own personal data public, that personal data may be processed by the Company, limited to the purpose of that disclosure.

Necessity of Data Processing for the Establishment or Protection of a Right
Where data processing is necessary for the establishment, exercise, or protection of a right, the data subject's personal data may be processed. Example: using certain data as evidence in a case brought by an employee.

Necessity of Data Processing for the Company's Legitimate Interests, Provided It Does Not Harm the Data Subject's Fundamental Rights and Freedoms
Where necessary for the Company's legitimate interests, provided this does not harm the data subject's fundamental rights and freedoms, personal data may be processed. Example: processing employees' personal data — without harming their fundamental rights and freedoms — as a basis for promotions, salary increases, or arrangement of social benefits, or for assigning duties and roles during a company restructuring process.

Processing of Special Categories of Personal Data

Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sex life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data.

Pursuant to Article 6 of the Law, special categories of personal data may not be processed without the data subject's explicit consent. However, special categories of personal data other than those relating to sex life and health may be processed without the data subject's explicit consent in cases provided for by law.

Personal data relating to health and sex life may only be processed, without seeking the data subject's explicit consent, by persons bound by a duty of confidentiality or authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing. In all cases, the processing of special categories of personal data is additionally subject to the adequate measures determined by the Board (the Personal Data Protection Board).

Our Company holds health information about its employees only to the extent required by law, and processes it within the scope of that legislation. Care is taken not to hold any special category personal data under any other condition.

Informing Data Subjects

In accordance with Article 10 of the Law, our Company informs data subjects before processing their Personal Data. In this context, our Company fulfils its Disclosure Obligation at the time personal data is collected. Under this disclosure obligation, the notice made to Data Subjects includes the following elements:

• The identity of the data controller and its representative, if any
• The purpose for which the personal data will be processed
• To whom, and for what purpose, the processed personal data may be transferred
• The method and legal basis for collecting personal data
• The data subject's rights listed under Article 11 of the Law

In accordance with Article 20 of the Constitution and Article 11 of the Law, our Company provides the necessary information where a data subject requests it.

Transfer of Personal Data

Transfer of Personal Data Within Turkey
Pursuant to Article 8 of the Law, Personal Data may not, as a rule, be transferred to third parties without the Data Subject's explicit consent. However, where one of the conditions listed in Article 4 of this Policy — under which the Data Subject's explicit consent is not required — exists, Personal Data may be transferred to third parties within Turkey without the Data Subject's explicit consent.

For Special Categories of Personal Data, provided adequate measures are taken, data may be transferred without the data subject's explicit consent where one of the conditions set out in paragraph 3 of Article 6 of the Law exists.

Transfer of Personal Data Abroad
Pursuant to Article 9 of the Law, Personal Data may not, as a rule, be transferred abroad without the Data Subject's explicit consent. However, where one of the following circumstances exists, Personal Data may be transferred abroad to third parties without seeking the Data Subject's explicit consent:

• One of the circumstances specified in Articles 2 and 3 of this Policy, in which the Data Subject's consent is not required, exists
• The foreign country to which the Personal Data will be transferred provides an adequate level of protection
• Where adequate protection does not exist, the data controllers in Turkey and in the relevant foreign country undertake in writing to provide adequate protection, and the Board grants its approval

Countries deemed to provide adequate protection are determined and announced by the Board.

Subject to the provisions of international agreements, Personal Data may be transferred abroad, with the Board's approval obtained after consulting the relevant public institution or organization, in cases where Turkey's interests or the Data Subject's interests would be seriously harmed.

Third Parties to Whom Personal Data May Be Transferred
In order to achieve the purposes specified in this Policy, and in accordance with Articles 8 and 9 of the Law, our Company may transfer Personal Data — within Turkey or abroad — to the following types of third parties, whether natural or legal persons: suppliers, consultants, financial advisors, lawyers, audit firms, service providers, business partners, dealers, banks, and authorized public institutions and organizations.

Purposes of Processing Personal Data

Your personal data will be used to achieve the purposes set out in the Company's policies, in compliance with the limits set by the Law. The purposes of processing include: carrying out emergency management processes, carrying out information security processes, carrying out candidate / intern / student selection and placement processes, carrying out job application processes, carrying out employee satisfaction and loyalty processes, fulfilling obligations arising from employment contracts and legislation, carrying out employee fringe benefit processes, carrying out audit / ethics activities, carrying out vehicle inquiry processes, carrying out dealer opening processes, carrying out appointment scheduling processes, carrying out training activities, managing access authorizations, ensuring activities are carried out in compliance with legislation, carrying out finance and accounting operations, carrying out brand / product / service loyalty processes, ensuring physical space security, carrying out assignment processes, following up and conducting legal affairs, carrying out internal audit / investigation / intelligence activities, carrying out communication activities, planning human resources processes, carrying out / auditing business activities, carrying out occupational health / safety activities, receiving and evaluating suggestions for improving business processes, carrying out business continuity activities, carrying out goods / service purchasing processes, carrying out after-sales support services, carrying out sales processes, carrying out production and operations processes, carrying out customer relationship management processes, carrying out customer satisfaction activities, organization and event management, carrying out marketing analysis studies, carrying out performance evaluation processes, carrying out advertising / campaign / promotion processes, carrying out risk management processes, carrying out storage and archiving activities, carrying out contract processes, following up requests / complaints, ensuring the security of movable property and resources, carrying out supply chain management processes, carrying out the remuneration policy, carrying out product / service marketing processes, ensuring the security of data controller operations, carrying out investment processes, carrying out talent / career development activities, informing authorized persons, institutions, and organizations, and carrying out management activities.

Method of Collecting Personal Data

Personal data may be collected through the website, applications, e-mail, third-party digital channels including recruitment portals, the Piga Yazılım website, or the dealer portal, through means such as contracts, applications, forms, the call center, the sales and marketing department, and telephone; through face-to-face meetings with the person concerned; through appointment records made over the internet, and footage recorded at openings and events; and through security camera recordings, by automated or non-automated means.

Legal Basis for Collecting Personal Data

The Law lists the conditions for processing personal data in paragraph 2 of Article 5. If a data controller's purposes for processing personal data can be assessed within the framework of the personal data processing conditions listed in the Law, that data controller may lawfully process personal data. In this context, the Company carries out personal data processing activities where the purposes of processing it pursues can be assessed within the processing conditions set out in the Law. The Company does not engage in any personal data processing activity that does not fall within these processing conditions.

The personal data processing conditions set out in the Law are as follows:

• The data subject has given explicit consent,
• It is expressly provided for by law,
• It is necessary for the protection of the life or physical integrity of the person concerned, or of another person, where the person concerned is unable to express consent due to actual impossibility, or whose consent is not legally valid,
• It is necessary to process personal data belonging to the parties to a contract, provided it is directly related to the establishment or performance of that contract,
• It is necessary for the data controller to fulfil its legal obligation,
• The data has been made public by the data subject themselves,
• It is necessary for the establishment, exercise, or protection of a right,
• It is necessary for the data controller's legitimate interests, provided this does not harm the data subject's fundamental rights and freedoms.

For special categories of personal data too, the basic processing condition is explicit consent, and the Company does not fundamentally pursue a purpose of processing special categories of personal data. However, where required by our activities, or where you have given your explicit consent, your special category personal data is also processed proportionately, within the scope of the applicable legislation.

The conditions listed in the Law for the processing of special categories of personal data are as follows:

• The data subject has given explicit consent,
• For special categories of personal data other than those relating to health and sex life, it is expressly provided for by law,
• Personal data relating to health and sex life may only be processed, without seeking the data subject's explicit consent, by persons bound by a duty of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

More than one personal data processing condition that renders a personal data processing activity lawful may exist at the same time. The processing of the data described above is necessary in order to achieve our stated purposes. When identity information is transferred to our Company, data that does not actually fall within our processing purposes may also be transferred to us. Within administrative and technical measures, we delete and/or anonymize such data at the end of the periods set out in the legislation; however, it is not always possible to guarantee this under all circumstances. In such cases, it becomes necessary to rely on your explicit consent for the purpose of processing that data.

Review Period of the Policy

The Policy is reviewed as needed, and the relevant sections are updated.

Entry into Force and Repeal of the Policy

The Policy is deemed to enter into force once it is published on the Company's website. If a decision is made to repeal it, the old signed paper copies of the Policy are cancelled (marked as cancelled) and signed by the KVK team lead, and are retained in the KVKK folder for at least 5 years.

Have a question?

You can use our contact channels to learn more about KYS.

Contact page →