Information Text Regarding Personal Data
TABLE OF CONTENTS
1. SECTION 1 – INTRODUCTION
1.1. INTRODUCTION
1.2. PURPOSE OF THE POLICY
1.3. OBJECTIVE AND SCOPE
1.4. IMPLEMENTATION OF THE POLICY AND RELEVANT LEGISLATION
1.5. EFFECTIVENESS OF THE POLICY
2. SECTION 2 - MATTERS REGARDING THE PROTECTION OF PERSONAL DATA
2.1. ENSURING THE SECURITY OF PERSONAL DATA
2.1.1. Technical and Administrative Measures Taken to Ensure the Lawful Processing of Personal Data
2.1.2. Technical and Administrative Measures Taken to Prevent Unlawful Access to Personal Data
2.1.3. Storage of Personal Data in Secure Environments
2.1.4. Auditing of Measures Taken Regarding the Protection of Personal Data
2.1.5. Measures to be Taken in Case of Unauthorized Disclosure of Personal Data
2.2. OBSERVANCE OF THE DATA SUBJECT’S RIGHTS; CREATION OF CHANNELS FOR COMMUNICATING THESE RIGHTS TO OUR COMPANY AND EVALUATION OF DATA SUBJECT REQUESTS
2.3. PROTECTION OF PERSONAL DATA OF SPECIAL NATURE
2.4. INCREASING AWARENESS AND AUDITING OF BUSINESS UNITS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA
2.5. INCREASING AWARENESS AND AUDITING OF BUSINESS PARTNERS AND SUPPLIERS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA
3. SECTION 3 – MATTERS REGARDING THE PROCESSING OF PERSONAL DATA
3.1. PROCESSING OF PERSONAL DATA IN COMPLIANCE WITH THE PRINCIPLES PRESCRIBED IN THE LEGISLATION
3.2. PROCESSING OF PERSONAL DATA BASED ON AND LIMITED TO ONE OR MORE OF THE PERSONAL DATA PROCESSING CONDITIONS SPECIFIED IN ARTICLE 5 OF THE KVK LAW
3.3. CLARIFICATION AND INFORMING OF THE PERSONAL DATA SUBJECT
3.4. PROCESSING OF PERSONAL DATA OF SPECIAL NATURE
3.5. TRANSFER OF PERSONAL DATA
3.6. TRANSFER OF PERSONAL DATA ABROAD
4. SECTION 4 – CATEGORIZATION, PURPOSES OF PROCESSING, AND STORAGE PERIODS OF PERSONAL DATA PROCESSED BY OUR COMPANY
4.1. CLASSIFICATION OF PERSONAL DATA
4.2. PURPOSES OF PROCESSING PERSONAL DATA
4.3. STORAGE PERIODS OF PERSONAL DATA
5. SECTION 5 – CATEGORIZATION OF DATA SUBJECTS WHOSE PERSONAL DATA ARE PROCESSED BY OUR COMPANY
6. SECTION 6 – THIRD PARTIES TO WHOM PERSONAL DATA ARE TRANSFERRED BY OUR COMPANY AND PURPOSES OF TRANSFER
7. SECTION 7 - PROCESSING OF PERSONAL DATA BASED ON AND LIMITED TO THE PROCESSING CONDITIONS IN THE LAW
Our Company informs the personal data subject regarding the personal data it processes in accordance with Article 10 of the KVK Law.
7.1. PROCESSING OF PERSONAL DATA AND PERSONAL DATA OF SPECIAL NATURE
8. SECTION 8 – PERSONAL DATA PROCESSING ACTIVITIES CONDUCTED AT BUILDING AND FACILITY ENTRANCES AND WITHIN BUILDINGS/FACILITIES, AND WEBSITE VISITORS
8.1. CAMERA MONITORING ACTIVITIES CONDUCTED AT LE MABELLE BUILDING AND FACILITY ENTRANCES AND WITHIN
8.2. TRACKING OF GUEST ENTRIES AND EXITS CONDUCTED AT LE MABELLE BUILDING AND FACILITY ENTRANCES AND WITHIN
8.3. STORAGE OF RECORDS REGARDING INTERNET ACCESS PROVIDED TO OUR VISITORS AT LE MABELLE BUILDINGS AND FACILITIES
8.4. WEBSITE VISITORS
9. SECTION 9 – CONDITIONS FOR DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVK Law, in the event that the reasons requiring the processing of personal data disappear, even though the data has been processed in accordance with the provisions of the relevant law, personal data shall be deleted, destroyed, or anonymized upon our Company’s own decision or upon the request of the personal data subject.
9.1. LE MABELLE’S OBLIGATION TO DELETE, DESTROY, AND ANONYMIZE PERSONAL DATA
9.2. TECHNIQUES FOR DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
10. SECTION 10 – RIGHTS OF PERSONAL DATA SUBJECTS; METHODOLOGY FOR THE EXERCISE AND EVALUATION OF THESE RIGHTS
In accordance with Article 10 of the KVK Law, our Company notifies the personal data subject of their rights, provides guidance on how to exercise these rights, and conducts the necessary channels, internal procedures, and administrative and technical arrangements for the evaluation of personal data subjects' requests and the provision of necessary information to them, in accordance with Article 13 of the KVK Law.
10.1. DATA SUBJECT’S RIGHTS AND EXERCISE OF THESE RIGHTS
10.2. LE MABELLE’S RESPONSE TO APPLICATIONS
10.2.1. Our Company’s Procedure and Timeframe for Responding to Applications
10.2.2. Information Our Company May Request from the Personal Data Subject Applying
10.2.3. Our Company’s Right to Reject the Personal Data Subject’s Application
11. SECTION 11 – RELATIONSHIP OF THE COMPANY PERSONAL DATA PROTECTION AND PROCESSING POLICY WITH OTHER POLICIES
12. SECTION 12 – COMPANY PERSONAL DATA PROTECTION AND PROCESSING POLICY GOVERNANCE STRUCTURE
ANNEX-1 DEFINITIONS
ANNEX-2 PROCESSING OF PERSONAL DATA OF EMPLOYEE CANDIDATES
ANNEX-3 ONLINE MEMBERSHIP AND LE MABELLE STARS PROGRAM CLARIFICATION TEXT
ANNEX-4 MARKETING AND COMMERCIAL ELECTRONIC MESSAGE TEXTS
Le Mabelle Tekstil Limited Şirketi (hereinafter referred to as “Le Mabelle” or the “Company”) is aware that the protection of personal data, which is a constitutional right, also impacts the conduct of business relations based on trust.
In this regard, the Personal Data Processing and Protection Policy (“Policy”), which serves as a guide for our Company in fulfilling its obligations regarding the protection and processing of personal data in compliance with the law, has been made available to relevant parties.
Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the “KVK Law”) serves as the basis for this Policy. Ensuring compliance with legal regulations regarding the protection of personal data, primarily the KVK Law, is among our Company’s priorities.
In this context, necessary administrative and technical measures are taken by Le Mabelle for the protection of personal data processed in accordance with the relevant legislation. This Policy will provide detailed explanations regarding the fundamental principles adopted by Le Mabelle in the processing of personal data, listed as follows:
Processing personal data in compliance with the law and good faith,
Keeping personal data accurate and up to date when necessary,
Processing personal data for specific, explicit, and legitimate purposes,
Processing personal data in a manner relevant, limited, and proportionate to the purpose for which they are processed,
Retaining personal data for the period prescribed in the relevant legislation or necessary for the purpose for which they are processed,
Clarifying and informing personal data subjects,
Establishing the necessary system for personal data subjects to exercise their rights,
Taking necessary measures for the storage of personal data,
Acting in accordance with the relevant legislation and KVK Board regulations when transferring personal data to third parties in line with the requirements of the processing purpose,
Showing the necessary sensitivity to the processing and protection of personal data of special nature.
The main purpose of this Policy is to provide explanations regarding the personal data processing activities carried out by Le Mabelle in accordance with the law and the systems adopted for the protection of personal data, and to ensure transparency by informing the individuals whose personal data are processed by our Company, primarily our customers, potential customers, employee candidates, company shareholders, company officials, visitors, employees/shareholders/officials of the institutions we cooperate with, and third parties.
By publishing this Policy, Le Mabelle aims to provide the necessary information regarding its personal data processing activities and thereby ensure that these activities are conducted in a transparent manner and in compliance with the legislation.
In addition to defining the conditions for processing personal data, the Policy sets forth the fundamental principles adopted by Le Mabelle in the processing of personal data.
The scope of this Policy covers all personal data of our customers, potential customers, employee candidates, company shareholders, company officials, visitors, employees/shareholders/officials of the institutions we cooperate with, and other third parties that are processed by automated means or non-automated means provided that they are part of any data recording system.
Matters regarding the protection and processing of the personal data of Le Mabelle employees fall within the scope of the Personal Data Processing and Protection Policy.
Applicable legal regulations in force regarding the processing and protection of personal data shall take precedence. In the event of an inconsistency between the legislation in force and the Policy, our Company accepts that the legislation in force shall apply.
The Policy has been created by concretizing the rules established by the relevant legislation within the scope of Le Mabelle practices. Our Company carries out the necessary systems and preparations to act in accordance with the effective dates stipulated in the KVK Law.
This Policy, prepared by our Company, was updated on 11.09.2026. In the event of a renewal of the entire Policy or specific articles, the current text and the effective date are published on www.lemabelle.com. The Policy is kept constantly available for the access of relevant persons.
In accordance with Article 12 of the KVK Law, our Company takes the necessary technical and administrative measures to provide an appropriate level of security in order to prevent the unlawful processing of personal data it processes, prevent unlawful access to the data, and ensure the preservation of the data, and conducts or causes to be conducted the necessary audits in this context.
- ENSURING THE SECURITY OF PERSONAL DATA
- Technical and Administrative Measures Taken to Ensure the Lawful Processing of Personal Data
Our Company takes technical and administrative measures according to technological possibilities and implementation costs to ensure that personal data is processed in accordance with the law.
The primary technical measures taken by our Company to ensure the lawful processing of personal data are listed below:
- Personal data processing activities carried out within our Company are monitored through established technical systems.
- The technical measures taken are periodically reported to the relevant parties as required by the internal audit mechanism.
- Personnel knowledgeable in technical matters are employed.
The primary administrative measures taken by our Company to ensure the lawful processing of personal data are listed below:
- Employees are informed and trained on the law regarding the protection of personal data and the lawful processing of personal data.
- All activities carried out by our Company are analyzed in detail for each business unit, and as a result of this analysis, personal data processing activities are determined specifically for the commercial activities performed by the relevant business units.
- The personal data processing activities carried out by our business units; the requirements to be fulfilled to ensure compliance with the personal data processing conditions sought by Law No. 6698 are determined specifically for each business unit and the detailed activities they carry out.
- To ensure the legal compliance requirements determined on a business unit basis, awareness is created within the relevant business units, and application rules are determined; administrative measures necessary to ensure the audit of these matters and the continuity of the application are implemented through internal company policies and training.
- Records imposing an obligation not to process, disclose, or use personal data, except for the Company’s instructions and exceptions brought by law, are included in the contracts and documents governing the legal relationship between our Company and its employees, and employee awareness is created and audits are conducted on this matter.
Our Company takes technical and administrative measures according to the nature of the data to be protected, technological possibilities, and implementation costs to prevent the imprudent or unauthorized disclosure, access, transfer, or all other forms of unlawful access to personal data.
The primary technical measures taken by our Company to prevent unlawful access to personal data are listed below:
- Technical measures consistent with technological developments are taken, and the measures taken are periodically updated and renewed.
- Access and authorization technical solutions are implemented in accordance with the legal compliance requirements determined on a business unit basis.
- The technical measures taken are periodically reported to the relevant parties as required by the internal audit mechanism, and risk-posing issues are re-evaluated to produce the necessary technological solutions.
- Software and hardware including virus protection systems and firewalls are installed.
- Personnel knowledgeable in technical matters are employed.
The primary administrative measures taken by our Company to prevent unlawful access to personal data are listed below:
- Employees are trained on the technical measures to be taken to prevent unlawful access to personal data.
- Access and authorization processes for personal data are designed and implemented within the Company in accordance with business unit-based legal compliance requirements.
- Employees are informed that they cannot disclose the personal data they have learned to others in violation of the provisions of the PDPL, cannot use it for purposes other than processing, and that this obligation will continue after they leave their positions; necessary undertakings are obtained from them in this regard.
- Provisions are added to the contracts concluded with persons to whom personal data is transferred by our Company in accordance with the law, stating that the persons to whom the personal data is transferred will take the necessary security measures for the protection of personal data and ensure that these measures are complied with in their own organizations.
Our Company takes the necessary technical and administrative measures according to technological possibilities and implementation costs to store personal data in secure environments and to prevent its destruction, loss, or alteration for unlawful purposes.
The primary technical measures taken by our Company to store personal data in secure environments are listed below:
- Systems suitable for technological developments are used to store personal data in secure environments.
- Personnel with expertise in technical matters are employed.
- Technical security systems are installed for storage areas; the technical measures taken are periodically reported to the relevant parties in accordance with the internal audit mechanism, and issues posing a risk are re-evaluated to produce necessary technological solutions.
- Backup programs are used in a lawful manner to ensure that personal data is stored securely.
The primary administrative measures taken by our Company to store personal data in secure environments are listed below:
- Employees are trained on ensuring that personal data is stored securely.
- In the event that our Company receives services from third parties for the storage of personal data due to technical requirements, provisions are included in the contracts concluded with the relevant firms to whom personal data is transferred in accordance with the law, stating that the persons to whom the personal data is transferred will take the necessary security measures for the protection of personal data and ensure that these measures are complied with in their own organizations.
Our Company conducts or causes to be conducted the necessary audits within its own structure in accordance with Article 12 of the PDPL. The results of these audits are reported to the relevant department within the scope of the Company's internal operations, and necessary activities are carried out to improve the measures taken.
In accordance with Article 12 of the PDPL, our Company operates a system that ensures that in the event that the processed personal data is obtained by others through unlawful means, this situation is reported to the relevant personal data owner and the PDPL Board as soon as possible.
If deemed necessary by the PDPL Board, this situation may be announced on the PDPL Board's website or by another method.
- OBSERVANCE OF THE RIGHTS OF THE DATA OWNER; CREATION OF CHANNELS THROUGH WHICH THESE RIGHTS CAN BE COMMUNICATED TO OUR COMPANY AND EVALUATION OF THE REQUESTS OF DATA OWNERS
Our Company operates the necessary channels, internal workings, administrative and technical arrangements in accordance with Article 13 of the PDPL for the evaluation of the rights of personal data owners and for providing the necessary information to personal data owners.
If personal data owners submit their requests regarding their rights listed below to our company in writing, our company concludes the request as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee in the tariff determined by the PDPL Board may be applied.
If personal data owners submit their requests regarding their rights listed below to our Company in writing, our Company concludes the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee in the tariff determined by the PDPL Board will be charged by our Company. Personal data owners have the right to;
- Learn whether personal data is processed,
- Request information if personal data has been processed,
- Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request correction of personal data in case of incomplete or incorrect processing and request notification of this transaction to third parties to whom the personal data has been transferred,
- Request deletion or destruction of personal data in the event that the reasons requiring its processing disappear, despite being processed in accordance with the PDPL and other relevant law provisions, and request notification of this transaction to third parties to whom the personal data has been transferred,
- Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
- Request compensation for the damage in case of loss due to unlawful processing of personal data.
More detailed information regarding the rights of data owners is provided in Section 10 of this Policy.
Under the PDPL, special importance and priority are given to certain personal data due to the risk of causing victimization or discrimination when processed unlawfully.
This data includes data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in an association, foundation or union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.
Our Company acts with sensitivity in the protection of special category personal data, which is determined as "special category" by the PDPL and processed in accordance with the law. In this context, the technical and administrative measures taken by our Company for the protection of personal data are carefully applied to special category personal data, and the necessary audits are ensured within Le Mabelle.
Detailed information regarding the processing of special category personal data is provided in Section 3 of this Policy.
- INCREASING AWARENESS AND AUDIT OF BUSINESS UNITS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA
Our Company ensures that the necessary training is organized for business units to increase awareness for preventing the unlawful processing of personal data, preventing unlawful access to data, and ensuring the protection of data.
- INCREASING AWARENESS AND AUDIT OF BUSINESS PARTNERS AND SUPPLIERS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA
Our organization provides necessary information to business partners to increase awareness for preventing unlawful processing of personal data, preventing unlawful access to data, and ensuring the protection of data. References are made to the warnings and alerts required within the scope of PDPL legislation in the contracts, protocols, and confidentiality agreements concluded between our organization and its business partners.
Users authorized to access and process personal data are continuously trained on the necessity of information systems and network security, and what they can do to increase security, and are ensured to be conscious.
All users are aware that they are jointly responsible for the security of the information system components they use and the personal data.
In accordance with Article 20 of the Constitution and Article 4 of the PDPL, our Company conducts personal data processing activities in a manner that is lawful and in accordance with the rules of good faith; accurate and kept up-to-date when necessary; for specific, clear, and legitimate purposes; and in a way that is relevant, limited, and proportionate to the purpose. Our Company retains personal data for the period stipulated in the laws or required for the purpose of personal data processing.
Our Company processes personal data based on one or more of the conditions set forth in Article 5 of the PDPL regarding the processing of personal data, in accordance with Article 20 of the Constitution and Article 5 of the PDPL.
In accordance with Article 20 of the Constitution and Article 10 of the PDPL, our Company informs personal data owners and provides the necessary information when personal data owners request information.
Our Company acts in accordance with the regulations foreseen for the processing of special category personal data in accordance with Article 6 of the PDPL.
Our Company acts in accordance with the regulations provided for in the law and put forward by the PDPL Board regarding the transfer of personal data, in accordance with Articles 8 and 9 of the PDPL.
Our Company acts in accordance with the principles brought by legal regulations and the rule of general trust and good faith in the processing of personal data. In this context, our Company takes into account the proportionality requirements in the processing of personal data and does not use personal data beyond what the purpose requires.
Our Company ensures that the personal data it processes is accurate and up-to-date, taking into account the fundamental rights of personal data owners and its own legitimate interests. It takes the necessary measures in this direction. For example, a system has been established by Le Mabelle for personal data owners to correct their personal data and verify its accuracy. Detailed information on this subject is provided in Section 10 of this Policy.
Our Company determines the legitimate and lawful purpose of personal data processing clearly and precisely. Our Company processes personal data in connection with and as necessary for the service it provides. The purpose for which personal data will be processed by our Company is set forth before the personal data processing activity begins.
Our Company processes personal data in a manner suitable for the realization of the determined purposes and avoids processing personal data that is not related to or needed for the realization of the purpose. For example, personal data processing activity is not carried out to meet needs that are likely to arise later.
- Retaining for the Duration Required by the Relevant Legislation or for the Purpose for Which They are Processed
Our Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context, our Company first determines whether a period is stipulated for the storage of personal data in the relevant legislation; if a period is determined, it acts in accordance with this period, and if no period is determined, it stores the personal data for the period necessary for the purpose for which they are processed. At the end of the period or if the reasons requiring processing disappear, personal data is deleted, destroyed, or anonymized by our Company. Personal data is not stored by our Company with the possibility of future use. Detailed information on this subject is provided in Section 9 of this Policy.
The protection of personal data is a Constitutional right. Fundamental rights and freedoms may be restricted only by law, depending on the reasons specified in the relevant articles of the Constitution, without prejudice to their essence. Pursuant to the third paragraph of Article 20 of the Constitution, personal data can only be processed in cases provided for by law or with the explicit consent of the person. Accordingly, and in compliance with the Constitution, our Company processes personal data only in cases provided for by law or with the explicit consent of the person. Detailed information regarding this matter is provided in Section 7 of this Policy.
In accordance with Article 10 of the PDPL (Personal Data Protection Law), our Company enlightens personal data subjects during the collection of personal data. In this context, it provides enlightenment regarding the identity of Le Mabelle and its representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for personal data collection, and the rights of the personal data subject. Detailed information regarding this matter is provided in Section 10 of this Policy.
Article 20 of the Constitution establishes that everyone has the right to be informed about personal data concerning themselves. In line with this, "requesting information" is also listed among the rights of the personal data subject in Article 11 of the PDPL. In this context, our Company provides the necessary information in case the personal data subject requests information, in accordance with Article 20 of the Constitution and Article 11 of the PDPL. Detailed information regarding this matter is provided in Section 10 of this Policy.
Our Company acts with sensitivity in compliance with the regulations stipulated in the PDPL when processing personal data determined as "special categories" by the PDPL.
In Article 6 of the PDPL, certain personal data that carry the risk of causing victimization or discrimination when processed unlawfully are determined as "special categories". These data are; race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
Special categories of personal data may be processed provided that at least one of the processing conditions specified in the third paragraph of Article 6 of the PDPL is present and adequate measures determined by the Board are taken.
· These conditions cover; explicit consent, being clearly stipulated in laws, necessity for the protection of life or bodily integrity, processing in accordance with the data subject's intent to publicize, necessity for the establishment, exercise or protection of a right, conditions regarding health services, employment and social security obligations, and cases related to non-profit organizations specified in the Law.
Our Company may transfer the personal data and special categories of personal data of the personal data subject to third parties (third-party companies, group companies, third-party natural persons, and abroad) by taking necessary security measures (See Section II/Title 1) in line with lawful personal data processing purposes. In this direction, our Company acts in accordance with the regulations stipulated in Article 8 of the PDPL. Detailed information regarding this matter is provided in Section 6 of this Policy.
1. Transfer of Personal Data
Our Company may transfer personal data to third parties based on and limited to one or more of the personal data processing conditions specified in Article 5 of the Law, listed below, in line with legitimate and lawful personal data processing purposes:
- If the personal data subject has explicit consent;
- If there is a clear regulation in the laws regarding the transfer of personal data,
- If it is mandatory for the protection of the life or bodily integrity of the personal data subject or someone else, and the personal data subject is unable to disclose their consent due to actual impossibility or their consent is not given legal validity;
- If it is necessary to transfer the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract;
- If personal data transfer is mandatory for our Company to fulfill its legal obligation;
- If personal data has been made public by the personal data subject;
- If personal data transfer is mandatory for the establishment, exercise or protection of a right;
- If personal data transfer is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data subject.
2. Transfer of Special Categories of Personal Data
Our Company may transfer special categories of personal data to third parties only in accordance with Article 8 of the PDPL; provided that one of the conditions in the third paragraph of Article 6 of the Law is present, adequate measures determined by the Board are taken, and the transfer is relevant, limited, and proportionate to the purpose.
3.6. TRANSFER OF PERSONAL DATA ABROAD
Personal data is transferred abroad in accordance with Article 9 of the PDPL and the Regulation on Procedures and Principles Regarding the Transfer of Personal Data Abroad. For the transfer, first of all, one of the processing conditions in Article 5 or 6 of the Law must be present.
1. Transfer abroad is carried out through an adequacy decision, or if there is no adequacy decision, by providing one of the appropriate safeguards listed in the Law. As appropriate safeguards, methods such as binding corporate rules, standard contracts announced by the Board, or a written undertaking subject to Board approval can be used. Standard contracts are notified to the Authority within five business days from the signing.
In the absence of an adequacy decision or appropriate safeguards, the transfer can only be carried out provided that it is incidental and one of the exceptions in the sixth paragraph of Article 9 of the PDPL is present. Regular and continuous transfers are not carried out through the incidental transfer exception based on explicit consent.
- SECTION 4 – CATEGORIZATION, PROCESSING PURPOSES, AND STORAGE PERIODS OF PERSONAL DATA PROCESSED BY OUR COMPANY
In accordance with Article 10 of the PDPL, our Company informs relevant persons during the collection of personal data about; categories of processed data, purposes of processing, recipient groups to whom transfer is made, collection method, legal reason, and rights of the relevant person. It publishes current enlightenment texts in an accessible manner.
1.CLASSIFICATION OF PERSONAL DATA
In the presence of our Company, pursuant to Article 10 of the PDPL, by informing the relevant persons, in line with our Company's legitimate and lawful personal data processing purposes, based on and limited to one or more of the personal data processing conditions specified in Article 5 of the PDPL, complying with the general principles specified in the PDPL, primarily the principles regarding the processing of personal data specified in Article 4, and all obligations regulated in the PDPL, the personal data in the categories specified below are processed, limited to the periods within the scope of this Policy. Which data subjects the personal data processed in these categories are related to is also stated in Section 5 of this Policy.
|
PERSONAL DATA CLASS |
PERSONAL DATA CLASS DESCRIPTION |
|
Identity Information |
Clearly belonging to an identified or identifiable natural person; processed partially or completely automatically or non-automatically as part of a data recording system; all information contained in photo and valid official documents such as Driver's License, Identity Card, Passport
|
|
Contact Information |
Clearly belonging to an identified or identifiable natural person; processed partially or completely automatically or non-automatically as part of a data recording system; information such as phone number, address, e-mail
|
|
Location Data |
Clearly belonging to an identified or identifiable natural person; processed partially or completely automatically or non-automatically as part of a data recording system; information identifying the location of the personal data subject during their use of our products and services or the location of employees of institutions with which we are in cooperation while using the Institution's vehicles
|
|
Customer Information |
Clearly belonging to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; information obtained and produced about the relevant person as a result of our commercial activities and the operations carried out by our business units within this framework
|
|
Family Members and Relative Information |
Clearly belonging to an identified or identifiable natural person and included in the data recording system; information about the personal data subject's family members and relatives related to the products and services we offer or to protect the legal interests of the Institution and the data subject
|
|
Customer Transaction Information |
Belonging to an identified or identifiable natural person; information regarding product, service, and membership transactions including order, product, amount, discount, cancellation, return, exchange, campaign participation, Le Mabelle Stars Point accrual, pending and available balance, usage, expiration date, set-off, and account movements. |
|
Physical Space Security Information |
Clearly belonging to an identified or identifiable natural person and included in the data recording system; personal data regarding records and documents taken during entry into the physical space and during the stay within the physical space
|
|
Transaction Security Information |
Clearly belonging to an identified or identifiable natural person and included in the data recording system; your personal data processed to ensure our technical, administrative, legal, and commercial security while carrying out our commercial activities
|
|
Risk Management Information |
Clearly belonging to an identified or identifiable natural person and included in the data recording system; personal data processed through methods used in accordance with generally accepted legal, commercial customs, and good faith rules in these areas in order to manage our commercial, technical, and administrative risks
|
|
Financial Information |
Clearly belonging to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; personal data processed regarding all kinds of information, documents, and records showing financial results created according to the type of legal relationship established by the Institution with the personal data subject
|
|
Personnel Information |
Clearly belonging to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; all kinds of personal data processed to obtain information that will form the basis for the establishment of the personal rights of our employees or natural persons who are in a working relationship with the Institution
|
|
Employee Candidate Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; processed in relation to individuals who have applied to become employees of the Institution, have been evaluated as prospective employees in line with the Institution's human resources needs in accordance with commercial practices and rules of honesty, or who are in an employment relationship with the Institution.
|
|
Employee Transaction Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; personal data processed regarding any and all transactions performed by our employees or natural persons in an employment relationship with the Institution in relation to their work.
|
|
Employee Performance and Career Development Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; personal data processed for the purpose of measuring the performance of our employees or natural persons in an employment relationship with the Institution, and for planning and executing their career development within the scope of the Institution's human resources policy.
|
|
Fringe Benefits and Perks Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; your personal data processed for the planning of fringe benefits and perks that we offer or will offer to employees or other natural persons in an employment relationship with the Institution, for the determination of objective criteria for entitlement to these, and for the tracking of accruals related to them.
|
|
Legal Transaction and Compliance Information
|
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; your personal data processed within the scope of the identification and pursuit of our legal claims and rights, the fulfillment of our debts, and compliance with our legal obligations and the Institution's policies.
|
|
Audit and Inspection Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; your personal data processed within the scope of the Institution's legal obligations and compliance with institutional policies.
|
|
Special Category Personal Data |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; data regarding individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership in an association, foundation, or trade union, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data are special category personal data.
|
|
Marketing Information |
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; personal data processed for the purpose of marketing our products and services by customizing them in line with the personal data subject's usage habits, tastes, and needs, and reports and evaluations created as a result of such processing.
|
|
Request/Complaint Management Information
|
Personal data belonging to an identified or identifiable natural person, processed in whole or in part by automatic means or by non-automatic means as part of a data filing system; personal data regarding the receipt and evaluation of any and all requests or complaints directed to the Institution.
|
|
Reputation Management Information
|
Information collected for the purpose of protecting our company's commercial reputation, and information regarding the evaluation reports created and actions taken in relation to this.
|
|
Incident Management Information |
Personal data processed in order to take necessary legal, technical, and administrative measures against incidents occurring for the purpose of protecting our company's commercial rights and interests, as well as the rights and interests of our customers. |
Our Company processes personal data limited to the purposes and conditions specified in the 2nd paragraph of Article 5 and the 3rd paragraph of Article 6 of the Personal Data Protection Law No. 6698. These purposes and conditions are:
- Where it is expressly provided for by the Laws that the Institution engages in the relevant activity regarding the processing of your personal data and within the framework of the legal obligations arising from the relevant legislation)
- Where the processing of your personal data by our Company is directly related to and necessary for the establishment or performance of a contract,
- Where the processing of your personal data is mandatory for our Company to fulfill its legal obligations,
- Provided that your personal data has been made public by you; where it is processed by our Company limited to the purpose of you making it public,
- Where the processing of your personal data by our Company is mandatory for the establishment, exercise, or protection of the rights of our Company, you, or third parties,
- Where it is mandatory to conduct personal data processing activities for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms,
- Where it is mandatory for the protection of the life or bodily integrity of the personal data subject or another person, and in this case, the personal data subject is unable to disclose their consent due to actual impossibility or legal invalidity,
· The presence of one of the conditions listed in the third paragraph of Article 6 of the KVKK Law for the processing of special category personal data,
· Taking adequate technical and administrative measures determined by the Board for special category personal data.
In accordance with the personal data processing conditions explained above, your personal and special category personal data
can be processed by Le Mabelle for the following purposes.
|
MAIN PURPOSES |
SUB-PURPOSES |
|
Planning and Execution of Le Mabelle’s Human Resources Policies and Processes |
1- Planning and Execution of Fringe Benefits and Perks for Employees, 2- Planning and Execution of Human Resources Processes, 3- Execution of Personnel Recruitment Processes, 4- Planning and Execution of Corporate Communication Activities for Employees or Corporate Social Responsibility or Non-Governmental Organization Activities in which Employees Participate, 5- Planning and Execution of Talent - Career Development Activities, 6- Fulfillment of Obligations Arising from the Employment Contract and/or Legislation for Company Employees, 7- Planning and Execution of In-Company Orientation Activities, 8- Planning and Execution of Personnel Exit Procedures, 9- Salary Management, 10- Planning and Execution of In-Company Assignment-Promotion and Resignation Processes, 11- Planning and Tracking of Employees' Performance Evaluation Processes, 12- Tracking and/or Auditing of Employees' Work Activities or Working Hours, 13- Planning and Execution of Employee Satisfaction and/or Loyalty Processes, 14- Planning of Employees' Salary Increases, 15- Planning and Execution of Employees' Information Access Authorization, 16- Foreign Personnel Work and Residence Permit Procedures, 17- Planning and Execution of Processes Regarding Supporting Urgent Medical Needs of Employees and Employees' Relatives, 18- Planning and Execution of Processes Regarding Employees' Trade Union Membership, 19- Fulfillment and Tracking of Disciplinary Practices Regarding Employees, 20- Providing Information Regarding Employees to Legally Authorized Public Institutions, 21- Execution and Tracking of Hiring and Personnel File Processes, 22- Collection and Evaluation of Employees' Complaints, Requests, or Suggestions, 23- Determination and Meeting of Human Resources Needs Required for Production and Organization, 24- Planning and execution of personnel file processes regarding subcontracted employees, 25- Determination and Meeting of Human Resources Needs Required for Production and Organization, 26- Planning and/or Execution of In-Company Training Activities, 27- Planning and Management of Organizations and Events
|
|
Execution of Necessary Work by Our Relevant Business Units and Execution of Related Business Processes for the Realization of Commercial Activities Conducted by Le Mabelle |
1- Tracking of Finance and Accounting Affairs, 2- Planning and Execution of Business Continuity Activities, 3- Planning, Audit and Execution of Information Security Processes, 4- Establishment and Management of Information Technology Infrastructure, 5- Planning and Execution of Corporate Communication Activities, 6- Planning and Execution of Logistics Activities 7- Planning and Execution of Data Access Authorizations for Business Partners and Suppliers, 8- Organization and Event Management, 9- Planning and Execution of Business Activities, 10- Planning and Execution of Supply Chain Management Processes, 11- Planning and Execution of Corporate Governance Activities, 12- Planning and Execution of Efficiency/Effectiveness and Appropriateness Analysis Activities for Business Operations, 13- Planning and Execution of Corporate Sustainability Activities, 14- Planning and Tracking of Construction and/or Infrastructure Works, 15- Planning and Execution of Production and/or Operation Processes, |
|
Planning and Execution of Le Mabelle’s Commercial and Business Strategies |
|
|
Conducting Necessary Studies by Our Business Units and Execution of Related Business Processes to Benefit Relevant Persons from Products and Services Offered by Le Mabelle |
1- Tracking of Contractual Processes and/or Legal Requests, |
|
Planning and Execution of Necessary Activities to Customize and Recommend/Introduce Products and Services Offered by Le Mabelle Based on the Preferences, Usage Habits, and Needs of Relevant Persons |
1- Planning and/or Execution of Customer Satisfaction Activities, 2- Planning and Execution of Marketing Processes for Products and/or Services, 3- Planning and Execution of Market Research Activities for the Sales and Marketing of Products and Services, 4- Planning and/or Execution of Processes for Creating and/or Increasing Loyalty to the Products and/or Services Offered by the Company |
|
Ensuring the legal, technical, and commercial-business security of Le Mabelle and relevant persons who have a business relationship with Le Mabelle
|
1- Planning and Execution of Company Audit Activities, 2- Providing Information to Authorized Institutions Originating from Legislation, 3- Planning and/or Execution of Occupational Health and/or Safety Processes, 4- Planning and/or Execution of the Company’s Production and/or Operational Risk Processes, 5- Tracking of Legal Affairs, 6- Creation and Tracking of Visitor Records, 7- Ensuring the Security of Company Premises and/or Facilities, 8- Management and/or Audit of Relationships with Affiliates, 9- Ensuring the Security of Company Operations, 10- Ensuring the Security of Company Assets and/or Resources, 11- Planning and/or Execution of the Company’s Financial Risk Processes, 12- Planning and Execution of Operational Activities Necessary to Ensure that Company Operations are Conducted in Accordance with Company Procedures and/or Relevant Legislation, 13- Ensuring that Data is Accurate and Up-to-Date. 14- Planning and Execution of Emergency Management Processes, 15- Execution of Corporate and Partnership Law Transactions
|
In the event that the processing activity carried out for the mentioned purposes does not meet any of the conditions provided under the PDPL (KVK Law), your explicit consent is obtained by Le Mabelle regarding the relevant processing process.
Our Company retains personal data for the period specified in the relevant laws and regulations if such retention is stipulated therein.
If no specific period is provided in the legislation regarding how long personal data should be retained, personal data is processed for the period necessitated by the services our Company offers while processing that data, in accordance with our Company's practices and the customs of commercial life, and is subsequently deleted, destroyed, or anonymized. Detailed information on this subject is provided in Section 9 of this Policy.
If the purpose for processing personal data has ended and the retention periods determined by the relevant legislation and the Company have also expired, personal data may only be stored for the purpose of serving as evidence in potential legal disputes or to assert a right related to the personal data or to establish a defense. In determining the periods herein, retention periods are determined based on the statute of limitations for asserting the mentioned right, as well as examples of previous requests directed to our Company on the same issues, even if the statute of limitations has passed. In this case, the stored personal data is not accessed for any other purpose and access is provided only when it needs to be used in the relevant legal dispute. After the mentioned period ends, the personal data is deleted, destroyed, or anonymized.
Although the personal data of the personal data subject categories listed below are processed by our Company, the scope of application of this Policy is limited to our customers, potential customers, employee candidates, company shareholders, company officials, visitors, employees, shareholders, and officials of the institutions we cooperate with, and third parties.
The activities regarding the protection and processing of our employees' personal data will be evaluated under the Le Mabelle Employees Personal Data Processing and Protection Policy.
While the categories of persons whose personal data is processed by our Company are within the scope mentioned above, persons outside these categories may also direct their requests to our Company within the scope of the PDPL; the requests of these persons will also be evaluated within the scope of this Policy.
The concepts of customer, potential customer, visitor, employee candidate, shareholder and board member, natural persons in institutions we cooperate with, and third parties related to these persons, which are included in the scope of this Policy, are clarified below.
|
Personal Data Subject Category |
Description |
|
Customer |
Natural persons who use or have used the products and services offered by our Company, regardless of whether there is a contractual relationship with our Company.
|
|
Potential Customer |
Natural persons who have requested or expressed interest in using our products and services, or who have been evaluated as having such interest in accordance with commercial customs and honesty rules.
|
|
Visitor |
Natural persons who have entered the physical premises owned by our Company for various purposes or who visit our websites.
|
|
Third Party |
Third-party natural persons related to the aforementioned parties in order to ensure the commercial transaction security between our Company and said parties or to protect the rights of said persons and provide benefits (e.g., Guarantor, Companion, Family Members, and relatives) or other natural persons who do not fall within the scope of this Policy and the Le Mabelle Employees Personal Data Protection and Processing Policy.
|
|
Employee Candidate |
Natural persons who have applied for a job at our Company by any means or who have made their resume and related information available for our Company’s review.
|
|
Company Shareholder |
Natural persons who are shareholders of our Company.
|
|
Company Official |
Members of the board of directors and other authorized natural persons of our Company.
|
|
Employees, Shareholders, and Officials of Institutions We Cooperate With |
Natural persons, including employees, shareholders, and officials, working at institutions with which our Company has any kind of business relationship (such as, but not limited to, business partners, suppliers). |
The table below details the aforementioned personal data subject categories and the types of personal data processed for individuals within these categories.
|
PERSONAL DATA CATEGORIZATION |
RELATED PERSONAL DATA SUBJECT CATEGORY |
|
Identity Information |
Customer, Potential Customer, Employee Candidate, Company Shareholder, Company Official, Visitor, Employees, Shareholders, and Officials of Institutions We Cooperate With, Third Party |
|
Contact Information |
Customer, Potential Customer, Job Applicant, Company Shareholder, Company Official, Visitor, Employees, Shareholders and Officials of Institutions with which we cooperate, Third Party |
|
Location Data |
Customer, Employee, Employees of Institutions with which we cooperate |
|
Customer Information |
Customer |
|
Family Members and Relative Information |
Customer, Visitor, Job Applicant, Third Party, Employees, Shareholders and Officials of Institutions with which we cooperate |
|
Customer Transaction Information |
Customer |
|
Physical Space Security Information |
Visitor, Company Officials, Employees, Shareholders and Officials of Institutions with which we cooperate |
|
Transaction Security Information |
Customer, Visitor, Third Party, Company Officials, Employees, Shareholders and Officials of Institutions with which we cooperate |
|
Risk Management Information |
Customer, Potential Customer, Job Applicant, Company Shareholder, Company Official, Visitor, Employees, Shareholders and Officials of Institutions with which we cooperate, Third Party |
|
Financial Information |
Customer, Employee, Company Shareholder, Company Official, Company Shareholder, Employees, Shareholders and Officials of Institutions with which we cooperate |
|
Personnel Information |
Employees, Shareholders and Officials of Institutions with which we cooperate
|
|
Job Applicant Information |
Job Applicant, Employees of Institutions with which we cooperate
|
|
Employee Transaction Information |
Employees of Institutions with which we cooperate |
|
Employee Performance and Career Development Information |
Employees of Institutions with which we cooperate
|
|
Fringe Benefits and Perks Information |
Employees of Institutions with which we cooperate |
|
Legal Transaction and Compliance Information |
Customer, Potential Customer, Job Applicant, Company Shareholder, Company Official, Visitor, Employees, Shareholders and Officials of Institutions with which we cooperate, Third Party
|
|
Audit and Inspection Information |
Customer, Potential Customer, Job Applicant, Company Shareholder, Company Official, Visitor, Employees, Shareholders and Officials of Institutions with which we cooperate, Third Party |
|
Special Categories of Personal Data |
Customer, Job Applicant, Company Shareholder, Company Official, Employees, Shareholders and Officials of Institutions with which we cooperate |
|
Marketing Information |
Customer, Potential Customer |
|
Request/Complaint Management Information |
Customer, Potential Customer, Job Applicant, Company Shareholder, Company Official, Visitor, Employees, Shareholders and Officials of Institutions with which we cooperate, Third Party |
- SECTION 6 – THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED BY OUR COMPANY AND PURPOSES OF TRANSFER
Our Company informs the personal data subject about the groups of persons to whom personal data is transferred in accordance with Article 10 of the PDPL.
In accordance with Articles 8 and 9 of the PDPL (See Section 3/Heading 3.5), our Company may transfer customers' personal data to the categories of persons listed below:
- Business partners,
- Suppliers,
- Consultants,
- Shareholders,
- Group Companies
- Company officials,
- Legally authorized public institutions and organizations
- Legally authorized private law persons
The scope of the aforementioned persons to whom the transfer is made and the purposes of data transfer are stated below.
|
Persons to Whom Data Can Be Transferred |
Definition |
Purpose of Data Transfer |
|
Business Partner |
Parties with whom Le Mabelle has established a business partnership while conducting its commercial activities
|
Sharing of personal data limited to ensuring the fulfillment of the purposes for establishing the business partnership
|
|
Supplier |
Defines the parties that provide services to Le Mabelle. |
Limited to ensuring that the services, which our Company procures from the supplier via outsourcing and which are necessary for our Company to carry out its commercial activities, are provided to our Company.
|
|
Consultant |
Defines the parties that provide consultancy to Le Mabelle on a contractual basis. |
Limited to ensuring that the consultancy services necessary for Le Mabelle to carry out its activities are properly provided to Le Mabelle.
|
|
Our Shareholders |
Our shareholders who are authorized to design strategies and audit activities regarding our Company's commercial activities according to relevant legislative provisions
|
Limited to the purposes of designing strategies regarding our Company's commercial activities and auditing according to relevant legislative provisions |
|
Group Companies |
Le Mabelle companies |
Limited to ensuring the execution of commercial activities that require the participation of Le Mabelle group companies
|
|
Company officials |
Le Mabelle chairman and members of the board of directors and other authorized natural persons |
Limited to the purposes of designing strategies regarding Le Mabelle's commercial activities, ensuring its management at the highest level, and auditing according to relevant legislative provisions
|
|
Legally Authorized Public Institutions and Organizations |
Public institutions and organizations authorized to receive information and documents from our Company according to relevant legislative provisions
|
Limited to the purpose requested by the relevant public institutions and organizations within the scope of their legal authority |
|
Legally Authorized Private Law Persons |
Private law persons authorized to receive information and documents from our Company according to relevant legislative provisions |
Limited to the purpose requested by the relevant private law persons within the scope of their legal authority |
Transfers carried out by our Company are conducted in accordance with the issues regulated in Sections 2 and 3 of the Policy.
- SECTION 7 - PROCESSING OF PERSONAL DATA BASED ON AND LIMITED TO THE PROCESSING CONDITIONS IN THE LAW
Our Company informs the personal data subject about the personal data it processes in accordance with Article 10 of the PDPL.
The explicit consent of the personal data subject is only one of the legal grounds that enable the lawful processing of personal data. Apart from explicit consent, personal data can also be processed in the presence of one of the other conditions written below. The basis for a personal data processing activity can be just one of the conditions stated below, or more than one of these conditions can be the basis for the same personal data processing activity. If the processed data is a special category of personal data; the conditions set forth under Heading 7.1.2. in this section below apply.
Although the legal grounds for the processing of personal data by our Company differ, every personal data processing activity is conducted in accordance with the general principles specified in Article 4 of Law No. 6698 (See Section 3.1.).
One of the conditions for processing personal data is the explicit consent of the subject. The explicit consent of the personal data subject must be given regarding a specific subject, based on information, and with free will.
For personal data processing activities (secondary processing) other than the processing purpose (primary processing) aimed at the reasons for obtaining personal data, at least one of the conditions contained in (ii), (iii), (iv), (v), (vi), (vii), and (viii) of this heading is sought; if none of these conditions exist, these personal data processing activities are carried out by our Company based on the personal data subject's explicit consent for these processing activities.
For personal data to be processed based on the personal data subject's explicit consent, explicit consents are obtained from customers, potential customers, and visitors through relevant methods.
- Explicitly Provided for by Law
Personal data of the data subject may be processed lawfully if it is explicitly provided for in the law.
In cases where the processing of personal data is mandatory to protect the life or physical integrity of the data subject or another person, provided that the person concerned is unable to declare their consent due to actual impossibility or their consent is not legally valid, the personal data of the data subject may be processed.
It is possible to process personal data if it is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of said contract.
In cases where processing is mandatory for our Company to fulfill its legal obligations as a data controller, the personal data of the data subject may be processed.
If the personal data has been made public by the data subject themselves, the relevant personal data may be processed.
In cases where data processing is mandatory for the establishment, exercise, or protection of a right, the personal data of the data subject may be processed.
In cases where data processing is mandatory for our Company's legitimate interests, provided that it does not infringe upon the fundamental rights and freedoms of the personal data subject, the personal data of the data subject may be processed.
2. Processing of Special Categories of Personal Data
Our Company processes special categories of personal data, provided that at least one of the conditions specified in the third paragraph of Article 6 of the PDPL (KVK Law) is met and that adequate measures determined by the Board are taken.
1. The principles of relevance to purpose, limitation, and proportionality are observed in processing activities; access authorizations are restricted, and necessary security controls are implemented.
- SECTION 8 – PERSONAL DATA PROCESSING ACTIVITIES CONDUCTED AT BUILDING AND FACILITY ENTRANCES AND WITHIN BUILDINGS AND FACILITIES, AND INTERNET SITE VISITORS
Personal data processing activities conducted by our Company at building and facility entrances and within the facilities are carried out in accordance with the Constitution, the Law No. 5188 on Private Security Services, the Personal Data Protection Law (PDPL) No. 6698, and other relevant legislation.
For the purpose of ensuring security, our Company engages in personal data processing activities through security camera monitoring in our buildings and facilities, and by tracking guest entry and exit.
By utilizing security cameras and recording guest entries and exits, our Company conducts personal data processing activities.
In this context, our Company acts in accordance with the Constitution, the PDPL, and other relevant legislation.
In this section, explanations regarding our Company's camera monitoring system will be provided, along with information on how personal data, privacy, and fundamental human rights are protected.
As part of its security camera monitoring activities, our Company pursues objectives such as improving the quality of the services provided, ensuring reliability, safeguarding the security of the company, customers, and other individuals, and protecting the interests of customers regarding the services they receive.
The camera monitoring activity conducted by our Company is maintained in compliance with the Law No. 5188 on Private Security Services and relevant legislation.
Our Company acts in compliance with the regulations set forth in the PDPL while conducting security camera monitoring for security purposes.
Our Company engages in security camera monitoring activities for the purpose of ensuring security in its buildings and facilities, for the purposes provided by law, and in compliance with the personal data processing conditions stipulated in the PDPL.
Our Company provides information to the personal data subject in accordance with Article 10 of the PDPL.
In this way, the aim is to prevent any infringement upon the fundamental rights and freedoms of the personal data subject and to ensure transparency and proper notification of the personal data subject.
Regarding camera monitoring activity, our Company publishes this Policy on its website (online policy regulation) and hangs notice signs at the entrances of the areas where monitoring takes place, informing that monitoring is being conducted (on-site disclosure).
In accordance with Article 4 of the PDPL, our Company processes personal data in a manner relevant, limited, and proportionate to the purpose for which they are processed.
The purpose for our Company in conducting video camera monitoring is limited to the objectives listed in this Policy. Accordingly, the monitoring areas, the number of security cameras, and the monitoring schedule are implemented to be sufficient and limited to achieving the security objective. Monitoring does not take place in areas where it could result in an intrusion into an individual's privacy beyond what is necessary for security purposes (e.g., restrooms).
In accordance with Article 12 of the PDPL, our Company takes the necessary technical and administrative measures to ensure the security of personal data obtained through camera monitoring activities. (See Section 2/Heading 2.1)
Detailed information regarding the retention period for personal data obtained by our Company through camera monitoring activities is provided in Article 4.3 of this Policy, titled "Personal Data Retention Periods."
Only a limited number of Le Mabelle employees have access to records saved and stored in a digital environment. External security personnel providing services may view live camera footage. The limited number of persons with access to the records declare, through a confidentiality agreement, that they will maintain the confidentiality of the data they access.
For the purpose of ensuring security and the objectives stated in this Policy, our Company engages in personal data processing activities to track guest entries and exits at Le Mabelle buildings and facilities.
Personal data subjects are informed in this context when obtaining the names and surnames of individuals visiting Le Mabelle buildings as guests, or through texts posted at the Company or otherwise made accessible to guests. Data obtained for the purpose of tracking guest entries and exits are processed solely for this purpose, and the relevant personal data is recorded in a physical data recording system.
- STORAGE OF RECORDS RELATING TO INTERNET ACCESS PROVIDED TO OUR VISITORS AT LE MABELLE BUILDINGS AND FACILITIES
For the purpose of ensuring security and the objectives stated in this Policy, our Company may provide internet access to requesting visitors for the duration of their stay within our Buildings and Facilities. In such cases, log records concerning your internet access are recorded in accordance with the mandatory provisions of Law No. 5651 on Regulation of Publications on the Internet and Suppression of Crimes Committed by Means of Such Publications and the legislation enacted thereunder; these records are processed only when requested by authorized public institutions and organizations, or to fulfill our relevant legal obligation during audit processes carried out within the Company.
In this framework, only a limited number of Le Mabelle employees have access to the obtained log records. Company employees with access to said records access them only to use them in response to requests from authorized public institutions and organizations or during audit processes, and share them only with legally authorized individuals. The limited number of persons with access to the records declare, through a confidentiality agreement, that they will maintain the confidentiality of the data they access.
Our Company may use mandatory cookies for the safe and functional operation of website visits. Non-mandatory cookies for analytical, functional, or advertising/marketing purposes are activated based on preference management and, where necessary, explicit consent in accordance with relevant legislation. Users can change their preferences via the cookie management panel.
The types, purposes, providers, and storage periods of cookies are explained in the current Cookie Policy and preference panel on the website.
As stipulated in Article 138 of the Turkish Penal Code and Article 7 of the PDPL, although processed in accordance with the provisions of the relevant law, personal data shall be deleted, destroyed, or anonymized upon the decision of our Company or upon the request of the personal data subject when the reasons requiring its processing cease to exist.
As stipulated in Article 138 of the Turkish Penal Code and Article 7 of the PDPL, although processed in accordance with the provisions of the relevant law, personal data shall be deleted, destroyed, or anonymized upon the decision of our Company or upon the request of the personal data subject when the reasons requiring its processing cease to exist. In this context, our Company fulfills its relevant obligation using the methods described in this section.
- TECHNIQUES FOR DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
- Techniques for Deletion and Destruction of Personal Data
Although processed in accordance with relevant law provisions, our Company may delete or destroy personal data upon its own decision or the request of the personal data subject when the reasons requiring its processing cease to exist. The deletion or destruction techniques most commonly used by our Company are listed below:
- Physical Destruction
Personal data can also be processed by non-automated means, provided they are part of a data recording system. When deleting/destroying such data, a system of physical destruction is applied so that the personal data cannot be used subsequently.
- Secure Deletion from Software (Secure Deletion Software)
When deleting/destroying data processed by fully or partially automated means and stored in digital environments, methods are used to delete the data from the relevant software in such a way that it cannot be recovered.
- Secure Deletion by a Specialist (Sending to a Specialist for Secure Deletion)
In certain cases, Le Mabelle may contract with a specialist to delete personal data on its behalf. In such cases, personal data is securely deleted/destroyed by a person expert in this field, in such a way that it cannot be recovered.
Anonymization of personal data refers to rendering personal data such that it can in no way be associated with an identified or identifiable natural person, even when matched with other data. When the reasons requiring the processing of personal data processed in accordance with the law cease to exist, our Company may anonymize the personal data.
In accordance with Article 28 of the PDPL, anonymized personal data may be processed for purposes such as research, planning, and statistics. Such processing falls outside the scope of the PDPL, and the explicit consent of the personal data subject will not be sought. Since personal data processed by anonymization will be outside the scope of the PDPL, the rights regulated in Section 10 of the Policy will not be valid for this data.
The anonymization techniques most commonly used by our Company are listed below.
Data masking is a method of anonymizing personal data by removing the primary identifying information of the personal data from the dataset.
|
Example: Transforming a dataset into one where the identification of the personal data subject becomes impossible by removing information such as name, ID number, etc., that enables the identification of the personal data subject. |
With the data aggregation method, many data points are aggregated, and personal data are rendered in such a way that they cannot be associated with any individual.
|
Example: Demonstrating that there are Z number of customers aged X, without showing customers' ages individually. |
With the data derivation method, more general content is created from the content of personal data, and it is ensured that the personal data cannot be associated with any individual.
|
Example: Stating ages instead of birth dates; specifying the region of residence instead of a full address. |
With the data shuffling method, the connection between the values and the individuals is broken by shuffling the values within the personal data set.
|
Example: Modifying the quality of voice recordings so that the voices cannot be associated with the data subject. |
- SECTION 10 – RIGHTS OF PERSONAL DATA SUBJECTS; METHODOLOGY FOR EXERCISING AND EVALUATING THESE RIGHTS
In accordance with Article 10 of the KVK Law, our Company informs the personal data subject of their rights and provides guidance on how to exercise these rights; and in accordance with Article 13 of the KVK Law, our Company operates the necessary channels, internal procedures, and administrative and technical arrangements for the evaluation of personal data subjects' rights and for providing the necessary information to personal data subjects.
Personal data subjects have the following rights:
- To learn whether personal data is being processed,
- To request information if personal data has been processed,
- To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
- To know the third parties to whom personal data is transferred domestically or abroad,
- To request the correction of personal data in case of incomplete or incorrect processing and to request that the transaction made in this context be notified to third parties to whom personal data has been transferred,
- To request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, even though it has been processed in accordance with the KVK Law and other relevant laws, and to request that the transaction made in this context be notified to third parties to whom personal data has been transferred,
- To object to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
- To request the compensation of damages in case of loss due to unlawful processing of personal data.
Since the following situations are excluded from the scope of the KVK Law pursuant to Article 28 of the KVK Law, personal data subjects cannot assert their rights listed in 10.1.1. regarding these matters:
- Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics.
- Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, the privacy of private life, or personal rights, or does not constitute a crime.
- Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security.
- Processing of personal data by judicial or execution authorities regarding investigation, prosecution, trial, or execution proceedings.
Pursuant to Article 28/2 of the KVK Law; in the following situations, personal data subjects cannot assert their other rights listed in 10.1.1., except for the right to request the compensation of damages:
- The processing of personal data is necessary for the prevention of a crime or for a criminal investigation.
- Processing of personal data made public by the personal data subject himself.
- Processing of personal data is necessary for the performance of auditing or regulatory duties and disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations acting as public institutions, based on the authority granted by law.
- Processing of personal data is necessary for the protection of the economic and financial interests of the State regarding budget, tax, and financial matters.
Personal data subjects may submit their requests in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller; to Le Mabelle Tekstil Limited Şirketi, at the address of Kazım Karabekir Mahallesi 2. Kervan Sokak No:91/3 Yıldırım/Bursa, by written application, or via the e-mail address lemabelle.100@gmail.com, provided that it has been previously notified to the Company and is registered in the system, provided that it is suitable for identity verification. Other application methods permitted by legislation may also be used.
The relevant person may make their application personally or through a specially authorized representative.
In applications made through a representative, the document showing the authorization of representation must be submitted.
Personal data subjects will fill out the “Application Form for Data Subjects regarding Applications to be Made to the Data Controller by the Relevant Person (Personal Data Subject) in accordance with the Law on the Protection of Personal Data No. 6698”, which is linked above, in their application to exercise their rights. The method of application to be made in this form is also explained in detail.
In cases where the application is rejected, the answer provided is found to be insufficient, or the application is not answered in due time, pursuant to Article 14 of the KVK Law, the personal data subject may file a complaint with the KVK Board within thirty days from the date of learning the response of our Company, and in any case within sixty days from the date of application.
If the personal data subject submits their request to our Company in accordance with the procedure set forth in the section titled 10.1.3 of this section, our Company will finalize the relevant request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request.
However, if the transaction requires an additional cost, the fee in the tariff determined by the KVK Board will be charged to the applicant by our Company.
Our Company may request information from the relevant person in order to determine whether the person applying is the personal data subject.
Our Company may direct questions to the personal data subject regarding their application in order to clarify the matters contained in the personal data subject's application.
Our Company may reject the application by explaining the reason only in cases permitted by the KVK Law and relevant legislation. The scope and exception provisions in Article 28 of the KVK Law are reserved.
- SECTION 11 – RELATIONSHIP OF THE COMPANY'S PERSONAL DATA PROTECTION AND PROCESSING POLICY WITH OTHER POLICIES
Basic policies have been drafted regarding the protection and processing of personal data to which the principles set forth by the Company in this Policy are related. By establishing a connection between these policies and the basic policies conducted by the Company in other areas, harmonization is also ensured between the processes that the Company operates with different policy principles for similar purposes.
Our Company has established a governance structure to ensure compliance with KVK Law regulations and to ensure the implementation of the Personal Data Protection and Processing Policy.
A “Data Controller Representative” has been appointed by the decision of the Company's senior management to manage this Policy and other policies related and connected to this Policy (See Section 11) within the Company. The duties of the Data Controller Representative are stated below.
- To prepare basic policies regarding the Protection and Processing of Personal Data and to submit them to the senior management for approval in order to put them into effect.
- To decide how the implementation and auditing of policies regarding the Protection and Processing of Personal Data will be carried out and, in this framework, to submit internal company assignments and coordination matters to the senior management for approval.
- To determine the matters that need to be done to ensure compliance with the Personal Data Protection Law and relevant legislation and to submit what needs to be done to the senior management for approval; to oversee their implementation and ensure coordination.
- To increase awareness within the Company and among the institutions with which the Company is in cooperation regarding the Protection and Processing of Personal Data.
- To identify risks that may arise in the Company's personal data processing activities and ensure that necessary precautions are taken; to submit improvement suggestions to the senior management for approval.
- To design and ensure the execution of training on the protection of personal data and the implementation of policies.
- To decide on the applications of personal data subjects at the highest level.
- To coordinate the execution of awareness and training activities to ensure that personal data subjects are informed about personal data processing activities and their legal rights.
- To prepare amendments to the fundamental policies regarding the Protection and Processing of Personal Data and submit them to the approval of senior management for enactment.
- To monitor developments and regulations concerning the Protection of Personal Data; to provide recommendations to senior management regarding the actions that need to be taken within the Company in accordance with these developments and regulations.
- To coordinate relations with the Personal Data Protection Board and Authority.
- To perform other tasks assigned by the Company's senior management regarding the protection of personal data.
|
Explicit Consent |
: |
Consent regarding a specific subject, based on information and declared with free will.
|
|
Anonymization
|
: |
The modification of personal data in such a way that it loses its status as personal data and this situation becomes irreversible. Ex: Rendering personal data unassociable with a natural person through techniques such as masking, aggregation, data disruption, etc.
|
|
Job Applicant |
: |
Natural persons who have applied for a job at our Company by any means or who have made their resumes and related information available for review by our company.
|
|
Employees, Shareholders, and Officials of Institutions We Are in Cooperation With |
: |
Natural persons, including employees, shareholders, and officials of the institutions with which our Company has any business relationship (such as business partners, suppliers, but not limited to these).
|
|
Processing of Personal Data |
: |
Any operation performed on personal data such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of data, whether fully or partially automatic or by non-automatic means provided that it is part of any data filing system.
|
|
Personal Data Subject |
: |
The natural person whose personal data is processed. For example; Customers and employees.
|
|
Personal Data
|
: |
Any information relating to an identified or identifiable natural person. Therefore, the processing of information regarding legal entities is not within the scope of the Law. For example; name-surname, TR ID number, e-mail, address, date of birth, credit card number, etc.
|
|
Customer |
: |
Natural persons who use or have used the products and services offered by our Company, regardless of whether there is any contractual relationship with our Company.
|
|
Special Categories of Personal Data
|
: |
Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data are special categories of data.
|
|
Potential Customer |
: |
Natural persons who have expressed a request or interest in using our products and services or who have been evaluated as potentially having such interest in accordance with commercial practices and the rules of honesty.
|
|
Company Shareholder |
: |
Natural persons who are shareholders of our Company.
|
|
Company Official |
: |
Members of the board of directors and other authorized natural persons of our Company.
|
|
Third Party |
: |
Third-party natural persons who are associated with the aforementioned parties in order to ensure the security of commercial transactions between our Company and said parties or to protect the rights of said persons and provide benefits (e.g., Guarantor, Companion, Family Members, and relatives).
|
|
Data Processor
|
: |
The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller. For example, the cloud computing company that holds our Company's data, surveyors who have customers sign forms, call-center companies making calls within the framework of scripts, etc.
|
|
Data Controller
|
: |
The data controller is the person who determines the purposes and means of processing personal data and manages the place where data is kept systematically (data filing system).
|
|
Visitor |
: |
Natural persons who have entered the physical premises owned by our Company for various purposes or who visit our websites. |
ANNEX-2 PROCESSING OF PERSONAL DATA OF JOB APPLICANTS
|
PERSONAL DATA SUBJECT |
COLLECTION AND PROCESSING OF PERSONAL DATA |
EXERCISE OF RIGHTS AND APPLICATION |
|
Job Applicant |
Personal data of job applicants collected during the recruitment process and special categories of personal data collected according to the nature of the job are processed by our Company for the purposes specified in Sections 4.2 and 7 of the Policy and listed below:
Personal data of job applicants can be collected through the following methods and means:
|
Job applicants may also submit their requests regarding their rights arising from being a data subject to our Company using the method explained in Section 10 of this Policy. |
ANNEX-3 ONLINE MEMBERSHIP AND LE MABELLE STARS PROGRAM CLARIFICATION TEXT
As the data controller, Le Mabelle Tekstil Limited Şirketi processes members' personal data within the scope of establishing an online membership account, account security, order and return transactions, and the execution of the Le Mabelle Stars Program.
Processed data includes identity and contact information, membership and verification records, order and product information, limited records regarding payment transactions, cancellation-return-exchange records, Le Mabelle Stars Point acquisition and usage activities, campaign participation, requests and complaints, and IP, session, and transaction security records.
Data is processed for the purposes of establishing and performing the membership agreement, maintaining accurate point accounts, making returns and offsets, preventing fraud and abuse, responding to customer requests, ensuring information security, and fulfilling legal obligations.
Processing activities are based on the conditions of establishing or performing a contract, legal obligation, establishment-exercise-protection of a right, and legitimate interest, provided that it does not harm fundamental rights, under the second paragraph of Article 5 of the Personal Data Protection Law (KVK Law). Separate explicit consent is obtained where necessary for non-mandatory marketing, personalization, and cookie activities.
Data may be transferred to suppliers providing infrastructure, hosting, e-commerce, point systems, payment, cargo, customer service, security, and IT services only to the extent required by the service; and to authorized public institutions and judicial authorities within the scope of legal obligation. If there is a cross-border transfer, the relevant condition among adequacy decision, appropriate safeguards, or incidental transfer conditions under Article 9 of the KVK Law is applied.
Data is collected through electronic membership and order forms, account activities, call and support channels, cookies, and technical records. It is stored for the periods stipulated in the relevant legislation or for the duration required by the purpose of processing; it is deleted, destroyed, or anonymized at the end of the period.
Relevant persons can exercise their rights under Article 11 of the KVK Law using the application methods explained in Section 10 of the Policy.
ANNEX-4 MARKETING AND COMMERCIAL ELECTRONIC MESSAGE TEXTS
Participation in membership and the Le Mabelle Stars Program is not conditional upon providing explicit consent for personal data processing for marketing purposes or approval for commercial electronic messages. These approvals are obtained separately, with free will, and with non-preselected options; they can be withdrawn at any time.
The fulfillment of the disclosure obligation is not subject to the condition of explicit consent. For every activity requiring explicit consent, the purpose, data category, recipient group, and, if applicable, the mechanism for international transfer are specified separately.