Legal Notice

KVKK Clarification Text
CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA PURSUANT TO THE TURKISH PERSONAL DATA PROTECTION LAW NO. 6698

Dear visitor,
The purpose of this clarification text regarding the Protection and Processing of Personal Data is to inform the data subject within the scope of fulfilling the obligation to inform pursuant to Article 10 of the Law, regarding the fact that necessary administrative and technical measures are taken, audits are conducted or had conducted to ensure the highest required security level to protect the personal data of the data subject in accordance with the published and/or to be published legislation in the capacity of data controller, in order to prevent the unlawful disclosure, unlawful access, transfer or any data security breach that may occur in any way regarding all types of personal data belonging to all natural persons associated with our firm, including individuals who benefit or contact our firm to benefit from our products and services, our employees, employee candidates, and business partners, in accordance with the relevant laws and regulations and Article 12 of the Law.

1. Data Controller
In accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller regarding the processing of your personal data is "BRIDAYSTORE - NEŞE KARAKAŞ", registered at the Başakşehir Tax Office, located at "Başakşehir Mahallesi, Süleyman Çelebi Caddesi, No:17E, Başakşehir, İstanbul".

In our capacity as data controller; we declare that your personal data directly and/or indirectly shared with us, as requested through visiting our firm and/or our website or through being called by our call centre or calling our call centre, in a manner connected, limited, and proportionate to the purpose of processing, within the framework of the purpose requiring their processing; may be recorded, stored, preserved, reorganised, shared with institutions legally authorised to request such personal data, transferred to domestic or international third parties under the cases and conditions stipulated by the Law, assigned, classified, erased upon request of the data subject, and processed in the forms listed in the Law.

2. Personal Data to be Processed
Your personal data to be processed by the data controller means your data defined in KVKK as "any information relating to an identified or identifiable natural person". Special categories of personal data within the scope of the same Law refer to "data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric and genetic data".

Our firm may obtain, classify, record, and preserve personal data or special categories of personal data fully or partially with the consent of customers/employees/visitors according to the purpose of obtaining personal data or for the duration stipulated by the provisions of the relevant law.

In this regard, your personal data categories and their contents processed, including but not limited to those below, are as follows:

Identity data
Name, Surname, Turkish Republic identity number, foreign identity number or passport number.

Contact data
Telephone number, e-mail address, password, residence address.

Financial data
Your bank account number, IBAN number, credit card information and other billing details.

Visual and audio records
Photos taken with products subject to the service and messages you send to us.

Physical space security
Camera recordings.

3. Purpose of Processing Personal Data
Your personal data and, in case of explicit consent, your special categories of personal data are processed by the data controller in line with the purposes and legal grounds specified below, including but not limited to similar purposes and grounds when required, within the personal data processing conditions specified in Articles 5 and 6 of KVKK, and limited to the purposes and conditions suitable with the principles and periods specified in our Firm's VERBİS registration.

In this scope, the purposes of processing your personal data may be listed as follows:

Fulfilling our legal obligations,
Confirming your identity required by the service provided by our firm,
Planning and managing internal operations and daily operations of our firm,
Measuring, increasing, and researching customer satisfaction,
Procurement of required products,
Notifying you about the appointment in case you make an appointment,
Participation in campaigns and providing campaign information by our firm,
Designing and delivering custom content, tangible and intangible benefits on web and mobile channels,
Execution of Business and Human Resources Processes,
Execution of Customer Relations and Corporate Communication Processes,
Managing Shares to be Made on Social Media Accounts and Corporate Website,
Execution of Advertising and Promotional Activities and Preparation of Promotional Catalogues,
Issuing invoices.
4. Method and Legal Ground of Personal Data Collection
Your personal data may be collected verbally, in writing or electronically including GSM technologies via various methods based on Information Technologies, through call centre, website, social media channels and similar means.

Furthermore, in line with the purposes of processing personal data, personal data are processed in accordance with the general principles and periods specified in the Law and our company's KVKK Policy, primarily the principles specified in Article 4 of the Law, based on and limited to at least one of the personal data processing conditions regulated in Articles 5 and 6 of the Law.

Mandatory Principles in the Processing of Personal Data
• Processing in Accordance with Law and Rules of Good Faith
• Ensuring Personal Data are Accurate and Up to Date When Necessary
• Processing for Specific, Explicit and Legitimate Purposes
• Being Relevant, Limited and Proportionate to the Purpose for Which They are Processed
• Preserving for the Period Stipulated in Relevant Legislation or Necessary for the Purpose for Which They are Processed

Conditions for Processing Personal Data
According to Article 5 of the Law, personal data cannot be processed without the explicit consent of the data subject. Explicit Consent of the Personal Data Subject must relate to a specific matter and be declared with free will based on information. In the presence of one of the following conditions, personal data may be processed without seeking the explicit consent of the data subject.

a. Explicitly Stipulated in Laws
b. Inability to Obtain Explicit Consent of the Data Subject Due to Actual Impossibility
c. Being Directly Related to the Establishment or Execution of a Contract
d. Data Controller Fulfilling Its Legal Obligation
e. Data Having Been Made Public by the Data Subject Themselves
f. Data Processing Being Mandatory for the Establishment or Protection of a Right
g. Data Processing Being Mandatory for the Legitimate Interests of the Data Controller

Processing Special Categories of Personal Data
In Article 6 of the Law, data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric and genetic data are defined as special categories of personal data, and it is also stipulated that processing of special categories of personal data without the explicit consent of the data subject is prohibited. Accordingly; Special categories of personal data are processed by the data controller in accordance with the principles specified in this Clarification Text, by taking all necessary administrative and technical measures including the procedures and principles to be determined by the Personal Data Protection Board, in the presence of the following conditions:

a. Special categories of personal data other than health and sexual life: may be processed without seeking the explicit consent of the data subject in cases explicitly stipulated in laws. In all other cases and conditions, explicit consent of the data subject shall be obtained to process such special categories of personal data.

b. Special categories of personal data relating to health and sexual life: may only be processed without seeking the explicit consent of the data subject by persons under non-disclosure obligation or authorised institutions and organisations for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

Your personal data listed among special categories of personal data other than health and sexual life may only be transferred to the real or legal persons listed above without seeking your explicit consent in cases stipulated by laws.

Your personal data relating to health and sexual life, on the other hand, may be transferred to the real or legal persons listed above without seeking your explicit consent only for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, as well as fulfilling our legal obligations under the Basic Law on Health Services No. 3359, the Regulation on Personal Health Data dated 21.06.2019, and other relevant legislation alongside the Turkish Personal Data Protection Law No. 6698. Electronic Medical Records and Electronic Health Records are also within this scope.

In all other cases and conditions, explicit consent of the data subject shall be obtained to process such special categories of personal data. In the processing of special categories of personal data, it is mandatory to take adequate measures determined by the Personal Data Protection Board.

Erasure, Destruction or Anonymisation of Personal Data
According to Article 7 of the Law, although processed in accordance with the provisions of this Law and other relevant laws, in the event that the reasons requiring their processing cease to exist, personal data shall be erased, destroyed or anonymised by the data controller ex officio or upon the request of the data subject. In this context, our Firm preserves personal data only for the period specified in the relevant legislation or mandatory and necessary for the purpose for which they were processed. In the event of the expiration of the period or the disappearance of the reasons requiring processing, personal data will be destroyed in accordance with periodic destruction periods or destruction methods (erasure and/or destruction and/or anonymisation) determined in accordance with the application of the personal data subject, if any. Personal data processing activities are conducted in accordance with the general principles specified in Article 4 of Law No. 6698.

5. Transfer of Personal Data
Regarding the transfer of personal data, provisions parallel to the regulations on Processing of Personal Data are stipulated in the Law. According to Article 8 of the Law:

Personal data cannot be transferred without the explicit consent of the data subject. Even without the explicit consent of the personal data subject, in the presence of one or more of the conditions specified below, personal data may be transferred to third parties by our Firm by showing necessary care and taking all necessary security measures through methods stipulated by the Personal Data Protection Board. The relevant activities regarding the transfer of personal data being explicitly stipulated in laws,

• Transfer of personal data by our Firm being directly related to and necessary for the establishment or performance of a contract,
• Transfer of personal data being mandatory for our Firm to fulfil its legal obligation,
• Provided that personal data have been made public by the data subject, transfer by our Firm limited to the purpose of making public,
• Transfer of personal data by our Firm being mandatory for the establishment, exercise or protection of the rights of our Firm, the data subject or third parties,
• Conduct of personal data transfer activity being mandatory for the legitimate interests of our Firm, provided that it does not harm the fundamental rights and freedoms of the data subject,
• Being mandatory to protect the life or physical integrity of the person or another person where the person is unable to express consent due to actual impossibility or whose consent is not granted legal validity.

According to Article 9 of the Law; Personal data cannot be transferred abroad without the explicit consent of the data subject.

6. Rights of the Personal Data Subject
Within the scope of KVKK Article 11, as a personal data subject, you have the right to;
• Learn whether your personal data are processed or not,
• Request information if your personal data have been processed,
• Learn the purpose of processing your personal data and whether they are used appropriately for their purpose,
• Know the third parties to whom your personal data are transferred domestically or abroad,
• Request correction of your personal data if they are incompletely or incorrectly processed and request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
• Request erasure or destruction of your personal data in the event that reasons requiring processing cease to exist although processed in accordance with the provisions of Law No. 6698 and other relevant laws, and request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
• Object to the occurrence of a result against you by analysing the processed data exclusively through automated systems,
• Request compensation for damages in case you suffer damage due to unlawful processing of your personal data.

Pursuant to paragraph 1 of Article 13 of KVKK, as personal data subjects, you may convey your requests regarding your rights to our Firm in writing or through other methods determined by the Personal Data Protection Board. You can access the application information text and application form explaining the channels and procedures through which you will submit your application at the bridaystore.com web address, or request them from us.

In case the personal data subject conveys their request regarding rights to us duly, the relevant request will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest according to the nature of the request. However, if the transaction requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. In cases where the application is rejected, the answer given is found insufficient or the application is not answered in due time; you may lodge a complaint with the Personal Data Protection Board within thirty days from the date you learn about our response and in any case within sixty days from the application date.

For our visitors who are European Union citizens and citizens of other foreign countries, information and clarification can be made upon request via the English translation of the text or with the help of an interpreter.

This Clarification Text on the Processing of Personal Data, prepared in accordance with the provisions of Law No. 6698 and other relevant legislation current as of the date of publication, is presented for your information.

Sincerely.
Data Controller: BRIDAYSTORE - NEŞE KARAKAŞ
Address: Başakşehir Mahallesi, Süleyman Çelebi Caddesi, No:17E, Başakşehir, İstanbul

Corporate e-mail: [email protected]