Kızılay Kaynak Suları A.Ş.
Privacy Policy and Disclosure Statement on the Protection of Personal Data
Website: https://www.kizilaysu.com.tr
Phone Number: 444 9 557
E-Mail Address: info@kizilaysu.com.tr
Address: Küçükbakkalköy Mahallesi Rüstemağa Sokak No:2/A, 34750 Ataşehir - İstanbul
General Principles of Data Protection
We process your data by the general principles of data protection law. These principles are as follows:
- Processing of personal data in a transparent, lawful, and fair manner,
- Processing of personal data for specific, explicit, and legitimate purposes,
- Processing of personal data only for the purposes stated,
- Ensuring that personal data is accurate and kept up to date,
- Storing personal data for no longer than necessary in connection with the purpose of processing,
- Storing personal data securely.
What Type of Data Do We Collect?
Within the scope of our activities, Gürpınar Su A.Ş. (“Company”) processes your data in compliance with the general principles set forth under Article 4 of the Law on the Protection of Personal Data (“KVKK”). The personal data we process includes:
- Identity information (Name, surname, trade name for sole proprietorships, signature/signature circular, Turkish Republic identity number, passport details, gender, date of birth),
- Contact information (Phone number, e-mail address, business address, residential address),
- Professional experience information (Position/title, role, department, employer, CV, education details),
- Financial information (Bank account/IBAN details, amounts, invoice details, debt/enforcement information),
- Marketing information (Marketing data, cookie records),
- Legal transaction information (Information contained in correspondence with judicial authorities, personal data in litigation/enforcement files),
- Customer transaction information (Invoices, cheques, promissory notes, payment details, order information),
- Request and complaint information.
How Do We Collect This Data?
We may obtain the personal data we process through the following means:
- Via the website https://www.kizilaysu.com.tr and forms available on the website (automatic means),
- Through litigation/enforcement files and notifications (non-automatic or semi-automatic means),
- Through documents you provide to us (non-automatic means),
- From relevant public institutions and organizations (non-automatic or semi-automatic means),
- Via e-mail (semi-automatic means),
- Verbally (non-automatic means),
- Through physically delivered documents (non-automatic means),
- Through applications (semi-automatic and non-automatic means),
- Via contracts (non-automatic means),
- Via social media (semi-automatic means).
Why Do We Process This Data and On What Legal Basis?
The legal bases for processing personal data under the KVKK are as follows:
- Explicit consent of the data subject (Art. 5/1, Art. 6/3-a),
- Explicit provision in laws (Art. 5/2-a, Art. 6/3-b),
- Necessity for the protection of life or physical integrity of the person or another where the data subject is unable to give consent (Art. 5/2-b),
- Necessity of processing personal data directly related to the conclusion or performance of a contract to which the data subject is a party (Art. 5/2-c),
- Necessity for the data controller to fulfill its legal obligations (Art. 5/2-ç),
- Data made public by the data subject (Art. 5/2-d, Art. 6/3-ç),
- Necessity for the establishment, exercise, or protection of a right (Art. 5/2-e, Art. 6/3-d),
- Necessity for the legitimate interests of the data controller provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f).
We process the following data for the purposes indicated above:
- Identity information,
- Contact information,
- Professional experience information,
- Financial information,
- Marketing information,
- Legal transaction information,
- Customer transaction information,
- Request/complaint information.
With Whom Do We Share the Data?
We may share the personal data we process with:
- Courts and competent public institutions and organizations to follow legal and judicial processes,
- Competent public institutions and organizations in order to fulfill our legal obligations,
- Domestic banks for the execution of payment processes,
- Relevant suppliers for the execution and auditing of business activities,
- Relevant private or legal persons for necessary correspondence and communication activities.
We do not share your data with unrelated or unauthorized third parties other than those specified above.
Retention and Destruction of Personal Data
As a Company, we process and retain your data by the general principles, in connection with and limited to the purpose of processing. We take all necessary technical and administrative measures for the security of retained personal data and ensure that third parties to whom we transfer your data also comply with these measures.
We store your data by considering the purpose and reason for processing, the periods required by applicable legislation, and our legal obligations. If we no longer need your data according to these criteria and have no legal obligation to retain it, we will destroy your data.
What Are Your Rights Under the KVKK?
By applying to us, data subjects have the right to:
- Learn whether their data has been processed,
- Request information if their data has been processed,
- Learn the purpose of processing and whether personal data has been used for such purpose,
- Know the third parties to whom personal data has been transferred, domestically or abroad,
- Request correction of personal data if it is incomplete or inaccurate, and request notification of the correction to third parties to whom data has been transferred,
- Request deletion or destruction of personal data if the reasons requiring its processing no longer exist, and request notification of such to third parties to whom data has been transferred,
- Object to the occurrence of any result against the data subject arising from the analysis of personal data exclusively through automated systems,
- The data subject has the right to request compensation for damages in case of unlawful processing of personal data.
You may submit your requests regarding your rights by the Communiqué on the Principles and Procedures of Application to the Data Controller. Your requests will be evaluated free of charge and finalized as soon as possible and, in any case, within thirty (30) days at the latest. If the evaluation and decision-making process requires an additional cost, fees shall be charged by the tariff determined by the Personal Data Protection Board. You may also contact us if you wish to obtain more detailed information regarding your data processing procedures.
