The Personal Data Protection Law No. 6698 (“Law”) entered into force on April 7, 2016; This Privacy and Personal Data Protection Policy (“Policy”) is carried out to ensure Innthebox Yazılım Pazarlama A.Ş. ( “InntheBox” or “Company”) compliance with the Law and to determine the principles to be followed by the Company in the fulfillment of obligations related to the protection and processing of personal data. The policy determines the terms of processing of personal data and sets out the main principles adopted by the Company in the processing of personal data. In this context, the Policy covers all personal data processing activities under the Law by the Company, the data subjects of all personal data processed by the Company and all personal data processed.
1.2 Enforcement and Amendment
The policy was published by the Company on its website and presented to the public. In case of conflict with the legislation in force, especially the Law, and the regulations in this Policy, the provisions of the legislation shall apply.
The Company reserves the right to make amendments to the Policy in line with the legal regulations.
2.1. Data Subjects
Data subjects within the scope of the Policy are all real persons except employees of the Company whose personal data is processed by the Company.
In this context, the categories of data subjects in general are as follows:
2.2. Purposes of the Personal Data Processing
Your personal data and special category of personal data can be processed by the Company for the following purposes in accordance with the personal data processing conditions under the Law and the relevant legislation:
1. Planning and execution of after-sales support services activities,
2. Planning and execution of customer relationship management processes,
3. Tracking customer demands and complaints
4. Planning and execution of sales processes of products and services
1. Planning and execution of corporate communication activities,
2. Planning and execution of supply chain management processes,
3. Planning and execution of authority to information access of business partners and suppliers
4. Tracking finance and accounting
5. Planning and execution of logistics activities
Planning and Execution of the Company’s Human Resources Policies and Processes
1. Planning of human resources processes
2. Fulfillment of contractual and regulatory obligations for employees of the Company
3. Wage management
4. Planning and execution of personnel exit procedures
5. Execution of personnel procurement processes
6. Monitoring and supervision of employees’ business activities
7. Planning and execution of in-house training activities
8. Planning and execution of side benefits and interests for employees
9. Planning and execution of in-house appointment-promotion and dismissal processes
Ensuring the legal, technical and commercial-business safety of the Company and the data subjects involved in the business relationship with the Company
1. Ensuring the safety of Company premises and facilities
Ensuring the safety of Company operations
Ensuring the safety of Company fixtures and resources
1. Planning and execution of production and operation processes,
2. Planning and execution of customer satisfaction activities
3. Planning and execution of the processes of establishing and increasing the commitment to the products and services offered by the Company
2.3 Personal Data Categories
Your personal data, which is categorized below by the Company, is processed in accordance with the personal data processing conditions under the Law and related legislation:
3.1 Principles for the Processing of Personal Data
Your personal data is processed by the Company in accordance with the personal data processing principles under Article 4 of the Law. These principles must be followed for each personal data processing activity:
3.2 Terms for the Processing of Personal Data
Your personal data is processed by the Company in the presence of at least one of the personal data processing terms set forth under Article 5 of the Law. Explanations of these terms are as follows:
3.3 Conditions for the Processing of Special Category of Personal Data
As per Article 6 of the Law, special category of personal data are specified in a limited number. These are, people’s race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures and biometric and genetic data.
The Company may process special category of personal data by taking additional measures determined by the Personal Data Protection Board in the following situations.:
In accordance with the additional regulations set forth in Articles 8 and 9 of the Law and determined by the Personal Data Protection Board; in case of conditions for the transfer of personal data, it can transfer personal data domestically or abroad.
In the event that the country to which the transfer will be made is not among the safe countries to be announced by the Personal Data Protection Board, upon the written undertaking of sufficient protection by the Company and the data controller in the relevant country, with the permission of Personal Data Board to this processing and in the presence of at least one of the data processing conditions (see Title 3. Policy.) stipulated under Article 5 and Article of the Law, personal data can be transferred to third parties abroad.
Within the scope of the general principles of the Law and the data processing requirements in Article 8 and 9, the Company is able to transfer data to the parties categorized in the following table:
According to Article 10 of the Law, data subjects must be enlightened about the processing of personal data before the processing of personal data or at the time of processing of personal data at the latest. In accordance with the relevant article, the necessary internal structure has been established in order to enlighten the data subjects in every situation where the personal data processing activity is carried out by the Company as the data controller. In this context;
Please submit your applications regarding your rights listed above to our Company via the address [email@example.com]. Depending on the nature of your request, your applications will be finalized free of charge as soon as possible and within thirty days at the latest; however, if the process requires an additional cost, you may be charged according to the tariff to be determined by the Personal Data Protection Board.
Altunizade, Sarkuysan Plaza, Altunizade Mah, Kısıklı Cad. No.4, 34662 Üsküdar