Data Subject Request (GDPR)

To exercise your rights under Article 11 of Law No. 6698 on the Protection of Personal Data, you can submit your application with the information below, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. You may write the application in your own words using the headings on this page; a separate form template is not required.

What the application must include

Name, surname and — if the application is in writing — a signature
Turkish ID number (for foreign nationals: nationality, passport number or identity number)
Place of residence or business address for service of notice
Email address, telephone or fax number for correspondence
A clear statement of the subject of the request
Any information and documents supporting the request

If any of this information is missing, we may be unable to assess your application and may ask you to complete it.

How to apply

Email: to info@innthebox.com, from the email address you have previously given us and that is registered in our systems
Post: by signed letter to Müeyyetzade Mah. Kemeraltı Cad. No: 24 İç Kapı No: 7, 34425 Beyoğlu, İstanbul, Türkiye (writing "Information Request under the Personal Data Protection Law" on the envelope will speed up your application)
In person: delivered to the address above together with a document verifying your identity
Through a notary, by way of formal notice

Applications made by the other methods prescribed by legislation (secure electronic signature or mobile signature) are also accepted.

What you can request

Under Article 11 of the Law:

To learn whether your personal data is being processed
To request information about it if it has been processed
To learn the purpose of processing and whether the data is used in line with that purpose
To know the third parties in Türkiye or abroad to whom the data is transferred
To request the correction of incomplete or incorrectly processed data
To request its erasure or destruction within the conditions set out in the law
To request that correction, erasure and destruction be notified to the third parties the data was transferred to
To object to a result against you arising from analysis carried out exclusively by automated systems
To claim compensation for damage suffered as a result of unlawful processing

Identity verification and applying on behalf of someone else

For the security of personal data we verify the identity of the applicant; where necessary we may request additional information or documents. If you are applying on behalf of someone else, a notarised power of attorney drawn up specifically for this matter, or a document evidencing your authority, must be attached to the application.

Response time and fees

Your application will be concluded free of charge as soon as possible and in any event within thirty days at the latest, depending on the nature of the request. Where the process incurs an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. The response is sent to you through the contact channel you specify in your application.

If your application is not resolved

If your application is rejected, if you find the response insufficient, or if no response is given within the applicable period, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of your application.

Let's discover the right solution for your needs together

About us