Loyal Marine
PERSONAL DATA PROTECTION AND PROCESSING POLICY
This Policy determines the principles that Loyal Marine will adhere to in processing personal data in accordance with Law No. 6698 on the Protection of Personal Data (KVKK) and the regulations stipulated in the related legislation. The Company commits to act in accordance with the procedures and principles specified in this Policy regarding the personal data processed within its own structure.
The purpose of this Policy is to determine the principles and processes related to the processing and protection of personal data by the Company. This Policy covers all activities related to the personal data processed by the Company and applies to these activities. This Policy can be changed by the Company when deemed necessary and required by the KVKK Regulations. In case of any inconsistency between the KVKK Regulations and this Policy, the KVKK Regulations will prevail. The Company may change this Policy when deemed necessary and as required by the KVKK Regulations.
The definitions used in this Policy include the following meanings;
Explicit Consent refers to consent that is freely given, based on being informed about a specific subject.
Anonymization refers to rendering personal data unable to be associated with an identifiable or identified natural person under any circumstances, even when matched with other data.
Information Obligation refers to the obligation of the data controller or the person authorized by them to inform the data subject at the time of obtaining personal data, as stipulated in Article 10 of the KVKK.
Personal Data refers to any information relating to an identified or identifiable natural person (within the scope of this Policy, the term Personal Data will also include Special Categories of Personal Data defined below).
Processing of Personal Data refers to any operation which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Board refers to the Personal Data Protection Board.
Authority refers to the Personal Data Protection Authority.
KVKK refers to Law No. 6698 on the Protection of Personal Data.
KVKK Regulations refers to Law No. 6698 on the Protection of Personal Data and other related legislation on the protection of personal data, binding decisions, principle decisions, provisions, instructions issued by regulatory and supervisory authorities, courts and other official bodies, as well as applicable international agreements and all other relevant legislation.
Special Categories of Personal Data refers to data concerning a person's race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or trade-unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Data Processor refers to the natural or legal person who processes Personal Data on behalf of the Data Controller, upon authorization by the Data Controller.
Data Subject refers to all natural persons whose Personal Data is processed by the Company or on behalf of the Company.
Data Controller refers to the natural or legal person who determines the purposes and means of the processing of Personal Data, and who is responsible for establishing and managing the data recording system.
- PRINCIPLES TO BE APPLIED IN THE PROCESSING OF PERSONAL DATA
- Processing of Personal Data in Compliance with Law and Integrity
The Company will process personal data in accordance with the law and the principles of integrity and proportionality, processing only as much personal data as is necessary for the purposes of data processing.
- Taking Necessary Measures to Ensure Personal Data is Accurate and Updated When Necessary
The Company will ensure that the personal data it processes is accurate and up-to-date, and will take the necessary measures in this regard. If the data subject requests changes to their personal data under the KVKK Regulations, the relevant personal data will be updated.
- Processing Personal Data for Specified, Explicit, and Legitimate Purposes
The Company will process personal data for specific, explicit, and lawful reasons. The Company will determine the purposes for which personal data will be processed and will inform the data subject of these purposes before processing the personal data. In this context, the data subject will be informed under the KVKK Regulations, and explicit consent will be obtained where necessary.
- Ensuring Personal Data is Relevant, Limited, and Proportionate to the Purposes for Which They are Processed
The Company will process personal data in a manner suitable for achieving the specified purposes and will avoid processing data that is not necessary or relevant to these purposes.
- Maintaining Personal Data for the Period Prescribed by Law or Necessary for the Purposes for Which They are Processed
The Company will retain personal data only for the periods prescribed by law or as necessary for the purposes for which they are processed. If the Company wishes to retain Personal Data for a period longer than required by the KVKK Regulations or the purpose of data processing, the Company will comply with the obligations specified in the KVKK Regulations.
- CONDITIONS FOR PROCESSING PERSONAL DATA
Personal data will be processed following the provision of information and obtaining explicit consent from data subjects. In this context, data subjects will be informed of their rights before obtaining explicit consent. Explicit consent will be obtained in methods compliant with the KVKK Regulations and will be maintained for the necessary period accordingly.
- Processing Personal Data Without Explicit Consent
In cases where the processing of personal data without explicit consent is foreseen under the KVKK Regulations, the Company may process personal data within the limits set by the KVKK Regulations without obtaining explicit consent from the data subject. In this context:
- If explicitly stipulated by law,
- If it is necessary to protect the life or physical integrity of the data subject who is physically incapable of giving consent or whose consent is not legally recognized,
- If it is necessary for the performance of a contract to which the data subject is a party,
- If processing is necessary for the Company to fulfill a legal obligation,
- If the personal data has been made public by the data subject,
- If processing is necessary for the establishment, exercise, or defense of legal claims,
- If processing is necessary for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject,
Personal data may be processed by the Company without explicit consent.
- Processing of Special Categories of Personal Data
Special categories of personal data may only be processed with the explicit consent of the data subject or, in cases other than personal health and sexual life data, if explicitly required by law. Health and sexual life data may be processed without explicit consent for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and financing. Special categories of personal data will be processed with necessary administrative and technical measures determined by the Company.
- OBLIGATION TO INFORM THE DATA SUBJECT
The Company will inform data subjects about how their personal data will be processed at the time of acquisition. The minimum requirements to be included in the information are as follows:
- The identity of the Company and, if applicable, its representative as the data controller
- The purposes for which personal data will be processed
- To whom and for what purposes the personal data may be transferred
- The legal basis for collecting personal data
- The rights of the data subject
- The obligation of the Company to respond to applications from the data subject
- RIGHTS OF THE DATA SUBJECT
The rights of the data subject are as follows:
(1) To learn whether personal data concerning them is being processed,
(2) To request information if their personal data has been processed,
(3) To learn the purposes of the processing of personal data and whether they are used for intended purposes,
(4) To know the third parties to whom personal data is transferred domestically or internationally,
(5) To request the rectification of incomplete or inaccurate data and to have the corrected data notified to third parties to whom personal data have been transferred,
(6) To request the deletion or destruction of personal data in case the reasons necessitating their processing cease to exist, despite being processed in accordance with the provisions of the law and other relevant laws, and to have the operation carried out in this context notified to third parties to whom personal data have been transferred,
(7) To object to adverse results arising from the analysis of processed data solely through automated systems,
(8) To request compensation for damages arising from the unlawful processing of personal data.
Data subjects can send their requests related to their rights listed above to the email address given below, which may change from time to time, to the Company's KEP address, or to the postal address specified below, which may also change from time to time, using the methods determined by the Board.
- Data Controller: Loyal Marine
- Email: info@loyalmarine.net
- Postal: Esentepe Mah. İnönü Cad. Kartalkule No:147, K:11, D:108 Kartal - Istanbul
If the data subject properly submits their request to our Company, our Company will finalize the request free of charge as soon as possible and within a maximum of 30 (thirty) days depending on the nature of the request.
However, if the transaction requires an additional cost, a fee may be charged according to the tariff determined by the Board.
- PURPOSES OF PROCESSING PERSONAL DATA
The Company processes personal data within the purposes and conditions limited to those specified in Article 5.2 and Article 6.3 of the KVKK and listed in Article 4 of our policy.
In this context, the Company processes your personal data for the following purposes:
- Execution of Information Security Processes
- Conducting Activities in Compliance with Legislation
- Execution of Finance and Accounting Affairs
- Ensuring Physical Space Security
- Tracking and Conducting Legal Affairs
- Conducting / Auditing Business Activities
- Conducting Logistics Activities
- Conducting Goods / Services Procurement Processes
- Conducting Goods / Services Sales Processes
- Conducting Goods / Services Production and Operation Processes
- Management of Customer Relations Processes
- Conducting Activities Aimed at Customer Satisfaction
- Conducting Marketing Analysis Studies
- Conducting Advertising / Campaign / Promotion Processes
- Conducting Contract Processes
- Ensuring the Security of Movable Property and Resources
- Conducting Marketing Processes of Products / Services
- Ensuring the Security of Data Controller Operations
- Providing Information to Authorized Persons, Institutions, and Organizations
- Conducting Management Activities
If the processing activity carried out for the purposes mentioned above does not meet one of the conditions prescribed under the KVKK, the Company will obtain the explicit consent of the personal data owner for the relevant processing activity.
- TRANSFER OF PERSONAL DATA
The Company may transfer personal data to real or legal persons located domestically and/or abroad in accordance with the regulations stipulated by the Law and this Policy, for the purposes of processing personal data.
Personal Data may be transferred to third parties located in Turkey or abroad, with the explicit consent of the data subject or without explicit consent in exceptional cases determined in Article 5.2 and Article 6.3. The Company will ensure that this transfer complies with the KVKK regulations.
In cases where personal data is transferred without explicit consent, one of the following conditions must exist for the foreign country to which the transfer is made:
- The foreign country to which the transfer is made has been determined by the Board to have adequate protection
- If the foreign country to which the transfer is made does not have adequate protection, the Company and the data controller in the relevant foreign country must provide a written commitment that adequate protection will be ensured, and the approval of the Board must be obtained for this commitment.
- Transfer of Special Categories of Personal Data
Special Categories of Personal Data may be transferred by the Company in accordance with the principles specified in this Policy and including the methods determined by the Board, under the following conditions:
- Special categories of personal data other than health and sexual life may be processed without the explicit consent of the data owner if explicitly stipulated by law, i.e., if there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained.
- Personal data related to health and sexual life may be processed without explicit consent for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and financing, by persons or authorized institutions and organizations under confidentiality obligations. Otherwise, the explicit consent of the data owner will be obtained.
In addition to the above, personal data may be transferred to foreign countries with adequate protection or, in cases where there is no adequate protection, to foreign countries where the data controller has committed to ensuring adequate protection, under the conditions specified in the legislation.
The Company may transfer the personal data of data subjects managed under this Policy to the following categories of persons in accordance with Articles 8 and 9 of the KVKK:
(i) Company business partners,
(ii) Company suppliers,
(iii) Real Persons and Private Law Legal Entities,
(iv) Legally authorized public institutions and organizations,
(v) Legally authorized private law persons
- DATA SECURITY AND MANAGEMENT
The Company will take necessary legal, technical, and administrative measures regarding data security and will show the highest level of care and attention in this regard. The Company will take technical and administrative measures according to technological possibilities and implementation costs to ensure the lawful processing of personal data. Employees will be informed that they cannot disclose personal data they learn to others in violation of the provisions of the KVKK and cannot use it for purposes other than processing, and this obligation will continue even after they leave their job.
The Company will take technical and administrative measures according to the nature of the data to be protected, technological possibilities, and implementation costs to prevent the unauthorized or accidental disclosure, access, transfer, or other illegal access to personal data.
The Company will increase awareness among institutions such as business partners and suppliers who process data on behalf of the Company regarding the prevention of unlawful processing of personal data, prevention of unlawful access to data, and ensuring the lawful preservation of data; and will take necessary measures to ensure that business partners and suppliers engage in personal data processing activities in compliance with the KVKK.
- STORAGE AND DESTRUCTION OF PERSONAL DATA
The Company will retain personal data for the period necessary for the purposes for which they are processed and in accordance with the minimum periods specified in the relevant legal legislation related to the activity conducted. If a period for the retention of personal data is specified in the relevant legislation, this period will be complied with. If no legal period is specified, personal data will be retained for the period necessary for the purposes for which they are processed. At the end of the specified retention periods, personal data will be destroyed using the destruction methods determined by the Company, either periodically or in response to a request from the data subject.
- CHANGES TO THE POLICY AND EFFECTIVE DATE
The provisions contained in this Policy may be changed by the Company as deemed necessary and in accordance with the KVKK Regulations, and such changes will be published on the internet sites. Any changes to these provisions will take effect on the date of publication.
This Policy was published and came into effect on 27.12.2024.
Loyal Marine
