PRIVACY POLICY and KVKK POLICY
As Nizip Commodity Exchange (“Exchange” and/or “Our Exchange”), we would like to inform you that we attach importance to the protection of your Personal Data and that we take precautions and steps in accordance with legal regulations in this field.
Our Stock Exchange takes the necessary measures to protect the personal data of our members, suppliers, visitors, employees and other real persons who establish a relationship with us by applying for a job or visiting our website or in any other way, and we have prepared this Personal Data Protection Policy and Privacy Policy in order to inform you about our Stock Exchange rules and policies regarding the processing of personal data and the use of cookies and similar technologies within the framework of the Personal Data Protection Law No. 6698 ("KVKK Law" ).
We would like to remind you that you will be subject to the privacy policy in this text regarding the confidentiality, protection, processing, use, modification, communications and other matters of our Borsa and the website www.niziptb.org.tr and our members, suppliers, employees, employee candidates, and that you should review this text to ensure that you accept the terms every time you use our website.
Depending on the type and nature of the relationship between Borsa İstanbul, as the data controller, and the data owner, it is possible for Borsa İstanbul to provide different personal data policies and/or notifications to the data owner than this text. In this case, the special policies and notifications provided to the data owner may contain different or additional matters than the explanations in this Policy, and the special policies and notifications provided to the data owner should be taken into consideration first.
SCOPE OF THE POLICY
This Policy; It relates to all personal data of our members, employees, employee candidates, visitors and members whose personal data have been obtained through our Stock Exchange, employees of the institutions we cooperate with and third parties, processed automatically or by non-automatic means provided that they are part of any data recording system .
MEASURES TAKEN TO ENSURE THE LEGAL PROCESSING OF PERSONAL DATA
Our stock exchange takes technical and administrative measures according to technological possibilities and implementation costs to ensure that personal data is processed in accordance with the law.
TECHNICAL MEASURES
The main technical measures taken by Borsa İstanbul to ensure the lawful processing of personal data are listed below:
- Personal data processing activities carried out within our Borsa İstanbul are audited by the established technical systems.
- The technical measures taken are periodically reported to the relevant person in accordance with the internal audit mechanism.
ADMINISTRATIVE MEASURES
Administrative measures taken by our Borsa Istanbul for the legal processing of personal data:
- Our Borsa İstanbul employees, members, suppliers and visitors are informed about the personal data protection law and the lawful processing of personal data.
- All personal data processing activities carried out by our stock exchange; It is carried out in accordance with the personal data inventory and attachments created by analyzing all business units in detail.
- Personal data processing activities carried out by the relevant departments within our Borsa; The obligations to be fulfilled to ensure that these activities comply with the personal data processing conditions required by KVKK are bound to written policies and procedures by our Borsa Istanbul, each business unit has been informed about this issue and the issues that need to be taken into consideration specific to the activity it carries out have been determined.
- Awareness is created to ensure that the legal requirements determined on a business unit basis are met, and the necessary administrative measures are implemented through internal exchange policies, procedures and training to ensure the control of these issues and the continuity of the implementation.
- Records containing information about personal data and data security are included in the service contracts and related documents between our Borsa and employees, and additional protocols are made. Studies have been carried out to raise the necessary awareness for employees on this issue.
LEGAL BASIS AND GENERAL PRINCIPLES
Protection of personal data is regulated in Law No. 6698, Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through These Publications, Law No. 6563 on the Regulation of Electronic Commerce and relevant secondary legislation. In addition, the Turkish Penal Code No. 5237 stipulates some criminal sanctions for the protection of personal data.
In this context, when the Law on the Protection of Personal Data is examined, it is seen that the definition of "personal data" refers to all kinds of information regarding identified or identifiable real persons. In other words, anonymous information, anonymized information and other data that cannot be associated with a specific person are not considered personal data within the scope of this Privacy Policy.
Data processing refers to all kinds of operations that can be performed on personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system.
Borsa İstanbul takes the necessary precautions to protect confidentiality and comply with all legal principles regarding the processing of personal data; processes personal data in accordance with the following principles within the framework of the purposes specified in this Privacy Policy:
- Complying with the law and the rules of honesty,
- Being accurate and up to date when necessary,
- Processing for specific, clear and legitimate purposes,
- Being related to the purpose for which they are processed, being limited and proportionate,
- To be kept for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.
DATA PROCESSED BY OUR EXCHANGE
Our stock exchange may process general and special personal data with the explicit consent of the data owner or without explicit consent in cases stipulated in Articles 5 and 6 of the KVK Law. General and special data processed by our Stock Exchange are exemplified below, but which data will be processed for each data owner; It may vary depending on various factors such as the type of relationship between the data owner and our Stock Exchange (our members, personnel, suppliers, candidate personnel, etc.) and the communication channels used.
The following types of data may be processed by our Stock Exchange, in line with the relevant legislation and the principles contained in this Policy, depending on the type and nature of the relationship between the data owner and our Stock Exchange (for example, having a relationship with our Stock Exchange as a member, employee, business partner, service supplier, etc.):
- Data to identify the data owner, such as name, surname, profession, title, institution/organization information, education history, work history, gender, marital status,
- Data such as date of birth, place of birth, and identification number included in identification documents such as ID, passport, driver's license,
- Contact information such as address, telephone, e-mail and fax number of your home, workplace or temporary residence,
- Communication records such as telephone calls, e-mail correspondence and other audio and video data regarding the products purchased by the data owner,
- Internet protocol (IP) address, device ID, unique identifier information, device type, advertising ID, unique device icon, statistics on web page views, incoming and outgoing traffic information, referral URL, internet log information, location information, information about visited sites and transactions and actions carried out through our websites, platforms, internet network and advertising and e-mail content.
Purposes of Use of Personal Data
Our stock exchange may process personal data for the following purposes and to the extent permitted by the legislation and may retain it for the period required for these purposes.
- Fulfilling legal and administrative obligations and exercising rights arising from current legislation,
- Providing information to public officials on matters related to public security upon request and in accordance with the legislation,
- Negotiation, establishment and execution of contracts concluded/considered to be concluded
- Preparing all records and documents that will be the basis for the transaction in electronic (internet/mobile etc.) or paper environment ,
- Ensuring and improving coordination, cooperation and efficiency within or between units within our Stock Exchange,
- Ensuring the security of the website and other electronic systems and physical environments used by our stock exchange,
- Notifying changes in the legislation or in the rules and policies adopted by our Exchange, or making other notifications concerning the data subject,
- Investigating, detecting and preventing violations of the contract and the law and reporting them to the relevant administrative or judicial authorities,
- Resolving current and future legal disputes,
- Responding to requests and questions,
- Providing employee needs within the framework of Borsa İstanbul's human resources policies and carrying out, developing and improving recruitment processes,
- Evaluating the suitability of job applications, finalizing them and communicating with job applicants,
- Developing and improving our Exchange's human resources, public relations and marketing policies,
- Data processing is mandatory for the establishment, exercise or protection of a right,
- Protection of the legitimate interests of Borsa İstanbul, provided that the fundamental rights and freedoms of the data owner are not harmed.
Protection, Security and Control of Your Personal Data
Within the scope of the relevant legal legislation, Borsa İstanbul takes the necessary technical and administrative measures to ensure the appropriate level of security as the data controller in order to prevent the lawful processing of personal data and unlawful access to data and to ensure the preservation of personal data. In this context, it is ensured that our Stock Exchange's business processes and activities are carried out in accordance with the stock exchange's internal policies and rules prepared for the protection of personal data. Studies are carried out to raise awareness among employees about the personal data protection legislation and the internal exchange policies and rules prepared accordingly, and the necessary declarations and commitments are taken from employees and individuals and institutions that process data on behalf of our Stock Exchange for the confidentiality and protection of data, and non-compliance with these declarations and commitments is subject to certain sanctions. Necessary information security measures are implemented to prevent unauthorized access to personal data, and the adequacy of the measures taken is checked periodically, aiming to continuously improve the existing data security system.
Sharing and Storage Period of Personal Data with Third Parties at home/abroad
Provided that we comply with the general principles listed in Article 4 of the KVK Law and the conditions stipulated in Articles 8 and 9 and take the necessary security measures, we may transfer personal data to third parties in the country and process and store it on servers or other electronic media in the country for the purposes specified under the heading "Purposes of Processing Personal Data" of this Privacy Policy.
In this context, your personal data may be shared with program partner institutions and organizations with which we cooperate in order to carry out our activities, with domestic individuals and institutions whose services we use to store data and from which we receive physical server and/or cloud services, and with institutions from which we receive services for sending commercial electronic messages.
Except for cases where a longer period is required or permitted by law, Borsa İstanbul retains personal data only for the period necessary to achieve the purposes specified in this Privacy Policy. Personal data whose storage period has expired is deleted, destroyed or anonymized by Borsa İstanbul within the framework of Article 7 of the KVK Law.
Rights of the Data Owner Within the Framework of the Personal Data Protection Law
As the data owner, in accordance with Article 11 of the KVK Law:
- Learning whether personal data is being processed or not,
- Request information if your personal data has been processed,
- Learning the purpose of processing personal data and whether they are used for their intended purpose,
- Knowing the third parties to whom personal data are transferred within the country,
- Requesting correction of personal data if it is incomplete or incorrectly processed,
- Request the deletion or destruction of personal data if the reasons requiring its processing no longer exist,
- Requesting correction and deletion procedures to be notified to third parties to whom personal data has been transferred,
- Object to the emergence of an unfavorable result by analyzing the processed data exclusively through automatic systems,
- Requesting compensation for damages in case of damage due to illegal processing of personal data
If, as a data subject, you wish to exercise any of the rights listed above, you should review the Data Subject Rights and Application Form available on our website.
Collection Method and Legal Reason for Personal Data
Your personal data may be obtained in writing, verbally, audio or video recording or other physical or electronic means for the purposes specified in this Privacy Policy within the framework of the conditions set out in Articles 5 and 6 of the KVK Law. Personal data; It can be collected through stores and other physical environments where data owners can contact, website, mobile applications, social media and other public channels, or organized training, conferences and similar events, or through investigation.
Although personal data is generally obtained from data owners, it is also possible to obtain personal data through business partners we work with within the framework of the conditions specified in Articles 5 and 6 of the KVK Law, individuals, institutions and organizations that are referenced in job applications or included in the applicant's work and education history, recruitment platforms, persons and institutions that the data owner represents/represents the data owner.