PAYNA GRUP TURİZM GIDA SANAYİ VE TİCARET ANONİM ŞİRKETİ PERSONAL DATA PROCESSING, PROTECTION AND PRIVACY POLICY

We, Payna Grup Turizm Gıda Sanayi ve Ticaret Anonim Şirketi (the “Company” or “Payna”), attach great importance to protecting the privacy of our customers’ and visitors’ personal data.

The objectives of the Personal Data Processing, Protection and Privacy Policy (the “Policy”) are to inform you of the personal data we collect in accordance with the Personal Data Protection Law No. 6698 (“KVKK”), how and why we collect them, how we process them, to whom we transfer them, how we take the necessary technical and organizational measures to ensure data security, and your rights to your personal data.

1. Definitions

2. What Personal Data Do We Collect? How Do We Collect Personal Data?

Your personal data may be automatically or non-automatically collected by the Company through the website of the Company, our corporate social media accounts, our WhatsApp account, our dealers, our franchise entities, our sales locations, printed forms, telephones, call centers, electronic mails, communications through notarial and/or postal means, customer interviews, interviews during conclusion of an agreement, and processes or methods executed verbally, in writing or electronic environment or physical channels. 

3. Information Provided by You 

When you create your account, you provide your e-mail address, password and phone number, and your order address and billing information when you place order.  

If you contact us to get information on our products, services and/or assistance, we may ask for your e-mail address and contact information. 

1 Automatically Collected Data 

As with most websites and mobile applications, certain data is automatically collected when you visit a website or use a service application. The data collected automatically includes service metadata, log data, device information, last used service, session data, navigation data, IP addresses, third-party data, and cookie information.  

2 Cookie Information 

When you access the Website or mobile application, we collect certain data from your browser using cookies. The cookies used include both first-party and third-party cookies. First-party cookies allow us to collect analytic data, to remember your settings, to find out the last page you visited and the last service you used, and to perform other useful functions that help simplify your user experience. Third-party cookies are used by third parties for advertising, retargeting, analytics, marketing and tracking. 

Cookies vary in nature and purpose. For example, a "session cookie" exists only in the temporary memory of your device, i.e. while you are logged in or visiting a Website, and is typically deleted when your web browser is closed. A “persistent cookie,” on the other hand, has a longer lifespan: it remains on your device until you delete it (that is, instruct your browser to do so) or until it expires. A "secure cookie" can only be transmitted via a "secure" (encrypted) connection, making it more difficult for others to acquire the data. A "first party cookie" indicates that the cookie belongs to us, and a "third party cookie" indicates that the cookie belongs to someone other than Payna.   

We use Google Analytics and Facebook cookies, which are web analytic tools that help us understand how users interact with the Website. Like many services, it uses first-party cookies to track user interactions, such as in our case where Google Analytics and Facebook cookies are used to collect Data about how users use our site. Such Data is used to compile reports and help us improve our Website. The reports describe website trends without identifying individual visitors. You can disable Google Analytics and Facebook cookies without affecting how you visit our Website.

Please note that we do not change our applications in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application, but most browsers allow you to control whether to accept cookies, including how to remove them. You can set most browsers to notify you when you receive a cookie or to completely block or remove cookies.

Third-party cookies can often be managed by tools provided by those parties. Some of these tools include:

https://tools.google.com/dlpage/gaoptout (Google Analytics opt-out); https://yandex.com/support/metrica/general/opt-out.html (Yandex Metrica opt-out); https://www.facebook.com/policies/cookies (Facebook cookie policy and opt-out); http://optout.networkadvertising.org (Network Advertising Initiative opt-out page); http://optout.aboutads.info (Digital Advertising Alliance opt-out page).

To find more information about cookies and how to manage them, visit this link: http://www.allaboutcookies.org.

It will also be helpful for you to read the Cookie Usage Information Policy on our website. 

3 Other Data 

We may collect data provided to us by you from you when you fill out forms (for example, applications or surveys) that are/may be on our website, or when you participate in our campaigns or programs, when you sign up to receive notifications, newsletters or other communications from us, when you request support, when you interact with our social media accounts, or when you contact us or otherwise communicate with us. If you send us an e-mail, letter or message, we may keep a record of such communication, including your name, e-mail address or telephone number (as included in the message/email, if applicable), the contents of your communication and our response. We may supplement this data with other information. 

4. Why and How do we process your personal data? 

We may collect or receive personal data from you in various ways. You provide us with personal data directly when you contact us or when you select cookies. The following table indicates the legitimate purposes we use as a basis when processing your personal data for the different contexts in which we establish communication with you.

The followings are the legal grounds for processing personal data under KVKK:

Consent: If you have freely entered into a specific, informed and express agreement.

Agreement: Because processing is necessary for an agreement you have entered with us or because it is necessary to take certain steps before entering into an agreement.

Legal obligation: If processing is necessary for us to comply with the law.

Vital: If processing is necessary to protect someone's life.

Civil Service: If processing is necessary for us to perform a task in the public interest or for our official functions, or where the function has a clear basis in law.

Legitimate Interest: If processing is necessary for our legitimate business interests or the legitimate interests of a third party and as long as it does not harm the protection of your personal data.

5. Sensitive Personal Data 

As Payna, we do not collect and process sensitive personal data such as racial or ethnic origin, political opinion, religious or philosophical beliefs, union membership, genetic data, biometric data processed solely to identify a person, health-related data, and data regarding a person's sex life or sexual orientation.

6. Transfer of Personal Data 

We may transfer your personal data in accordance with the KVKK and under legal grounds. We shall not sell, trade or otherwise transfer your Personally Identifiable Data to third parties. Your personal data may also be disclosed to third parties other than suppliers if we are under a duty to disclose or transfer your personal data in order to comply with any legal obligation and in other cases, we may only transfer your personal data if we have your consent to do so or if we are permitted by law.

7. Storage and Destruction of Personal Data  

Please review our Personal Data Storage and Destruction Policy for detailed information on the storage and destruction of personal data.

8. Data Security 

This Policy shall only apply to data provided by Tunam during a session and/or by you.

Payna has implemented administrative and technical measures it believes appropriate to protect the confidentiality, integrity and availability of your personal data. Despite our utmost effort, we cannot guarantee that your personal data will be absolutely secure from unauthorized or unlawful processing or accidental loss, alteration or destruction during transfer via the Internet, or while stored on our systems or the systems of our service providers, or otherwise while it is in our custody, or that it will remain truly intact and confidential at all times or shortly after any such incident. Also, please note that we cannot control, and are not responsible for, the actions of other parties to whom you provide (or instruct us to provide) your personal data.

9. Rights in Personal Data Protection under KVKK 

You have rights under the KVVV that we must protect and prioritize through our data applications. These rights include:

Right to information: You have the right to ask what kind of data is processed and why we need to do that.

Right of access: You have the right to request copies of your personal data. We may charge you a fee for this service. 

Right to correct: You have the right to request that we correct any data you believe is inaccurate. You also have the right to request that we complete any information you believe is incomplete.

Right to be forgotten: You have the right to request that we erase your personal data under certain conditions.

Right to restrict processing: You have the right to request that we restrict the processing of your personal data under certain conditions.

Right to data portability: You have the right to request that we transfer the data we collect to another entity or directly to you, under certain conditions.

Right to object: You have the right to object to our processing of your personal data under certain conditions.

Right to avoid automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly affects you.

10. Amendments to the Policy 

We may, from time to time, revise and amend this Policy to reflect changes in our products and services, amendments to applicable laws, regulations or standards, or other changes that may occur in our business. 

We will post the revised Policy (or our new privacy policy, as the case may be) on the same web page on which we post this Policy or on another web page that we may later habitually use to post materials such as the Policy. We may also use other means to notify you of amendments to the Policy. The revised Policy (or new one, as applicable) shall become effective when posted as described, unless the document itself specifies a later time for it to come into effect.

11. Contact 

Please do not hesitate to contact us at any of the following addresses if you have any questions about this Policy or our data processing practice, or if you wish to exercise any of your rights as a “data subject” in relation to personal data we maintain about you.

E-mail: kvkk@paynagrup.com

Address: Şerifali Mahallesi Atabek Sok. Dilim Börek Apt. No: 11 A Ümraniye/İstanbul