FAQ

HASHTAG TEXTILE TRADE LTD STI

POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

1. INTRODUCTION

Protection of personal data is among the most important priorities of Hashtag Tekstil Ticaret Limited Şirketi (“Hashtag Kids” or “Company”). Hashtag Kids makes the utmost effort to comply with all applicable legislation in this regard. The principles adopted in the execution of the personal data processing activities carried out by our Company within the framework of the Hashtag Kids Personal Data Protection and Processing Policy (“Policy”), and the data processing activities of our Company as set forth in the Personal Data Protection Law No. 6698 (“Law” or “KVKK”). The basic principles adopted in terms of compliance with the regulations are explained.

1.2 Purpose

This Policy; It has been prepared to ensure the management of compliance activities to be carried out by Hashtag Kids in order to comply with the KVKK on the protection of personal data.

Hashtag Kids will make the necessary arrangements for the legal protection and processing of personal data in line with the principles set out in this Policy, and will establish the necessary system to raise awareness of its employees and business partners on this issue.

1.3. Scope

This Policy; Being a part of any data recording system, fully or partially automatic, of the persons whose personal data are processed by our company, especially our employees, employee candidates, company officials, company shareholders, customers, visitors, employees, shareholders and officials of the institutions we cooperate with, and third parties. regarding all personal data processed by non-automatic means, provided that

1.4. Implementation and Enforcement of the Policy

Relevant legal regulations in force on the processing and protection of personal data will find application first. In case of inconsistency between the current legislation and the Policy, our Company accepts that the applicable legislation will find an area of application.

The effective date of this Policy is 30.09.2020.

2. ISSUES REGARDING THE PROCESSING OF PERSONAL DATA

This policy is a guide on how Hashtag Kids will apply the rules regulated in the KVKK and related legislation.

Our company, regarding the processing of personal data in accordance with Article 20 of the Constitution and Article 4 of the KVKK; in accordance with the law and the rules of honesty; accurate and up-to-date; for specific, clear and legitimate purposes; engages in personal data processing activities in a connected, limited and measured manner for this purpose.

3. PROCESSING PERSONAL DATA IN ACCORDANCE WITH THE LEGISLATION

3.1. Processing in Compliance with Law and Integrity

Hashtag Kids acts in accordance with the principles brought by legal regulations and the general rule of trust and honesty in the processing of personal data. In this framework, personal data is processed to the extent and limited to the business activities of our Company.

3.2.Ensuring Personal Data Are Accurate and Up-to-Date When Necessary

Hashtag Kids; It ensures that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights of personal data owners and their own legitimate interests. It takes the necessary measures in this direction.

3.3. Processing for Specific, Explicit, and Legitimate Purposes

Our company clearly and precisely determines the purpose of processing personal data, which is legitimate and lawful. Our company processes personal data in connection with the service it provides and as much as is necessary for them.

3.4. Being Related to the Purpose for which they are Processed, Limited and Measured

Our company processes personal data in a way that is suitable for the realization of the determined purposes and avoids the processing of personal data that is not related to the realization of the purpose or that is not needed.

3.5. Retention for as Long as Required for the Purpose of Processing or Envisioned in the Relevant Legislation

Our company retains personal data only for as long as required by the relevant legislation or for the purpose for which they are processed. In this context, our Company first determines whether a period is foreseen for the storage of personal data in the relevant legislation, if a period is determined, it acts in accordance with this period, and if a period is not determined, it stores the personal data for the period required for the purpose for which they are processed. Personal data is deleted, destroyed or anonymized by our Company in the event that the period expires or the reasons requiring its processing are eliminated. Personal data is not stored by our Company for the possibility of future use.

4. TERMS OF PROCESSING PERSONAL DATA

As a rule, personal data should be processed based on one or more of the personal data processing conditions specified in Article 5 of the KVKK. In this context, Hashtag Kids evaluates whether personal data processing activities fall within the scope of one of these conditions and personal data processing activities that are not based on one of these conditions are stopped. It is regulated in the KVKK that special measures can be introduced for the processing of personal data of a special nature. In this context, measures determined by the Board are taken while processing special quality personal data.

Except for the express consent of the personal data owner, the basis of the personal data processing activity may be only one of the following conditions, or more than one condition may be the basis of the same personal data processing activity:

Finding the Explicit Consent of the Personal Data Owner

One of the conditions for the processing of personal data is the explicit consent of the data owner. The explicit consent of the personal data owner should be disclosed on a specific subject, based on information and free will. In the presence of the following personal data processing conditions, personal data may be processed without the need for the explicit consent of the data owner.

Explicitly Provided in Laws

If the personal data of the data owner is expressly stipulated in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, the existence of this data processing condition may be mentioned.

Failure to Obtain the Explicit Consent of the Person Related to the Cause of Actual Impossibility

The personal data of the data owner may be processed if it is necessary to process the personal data of the person who is unable to express his/her consent due to actual impossibility or whose consent cannot be validated, in order to protect the life or bodily integrity of himself or another person.

Direct Concern with the Establishment or Performance of the Contract

Provided that it is directly related to the establishment or performance of a contract to which the data owner is a party, this condition may be deemed to be fulfilled if the processing of personal data is necessary.

Fulfilling the Legal Obligation of the Company

Personal data of the data owner may be processed if the processing is necessary for our company to fulfill its legal obligations.

Making Personal Data Public by the Personal Data Owner

If the data owner has made his personal data public, the relevant personal data may be processed for the purpose of making it public on a limited basis.

Mandatory Data Processing for the Establishment or Protection of a Right

If data processing is necessary for the establishment, exercise or protection of a right, the personal data of the data owner may be processed.

Obligatory Data Processing for the Legitimate Interest of Our Company

Provided that it does not harm the fundamental rights and freedoms of the personal data owner, the personal data of the data owner may be processed if data processing is necessary for the legitimate interests of our Company.

4.2. Processing of Special Quality Personal Data.

In Article 6 of the KVKK, there is a risk of causing victimization or discrimination of individuals when processed unlawfully; Data related to race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data are classified as “special quality” data. ” is regulated as personal data.

Our company acts in accordance with the regulations stipulated in the Law in the processing of personal data of special nature. Special quality personal data is processed by our Company in accordance with the principles set forth in this Policy, by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and in the presence of the following conditions:

Special categories of personal data other than health and sexual life

It can be processed without seeking the explicit consent of the data owner if it is expressly stipulated in the laws, in other words, if there is a clear provision regarding the processing of personal data in the law governing the related activity. Otherwise, the explicit consent of the data owner will be obtained in order to process the aforementioned special categories of personal data.

Special categories of personal data regarding health and sexual life

It may be processed without the explicit consent of persons or authorized institutions and organizations under the obligation of secrecy for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. Otherwise, the explicit consent of the data owner will be obtained in order to process the aforementioned special categories of personal data.

5. DISCLOSURE OF THE PERSONAL DATA OWNER

Hashtag Kids, in accordance with Article 10 of the KVKK, enlightens the personal data owners about how their data will be processed during the acquisition of personal data. Within the scope of the relevant legislation, Hashtag Kids; has identified all the processes through which personal data is obtained, and in particular, clarification texts have been prepared by our company for all of these processes. Personal data owners through these texts:

The identity of our company as a data controller,
For what purpose your personal data will be processed,
To whom and for what purpose personal data can be transferred,
The method and legal reasons for our personal data collection,
Their rights as a personal data owner

are informed by our company.

6. TRANSFER OF PERSONAL DATA

Even without the explicit consent of the personal data owner, if one or more of the following conditions are present, personal data may be transferred to third parties by taking all necessary security measures, including the methods prescribed by the Board, with due care by Hashtag Kids:

The relevant activities regarding the transfer of personal data are clearly stipulated in the laws,
The transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
The transfer of personal data is mandatory for our Company to fulfill its legal obligation,
Provided that the personal data has been made public by the data owner, transferring by our Company in a limited manner for the purpose of making it public,
The transfer of personal data by the Company is mandatory for the establishment, exercise or protection of the rights of the Company or the data owner or third parties,
It is obligatory to transfer personal data for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner,
It is compulsory for the person or someone else to protect his/her life or physical integrity, who is unable to express his/her consent due to actual impossibility or whose consent is not legally valid.

6.2. Transfer of Private Personal Data

Special quality personal data may be transferred by our Company in accordance with the principles set forth in this Policy, by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and in the presence of the following conditions:

Special categories of personal data other than health and sexual life

In other words, if there is a clear provision regarding the processing of personal data in the relevant law, it can be transferred without the explicit consent of the data owner. Otherwise, the explicit consent of the data owner will be obtained.

Special categories of personal data regarding health and sexual life

For the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, it can be transferred without explicit consent by persons or authorized institutions and organizations under the obligation of keeping secrets. Otherwise, the explicit consent of the data owner will be obtained. If sensitive personal data is to be transferred abroad, in addition to the above-mentioned conditions, special quality personal data is transferred to foreign countries with adequate protection or to foreign countries where the serial officer is committed to adequate protection.

6.3. Third Parties and Purposes of Transfer of Personal Data by Hashtag Kids

Our company can transfer the personal data and sensitive personal data of the personal data owner to third parties (third party companies, public and private authorities, third real persons) by taking the necessary security measures in line with the personal data processing purposes in accordance with the law. Accordingly, our company acts in accordance with the regulations stipulated in Article 8 of the Law.

Our company may transfer the personal data of data subjects managed by this Policy to the following categories of persons in accordance with Articles 8 and 9 of the KVKK:

To Hashtag Kids business partners,
To Hashtag Kids suppliers,
Legally authorized public institutions and organizations
Legally authorized private legal persons

Persons to whom Data Transfer can be made

Definition

Data Transfer Purpose

Business partner

It defines the parties with which our company establishes business partnerships for purposes such as carrying out various projects and receiving services while carrying out its commercial activities.

Limited to ensure the fulfillment of the purposes for which the business partnership was established.

supplier

It defines the parties that provide services to our Company on a contractual basis in accordance with the orders and instructions of Hashtag Kids while carrying out the commercial activities of our company.

Limited to ensure that the services that Hashtag Kids outsourced from the supplier and that are necessary to carry out the commercial activities of Hashtag Kids are provided to our Company.

Legally Authorized Public Institutions and Organizations

Public institutions and organizations authorized to receive information and documents from Hashtag Kids in accordance with the provisions of the relevant legislation

Limited to the purpose requested by the relevant public institutions and organizations within the legal authority

Legally Authorized Private Law Persons

Private law persons authorized to receive information and documents from Hashtag Kids in accordance with the provisions of the relevant legislation

Limited to the purpose requested by the relevant private legal persons within the scope of their legal authority.

7. CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND THE PURPOSE OF PROCESSING

Before our company, by informing the relevant persons in accordance with Article 10 of the Law and secondary legislation, in line with the personal data processing purposes of our Company, based on and limited to at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law, primarily the processing of personal data. Personal data is processed in accordance with the general principles set forth in the Law, including the principles set forth in Article 4 of the Law. Within the framework of the purposes and conditions specified in this Policy, detailed information about the categories and categories of personal data processed is as follows:

PERSONAL DATA CATEGORY

PERSONAL DATA CATEGORY DISCLOSURE

Credentials

Data that contains information about the identity of the person; name-surname, T.C. identification number, nationality information, place of birth, date of birth, gender, workplace information, registration number, tax number, title, biography, etc. information and documents such as driver's license, professional identity, identity card and passport

Communication information

Phone number, address, e-mail address, fax number etc. informations

Family Members and Close Information

Information about the family members (e.g. spouse, mother, father, child), relatives and other people who can be reached in case of emergency, related to the services provided by our company or to protect the legal and other interests of the Company and the personal data owner.

Physical Space Security Information

Personal data regarding the records and documents taken at the entrance to the physical space, during the stay in the physical space; camera records, vehicle information records and records taken at the security point, etc.

Financial Information

Personal data processed for information, documents and records showing all kinds of financial results created according to the type of legal relationship our Company has established with the personal data owner, and data such as bank account number, IBAN number, income information, debt/credit information

Audio/Visual Information

Photographs and camera recordings (excluding the recordings included in the Physical Space Security Information)

Special Qualified Personal Data

Data on people's health, criminal convictions and security measures

Legal Process and Compliance Information

Personal data processed within the scope of determination, follow-up and performance of our legal receivables and rights, and compliance with our legal obligations and our Company's policies

Audit and Inspection Information

Personal data processed for the execution of our company's operational, financial, fraud and compliance audit activities

Request/Complaint Management Information

Personal data regarding the receipt and evaluation of any request or complaint directed to our Company

THE PURPOSE OF PROCESSING THE SUCH PERSONAL DATA IS AS FOLLOWS:

MAIN OBJECTIVES (PRIMARY)

SUB-OBJECTIVES (SECONDARY)

Planning and Execution of the Company's Human Resources Policies and Processes

Execution of personnel procurement processes

Carrying out the necessary work by our relevant business units for the realization of the commercial activities carried out by the company and the execution of the related business processes

Planning and execution of corporate communication activities

Follow-up of finance and/or accounting works

Planning and execution of corporate sustainability activities

Planning and execution of corporate governance activities

Planning and Execution of the Company's Commercial and/or Business Strategies

Management of relations with business partners and/or suppliers

Planning and Execution of Company Human Resources Policies and Processes

Employee demand and complaint management

Planning analysis and improvement activities related to company wage management

Planning and supporting the processes of providing fringe benefits and benefits to company employees

Supporting the wage management planning activities of company employees

Managing the processes related to the Company's Strategic Human Resources Planning, Backup Processes and performance evaluation of company employees. Supporting Organizational Development Activities

Managing the processes related to the performance evaluation of company employees

Supporting the management of the appointment and promotion processes of personnel and managers within the company

Maintaining the Trust of Hashtag Kids' Reputation in Business and Consumers

Carrying out studies to protect the reputation of company values

Follow-up of company customer requests and/or complaints

Ensuring the legal, technical and commercial-occupational safety of the Company and the persons who have a business relationship with the Company

Follow-up of legal affairs

Planning and execution of necessary operational activities to ensure that company activities are carried out in accordance with company procedures and / or relevant legislation

Ensuring the security of company fixtures and/or resources

Ensuring the security of company operations

Giving information to authorized institutions based on legislation

Realization of corporate and partnership law transactions

Supporting the company in the realization of corporate and partnership law transactions

Ensuring data is accurate and up-to-date

Ensuring the security of company premises and/or facilities

Planning and execution of company audit activities

Planning and Execution of Audit Activities of Hashtag Kids

Supporting the misconduct reporting and investigation processes of the company

Planning and execution of audit activities to ensure that the company's activities are carried out in accordance with the legislation

8. ISSUES REGARDING THE PROTECTION OF PERSONAL DATA

8.1. Ensuring the Security of Personal Data

In accordance with Article 12 of the Law, our company takes the necessary measures according to the nature of the data to be protected in order to prevent the unlawful disclosure, access, transfer or security deficiencies that may occur in other ways. In this context, our Company takes administrative measures to ensure the required level of security in accordance with the guidelines published by the Personal Data Protection Committee (“Committee”), carries out audits or has them made.

8.2. Protection of Private Personal Data

With the law, special importance is attached to certain personal data due to the risk of causing victimization or discrimination when processed unlawfully. These data are; Data related to race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, attire, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Hashtag Kids acts sensitively in the protection of special quality personal data, which is determined as "special quality" by the Law and processed in accordance with the law. In this context, the technical and administrative measures taken by our Company for the protection of personal data are carefully implemented in terms of personal data of special nature, and the necessary audits are provided within the body of Hashtag Kids.

8.3. Raising Awareness and Supervision of Business Units on the Protection and Processing of Personal Data

Hashtag Kids provides the necessary trainings to business units in order to prevent the illegal processing of personal data, illegal access to personal data, and to raise awareness to ensure the protection of personal data. Hashtag Kids establishes the necessary systems to raise awareness of its employees on the protection of personal data, and works with consultants if needed. Accordingly, our Company evaluates the participation in the relevant trainings, seminars and information sessions, and updates and renews its trainings in parallel with the updating of the relevant legislation.

9. STORAGE AND DISPOSAL OF PERSONAL DATA

Our company preserves personal data for the period required for the purpose for which they are processed and in accordance with the minimum periods stipulated in the legal legislation to which the relevant activity is subject. In this context, our Company first determines whether a period is foreseen for the storage of personal data in the relevant legislation, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data are stored for the period necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the application of the data owner and with the determined destruction methods (deletion and / or destruction and / or anonymization).

In this direction, a Personal Data Retention and Destruction Policy has been prepared by our company, and you can find detailed information on the subject in the Hashtag Kids Personal Data Retention and Destruction Policy.

10. RIGHTS OF PERSONAL DATA OWNERS AND THE USE OF THESE RIGHTS

Personal data owners have the following rights:

Learning whether personal data is processed or not,
If personal data has been processed, requesting information about it,
Learning the purpose of processing personal data and whether they are used in accordance with its purpose,
Knowing the third parties to whom personal data is transferred at home or abroad,
Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing have disappeared, although it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and requesting that the transaction carried out within this scope be notified to the third parties to whom the personal data has been transferred,
Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
To request the compensation of the damage in case of loss due to unlawful processing of personal data,

10.2. Exercise of Personal Data Owner's Rights

In accordance with your legal rights envisaged in the relevant law and other legislation, listed in Article 10 of this Policy, you can personally submit your requests to our address above with a petition, or send them through a notary public. In addition, by using the registered e-mail (KEP) address, secure electronic signature, mobile signature or the e-mail address you have previously notified to our Company and registered in our systems, pursuant to Article 5 of the "Communiqué on the Procedures and Principles of Application to the Data Controller".info@hashtag-kids.com You can forward it to your address.

It is not possible to make a request by third parties on behalf of personal data owners. In order for a person other than the personal data owner to make a request, there must be a special power of attorney issued by the personal data owner on behalf of the person to apply.

Personal data owners will be able to use the Application Form for the Applications to be Made by the Related Person (Personal Data Owner) to the Data Controller in accordance with the Law on Protection of Personal Data No. 6698, prepared by our Company, in their application to exercise their rights. The method of application to be made in this form is also explained in detail.

11.3. Right of Personal Data Owner to Complain to the KVK Board

In cases where the application is rejected, the response given is insufficient, or the application is not answered in due time, in accordance with Article 14 of the Personal Data Owner KVK Law; A complaint can be made to the KVK Board within thirty days from the date our company learns of the answer, and in any case within sixty days from the date of application.

11.4. Our Company's Response to Applications

As personal data owners, if you submit your requests regarding your rights to our company through the methods set out in the Personal Data Protection and Processing Policy, our company will conclude the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the tariff determined by the Personal Data Protection Board will be charged by our company.

Regards.

Hashtag Textile Trade Limited Company

#Wholesale

FAQ