General Privacy Notice regarding Website
Communication Channels of
Doğan Şirketler Grubu Holding A.Ş.
1. Information About the Data Controller
This Privacy Notice has been prepared by Doğan Şirketler Grubu Holding Anonim Şirketi (the "Holding Company") to inform data subjects about the processing of their personal data pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law") in connection with the communication channels (e.g., the contact form/contact portal) made available through the website.
Depending on the nature of the request/application you submit through the website communication channels, in addition to the Holding Company, other affiliated legal entities may also act as data controllers solely to the extent necessary for evaluating, and responding to, your request/application and only for such purpose. Detailed information regarding these legal entities is available at the following link: https://www.doganholding.com.tr/en/contact-us/companies-of-the-group/
2. Personal Data Processed and Method of Collection
It may not always be necessary for you to provide your personal data in order to use the website communication channels. However, if you choose to provide your personal data, particularly your identity and contact information, the following categories of personal data may be processed, including your name and last name, address, country of residence, telephone number, and email address.
Your personal data may be collected through the contact form/contact portal available on our website, via our call center, or through emails and other communication channels that you use to contact us.
As a general rule, sensitive personal data (e.g., health data, criminal conviction records, etc.) are not collected as part of our communication processes. However, if you choose to provide such data, it may be processed pursuant to Article 6(3)(b) of the LPPD (Law on the Protection of Personal Data), on the ground that “processing is expressly provided for by law”; pursuant to Article 6(3)(d), “where processing is mandatory to establish, exercise or protect a right”; and pursuant to Article 6(3)(f), “where processing is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, or social assistance”.
Accordingly, you are requested to disclose such sensitive personal data only where it is strictly necessary for the evaluation of your request. Otherwise, any sensitive personal data provided will be deleted immediately. All responsibility for the collection of such data rests with you, and neither the Holding Company nor its affiliates accept any responsibility for the manner in which such data was obtained by you.
3. Purposes of, and Legal Grounds for, the Processing of Personal Data
If you choose to provide your personal data and, where applicable, personal data relating to third parties such data will be processed for the following purposes:
- Receiving and processing the requests or applications you submit through our communication channels;
- Carrying out the activities required for the provision of the services we provide to you;
- Responding to your requests for information;
- Evaluating your suggestions and feedback and handling your complaints;
- Conducting our Company's commercial activities and ensuring the continuity of its business processes;
- Planning and implementing our commercial and/or business strategies;
- Ensuring the legal, technical, and commercial security of individuals having a business relationship with our Company.
Your personal data collected are processed in accordance with Articles 5 and 6 of the Law for the purposes and on the legal grounds set out below. In addition, your personal data may be anonymized and used for reporting and statistical purposes.
Further details regarding the legal grounds for processing are provided below:
| Personal Data Category | Personal Data Processed | Purpose of Processing | Legal Grounds (LPPD) |
|---|---|---|---|
| Identity | Name and last name; mother's/father's name; date and place of birth; marital status; Turkish ID number; identity card serial and sequence number; etc. | Receiving requests/applications submitted through the communication channels; verifying the identity of the data subject (where necessary); evaluating and resolving the request/application; carrying out the relevant business processes; managing legal disputes; and establishing, exercising, or protecting a right | Article 5(2)(c) of the LPPD – performance or execution of a contract; Article 5(2)(f) – legitimate interest; where necessary, Article 5(2)(e) – establishment, exercise, or protection of a right |
| Contact | Address; correspondence address; e-mail address; registered electronic mail (KEP) address; telephone number; etc. | Managing request/application processes; responding to requests for information; evaluating suggestions and feedback; handling complaint processes; contacting the data subject and providing a response | Article 5(2)(c) of the LPPD – performance/execution of a contract; Article 5(2)(f) – legitimate interest |
| Employment Records | Payroll information; résumé/CV information; employment certificate records; performance evaluation reports; disciplinary investigation records; asset declaration information; etc. | Managing human resources and employee relations processes (where necessary); evaluating applications; carrying out activities necessary for the planning and implementation of the Holding Company's commercial and/or business strategies; conducting audit and compliance activities | Article 5(2)(c) of the LPPD – performance/execution of a contract; Article 5(2)(ç) – compliance with a legal obligation; where necessary, Article 5(2)(f) – legitimate interest |
| Legal Transaction | Information included in the correspondence exchanged with judicial authorities, information included in litigation/dispute files, etc. | Fulfilling legal obligations; managing legal proceedings and disputes; establishing, exercising, or protecting a right; and providing information to authorized persons, institutions, and organizations | Article 5(2)(ç) of the LPPD – compliance with a legal obligation; Article 5(2)(e) – establishment, exercise, or protection of a right |
| Customer Transaction | Request information; order information; call center records; invoice, promissory note/check information; information contained in payment receipts; etc. | Carrying out the activities necessary to enable data subjects to benefit from the services provided by the Holding Company or its affiliates; conducting commercial activities and the related business processes; evaluating and resolving requests/applications; and managing customer relationship processes | Article 5(2)(c) of the LPPD – performance of a contract; where necessary, Article 5(2)(f) – legitimate interest |
| Physical Premises Security | Entrance and exit record information of employees and visitors, CCTV recordings, etc. | Ensuring the security of the Holding Company's premises and physical facilities; managing visitor processes; implementing occupational health and safety measures; preserving evidence for potential incidents/disputes and establishing, exercising, or protecting a right | Article 5(2)(f) of the LPPD – legitimate interest; where necessary, Article 5(2)(e) – establishment, exercise, or protection of a right |
| Transaction Security | IP address information, website access logs, password and keyword information, etc. | Ensuring the security of the communication channels and information systems; carrying out information security processes; managing access authorizations; preventing misuse; and ensuring the legal, technical, and commercial security of the Holding Company | Article 5(2)(ç) of the LPPD– compliance with a legal obligation; Article 5(2)(f) – legitimate interest |
| Finance | Balance sheet information, financial performance information, credit and risk information, information on assets, etc. | Conducting commercial activities; carrying out finance and accounting operations; conducting risk management processes; fulfilling obligations arising under applicable legislation; and conducting audit activities | Article 5(2)(ç) of the LPPD– compliance with a legal obligation; where necessary Article 5(2)(f) – legitimate interest |
| Professional Experience | Diploma information; certificates; transcript information; information regarding courses attended; on-the-job training information; etc. | Carrying out the relevant processes depending on the nature of the request/application; carrying out activities necessary to enable data subjects to benefit from the services provided by the Holding Company; managing human resources processes (where necessary); and conducting competency and suitability assessments | Article 5(2)(c) of the LPPD – performance/execution of a contract; Article 5(2)(f) – legitimate interest; where necessary, Article 5(2)(ç) – compliance with a legal obligation |
| Visual and Audio Records | Visual and audio recordings; etc. | Ensuring physical premises security; maintaining information security and preventing misuse; recording communications, where applicable, in connection with the management of request/application processes; managing disputes; and establishing, exercising, or protecting a right | Article 5(2)(f) of the LPPD – legitimate interest; where necessary, Article 5(2)(e) – establishment, exercise, or protection of a right |
| Other Information (Information Relating to Family Members) | Data types specified by the user (e.g., identity and contact information relating to family members, degree of relationship, etc.) | Managing request/application processes (depending on the nature of the request/application); administering employee/intern fringe benefits and related human resources processes (where necessary); fulfilling legal obligations; and ensuring the legal security of the Company and the relevant individuals | Article 5(2)(ç) of the LPPD– compliance with a legal obligation; where necessary Article 5(2)(f) – legitimate interest |
Sensitive Personal Data (processed only where necessary and in accordance with Article 6 of the LPPD):
| Data Category | Personal Data Processed | Purpose of Processing | Legal Grounds (LPPD) |
|---|---|---|---|
| Health Information | Information relating to disability status; blood type information; personal health information; information regarding medical devices and prostheses used; etc. | Fulfilling obligations under employment, occupational health and safety, and social security legislation; carrying out business operations where necessary; and establishing, exercising, or protecting a right | Article 6(3)(f) or Article 6(3)(d) of the LPPD |
| Criminal Conviction and Security Measures | Information relating to criminal convictions; information relating to security measures; etc. | Fulfilling legal obligations; ensuring compliance with applicable legislation; ensuring the legal security of the Company and data subjects having a business relationship with the Company; and, where necessary, establishing, exercising, or protecting a right | Article 6(3)(b) or Article 6(3)(d) of the LPPD |
4. Transfer of Personal Data
To the extent required for the handling of your request/application, your personal data will be shared with a limited number of Holding Company personnel authorized to evaluate and resolve your request/application. In addition, depending on the nature of your request/application, your personal data may be shared with the other affiliated legal entities referred to in Section 1 above.
Depending on the nature of your request/application, your personal data may also be shared with the following third parties:
- Our legal and financial advisors (e.g., attorneys, certified public accountants, etc.)
- Competent public institutions and organizations, and regulatory authorities;
- Professional indemnity insurers and other relevant insurance providers.
Your personal data may also be transferred to service providers engaged in connection with the operation of the communication channels (e.g., technical infrastructure and support providers). Under the relevant contractual arrangements, such service providers are required to implement all necessary technical and organizational measures to ensure an adequate level of protection for your personal data.
If we are legally required to disclose your personal data, we will notify you to the extent permitted by law.
The information systems in which your personal data are processed, as well as the administrative/technological management infrastructure and personnel supporting those systems, are located within Türkiye. However, where required by the technological infrastructure used, and only to the extent necessary, your personal data may be transferred abroad. In this context, transfers relating to the Identity, Contact, Personnel, Legal Transaction, Physical Premises Security, Transaction Security, Financial, Professional Experience, and Visual and Audio Records categories of personal data will be made solely where required by the technological infrastructure and only to technology infrastructure service providers, on the basis of the Standard Contractual Clauses published by the Personal Data Protection Board pursuant to Article 9(4)(c) of the LPPD.
In addition, if an occasional, non-routine international transfer of your personal data becomes necessary, such transfer will be carried out only to the extent necessary and in accordance with the notification and, where applicable, consent requirements governing occasional transfers under the LPPD and the applicable secondary legislation.
5. Your Rights Under Article 11 of the LPPD
If you choose to provide your personal data, please note that you have the rights set out in Article 11 of the Law with respect to the processing of your personal data.
You may submit any requests for information or applications concerning the exercise of the rights described above to the Holding Company in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller. You may also submit your application by completing the application form available on our website and sending it to Burhaniye Mahallesi Kısıklı Cad. No:65/1 Üsküdar/Istanbul or by email to kvkk@doganholding.com.tr.
The Holding Company shall conclude the requests included in the application free of charge and as soon as possible considering the nature of the request and within 30 days at the latest. However, a fee may be charged where the processing of the request requires additional costs. The Holding Company may accept the request and proceed accordingly or reject it in writing, stating the reasons for its decision.
This website uses cookies
This website uses cookies to improve the user experience. By using our website, you consent to all cookies in accordance with our Cookie Policy. Read more.