M2L REKLAM DANIŞMANLIK HİZMETLERİ TİCARET ANONİM ŞİRKETİ
PRIVACY NOTICE UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA
M2L Reklam Danışmanlık Hizmetleri Ticaret Anonim Şirketi (“Company”) takes all necessary technical and legal measures to ensure that your personal data is processed in compliance with Law No. 6698 on the Protection of Personal Data (“KVKK”) due to its business activities. Data subjects may access detailed information on the processing of their personal data, the transfer of data to third parties, the legal grounds for data collection, and their rights under the KVKK from the notice below.
A. Processed Personal Data, Purpose of Processing, Collection Method, and Legal Basis
The legal bases relied upon by our Company during personal data processing are as follows:
Existence of explicit consent (Art. 5/1, Art. 6)
Explicit stipulation by law (Art. 5/2-a)
Necessity for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility, or whose consent is not legally valid (Art. 5/2-b)
Necessity of processing personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of that contract (Art. 5/2-c)
Necessity for compliance with a legal obligation to which the data controller is subject (Art. 5/2-ç)
Being made public by the data subject (Art. 5/2-d)
Necessity of data processing for the establishment, exercise, or protection of a right (Art. 5/2-e)
Necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f)
Purpose of Data Processing – Processed Data – Legal Basis – Collection Method
| Purpose of Processing | Processed Data | Legal Basis | Collection Method |
|---|---|---|---|
| Management of requests and complaints | Name-surname, email, phone number, title, signature, request/complaint details | Art. 5/2-e, 5/2-f | Electronically (partially automated) |
| Procurement of goods/services and contract management | Name, surname, TR ID number, signature circular, email, phone, bank account number, signature, address, reference information | Art. 5/2-c, 5/2-d, 5/2-e | Physically, by email and phone (partially automated and non-automated) |
| Sales and contract management | Name, surname, TR ID number, signature circular, email, phone, bank account number, signature, address | Art. 5/2-c, 5/2-d, 5/2-e | Physically, by email and phone (partially automated and non-automated) |
| Invoice management | Name, surname, TR ID number, email, phone, address | Art. 5/2-a, 5/2-c, 5/2-ç, 5/2-e | Physically or digitally (non-automated or partially automated) |
| Preparation of audit documents | Name, surname, TR ID number, signature, e-signature | Art. 5/2-c, 5/2-f | From relevant documents (non-automated) |
| Preparation of general assembly minutes, proxies, and recording meetings | Name, surname, TR ID number, signature, title, visual and audio recordings | Art. 5/2-ç, 5/2-f | Physically, by email, or via camera (partially automated and non-automated) |
| Follow-up of litigation, mediation, and enforcement proceedings | Personal data related to or included in the file | Art. 5/1, 6/1, 5/2-a, 5/2-d, 5/2-e, 5/2-f | Physically and by email (partially automated and non-automated) |
| Transmission of incoming/outgoing calls and mail to relevant parties | Name-surname, phone, email, organization, title, address | Art. 5/2-f | Physically, by fax and email (non-automated or partially automated) |
| Maintaining contact lists | Name-surname, title, phone | – | Email, phone, physically (partially automated) |
| Correspondence with public institutions | Name-surname, address, TR ID number, ID serial number, date of birth, parents’ names, title, photo, video, phone, email, signature | Art. 5/2-a, 5/2-c, 5/2-ç | Physically or by email (non-automated or partially automated) |
B. Transfer of Personal Data
The personal data specified in Section A is shared for the purposes indicated in that section, to the extent necessary and limited to the relevant purposes, with:
Audit firms, financial advisors, and public authorities (to ensure compliance with legal obligations, conduct business activities in accordance with the law, manage contract processes),
Banks and financial institutions (to execute contract processes, carry out finance and accounting activities, pursue legal matters),
Suppliers and business partners involved in business operations (to ensure business continuity, manage contract processes, follow up requests and complaints, pursue legal matters),
Service providers and business partners from whom our Company procures services (for the same purposes as above),
Competent public authorities, in line with their requests and limited to their legal authority (to ensure compliance with regulations, fulfill legal/administrative obligations, pursue legal matters).
C. Rights of the Data Subject
Pursuant to Article 11 of the KVKK, every individual has the following rights:
To learn whether personal data is being processed,
To request information if their personal data has been processed,
To learn the purpose of processing and whether it is used in accordance with this purpose,
To know the third parties to whom personal data has been transferred, whether domestically or abroad,
To request correction of incomplete or inaccurate data and to request notification of such corrections to third parties,
To request deletion or destruction of personal data when the reasons requiring processing cease to exist, and to request notification of such action to third parties,
To object to any result arising against them from analysis of personal data exclusively through automated systems,
To request compensation for damages incurred due to unlawful processing of personal data.
Individuals may submit their requests regarding these rights to our Company in accordance with the Communiqué on the Principles and Procedures of Application to the Data Controller. Requests will be evaluated and finalized as soon as possible and in any event within thirty (30) days free of charge. However, if the process requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board will be charged.