Personal Data Processing and Protection Policy

Personal Data Processing and Protection Policy

1. Introduction

Agromila Organic and Inorganic Industry and Trade Inc. (Agromila or the Company or Us) is in full compliance with the "Law on the Protection of Personal Data" (KVKK or Law), which entered into force with all its provisions as of 07.10.2016, published in the Official Gazette dated 07.04.2016. shows the highest level of sensitivity necessary to ensure In this context, it attaches importance to the processing and protection of personal data in accordance with the law and places it among its priorities. For this reason, Agromila has prepared the "Personal Data Processing and Protection Policy" (Policy) in order to inform you transparently about the processing and protection of personal data.

2. Purpose and Scope of the Policy

This Policy has been prepared in order to make explanations to the relevant persons whose personal data are processed by Agromila regarding the processing and protection of personal data, whose personal data are listed in ANNEX-1. to whom this data can be transferred, for what purposes, what administrative and technical measures are taken for the protection of personal data, what rights they have over their personal data, and the application methods and other issues regarding their requests for these rights. In this way, it is aimed to ensure full compliance with the legislation in the processing and protection of personal data carried out by the Company and to protect all the rights arising from the legislation regarding the personal data of these data subjects. Information regarding the processing and protection of personal data of Agromila employees is included in the “Processing and Protection of Employee Personal Data Policy”.

3. Definitions

The definitions in this Policy are as follows:

Open Consent: Consent on a specific subject, based on information and expressed with free will, Buyer Group: The natural or legal person category to which personal data is transferred by the data controller,

Anonymization: Making personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching with other data,

Storage for the period required by the relevant legislation or for the purpose for which they are processed: The natural person whose personal data is processed (other than the employees, whose personal data are processed by Agromila within the scope of this Policy, as listed in ANNEX-1)

Processing of Personal Data: Any information relating to an identified or identifiable natural person,

Special Quality Personal Data (SQPD): Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, costume and clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data,

Processing of Personal Data: Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or using personal data fully or partially by automatic or non-automatic means provided that it is a part of any data recording system. all kinds of operations performed on data such as blocking,

Board: Personal Data Protection Board,

Organisation: Personal Data Protection Authority,

Data Recording System: The registration system in which personal data is processed and structured according to certain criteria,

Data Controller: It refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

For definitions not included in this Policy, the definitions in the Law and secondary regulations are valid.

4. General Principles for the Processing of Personal Data

Article 4 of the KVKK regulates the general principles that must be followed for the processing of personal data. Within the scope of personal data processing activities, Agromila primarily acts in accordance with these general principles explained below.

̈Compliance with the law and honesty rules: Agromila acts in accordance with the legislation in force in all personal data processing processes and abides by the rules of honesty.

Being accurate and up-to-date when needed: Agromila takes the necessary measures to ensure that your personal data is correct and in line with the current situation, provides opportunities for updating and takes the necessary measures to ensure that the data is transferred to the databases correctly.

Processing for specific, explicit and legitimate purposes: Agromila limits its personal data processing activities to specific and legitimate purposes and clearly informs you about these purposes through clarification texts.

Storage for the period required by the relevant legislation or for the purpose for which they are processed: Personal data are processed by Agromila to the extent necessary for the purpose declared to you at the time of their provision, in connection with this purpose and in a limited manner.

Storage for the period required by the relevant legislation or for the purpose for which they are processed: Agromila keeps your personal data for a certain period of time, if it is determined within the scope of the legislation in force. If such a period is not specified in the legislation, reasonable retention periods are determined by taking into account the purpose of data use and company procedures, and the data is kept limited to this period. Following the expiry of the aforementioned periods, the data is deleted, destroyed and anonymized in accordance with the "Agromila Personal Data Retention and Destruction Policy" (Policy).

5. Terms of Processing Personal Data

Article 5 of the KVKK regulates the processing conditions of personal data, and article 6 regulates the processing conditions of special categories of personal data. KVKK stipulates that personal data can be processed even without the explicit consent of the person concerned, in the cases written in these articles, and allows this processing to be in accordance with the law. These processing conditions vary depending on whether the personal data is sensitive personal data or whether it is personal data related to health and sexual life among the special quality personal data. Special quality personal data is data that has the potential to discriminate between individuals and may cause victimization of the person concerned if learned by others, and KVKK has stipulated that adequate measures to be determined by the Board should be taken in the processing of these data.

KVKK m.5/2 and KVKK m. The situations in which personal data can be processed without seeking explicit consent, which are regulated in the provisions of 6/3, are as follows, and Agromila may process your personal data based on your explicit consent, except for these stipulated situations.

KVKK m. According to 5/2, it is possible to process personal data without seeking explicit consent in the presence of one of the following conditions:

  1. Clearly stipulated in the law
  2. It is compulsory for the protection of life or physical integrity of the person or someone else, who is unable to express his consent due to actual impossibility or whose consent is not legally valid.
  3. Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.

ç) It is mandatory for the data controller to fulfill its legal obligation.

  1. Being made public by the person concerned.
  2. Data processing is mandatory for the establishment, exercise or protection of a right.
  3. Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

According to KVKK 6/3, it is possible to process sensitive personal data without seeking explicit consent, provided that adequate measures determined by the Board are taken in the following cases:

Personal data other than health and sexual life are under the obligation of confidentiality for the purposes of protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. It can be processed by persons or authorized institutions and organizations without seeking the explicit consent of the person concerned.

6. Conditions for Transferring Personal Data to Domestic and International

Article 8 of the KVKK regulates the transfer of personal data to third parties in the country, and article 9 regulates the transfer of personal data to third parties abroad.

According to Article 8 of the KVKK, without prejudice to the provisions in other laws regarding the transfer of personal data, personal data can only be obtained without the consent of the person concerned a) KVKK m.5/2, b) KVKK m. In case of existence of one of the conditions in the provisions of 6/3, it can be transferred to third parties in the country.

According to Article 9 of the KVKK, personal data can only be obtained without seeking explicit consent, but with KVKK m.5/2 and KVKK m. The existence of one of the conditions in the provisions of 6/3 and in the country where the personal data will be transferred; a) In the absence of adequate protection, b) In the absence of sufficient protection, data controllers in Turkey and the relevant foreign country undertake in writing to provide adequate protection and that the Board has permission.

7. Collection Methods and Your Collected Personal Data

Your personal data by Agromila, but not limited to those listed; The data of our employee candidates through the CVs you have filled/entered/uploaded through the employment platform, our suppliers or our employees who have given/forwarded your CVs to send to our company, your CVs you have forwarded and verbally or by hand or e-mail/digital media during the interviews, or by you personally through the information/documents you have transmitted/shared via social media; the data of employee candidate references from our employee candidate who applied to our company and by you personally during the reference control interview; the data of the family member/relatives of our employees, through the information/documents (such as job request and information form and other documents conveyed) transmitted/shared by our employee, who is your family member/relative, verbally or by hand or by e-mail during the interviews; The data of our customers/potential customers verbally or by hand (such as printed forms/cards/documents you fill out, business cards you share) or digital/electronic media (such as our website, digital forms you fill in, personal data of our customers, as well as through our social media accounts) ) on the information/documents you have transmitted/shared via ) by you personally or by closed-circuit camera system or cookies; Data of customer/potential customer family member/relatives, printed forms filled or hand-delivered orally or filled in and/or hand-delivered by the customer's family member/relative personally or by your family member/relative customers/potential customer, information/forms filled/transmitted electronically /documents/documents; Information/documents that you have transmitted/shared the data of customer employees/authorities verbally or by hand (such as printed forms/cards/documents you fill out, business cards you share) or via e-mail or other forms of digital/electronic media (such as our website, digital forms you fill out) by yourself or from our customer, who is your employer; The data of our supplier/supplier employee/authorities are provided by you personally through the information/documents you have transmitted/shared through digital/electronic media, either verbally or by hand or by e-mail or other forms during the negotiations, and the personal data of the supplier employee/authorities, in addition to these, from our supplier, who is also your employer, closed circuit camera system; Data of business partner employees/authorities through physical and electronic media by you personally, through the information/documents you have transmitted/shared verbally or by hand or via e-mail or other forms of digital/electronic media during the interviews, from our business partners who are also your employers; The data of press members/influencers are from your employer and/or the media members' data from your employer, through the information/documents that you have transmitted/shared verbally or by hand or via e-mail during the interviews, personal data of the influencers from the influencers and manager agencies from the public domains; data of press member/influencer family member/relatives are from public domains and press member/influencer family member; data of our visitors, closed-circuit camera recording system; The personal data of the e-bulletin subscriber is collected automatically and non-automatically by you personally by filling out the newsletter registration form on our website, and your personal data collected varies according to the product service you request from Agromila, the activities to be carried out by Agromila and the legal obligations. The categories of personal data collected and the explanations of the relevant data categories are included in the annex (Annex-2) of this Policy. The information included in these personal data categories may vary depending on the person whose personal data is processed.

8. Our Purposes of Processing Your Personal Data

Your personal data obtained by Agromila in accordance with the general principles stipulated in the KVKK; It is processed for the purposes listed in Annex-3, within the processing conditions specified in Article 5 of the KVKK.

9. Transfer of Your Personal Data

Regarding the sharing of your personal data with third parties, Agromila complies with the conditions set forth in the KVKK, without prejudice to the provisions of other laws, and does not share your personal data with third parties without your express consent, except for the conditions stipulated in the PDPL. In this context, your personal data processed by Agromila in accordance with the law; It can be transferred to the recipient groups specified in ANNEX-4 below, within the framework of the processing conditions specified in Article 8 of the KVKK. In these cases where your personal data is shared, Agromila takes the necessary measures for the party to which the data is shared to process and transfer in accordance with the rules in this Policy and the provisions of the legislation.

10. Retention of Your Personal Data

Personal data is deleted, destroyed or anonymized based on the decision or request of our Company ex officio, in case the reasons that require processing are no longer valid although it has been processed by our Company in accordance with the provisions of the Law and other legislation.

Our company determines the retention periods of your personal data, taking into account the legislation in force and the processing purposes of your personal data, which is the subject of the processing activity. In this context, the statute of limitations regarding the legal obligations regarding the processing of your personal data are taken into account. In the event that the purpose of processing personal data disappears, the data is deleted, destroyed and anonymized unless there is another legal reason or basis that allows the personal data to be kept. Detailed information is available in the "Agromila Personal Data Retention and Disposal Policy", which Agromila bases on the process of determining the maximum period required for the purpose for which personal data is processed, and the deletion, destruction and anonymization process.

11. Your Rights You Have And The Use Of These Rights

According to Article 11 of the KVKK, as the person concerned;

  1. Learning whether your personal data is processed by our company,
  2. If your personal data has been processed, requesting information about it,
  3. Learning the purpose of processing your personal data and whether it is used in accordance with its purpose,

ç) Knowing the third parties to whom personal data is transferred at home or abroad,

  1. Requesting correction of personal data in case of incomplete or incorrect processing,
  2. Requesting the deletion or destruction of your personal data in the event that the reasons requiring processing are eliminated, although it has been processed in accordance with the provisions of the KVKK and other relevant laws,
  3. Requesting notification of the transactions made in subparagraphs d) and e) to the persons to whom personal data has been transferred,
  4. Objecting to a result against you by analyzing your personal data exclusively through automated systems,

ğ) If you suffer any damage due to unlawful processing of personal data, you have the right to demand the compensation of the damage.

To convey your requests regarding these aforementioned rights Agromila Personal Data Related Person Application Form If you fill in the form and submit it with one of the methods specified in the application form, your request will be evaluated and finalized as soon as possible and in any case within the period stipulated in the Law. If the process of examining and finalizing your application requires a cost, Agromila may charge the fee determined by the Board.

In order for third parties to apply on your behalf, you must have a special power of attorney issued by the notary public on behalf of the applicant.

Our company may request information from you in order to determine whether the applicant is you or not, and may ask you questions about your application in order to clarify the issues stated in the application.

12. Measures We Take for the Security of Your Data

Agromila takes reasonable technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of your personal data, to prevent unlawful access to your data and to ensure its preservation. it also takes into account the Board's Decision (Decision) dated 31/01/2018 and numbered 2018/10 on “Adequate Measures to be Taken by Data Controllers in the Processing of Special Quality Personal Data”. Technical and administrative measures taken by Agromila It is included in Annex-5.

13. Update and Changes

Agromila reserves the right to make changes in this Policy in order to provide up-to-date information on practices and legal regulations on the protection of personal data. The changes made are included in the annex (ANNEX-6) of this Policy.

ANNEX

ANNEX 1- Contact List

ANNEX 2- Data Categories and Explanation Table

ANNEX 3- Personal Data Processing Purposes

ANNEX 4- Third Party Categories to which Data is Transferred

ANNEX 5- Technical and Administrative Measures Taken

ANNEX 6- Update and Changes Table

ANNEX-1

RELATED CONTACT LIST

Employee Candidate

Potential Customer (Potential Product or Service Buyer)

Customer (Buyer of Product or Service)

Visitor

Other

● Press Member

● Press Member Family Member/Relatives

● Employee Candidate References

● Family Member/Relatives of Employees

● E-Newsletter subscriber

● Influencer

● Influencer Family Member/Relatives

● Partner Employee/Authority

● Customer Family Member/Relatives

● Customer (Buyer of Product or Service) Employee/Authority

● Potential Customer (Potential Product or Service Buyer) Family Member/Relative

● Supplier

● Supplier Employee/Officer

ANNEX-2

THIRD CATEGORY TO WHICH DATA IS TRANSFERRED

Information on Education/Work/Professional Life

Company name, title, school information, profession, place of work, position, Job status, education status Other information in the AGI form, Information about the job and profession, representative authority information

Finance

Bank account information, Bank Name, Branch Information, Account No, IBAN No, Payment Amount, credit card information such as income tax amount

Physical Space Security

Camera Recordings

Legal Action

Contract, Signature circular

Communication

Home/Work Address, e-mail address, phone number, fax number, social media account information

Transaction Security

Password and password information

Identity

Name, surname, place of birth, date of birth, mother's name, father's name, TR identity number/tax number, nationality, marriage date, marriage anniversary, marital status, type and number of identity document, signature, identity information in the signature circular (Mother's Name, Father's name) Name, TCKN, Date of Birth, etc.) age, degree of kinship, family member/close employee's family status statement/information in the certified population registration sample (such as name, surname, TR ID number, gender, father's name, mother's name, place of birth, date of birth, marital status)

Customer Transaction

sales/product/order/request/delivery/transaction/payment/complaint/invoice/shopping information,

Personnel

CV, candidate evaluation information, interview evaluation information/result, offer

Marketing

Such as Commercial Electronic Communication Permit, cookie records, shopping history records

Supplier Transaction Information

such as invoice/invoice information, tax office, supplier code/ID/status payment information

ANNEX-3

PERSONAL DATA PROCESSING PURPOSE

Execution of Emergency Management Processes

Execution of Information Security Processes

Execution of Employee Candidate Reference Control Processes

Execution of Employee Candidate/ Intern/Student Selection and Placement Processes

Execution of Application Processes of Employee Candidates

Fulfillment of Employment and Legislation Obligations for Employees

Execution of Activities in Compliance with the Legislation

Execution of Finance and Accounting Affairs

Execution of Company / Product / Service Loyalty Processes

Providing Physical Space Security

Follow-up and Execution of Legal Affairs

Execution of Communication Activities

Execution of Human Resources Process and Operation Activities

Execution / Supervision of Business Activities

Execution of Logistics Activities

Execution of Goods / Services After-Sales Support Services

Execution of Goods / Services Procurement Processes

Execution of Good / Service Sales Processes

Execution of Goods / Services Production and Operation Processes

Execution of Customer Relationship Management Processes

Execution of Activities for Customer Satisfaction

Organization and Event Management

Conducting Marketing Analysis Studies

Execution of Advertising / Campaign / Promotion Processes

Execution of Advertising, Promotion, Announcement Processes

Execution of Storage and Archive Activities

Execution of Contract Processes

Follow-up of Requests / Complaints

Execution of Supply Chain Management Processes

Commercial Electronic Message Transmission Processes

Execution of Marketing Processes of Products / Services

Providing Information to Authorized Persons, Institutions and Organizations

ANNEX-4

THIRD CATEGORY TO WHICH DATA IS TRANSFERRED

Agromila

Business Partner

Supplier

Authorized public institutions and organizations

 

ANNEX-5

TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN

Technical Measures

Administrative Measures

  
  
  
  
  
  
  

ANNEX-6

TABLE OF UPDATE AND CHANGE

Changes made in this Policy are listed in the table below.

TABLE OF UPDATE AND CHANGĖ

SCOPE OF CHANGES