1. INTRODUCTION
The principles adopted in the execution of personal data processing activities carried out by Kosmos Vize Hizmetleri Limited Şirketi (hereinafter referred to as “Kosmos”) within the framework of this Personal Data Protection and Processing Policy (“Policy”) and Kosmos data processing activities are regulated in the Personal Data Protection Law No. 6698. (the “Law”) explains the basic principles adopted in terms of compliance with the regulations and informs the personal data owners about the legal provisions and general principles adopted by our Company.
With full awareness of our responsibility in this context, your personal data is processed and reasonably protected within the scope of this Policy.
2. PURPOSE OF THE POLICY
The main purpose of this Policy is to set forth the principles of personal data processing and the protection of personal data, carried out in accordance with the law by Kosmos, and to ensure transparency by enlightening and informing the persons whose personal data are processed by our company.
3. THE SCOPE OF THE POLICY
This Policy; Regarding your personal data processed by Kosmos; The principles of the processing of personal data and personal health data, the purposes and conditions of the processing of this data, the transfer and destruction of this data in the country and abroad, and the practices and principles regarding your rights on the processed data are notified to you below.
4. ACCESS AND UPDATE
The policy is published on the website of our Company and made available to the relevant persons upon the request of the personal data owners and updated when necessary. (Your personal data that we collect and process must be accurate and up-to-date when necessary in accordance with Article 4 of the Personal Data Processing Law No. 6698. Therefore, in case of any change in your personal data, you can report your current and accurate personal information with the methods described in the Clarification Text on our website. .)
Our company reserves the right to make changes in the Policy in line with the legal regulations.
In case of conflict between the current legislation, especially the Law, and the regulations included in this Policy, the provisions of the legislation shall apply.
5. DEFINITIONS
Definitions used here in this Policy are as follows:
|
Explicit consent
|
Consent on a particular topic, based on information and stated by free will
|
|
Anonymization
|
Personal data to be rendered in such a way that even when matched with other data will by no means be associated with a person whose identity is apparent or can be identified
|
|
Personal data
|
All kinds of information regarding a person whose identity is apparent or can be identified
|
|
Processing of personal data
|
All kinds of processes performed on data acquired by non-automated means where the personal data is automated in whole or partially or is part of any data registry system, such as registration, storing, keeping, changing, rearranging, expounding, transferring, taking over of this data, making it available, categorizing it or preventing it from being used
|
|
PDP Law
|
Law No; 6698 Personal Data Protection Law
|
|
PDP Board
|
Personal Data Protection Board
|
|
PDP Institution
|
Personal Data Protection Institution
|
|
Sensitive private data
|
Data regarding race of people, ethnic origin, political view, philosophical view, religion, sect or other faith, raiment, membership in association, foundation or union, health, sexual life, criminal convictions, security measures, and biometric and genetic data
|
|
Data Handler
|
Real or legal person who processes personal data based on the authority given by the data officer on behalf of the data officer.
|
|
Personal data owner
|
Real person whose personal data is processed and is deemed to be “relevant person” in PDP Law,
|
|
Data Officer
|
Real or legal person who identifies the purposes and means of processing personal data, responsible for the establishment and management of the data recording system
|
|
Registry of Data Officers
|
Data officers’ registry kept by the Presidency under the supervision of Personal Data Protection Board (VERBIS)
|
|
Data Inventory
|
The inventory created by correlating and detailing the personal data processing activities implemented in line with the business processes of Kosmos Visa Services Limited Company; with personal data processing purposes, with the recipient group to which the personal data is transferred and with the related personal data owner
|
6. PERSONAL DATA INVENTORY AND CATEGORIZATION OF PERSONAL DATA
Before the Kosmos; In line with the legitimate and lawful personal data processing purposes of Kosmos, based on and limited to one or more of the personal data processing conditions specified in Article 5 of the KVK Law, in particular the principles specified in Article 4 regarding the processing of personal data, Personal data owners (Product and Service User, Potential Product and Service Buyer, Employees, Employee Candidates, Visitors, Supplier Employees, Supplier Authorities, Shareholders/Partners, Employees' Relatives, Consultants, Trainers, Inviting Persons and Reference Persons);
• Fulfilling the information sharing, reporting and informing obligations of public institutions and authorized third parties, especially the applications and requests of the relevant Mission,
• Ensuring that our company activities are carried out in accordance with company procedures or relevant legislation,
• Execution of customer relationship management processes,
• Execution of contract processes,
• Execution / supervision of business activities,
• Execution of communication activities,
• Evaluation of requests and complaints,
• Fulfillment of information and document retention obligations arising from legal legislation,
• Execution of finance and accounting works,
• Managing our legal processes,
• In order to provide you with uninterrupted better and reliable service, personal data will be processed in accordance with the processing conditions and purposes specified in Articles 5 and 6 of the Law No. 6698.
Kosmos has created a personal data inventory in accordance with the Data Controllers Registry Regulation issued by the Personal Data Protection Authority. This data inventory includes data categories, data source, data processing purposes, data processing process, recipient groups to which the data is transferred, and retention periods.
In this context, the following types of data categories exist in Kosmos, but are not limited to these types;
|
Identity Information
|
- Written in your identity card; Name, surname, mother's name, father's name, place of birth, date of birth, marital status, religion, blood group, registered province, district and neighborhood and the information written on your identity card without being limited to these.
|
|
Contact Information
|
- Requested or given by you in order to be able to communicate with you; your contact data such as home phone number, mobile phone number, residential address or other address information, e-mail address.
|
|
Personal Information
|
- Copy of identity card,
- For example the population Register,
- Certificate of residence,
- Health report,
- Diploma copy,
- Criminal record,
- Passport photograph,
- Document stating the family status,
- Military status document,
- Employment Contract / Service Contract
- SSI employment entry declaration,
- Your criminal record (criminal record),
- • Information and documents related to your health status.
|
|
Professional Experience
|
- Diploma information, courses attended, vocational training information, certificates, etc.
|
|
Bank Account Information (Finance)
|
- Bank account number, IBAN number, other information regarding the bank card.
|
|
Curriculum Vitae Information
|
- Your education information, school information about your education, certificate information, education status and information about your education, which is written in your CV or requested by Kosmos or given by you,
- Place, date and duration information about your work experience, which is written in your CV or requested by Kosmos or given by you, information about your previous job and task, any information about your work experience,
- Your photo in your CV or requested by Kosmos or given by you,
- Your driver's license written in your CV or requested by Kosmos or given by you, and the information in your driver's license,
- Your references and information about your references written in your CV or requested by Kosmos or given by you.
|
|
Location
|
- Location information of the current location
|
|
Physical Venue Security (Visitor Information)
|
- Camera recording, internet access information of visitors to the company,
|
|
Health Data
|
- All kinds of health information and data (disability information, blood type information, personal health information,)
|
|
Criminal Conviction Data
|
- Criminal record information obtained while creating the personal file,
|
|
Customer Transaction
|
- Invoice, promissory note, check information, information in box office receipts, order information, request information,
|
|
Legal Action
|
- Information in correspondence with judicial authorities, such as information in the case file,
|
|
Marketing
|
- Historical service information, survey, cookie records, information obtained through campaign work.
|
|
Transaction Security
|
- IP address information, website login and exit information, password and password information,
-
-
|
|
Financial Data
|
- Your financial data such as your bank account number, IBAN number, credit card information, payment information, billing information, and assets.
-
-
|
|
Audio-Visual Recordings
|
|
|
Biometric Data
|
- Biometric fingerprint information,
|
|
Other
|
- Your data such as insurance policy information, passport information, wage and payroll information, travel information, accommodation information, signature, travel document type, travel document number, school information, other countries to be visited, parent's name-surname, parent's year of birth, parent's nationality information, spouse-child's name-surname, spouse-child's nationality information, spouse-child's year of birth; your data such as the name-surname and nationality information of the person you will be traveling with.
|
7. GENERAL PRINCIPLES ON THE PROCESSING OF PERSONAL DATA
7.1. Legal Compliance
Our company carries out its personal data processing activities in accordance with the law and honesty rules, in accordance with the Constitution, the KVK Law and the relevant legislation. In this context, our Company takes action by determining the legal grounds that will require the processing of personal data, takes into account the requirements of proportionality, does not use personal data outside of what is required for the purpose, and does not perform any processing activities without the knowledge of individuals.
7.2. Accurate and up-to-date data when necessary
Our company; It ensures that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights of personal data owners and their own legitimate interests, and takes the necessary measures in this direction. In this context, data on all categories of persons are tried to be kept up-to-date, and all kinds of administrative and technical measures are taken to ensure accuracy and up-to-date.
7.3. Definite, Legitimate and Clear Purpose
Our company; It processes personal data only for clearly and precisely determined legitimate purposes and does not process data other than these purposes. The purpose for which personal data will be processed by our company is determined before the processing activity and is also processed in the "Personal Data Inventory".
7.4. Relating to the Purpose for which Data are Processed, Limited and Measured
Personal data is processed by our company to the extent necessary to achieve the determined purposes. Data processing is not carried out with the assumption that it can be used later. In this context, processes are constantly reviewed and the principle of reducing personal data is tried to be implemented.
7.5. Retention of Personal Data as Necessary and Deletion Afterward
Our company retains personal data only for as long as required by the relevant legislation or for the purpose for which they are processed. In this context, our Company first determines whether a period is foreseen for the storage of personal data in the relevant legislation, if a period is determined, it acts in accordance with this period. In the event that the period expires or the reasons requiring its processing disappear, personal data is deleted, destroyed or anonymized in accordance with our Company's "Data Destruction Policy".
8. TERMS OF PROCESSING PERSONAL DATA
Personal data may only be collected, processed or used within the scope of the legal bases set out below.
8.1. Open Consent
In Article 3 of the Law, explicit consent is defined as “consent based on information and expressed with free will regarding a specific subject”. In addition, in Article 20, paragraph 3 of the Constitution, it is stipulated that personal data can only be processed in cases stipulated by law or with the express consent of the person. Express consent is foreseen as the fundamental reason for compliance with the law in Law No. 6698 for both special personal data and non-special personal data.
Articles 5, 6, 8 and 9 of the Law include cases where data processing conditions are not met and consent is required, and our company processes personal data by obtaining express consents declared with free will and obtained in a provable manner (written, electronic or recorded verbally). In the case of processing of special personal data, express consents will be obtained in writing when necessary.
Process managers who process personal data are obliged to ensure the existence and validity of the express consent of the relevant data owner while the personal data they process is being collected. If it is determined that there is no explicit consent (except for the exceptions below), no data processing activity will be carried out.
8.2. Processing of Personal Data without Explicit Consent
In the presence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject:
8.2.1 expressly stipulated in laws,
8.2.2 The person who is unable to express his consent due to actual impossibility or whose consent is not given legal validity is compulsory for the protection of himself or someone else's life or physical integrity,
8.2.3 It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
8.2.4 It is mandatory for the data controller to fulfill its legal obligation,
8.2.5 It has been made public by the data owner himself,
8.2.6 Data processing is mandatory for the establishment, exercise or protection of a right,
8.2.7 Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner,
In such cases, it can be processed without express consent.
8.3. Processing of Private Personal Data
Our company shows special sensitivity in the processing of special personal data, the protection of which is of more critical importance for data owners in various aspects. In this context, such data is not processed without the explicit consent of the data owners, provided that sufficient measures determined by the Board are taken. However, it can be processed without explicit consent, provided that sufficient measures are taken and in the presence of the following reasons:
8.3.1. It is clearly prescribed by law,
8.3.2. It is mandatory for the protection of the life or physical integrity of the person who is unable to give his/her consent due to a de facto impossibility or whose consent is not legally valid, or of another person,
8.3.3. It is related to the personal data made public by the relevant person and is in accordance with the will to make it public,
8.3.4. It is mandatory for the establishment, exercise or protection of a right,
8.3.5. It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation of confidentiality or authorized institutions and organizations,
8.3.6. It is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
8.3.7. It is for the current or former members and members of foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or union purposes, provided that it complies with the legislation they are subject to and their purposes, is limited to their fields of activity and is not disclosed to third parties; or it is for persons who are in regular contact with these organizations and formations,
The KVKK Committee will be informed in every case where special personal data needs to be processed.
9. TRANSFER OF PERSONAL DATA
Your personal data may be transferred to the relevant Mission, domestic and foreign supervisory and regulatory authorities and relevant public institutions specified in the relevant mission's disclosure text, legally authorized public and private legal entities, our company's consultants, our auditors and our service providers within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698, limited to the purpose requested by the relevant mission within its legal authority.
Your personal data may be transferred to our suppliers, insurance companies, notaries, banks and financial institutions located in Turkey and/or abroad and with whom we cooperate in order to continue our company's activities and business processes, our consultancy firms from which we receive support in areas such as law, financial consultancy, tax, etc., legally authorized public institutions and private persons, domestic and/or foreign storage, archiving, information technology support (server, hosting, software, cloud computing, etc.) etc. that process personal data on behalf of our company. It may be transferred to our service providers from whom we receive support in their fields, within the framework of the personal data processing conditions specified in Articles 8 and 9 of Law No. 6698 and for the purposes specified above.
10. RIGHTS OF RELATED PERSONS
10.1 Kosmos will respond within 30 days to the requests of the persons whose personal data it processes, within the scope of the following rights:
(1) Learning whether personal data is processed or not,
(2) If personal data has been processed, requesting information about it,
(3) Learning the purpose of processing personal data and whether they are used in accordance with its purpose,
(4) To know the third parties to whom personal data is transferred in the country or abroad,
(5) Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
(6) Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist even though it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and requesting the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
(7) Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
(8) To request the compensation of the damage in case of loss due to unlawful processing of personal data.
10.2 Data owners can apply within the scope of the above-mentioned rights with the information and documents that will determine their identities and with the KVKK application form on the website with the methods specified below or other methods determined by the Personal Data Protection Board.
11. PRIVACY AND DATA SECURITY PRECAUTIONS;
All of the personal data processed within Kosmos is confidential, as specified in Article 12 of the Law;
a) To prevent the unlawful processing of personal data,
b) To prevent unlawful access to personal data,
c) To ensure the protection of personal data,
takes all necessary technical and administrative measures to ensure the level of security appropriate for its purpose.
11.1 Technical Measures Taken to Ensure Legal Processing of Personal Data and to Prevent Unlawful Access to Personal Data
Kosmos has taken all kinds of technical and technological security measures to protect your personal data and protects your personal data against possible risks. E.g;
• Network security and application security are provided.
• Security measures are taken within the scope of procurement, development and maintenance of information technology systems.
• Access logs are kept regularly.
• The authorizations of employees who have a change in duty or quit their job in this field are removed.
• Current anti-virus systems are used.
• Firewalls are used.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
• The security of environments containing personal data is ensured.
• Personal data is backed up and the security of the backed up personal data is also ensured.
• User account management and authorization control system is implemented and these are also followed.
• Log records are kept without user intervention.
• Intrusion detection and prevention systems are used.
• Encryption is done.
11.2 Administrative Measures to Ensure Legal Processing of Personal Data and to Prevent Unlawful Access to Personal Data
• A management framework has been established to initiate and control information security operation and implementation within the organization.
a. KVKK Committee and Liaison person have been appointed and their job descriptions have been determined.
b. KVKK Application channels have been determined.
c. Violation, claim/complaint management workflows have been determined.
• Main Principles, policies and procedures regarding the processing and protection of personal data have been determined.
a. Data Processing and Retention Policy Has Been Established.
b. A Policy on the Processing and Protection of Personal Data has been established.
c. A Policy Regarding the Security of Special Quality Personal Data has been established.
• Existing risks and threats have been determined within the scope of processed personal data.
• Training and awareness activities are carried out for employees on personal data security.
• Roles, responsibilities and job descriptions regarding data security have been determined in order to ensure that employees and contractors are aware of and fulfill their information security responsibilities.
• Confidentiality commitments are made.
• Employee, customer, supplier etc. Clarification text has been published for
• Processes requiring explicit consent are determined and implemented.
• In-house periodic and/or random audits are conducted and made. It eliminates privacy and security vulnerabilities that arise as a result of audits.
• Whether there is a need for the aforementioned personal data for the purpose of processing is evaluated and personal data is reduced as much as possible.
• If the data is obtained by others illegally, necessary measures are taken by the employees to inform the relevant person and the Board as soon as possible.
11.3 Measures to be Taken in Case of Unlawful Disclosure of Personal Data
In case the processed personal data is obtained by others illegally, our Company will notify the relevant data owner and the Board as soon as possible (within 72 hours maximum).
12. DISPOSAL (DELETE, DESTRUCTION AND ANONYMIZATION) CONDITIONS OF PERSONAL DATA
In accordance with Article 138 of the Turkish Penal Code, Article 7 of the KVK Law and the "Regulation on the Deletion, Destruction and Anonymization of Personal Data" issued by the Institution; Despite the fact that it has been processed in accordance with the provisions of the relevant law, in the event that the reasons requiring its processing are eliminated, personal data is deleted, destroyed or anonymized upon Kosmos' own decision or upon the request of the personal data owner. Kosmos has created a Policy in accordance with the provisions of the regulation on this subject and in accordance with this Policy, destruction is made according to the nature of the data. In accordance with this regulation, periodic destruction dates have been determined by Kosmos, and a calendar has been established according to which periodic destruction will be carried out at various intervals with the commencement of the obligation.
13. EXECUTION
A management structure has been established to ensure that Kosmos complies with the regulations of the KVK Law in the execution of this Policy.
14. EFFECTIVE DATE OF THE POLICY
This Policy entered into force on 07.01.2022 and was updated on 06.08.2024.