1. General Purpose

As CyberArts Bilişim Anonim Şirketi, we show utmost care and attention to the protection of all fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing and protection of personal data. In this context, we act in accordance with the principles of transparency and openness towards each person whose data we process.

This Personal Data Protection and Processing Policy (“Policy”) is CyberArts's responsibility for compliance with the personal data we process as CyberArts Bilişim Anonim Şirketi ("CyberArts"), with the relevant articles established in the Constitution and the Personal Data Protection Law No. 6698 and other relevant legislation provisions. It has been prepared for the purpose of transparently sharing the basic principles adopted in the activities it carries out with the public. 

Regarding the processing and protection of personal data, in case of conflict between the provisions of the applicable legislation and the provisions of this Policy, the provisions of the current legislation shall prevail.

2. Scope

The scope of this Policy; Company employees, employee candidates, customers, potential customers, service providers, visitors, employees and officials of cooperating institutions and all personal data processed automatically or non-automatically provided that they are part of any data recording system. relates to data. 

While sharing your data with us by filling out the forms on the contact and career pages, you will receive the offer on our site, subscribe to the newsletter, and you will be provided with the necessary information in the process, and you can reach detailed information through the business policy as the relevant person.

3. Definitions and Abbreviations

The definitions used in the implementation of this Policy are shown in the table below in accordance with the relevant legislation.

4. Principles to be Followed When Processing Personal Data

At every stage of CyberArts personal data processing activity, listed in Article 4 of the Law and shown below;

• “Being in compliance with the law and honesty rules,
• Being accurate and up-to-date when necessary,Being accurate and up-to-date when necessary,
• Processing for specific, explicit and legitimate purposes,
• Being connected, limited and restrained with the purpose for which they are processed,
• It will act in accordance with the principles of “preservation for the period required for the purpose for which they are processed or stipulated in the relevant legislation”.

5. Considerations Regarding the Processing of Personal Data

5.1. Personal Data Collected

Clearly belonging to an identified or identifiable natural person by CyberArts; The categorization and explanation of personal data processed partially or fully automatically or non-automatically as part of the data recording system is shown in the table below.

5.2. Data Groups

Owners of personal data processed within the scope of this Policy are shown in the table below.

5.3. Purposes of Processing Personal Data

Personal data processed by CyberArts are processed in accordance with the Law for the following purposes. The purposes of processing personal data are shown in general and may vary according to the specifics of the concrete case.

Within the scope of planning and development of each commercial activity specific to CyberArts, execution of the work and providing legal and technical security;

• Planning and execution of the company's physical and electronic / network security studies,
• Notifications to official institutions,
• Carrying out legally necessary actions, fulfilling obligations,
• Activities related to the establishment and performance of contracts,
• Activities related to the execution, management, planning and execution of relations with customers,
• Follow-up of finance and accounting works,
• Planning or execution of business continuity activities,
• Event management,
• Performing efficiency, productivity or appropriateness analyzes of business activities,
• Execution of goods/service procurement processes,
• Execution of sales or marketing processes of products/services,
• Carrying out storage and archiving activities,
• Fulfilling the obligations regarding all kinds of visitors entering and leaving the address where CyberArts resides, in accordance with the law,
• Within the scope of management and concluding activities of request-complaint processes after and during the service,
• To improve our website, to monitor its technical functionality and to ensure that it works properly,
• Organization and event management,

Planning or Execution of Our Company's Human Resources Policies and Processes;

• Carrying out the application processes of employee candidates,
• Execution of employee satisfaction and loyalty processes,
• Fulfillment of obligations arising from employment contracts and legislation for employees,
• Planning of human resources processes,
• Execution of fringe benefits and benefits processes for employees,
• We process the data of the employees for the purposes of keeping their personal files in accordance with the relevant legislation.

5.4. Associating Data Groups with Data Categories

5.5. Method of Obtaining Personal Data

By informing your personal data in accordance with the relevant legislation;

• Through the cookies produced when you visit our website,
• When you fill out the career, newsletter subscription, offer, contact forms on our website,
• Through social media channels,
• Through business card sharing,
• Via visitor records,
• By means of e-mails sent by the data owners and communication with the data owners over the box office, stands, telephone
• We collect your personal data through contracts.

5.6. Processing Methods of Personal Data and Legal Reason

5/1 of the Law. CyberArts pays utmost attention to issues such as obtaining explicit consent and disclosure processes while processing personal data. CyberArts may process personal data based on one or more of the legitimate reasons listed in Article 5 of the Law, without relying on express consent. 5/2 of the Law. legitimate reasons listed in the article; 

• Clearly stipulated in the law,
• It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid,
• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract,
• It is mandatory for the data controller to fulfill its legal obligation,
• The person concerned has been made public by himself,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Provided that it does not harm the fundamental rights and freedoms of the data subject, it may be based on one or more of the legitimate reasons listed as the necessity of data processing for the legitimate interests of the data controller.

5.7. Processing of Private Personal Data

CyberArts, to the extent required by the Law, 6/1 of the Law. It also processes the special categories of personal data listed in the article. These processed personal data are processed in accordance with the Law, by obtaining express consent and by taking adequate precautions.

6. Matters Regarding the Transfer of Personal Data

6.1. Transfer of Personal Data

CyberArts pays the utmost care and attention to the fact that the data it processes is not transferred to the country and abroad, in cases where there is no explicit consent of the personal data owner in accordance with the Law and in cases where there is no legal compliance.

6.2. Domestic Transfer of Processed Personal Data

CyberArts will be able to transfer personal data domestically by acting in accordance with this Policy, on the condition of acting in accordance with the conditions in Article 8 of the Law, even in cases where the person concerned does not have express consent for the transfer of the personal data it processes to the country. 5/2 of the Law from these conditions. in the article;

• The relevant activities regarding the transfer of personal data are clearly stipulated in the laws,
• The transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
• The transfer of personal data is mandatory for our Company to fulfill its legal obligation, 
• Transferring personal data by our Company in a limited manner for the purpose of making it public, provided that the personal data has been made public by the data owner, 
• The transfer of personal data by the Company is mandatory for the establishment, exercise or protection of the rights of the Company or the data owner or third parties, 
• It is mandatory to carry out personal data transfer activities for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner,
• A person who is unable to express his or her consent due to actual impossibility or whose consent is not legally recognized may transfer normal personal data into the country without the explicit consent of the person concerned, if it is necessary for the protection of his or someone else's life or physical integrity, and if the conditions are met.

6.2.1 Domestic Transfer of Private Personal Data

CyberArts will be able to transfer personal data domestically by acting in accordance with the conditions in Article 8 of the Law, even in cases where the person concerned does not have express consent for the transfer of sensitive personal data to the country. It will be able to process the processed special quality personal data in accordance with the conditions listed below, together with taking all necessary administrative and technical measures in accordance with the methods and forms to be determined by the relevant legislation and the Board. 

• Special categories of personal data other than health and sexual life may be processed without the explicit consent of the data owner, provided that it is expressly stipulated in the law, in other words, there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained.
• Special quality personal data regarding health and sexual life, for the purpose of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without the explicit consent of persons or authorized institutions and organizations under the obligation of keeping confidentiality. can be processed. Otherwise, the explicit consent of the data owner will be obtained.

CyberArts may process the sensitive data it processes without the explicit consent of the person concerned by providing the conditions listed above in accordance with Article 8 of the Law.

6.3. Transfer of Personal/Private Personal Data Abroad

CyberArts does not transfer the data it processes to abroad, in the absence of the express consent of the person concerned and the reasons for transfer listed in the legislation. However, the normal and special personal data processed can be transferred abroad without the explicit consent of the person concerned, provided that the provisions listed in Article 9 of the Law are followed.

6.2. and 9/2 of the Law, together with the conditions listed in 6.2.1. In the foreign country to which the transfer will be made as listed in the article;

• “The availability of adequate protection,
• In the absence of sufficient protection, it may transfer the data it processes abroad, provided that the conditions of “the data controllers in Turkey and the relevant foreign country undertake in writing to provide adequate protection and that the Board has the permission”.

6.4. Recipient Groups to be Transferred, Purpose and Definition of Transfer

CyberArts processes personal data in accordance with the relevant legislation, provided that the conditions listed in the above articles are met and in accordance with all other relevant legislation;

• Business partner,
• Supplier,
• CyberArts Shareholder/Authorities,
• Legally Authorized Public Institutions and Organizations,
• Legally Authorized Private Law Persons,
• Banks,

may share the personal data it processes with

7. Storage and Disposal of Personal Data

CyberArts preserves the personal data it processes for the minimum period stipulated in the current legislation and for the period required for the purpose for which it is processed. In this context, personal data are deleted, destroyed or anonymized upon the request of the person concerned, by periodically checking the minimum period stipulated in the legislation and the expiration of the period related to the purpose for which they are processed.

The criteria used to determine this period, including the retention period for each category of personal data and the legal obligations that CyberArts has to keep the data, are specified in CyberArts' Personal Data Retention and Destruction Policy and will be applied in all cases.

8. Measures to Ensure Data Security

CyberArts shows the utmost care and diligence in taking all kinds of technical and administrative measures stipulated by the relevant legislation and the Board to ensure the appropriate level of security required for the protection of personal data. Within this scope, the measures taken by CyberArts to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the protection of personal data are listed below..

Administrative Measures Taken for Personal Data Security

• CyberArts periodically performs/ has them do the necessary inspections in order to ensure the implementation of the provisions of the Law.
• There are personal data security policies and procedures.
• CyberArts employs knowledgeable and experienced personnel about the processing of personal data and provides the necessary training to its personnel. Awareness studies are carried out periodically.
• By adopting the understanding of data minimization, it works to reduce personal data as much as possible.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
• Personal data is backed up and the security of the backed up personal data is also ensured.

Technical Measures Taken for Personal Data Security

• ISO 27001 Information Security Management System is operated in our company. 
• The security of electronic media containing personal data is ensured.
• Performs necessary internal controls within the scope of established systems.
• CyberArts employs knowledgeable and experienced people in order to ensure data security and periodically gives the necessary training to its personnel.
• Data Loss prevention software is used.
• Current anti-virus systems are used.
• Institutional policies on access, information security, use, storage and destruction have been prepared and started to be implemented.
• User account management and authorization control system is implemented and these are followed.
• An authorization matrix has been created for employees.
• Confidentiality commitments are made.
• The signed contracts contain data security provisions.
• Access logs are kept regularly.
• The security of personal data stored in the cloud is ensured.
• Cyber security measures have been taken and its implementation is constantly monitored.

9. Personal and Owners' Rights and the Exercise of These Rights

9.1. Rights of Personal Data Owners

Personal data owners in Article 11 of the Law;

a. “Learning whether personal data is processed or not

b. If personal data has been processed, requesting information on the nature of this information and learning to whom it has been disclosed

c. Learning the purpose of processing personal data and whether they are used in accordance with the purpose

d. Knowing the third parties to whom personal data is transferred, in the country or abroad, and requesting the notification of the transaction made in this direction to third parties

e. In case of incomplete or incorrect processing of personal data, requesting their correction and notification of this to third parties

f. Requesting the deletion or destruction of personal data in the event that the reasons for processing disappear, although it has been processed in accordance with the provisions of the relevant law

g. Objecting to the emergence of a result against the person himself

h. In the event that personal data is damaged due to unlawful processing, they have the right to demand the compensation of the damage.

9.2. Ability of Personal Data Owners to Use Their Rights

Data owners may submit their requests regarding their rights enumerated in the Law, together with information and documents to identify them, to CyberArts in accordance with the methods determined by the Law and the Board. In this respect, all necessary information can be accessed through the use of the KVKK application form prepared by CyberArtshttps://www.cyberartspro.com/wp-ontent/themes/upscale/KVKK/Veri_Sahibi_KVKK_Basvuru_Formu-cyberarts.pdf If the transaction also requires a cost, a fee may be charged based on the fee in the tariff determined by the Personal Data Protection Board.

10. Enforcement of the Policy

This policy prepared by CyberArts is deemed to come into force after it is approved by the General Manager and published on the website. This prepared policy is periodically reviewed by CyberArts and made compatible with possible changes in the Law or Board decision. Updates made are also tabulated at the end of the policy.