Personal Data Protection Law

You can submit your requests regarding your rights listed in Article 11 of the Law No. 6698 on the Protection of Personal Data to our company using one of the methods described below by completing the Application Form.

For applications made via email:

After filling out and signing the application form, you can send an email to destek@puanestore.com using the email address registered in our company's system. The subject line of the email should read "Application under the Law on the Protection of Personal Data".

For applications made via registered mail, notification through a notary public, or in person:

After filling out and signing the application form, write "Application under the Law on the Protection of Personal Data" on the envelope/notification and send it to Bağlar Mah. Yalçın Koreş Cad. You can apply to the following address: Erdinç Buildings No:22 A3 Floor:2 Bağcılar / Güneşli / ISTANBUL.

Applicants are required to provide identification for their applications.

Your applications will be answered as soon as possible, and no later than 30 (thirty) days from the date we receive your request, either in writing or electronically, according to your preference.

What are your rights?

To learn whether your personal data is being processed.
To request information regarding the processing of your personal data if it has been processed.
To learn the purpose of the processing of your personal data and whether it is being used in accordance with its purpose.
To know the third parties to whom your personal data has been transferred, domestically or internationally.
To request the correction of your personal data if it is incomplete or inaccurate, and to request that the correction be notified to the third parties to whom your personal data has been transferred. Even if processed in accordance with the law and other relevant legal provisions, you have the right to request the deletion or destruction of your personal data if the reasons requiring its processing cease to exist, and to request that this action be notified to third parties to whom your personal data has been transferred.
You have the right to object to a result that is detrimental to you arising from the analysis of your processed data exclusively through automated systems.
You have the right to claim compensation for damages if you suffer harm due to the unlawful processing of your personal data.

In accordance with the Law No. 6698 on the Protection of Personal Data

Procedure Regarding the Response of the Data Subject's Application to the Data Controller

Seylan Ready-Made Clothing Industry and Foreign Trade Limited Company

Purpose and Scope
This procedure has been prepared to determine the procedures, principles, and processes regarding the application that the data subject will make to the data controller in accordance with the Personal Data Protection Law (KVKK or the Law).

Definitions
Application: An application made by the data subject in accordance with Article 13 of the KVKK.

Application Form: The form related to the application made by the data subject in accordance with Article 13 of the KVKK.

Data Subject: The natural person whose personal data is processed.

Contact Person: In accordance with the Regulation on the Data Controllers Registry, the natural person notified to the Registry by the data controller for natural and legal persons residing in Turkey, and by the data controller's representative for natural and legal persons not residing in Turkey, in order to ensure communication with the Authority regarding their obligations under the Law and secondary regulations to be issued based on this Law.

Secure Electronic Signature: An electronic signature that is exclusively linked to the signatory, created using a secure electronic signature creation tool under the sole control of the signatory, and based on a qualified electronic certificate that enables the identification of the signatory and allows for the detection of any subsequent changes to the signed electronic data.

Registered Electronic Mail (KEP) Address: A qualified form of electronic mail that provides legal evidence regarding the use of electronic messages, including their sending and delivery.

Recording Medium: Any medium containing personal data processed wholly or partly automatically or non-automatically, provided it is part of a data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, wholly or partly automatically or non-automatically, provided it is part of a data recording system.

Board: The Personal Data Protection Board.

Mobile signature: An electronic signature created using a mobile device.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Company: Seylan Ready-Made Clothing Industry and Foreign Trade Limited Company

Right to Apply
(1) Pursuant to Article 13 of the KVKK (Personal Data Protection Law), data subjects whose personal data is processed by the company have the right to:

Learn whether their personal data is being processed,
Request their personal data if it has been processed,
Request the correction of their personal data if its content is incomplete or incorrect,
Request the deletion or destruction of their personal data if it has been processed unlawfully, and notify third parties to whom the data has been disclosed of the actions to be taken accordingly,
Request compensation for damages caused by the unlawful processing of their personal data. They may apply to the data controller company in accordance with this right. (2) Data subjects must first apply to the data controller in order to exercise their rights. Complaints cannot be filed with the Board without first exhausting this avenue.

(3) Data subjects may benefit from this right by submitting their applications in Turkish, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller (Communiqué).

(4) Data subjects can view and obtain information about the application procedures under this right on our website.

Application Procedure
(1) The data subject may submit their requests within the scope of the rights specified in Article 11 of the KVKK (Personal Data Protection Law) by completing the application form published on the website (Annex 1 – KVKK Application Form) and signing it with a wet signature,

via a notary public or by registered mail to the company address,
in person in writing to the company address,
using a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or an electronic mail address previously notified to the company and registered in the company's system. (2) The company may use a software or application developed for the purpose of the application to enable the data subject to apply.

(3) The application must include:

Name, surname and signature if the application is in writing,
For Turkish citizens, the Turkish Republic Identity Number (T.C. Kimlik No.) The following information is mandatory:
Identity number, for foreigners nationality, passport number or identity number if available,
Residence or workplace address for notification purposes,
Email address and telephone number for notification purposes, if any,
Subject of the request.

(4) Information and documents related to the subject are specified in the application form and attached to the application.

(5) In written applications, the date the document is delivered to the data controller or its representative is the application date.

(6) In applications made by other methods; the date the application reaches the data controller is the application date. The legal period for responding to the application begins from this moment.

(7) No financial burden not foreseen in the Law or the Communiqué can be imposed in applications made by the data subject.

Application Verification
(1) When an application is received, first, it is checked whether the data subject's application meets the conditions specified in article "4. Application Procedure" of this procedure and the data subject's identity information. (2) If, as a result of these checks, there is any deficiency in the application or the identity information of the relevant person, this will be notified to the relevant person and they will be asked to correct the deficiencies.

(2) If there is no problem with the application procedure, the request of the relevant person will be considered and the necessary investigations will be carried out. If, as a result of the investigation, it is concluded that there is no action to be taken regarding the subject of the request, this will be notified to the relevant person as stated in section "6. Response to Application" of this procedure, and the request of the relevant person will be rejected with the reasoning.

(3) If, as a result of the investigation, the request of the relevant person is found to be justified, the request will be fulfilled immediately and the relevant person will be given a response as stated in section "6. Response to Application" of this procedure.

Response to Application
(1) The company is obliged to take all necessary administrative and technical measures to ensure that applications made by the data subject are processed effectively, in accordance with the law and the principle of good faith.

(2) The company accepts the application or rejects it, explaining the reasons. Explaining the reasons for the rejection decision is important for more effective protection of the data subject's rights. If the company accepts the data subject's request, it is obliged to fulfill the requirements of the request directly and immediately. If the requirements are not fulfilled despite the acceptance of the request, it is assumed that the company has rejected the request.

(3) The company notifies the data subject of its response in writing or electronically. Appendix 2 – Response Text is used for the response.

(4) If the data subject has specified a method for receiving the response in their application, the response should be given to the data subject using that method.

(5) The response must include at least the following information:

Information about the data controller company,
The applicant's; Name and surname, Turkish Republic identity number for Turkish citizens, nationality, passport number or identity number if available for foreigners, residential or business address for notification purposes, e-mail address for notification purposes if available, telephone and fax number,
Subject of the request,
Company's explanations regarding the application. (6) The company will process the requests included in the application free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the process requires additional costs, the fee specified in Article 6 may be charged. If the application is due to an error of the data controller, the fee charged will be refunded to the relevant person.

(6) If the request of the relevant person is accepted, the data controller will fulfill the request as soon as possible and inform the relevant person.

(7) If no response is given to the application within thirty (30) days, the application will be deemed rejected by the company. In this case, the relevant person has the right to file a complaint with the Board.

Fees
(1) If the response to the data subject's application is to be given in writing, no fee will be charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page exceeding ten pages.

(2) If the response to the application is provided on a CD, flash drive, or similar recording medium, the fee that may be requested by the company cannot exceed the cost of the recording medium.

(3) If the application is due to an error on the part of the company, the fee charged will be refunded to the data subject.

Internal Company Responsibility and Operation
(1) The Personal Data Protection Law Contact Person and, if established within the company, the Personal Data Protection Law Committee are responsible for the management and operation of the process related to the data subject's application under the Law.

Personal Rights and Legal Recourse
(1) Data subjects whose personal rights have been violated retain the right to compensation according to general provisions. The data subject may both file a complaint with the Board and directly pursue legal action. In other words, there is no obligation to apply to the data controller before the matter is brought before the courts.

Relevant Policies and Procedures
This procedure should be considered together with all policies and procedures put into effect by the Company regarding the protection and processing of personal data.

Entry into Force, Amendment and Update
This procedure enters into force as of the date it is approved by the Company's legal representative. Any changes or updates to this procedure shall enter into force as of the date the change or update is approved. Even if the procedure is not updated, changes in legislation shall be applied immediately.

Appendix 1 – Personal Data Protection Law Application Form

Appendix 2 – Response Text

Examples of Board Decisions

“Regarding an application to the Board concerning an operator company's rejection of an application made by the data subject via its website on the grounds that it could not verify identity”: Decision No. 2019/296 of the Personal Data Protection Board dated 01/10/2019

“Regarding T.C. Ziraat Bankası A.Ş., which did not respond to the application of the data subject and whose information text published on its website does not meet the requirements stipulated in the legislation”: Decision No. 2019/122 of the Personal Data Protection Board dated 02/05/2019

“Regarding applications made to the Board concerning matters falling within the jurisdiction of judicial authorities”: Decision No. 2018/156 of the Personal Data Protection Board dated 24/12/2018

“Regarding an application to the Board concerning the processing of visual and auditory personal data of the data subject within the video promotional section of the website of a medical center, by the data controller medical center…” Regarding the "failure of the central office to respond": Decision No. 2020/379 of the Personal Data Protection Board dated 14/05/2020

Regarding the complaint filed with our Institution by the data subject after the father of the data subject, who is under 18 years of age, applied to the data controller for the destruction of the data subject's health report and received no response: Decision No. 2020/622 of the Personal Data Protection Board dated 11/08/2020