PDPL Data Subject Application policy

1. Introduction

1.1 Purpose

According to Article 20 of the Turkish Constitution, titled "Privacy of Private Life," everyone has the right to demand the protection of their personal data. This right includes being informed about their personal data, accessing it, requesting its correction or deletion, and learning whether it is being used for its intended purpose. The Law on the Protection of Personal Data No. 6698 ("Law"), published in the Official Gazette dated 07.04.2016 and numbered 29677, regulates the protection of fundamental rights and freedoms of individuals, especially the right to privacy in the processing of personal data, and the obligations of real and legal persons processing personal data and the procedures and principles they must comply with. This “Policy on Application Processes of Personal Data Owners” (“Policy”) aims to determine the procedures and principles regarding the application processes regarding personal data carried out by SUMA ROBOTIC MAKINA SANAYI VE TICARET LIMITED SIRKETI (“Company”).

1.2 Scope

Personal data of all data subjects that the Company comes into contact with are within the scope of this Policy, and the Company's obligations and activities regarding application processes are also subject to this Policy.

1.3 Legislative Information

Regarding the application processes, Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller are taken as basis.
COMMUNIQUE
From the Personal Data Protection Institution:
COMMUNIQUE ON THE PROCEDURES AND PRINCIPLES OF APPLICATION TO THE DATA CONTROLLER
Purpose and scope:
ARTICLE 1 – (1) This Communiqué has been prepared to determine the procedures and principles regarding the application to the data controller and the fee to be charged in case the transaction requires an additional cost.
Basis
ARTICLE 2 –
(1) This Communiqué has been prepared based on the subparagraphs (e) and (g) of the first paragraph of the 13th ARTICLE and 22nd ARTICLE of the Law on the Protection of Personal Data No. 6698 dated 24/3/2016.
Definitions
ARTICLE 3 – (1) In this Communiqué; the following terms refer to the following meanings:
a) Application: Application made under Article 13 of the Law.,
b) Secure Electronic Signature: An electronic signature that is created with a secure electronic signature creation tool that is solely at the disposal of the signatory, and that allows the identification of the signatory based on a qualified electronic certificate, and allows the identification of any subsequent changes to the signed electronic data,
c) Relevant person: The natural person whose personal data is processed,
ç) Law: Law on the Protection of Personal Data No. 6698 dated 24/3/2016,
d) Recording medium: Any medium containing personal data processed by fully or partially automatic means or non-automatic means provided that it is part of any data recording system,
e) Registered electronic mail (KEP) address: A qualified form of electronic mail that provides legal evidence regarding the use of electronic messages, including their sending and delivery,
f) Board: Personal Data Protection Board,
g) Institution: Personal Data Protection Institution,
ğ) Mobile signature: An electronic signature created using a mobile device.
(2) For definitions not included in this Communiqué, the definitions in the Law will apply.
Right to apply
ARTICLE 4 –
(1) Natural persons whose personal data is processed have the right to apply to the data controller.
(2) Interested persons may benefit from this right provided that they submit their applications in Turkish.
Application procedure
ARTICLE 5 –
(1) The relevant person shall submit his/her requests to the data controller within the scope of his/her rights specified in Article 11 of the Law, in writing or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address previously notified to the data controller by the relevant person and registered in the data controller's system, or through a software or application developed for the application purpose.
(2) The following must be included in the application:
a) Name, surname, and signature if the application is in writing;
b) Turkish Republic identity number for citizens of the Republic of Turkey; nationality, passport number, or ID number, if applicable, for foreigners;
c) Residence or workplace address for notification;
ç) Email address, telephone, and fax number, if applicable, for notification.
d) Subject of the request.
(3) Relevant information and documents shall be attached to the application.
(4) For written applications, the date the document is notified to the data controller or its representative is the application date.
(5) For applications submitted by other methods, the date the application reaches the data controller is the application date.
Response to application
ARTICLE 6 –
(1) The data controller is obligated to take all necessary administrative and technical measures to ensure that applications submitted by the data subject within the scope of this Communiqué are processed effectively, legally, and in accordance with the principle of integrity.
(2) The data controller accepts the application or rejects it, explaining the reason.
(3) The data controller notifies the data subject of its response in writing or electronically.
(4) The following must be included in the answer letter :
a) Information about the data controller or its representative,
b) The applicant's name and surname, the Turkish ID number for citizens of the Republic of Turkey; and for foreigners, nationality, passport number or ID number, if any, residence or workplace address for notification, e-mail address, telephone and fax number for notification, if any,
c) Subject of the request,
ç) The data controller's explanations regarding the application
(5) The data controller will process the requests included in the application free of charge, depending on the nature of the request, as soon as possible and within thirty days at the latest. However, if the process requires additional costs, the fee specified in Article 7 may be charged. If the application is caused by the data controller's error, the fee will be refunded to the relevant party.
(6) If the request of the relevant person is accepted, the data controller fulfills the request as soon as possible and informs the relevant person.
Fee
ARTICLE 7 –
(1) If the data subject's application is to be responded to in writing, no fee will be charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page exceeding ten pages.
(2) If the response to the application is provided on a recording medium such as a CD or flash drive, the fee charged by the data controller cannot exceed the cost of the recording medium.
Force
ARTICLE 8 –
(1) This Communiqué shall enter into force on the date of its publication.
Execution
ARTICLE 9 –
(1) The President of the Personal Data Protection Authority shall enforce the provisions of this Communiqué.

2. RESPONSIBILITIES AND DUTY DISTRIBUTIONS

  • Applications are received by the Administrative Affairs Department, which is responsible for checking the company's e-mail address, the Accounting Department, which is responsible for checking the KEP address inbox, and the Administrative Affairs Department, which is responsible for checking physical notifications.
  • The Administrative Affairs Department checks the mandatory content of the application as required by law and determines whether the application is valid.
  • In case of invalid applications, the deficiencies are notified to the applicant and requested to be completed.
  • In valid applications, information and documents are collected from relevant departments and a response letter is prepared by the Company's Legal Counsel/Lawyer/Contracted Lawyer and sent to the applicant.
  • If the application includes a destruction request, data will be destroyed using the methods specified in the Company's Storage and Destruction Policy, excluding cases where retention is required by law. This will be reported to the relevant authorities by the Administrative Affairs Department.