INFORMATION NOTICE

As the South Aegean Development Agency (“Agency”), we place the utmost importance on the security of personal data. The Agency takes the highest level of security measures within the framework of the relevant legislation to ensure the lawful collection, storage, and sharing of your personal data and to protect your privacy.

With the awareness of this responsibility and in the capacity of Data Controller under Law No. 6698 on the Protection of Personal Data (“KVKK”), we process your personal data as described below and in compliance with the legislation.

Your personal data may be collected by our Agency through various channels (oral, written, electronic) for the purpose of carrying out our activities, ensuring compliance with the legislation and the Agency's internal policies, fulfilling contractual obligations, and based on the legal grounds of the Agency’s legitimate interest and legal requirements explicitly stated by law. Your personal data may also be processed for the purposes stated in this Information Notice, in accordance with the fundamental principles set forth by the KVKK and the conditions and purposes for processing personal data as outlined in Articles 5 and 6 of the KVKK.

The personal data processed hereunder is not transferred except for the purposes listed below and as legally required.

1) Identity of the Data Controller and Its Representative

In accordance with Article 10 of the KVKK, the scope under which your personal data may be processed by the South Aegean Development Agency, acting as the data controller, is detailed below.

2) Purposes of Processing Personal Data

Your collected personal data may be processed by the South Aegean Development Agency in compliance with the fundamental principles stipulated in the legislation for the following purposes:

• To carry out the necessary activities by our business units to ensure the Agency’s operations are conducted in accordance with the legislation and internal policies;
• To determine, plan, and implement the Agency’s short, medium, and long-term policies;
• To ensure the commercial, technical, and legal security of the related persons who have a business relationship with the Agency and to maintain communication with such real/legal persons;
• To maintain the regional reputation and the trust established by the South Aegean Development Agency;
• To comply with the obligations regarding data retention, reporting, and informing as prescribed by law and to fulfill legal obligations related to benefiting from public services;
• To define and implement the Agency’s business and strategic plans; to perform financial operations, communications, social responsibility activities, to monitor investments and promote the investment environment, and to carry out activities concerning state incentives as prescribed by law;
• To examine, evaluate, and respond to requests from public authorities or relevant individuals;
• To fulfill the burden of proof in potential legal disputes in the future;
• To process data within the scope of the conditions and purposes of personal data processing set forth in Articles 5 and 6 of the KVKK;
• To classify your data within the scope of automated decision-making for the purpose of processing the required data and information within the scope of our activities. This may be necessary for reports and documents to be submitted to relevant institutions.

Processing your personal data is a legal and contractual obligation. Failure to provide such data may render it impossible to maintain a relationship with real/legal persons associated with the Agency, to carry out the required activities, fulfill legal notifications and obligations, execute HR processes, and ensure legal, technical, and commercial security.

3) Transfer of Personal Data and Transfer Abroad

Personal data may be transferred by the South Aegean Development Agency, within the scope of the purposes listed above and in accordance with Article 8 of the KVKK, to the following entities:

• Business partners and subsidiaries of the Agency,
• Persons and institutions permitted under the Turkish Commercial Code, Turkish Code of Obligations, Labor Law, and other relevant legislation,
• Legally authorized public institutions and organizations, administrative and legal authorities, and institutions/persons/firms stipulated by special laws,
• Real and legal persons from whom we receive services or with whom we cooperate.

In case of transfer, it will be ensured that the domestic recipient institutions and/or organizations are also compliant with KVKK and possess adequate data security measures.

According to Article 9 of the Law, your personal data may be transferred abroad in the following cases:

• With the explicit consent of the data subject; or
• In the presence of circumstances specified in the Law (Article 5(2) and Article 6(3)), provided that:
  • The destination country is among those with adequate protection (as declared by the Board); or
  • If the country does not have adequate protection, adequate protection is committed in writing and permission from the Board is obtained.

The Personal Data Protection Board will announce the list of countries with adequate protection.

4) Method and Legal Grounds for Collecting Personal Data

Your personal data is collected through various channels (oral, written, electronic) by our Agency for the purpose of carrying out our activities, ensuring compliance with legislation and internal policies, performing contractual obligations, and based on the Agency’s legitimate interest and legal obligations explicitly stated by law. Your personal data may be processed and transferred for the purposes set forth in this Information Notice, in accordance with the fundamental principles provided under the KVKK and the conditions and purposes defined in Articles 5 and 6 of the Law.

5) Retention Period of Personal Data

Your personal data will be stored for the period prescribed by the relevant legislation or as long as necessary for the purpose for which it was processed. The following criteria are considered in determining the maximum retention period:

• Commonly accepted retention periods in the sector in which the data controller operates, according to the purpose of processing the relevant data category;
• The duration of the legal relationship established with the data subject requiring the processing of the personal data;
• The period during which the data controller may legally and ethically benefit from the legitimate interests obtained from processing the relevant data;
• The duration for which the risk, cost, and legal responsibilities of retaining the data continue;
• Whether the maximum period allows the data to be kept accurate and up-to-date when necessary;
• Legal obligations of the data controller to retain the data;
• The statute of limitations for asserting rights associated with the relevant personal data.

6) Rights of the Personal Data Subject under Article 11 of the KVKK

Data subjects may submit their requests regarding their rights to the South Aegean Development Agency in accordance with the methods outlined in the Agency's Personal Data Protection and Processing Policy, published at www.geka.gov.tr. The Agency will conclude the request as soon as possible and within no later than thirty (30) days depending on the nature of the request. However, if the procedure requires a separate cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

In this context, data subjects have the right to:

• Learn whether their personal data is being processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing personal data and whether they are used appropriately,
• Learn the third parties in the country or abroad to whom personal data has been transferred,
• Request correction of personal data if it is incomplete or incorrectly processed and request that the related transaction be notified to third parties,
• Request the deletion or destruction of personal data if the reasons requiring their processing no longer exist, even though they have been processed in accordance with the KVKK and other relevant laws, and request that this process be notified to third parties,
• Object to the occurrence of a result against themselves by analyzing the processed data exclusively through automated systems,
• Demand compensation for damages if they suffer damage due to unlawful processing of personal data.

In cases where the application is rejected, the response is deemed insufficient, or the application is not responded to within the prescribed period, the data subject may file a complaint with the Personal Data Protection Board within thirty (30) days from the date of learning of the response and, in any event, within sixty (60) days from the date of application. Pursuant to Article 13 of the Law, the complaint process cannot be initiated without first exhausting the application process.

Under international regulations, in addition to the above rights, the data subject also has the right to request restriction of data processing and to withdraw consent regarding the processing or transfer of personal data.

Applications related to the rights listed above can be made using the Data Subject Application Form available at www.geka.gov.tr.

İlgili Dosyalar

Aydınlatma Metni

Çerez Politikası

Kişisel Veri İşleme ve Koruma Politikası

Özel Nitelikli Kişisel Veri İşleme ve Koruma Politikası

Kişisel Veri Saklama ve İmha Politikası

KVKK Hak Bildirgesi