PRIVACY NOTICE ON COMMUNICATION

Data controller:

Odeon Yazılım ve Teknoloji Anonim Şirketi

Maslak Mah. Taşyoncası Sk. Maslak 1453 Sitesi No: 1G Kapı No: 51 Sarıyer / Istanbul

Odeon Yazılım ve Teknoloji Anonim Şirketi (hereinafter referred to as “OYT”), as a data controller within the meaning of Law No. 6698 on the Protection of Personal Data (“KVKK”), attaches great importance to the security of your personal data and hereby informs you about its processing.

Within the scope of our communication activities, your identity information (name, surname), contact information (e-mail address, phone number), activity information (request / complaint / offer information), activity security information (IP address details, website login / logout information, log records, device MAC address details) will be collected through OYT’s communication tools, online electronic forms and data processing technologies. These data will be processed for the purposes of conducting communication activities, tracking requests / complaints, carrying out customer relations management processes, conducting after-sales support services for goods / services, carrying out necessary research / examinations to provide support services related to the subject of the request, providing you with information and support services, and managing information security processes.

Your identity, contact and activity information processed within the scope of communication activities will be processed based on the legal grounds set forth in Article 5 paragraph 2 subparagraph (c), “Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract” and subparagraph (f), “Processing of data is mandatory for the legitimate interests pursued by the data controller, provided that it shall not violate the fundamental rights and freedoms of the data subject”.

Your activity security information will be processed based on the legal grounds set forth in Article 5 paragraph 2 subparagraph (ç), “Processing of data is mandatory for the compliance with a legal obligation of the data controller,” and subparagraph (f), “Processing of data is mandatory for the legitimate interests pursued by the data controller, provided that it shall not violate the fundamental rights and freedoms of the data subject”.

To whom and for what purposes can your personal data be transferred?

Your personal data may be transferred only to the extent necessary to achieve relevant purposes, in accordance with the rules specified in Article 8 of KVKK regarding domestic data transfers and by taking all necessary technical and administrative measures:

• To authorized public institutions and organizations for the purposes of conducting activities in accordance with legislation, providing information to authorized persons, institutions and organizations, and monitoring and conducting legal affairs;
• To affiliates for the purposes of conducting and supervising business activities, conducting communication activities, and providing after-sales support services for goods and services.

What are your rights with regard to your personal data as a data subject?

Regarding your personal data, you are entitled to:

• Learn whether your personal data has been processed;
• Request information if your personal data has been processed;
• Learn the purpose of personal data processing and whether it has been used in accordance with that purpose;
• Know the third parties to whom your personal data has been transferred, both domestically and internationally;
• Request correction of your personal data if it has been processed incompletely or incorrectly;
• Request the deletion or destruction of your personal data in accordance with the provisions of KVKK;
• Request that third parties to whom your personal data has been transferred be notified in case you have requested the correction of incomplete or inaccurate data, or the deletion or destruction of your personal data;
• Object to any decisions that adversely affect you as a result of your processed data being analysed exclusively through automated systems;
• Request compensation for damages suffered as a result of unlawful processing of your personal data.

How can you exercise your rights?

You may submit your applications and requests regarding your personal data through the Data Subject Application Form available on our website,

• By sending a wet-signed copy of the form together with a photocopy of your ID to Maslak Mah. Taşyoncası Sk. Maslak 1453 Sitesi No: 1G İç Kapı No: 51 Sarıyer / Istanbul;
• By applying in person to OYT with a valid identity document;
• By signing the form with a mobile signature or secure electronic signature and sending it via e-mail to kvkk@odeontechnology.com;
• By sending it to our registered e-mail (KEP) address odeonteknoloji@hs01.kep.tr using your registered e-mail address along with a mobile or secure electronic signature;
• By sending it to kvkk@odeontechnology.com from the e-mail address previously notified to OYT by the data subject and registered in our system.

In accordance with the Regulation on the procedures and principles of application to the data controller, the application of the data subject must include the following information: name, surname, signature (if the application is in writing), Turkish ID number (if the applicant is a foreign national, his/her nationality, passport number, or ID number (if any)), residence or workplace address for official notifications, e-mail address, phone number and fax number (if any) for notifications, and information regarding the subject of the request.

In the application submitted to exercise the above-mentioned rights, the data subject must clearly and comprehensibly specify the request and provide explanations regarding the right invoked. Any information and documents related to the application must be attached.

The subject of the request must be personally related to the applicant. If acting on behalf of someone else, the applicant must be authorized to do so, and this authority must be documented (power of attorney). If the application covers sensitive personal data, the applicant must be specifically authorized for this purpose, in accordance with Article 10 of the Regulation on personal health data. Furthermore, the application must include identity and address information, and documents confirming identity must be attached.

Requests submitted by unauthorized third parties on behalf of someone else will not be considered.

How long will it take to respond to your requests regarding the processing of your personal data?

Your requests regarding your personal data will be evaluated and responded to as soon as possible, and no later than 30 days from the date they are received. If your request is accepted or rejected with justification, our response will be sent to you by mail or e-mail to the address you provided in your application, and, if possible, using the same method by which you submitted your request. If the evaluation and decision-making require additional costs, the fee set by the Personal Data Protection Board will be applied.