VISITOR PRIVACY NOTICE

As Akasya Çocuk Dünyası A.Ş. (“Company”), we show maximum sensitivity to processing and protecting your personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) and its secondary regulations. This privacy notice has been prepared by the Company in its capacity as data controller to fulfill the disclosure obligation under Article 10 of the Law regarding the processing and transfer of personal data obtained from Company visitors.

1. PURPOSES AND TRANSFER OF PROCESSING YOUR PERSONAL DATA

The Company, as the data controller, processes your personal data lawfully and fairly, limited to the purposes specified below and for no other purposes. Processing includes—but is not limited to—recording, storing, classifying, updating, and transferring to third parties where permitted by legislation or limited to the purpose for which they were processed.

• Visitor Registration Process: Your identity data, professional experience data limited to the company you work for, and transaction security data including entry-exit timestamps to/from the premises and visitor card number are processed to ensure physical security, and to create and track visitor records. These personal data are shared with our group companies, visitor registration and access control vendors, and IT infrastructure and technical support providers to conduct entry-exit processes, maintain visitor logs, operate relevant information systems, and provide infrastructure, maintenance, and technical support services.
• Physical Security Process: Your physical premises security data, limited to CCTV video recordings, are processed to ensure physical space security and are retained for a period of 1 month. These recordings are shared with our security systems maintenance supplier to conduct periodic maintenance and technical support for camera systems.
• Logging Process under Law No. 5651: Your communication and transaction security data are processed to manage information security processes and conduct operations in compliance with applicable legislation. These data are shared with our supplier managing the relevant system and providing technical support to operate the logging system, deliver technical support services, manage information security processes, and govern the IT infrastructure.
• Information Security, Crisis, and Risk Management Processes: Your personal data are processed to manage information security workflows, control system access permissions, execute risk management processes, ensure the operational security of the data controller, and maintain business continuity. These data are shared with our suppliers providing IT infrastructure, software, information security, and technical support services to conduct information security procedures, manage access rights, operate relevant information systems, and carry out maintenance and technical support.
• Communication, Hosting, Backup, and Archiving Processes: Your personal data are processed to execute communication activities, maintain business operations, ensure business continuity, and conduct storage, backup, and archiving processes. These personal data are shared with our service providers in these domains to deliver email, web hosting, cloud storage, backup, and archiving services. Your personal data are processed in accordance with the fundamental principles outlined in the Law, securely stored in physical or electronic environments for a duration appropriate to the processing purpose, and upon expiration of the retention periods determined in connection with the purpose, erased or destroyed in accordance with the procedures stipulated in the legislation and the methods specified in the Company Retention and Disposal Policy. Within the scope of these activities, the Company acts in compliance with all obligations set forth in relevant legislation, primarily the Law.

2. METHOD AND LEGAL REASON FOR COLLECTING YOUR PERSONAL DATA

Your personal data are collected directly from you through visitor registration and access control systems used at facility entrances, closed-circuit television (CCTV) systems, and electronically during your use of company network and information systems. These data are collected automatically, partially automatically, or non-automatically provided that they are part of a data recording system, for the above-mentioned purposes, including fulfilling obligations arising from relevant legislation, managing visitor entry-exit processes, and ensuring physical space and information security.

In this context, your processed personal data are handled in accordance with the principles set forth in the Law, under the processing conditions specified in Article 5/2 (a) “explicitly provided for by law” and Article 5/2 (f) “necessity for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.” Cases involving the transfer of your personal data rely on the legal grounds specified in Articles 8 and 9 of the Law.

3. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

Under Article 11 of the Law, you may apply to the Company to: (i) learn whether your personal data are processed; (ii) request information if processed, learn the purpose of processing and whether they are used in accordance with their purpose; (iii) know the third parties to whom they are transferred domestically / abroad, request correction if incompletely or incorrectly processed; (iv) request deletion / destruction within the framework of the conditions specified in Article 7 of the Law; (v) request that notifications regarding the deletion, destruction, or correction of incomplete/incorrect personal data be submitted to the third parties to whom your personal data have been transferred; (vi) object to an adverse outcome resulting exclusively from automated analysis; and (vii) demand indemnification for damages in case you suffer damage due to unlawful processing.

4. YOUR REQUESTS

You may convey your requests within the scope of Article 11 of the Law by utilizing the Data Subject Application Form available on the Company website, in writing to Akasya, Derin Sok. No: 8/A Acıbadem Üsküdar/İstanbul, via KEP to [email protected], or through other methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller.