I. INTRODUCTION
The Law on Protection of Personal Data No. 6698 (“Law”) entered into force on 7 April 2016. With the law, the definition of personal data is made, the principles regarding their protection and the conditions to be followed by the data controllers in the processing of this data are included. According to the Law, personal data is “any information relating to an identified or identifiable natural person. Processing of personal data means “all kinds of operations performed on personal data, including obtaining, recording, storing, changing, sharing with third parties and transferring personal data to abroad, automatically or non-automatically, provided that it is a part of any data recording system”. . African Volunteers Association - African Platform Assistance and Solidarity Association (“www.afrikaplatformu.org”) adopts the principles regarding the protection and processing of personal data in the relevant legislation and takes the necessary administrative and technical measures in order to ensure compliance with the Law. For the scope of this Personal Data Protection and Processing Policy (“Policy”), see. VI. DATA OWNER AND PERSONAL DATA CATEGORIZATION.
The relevant legal regulations in force regarding the processing and protection of personal data shall be applied in priority. In case of incompatibility between the current legislation and the Policy, www.afrikaplatformu.org accepts that the current legislation will find an area of application. The policy is published on the website of www.afrikaplatformu.org (www.afrikaplatformu.org) and made available to personal data owners. In order to adapt to the changing conditions and legislation, changes and updates can be made in the Policy and can be presented to personal data owners via the relevant website.
II. PROCESSING PERSONAL DATA
II.I. PRINCIPLES ON THE PROCESSING OF PERSONAL DATA
m of the Constitution. 20/III, the protection of personal data is guaranteed by stating that personal data can only be processed in cases stipulated by the law or with the explicit consent of the person. In line with this right granted to personal data owners, www.afrikaplatformu.org processes personal data in line with the principles set forth in the relevant legislation or in accordance with the following principles in cases where the person has express consent: - Processing in Compliance with the Law and the Rule of Integrity - Ensuring Personal Data Are Accurate and Up-to-Date When Necessary - Specific, Explicit Processing for Legitimate Purposes - Being Relating to the Purpose for which they are Processed, Limited and Proper
II.II. TERMS AND PURPOSE OF PROCESSING PERSONAL DATA
In principle, personal data can only be processed in cases with the explicit consent of the personal data owner. In Article 5 of the Law, the conditions regarding the processing of personal data and in Article 6 are included. The law defines personal data that carries the risk of causing victimization or discrimination when processed unlawfully, as "special quality personal data". In Article 6 of the Law, special categories of personal data are listed in a limited way.
As stated in the policy above, the customer / user, etc. We do not process sensitive personal data. The explicit consent of the data owner should be disclosed on a specific subject, based on information and free will. In the presence of one or more of the conditions mentioned below, personal data may be processed without the explicit consent of the owner. www.afrikaplatformu.org processes personal data in any case, in accordance with the general principles set forth in Article 4 of the Law, for the purposes and conditions set forth below. Regarding general personal data;
It is clearly stipulated in the Laws that www.afrikaplatformu.org performs related activities regarding the processing of your personal data.
Personal data processing by www.afrikaplatformu.org is mandatory for the protection of the life or physical integrity of the personal data owner or someone else, and in this case, the personal data owner is unable to express his consent due to actual or legal invalidity.
The processing of your personal data by www.afrikaplatformu.org is directly related to and necessary for the establishment or performance of a contract
The processing of your personal data is mandatory for www.afrikaplatformu.org to fulfill its legal obligation.
Provided that your personal data has been made public by you; your limited processing by www.afrikaplatformu.org for the purpose of publicizing you
The processing of your personal data by www.afrikaplatformu.org is mandatory for the establishment, use or protection of www.afrikaplatformu.org or your or third parties' rights
It is mandatory to process personal data for the legitimate interests of www.afrikaplatformu.org, provided that it does not harm your fundamental rights and freedoms. In this context, personal data is processed by www.afrikaplatformu.org for the following purposes:
Planning, auditing and execution of information security processes
Creation and management of information technology infrastructure
Planning and executing employee access authorizations to user information
Follow-up of finance and/or accounting works
Follow-up of legal affairs
Planning and/or execution of efficiency/efficiency and/or appropriateness analyzes of business activities
Planning and execution of business activities
Planning and execution of information access authorizations of business partners and/or suppliers
Management of relations with business partners and/or suppliers
Planning and/or execution of business continuity activities
Planning and execution of corporate communication activities
Planning and execution of customer/user relationship management processes
Planning and/or execution of customer/user satisfaction activities
Follow-up of customer/user requests and/or complaints
Planning and execution of company audit activities
Planning and execution of operational activities necessary to ensure that company activities are carried out in accordance with company procedures and / or relevant legislation
Ensuring the security of company operations
Planning and execution of the relevant processes in order to obtain the highest benefit from the products or services offered by the company
Follow-up of contract processes and/or legal requests
Execution of strategic planning activities
Planning and execution of production and/or operation processes
Planning and execution of market research activities for sales and marketing of products and services
Planning and execution of marketing processes of products and/or services
Planning and execution of sales processes of products and / or services
Ensuring data is accurate and up-to-date
Giving information to authorized institutions based on legislation
III. TRANSFERRING PERSONAL DATA
III.I. GENERAL PRINCIPLES ON TRANSFERRING PERSONAL DATA
Articles 8 and 9 of the Law include matters regarding the transfer of personal data within the country and abroad. www.afrikaplatformu.org can transfer the personal data/private personal data of the data owner to third parties by taking the necessary security measures in line with the data processing purposes of the personal data it has obtained in accordance with the law. Accordingly, www.afrikaplatformu.org will be able to transfer personal data to third parties in the presence of one of the processing conditions specified in Part II and the following conditions:
If the personal data owner has express consent,
If there is a clear regulation in the law regarding the transfer of personal data,
If it is necessary for the protection of the life or bodily integrity of the personal data owner or someone else, and the personal data owner is unable to express his consent due to actual impossibility or if his consent is not legally valid;
If it is necessary to transfer the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
If personal data transfer is mandatory for www.afrikaplatformu.org to fulfill its legal obligation,
If the personal data has been made public by the personal data owner,
If personal data transfer is necessary for the establishment, exercise or protection of a right,
III.II. TRANSFERRING PERSONAL DATA ABROAD
www.afrikaplatformu.org will be able to transfer the personal data of the personal data owner abroad in the following cases, in line with the legitimate and lawful personal data processing purposes:
In case of explicit consent of the data owner, or
In the event that the data owner does not have explicit consent, but one or more of the other conditions mentioned above are present;
Provided that (i) there is sufficient protection in the country where the data is transferred, and (ii) there is insufficient protection in the country where the data is transferred, www.afrikaplatformu.org undertakes adequate protection in writing together with the data controller in the relevant foreign country and the permission of the KVK Board is obtained.
III.III. THIRD PARTIES TO THE TRANSFER OF PERSONAL DATA
www.afrikaplatformu.org may transfer the personal data of data owners managed by the Policy, in line with the above-mentioned conditions and in accordance with Articles 8 and 9 of the Law, to the following parties:
Anonymous business partners in order to ensure the fulfillment of the purposes of the establishment of the business partnership (if further data transfer is required, express consent is also obtained).
Limited to suppliers, in order to ensure that the services that www.afrikaplatformu.org outsources from the supplier and that are necessary to carry out the commercial activities of www.afrikaplatformu.org are provided to www.afrikaplatformu.org,
Limited to ensuring the execution of commercial activities that require the participation of www.afrikaplatformu.org affiliates,
To the shareholders, limited to audit purposes, in accordance with the provisions of the relevant legislation, designing strategies regarding the commercial activities of www.afrikaplatformu.org, providing information in accordance with company procedures,
To the relevant public institutions and organizations and private law persons, limited to the purpose they request within their legal powers.
IV. PROTECTION OF PERSONAL DATA
In order to ensure the security of the personal data it processes, www.afrikaplatformu.org ensures that personal data is processed and protected in accordance with the law by taking other administrative and technical measures that are stipulated in accordance with the relevant legislation and to be notified by the KVK Board. In this context, www.afrikaplatformu.org provides technological opportunities and services to process personal data in accordance with the law, to store them in secure environments, to prevent unauthorized access risks and any other unlawful access, to prevent accidental data loss, to deliberately damage data and to prevent deletion. takes reasonable technical and administrative measures, which also takes into account the cost of implementation.
Namely;
Supervision of personal data processing activities of www.afrikaplatformu.org with established technical systems,
Making periodic reports regarding the technical measures taken,
Informing and training the employees who process personal data at www.afrikaplatformu.org on the law of protection of personal data and the processing of personal data in accordance with the law,
In order to meet the legal compliance requirements determined on the basis of the business unit, by raising awareness and determining the rules of practice for the relevant business units, organizing in-house policies and trainings to ensure the supervision and sustainability of these issues,
Raising the awareness of the employees and the records that impose the obligation not to process, disclose or use personal data, except for the www.afrikaplatformu.org instructions and the exceptions brought by the law, to the contracts and documents governing the legal relationship between www.afrikaplatformu.org and employees,
Making access and authorizations in accordance with the legal compliance requirements determined on the basis of the business unit and limiting the access authorizations accordingly,
Installing and operating software and hardware including virus protection systems and firewalls,
Contracts concluded with the persons to whom personal data is transferred in accordance with the law, including the parties to which www.afrikaplatformu.org receives an external service due to technical requirements regarding the storage of personal data; Adding provisions that the persons to whom personal data are transferred will take the necessary security measures for the protection of personal data and ensure that these measures are complied with in their own institutions,
Establishment of technical security systems for storage areas by using legal backup programs, www.afrikaplatformu.org, In case the personal data processed in accordance with Article 12 of the Law is obtained by others illegally, this situation is reported to the relevant personal data owner and the KVK Board as soon as possible. It carries out the system that provides notification to . If deemed necessary by the KVK Board, this situation may be announced on the website of the KVK Board or by any other method.
V. DISCLOSURE, RIGHTS AND INFORMATION OF THE PERSONAL DATA OWNER
V.I. DISCLOSURE OF THE PERSONAL DATA OWNER
Article 10 of the Law states that personal data owners should be informed during the acquisition of personal data. www.afrikaplatformu.org, in accordance with the general principles of other personal data processing activities specified in the relevant legislation, during the acquisition of personal data of personal data owners; (i) the identity of its representative, if any, (ii) for what purpose the personal data will be processed, (iii) to whom and for what purpose it can be transferred, (iv) the method and legal reason for collecting personal data, (v) the rights of the personal data owner.
V.II. RIGHTS OF PERSONAL DATA OWNERS
In Article 11 of the Law, the rights of the personal data owner are listed. Namely, the data owner;
Learning whether personal data is processed or not,
If personal data has been processed, requesting information about it,
Learning the purpose of processing personal data and whether they are used in accordance with the purpose,
Knowing the third parties to whom personal data is transferred at home or abroad,
Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist despite the fact that it has been processed in accordance with the provisions of the law and other relevant laws, and requesting that the transaction carried out within this scope be notified to the third parties to whom the personal data has been transferred,
Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
It has the right to demand the compensation of the damage in case of loss due to unlawful processing of personal data.
However, in accordance with Article 28 of the Law, the above-mentioned rights cannot be asserted in the following cases:
Processing personal data for purposes such as research, planning and statistics by making it anonymous with official statistics.
Processing personal data for art, history, literature or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime.
Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.
Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.
Pursuant to article 28/2 of the Law; In the following cases, personal data owners cannot claim their other rights, except for the right to demand the compensation of the damage:
The processing of personal data is necessary for the prevention of crime or for criminal investigation.
Processing of personal data made public by the personal data owner.
Personal data processing is necessary for the execution of supervisory or regulation duties and for disciplinary investigation or prosecution by authorized and authorized public institutions and organizations and professional organizations in the nature of public institution, based on the authority given by the law.
The processing of personal data is necessary for the protection of the economic and financial interests of the State with regard to budgetary, tax and financial matters.
V.III. INFORMING PERSONAL DATA OWNERS
The information requests made by the personal data owners in line with the right to have information about their personal data in accordance with Article 20 of the Constitution and to "request information", which is among the rights mentioned above, are met by www.afrikaplatformu.org in accordance with the Law. www.afrikaplatformu.org carries out the necessary channels, internal functioning, administrative and technical regulations in accordance with Article 13 of the Law in order to provide the necessary information to the personal data owners. In this regard, if personal data owners submit their requests regarding their above-mentioned rights to www.afrikaplatformu.org, they report their reasoned positive/negative response to the request free of charge, within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, www.afrikaplatformu.org may receive the fee in the tariff determined by the KVK Board. Personal data owners will be able to submit their requests regarding their rights mentioned above to www.afrikaplatformu.org via the "AFRICAN VOLUNTEERS ASSOCIATION Application Form". Applications to be made by personal data owners will be made by one of the following methods, together with documents that will identify the personal data owner:
Fill out the form and send the wet signed copy to Ali Kuşçu Mah. Başimam Sokak No:11 Flat: 1-2 Fatih - Istanbul address,
Sending a request to the info@afrikaplatformu.org e-mail address, (In this case, in order to determine whether the applicant is the rightful personal data owner through the channel to which the applicant has applied; communication with the person concerned over the registered phone in order to identify his identity and to determine whether the requester really made this application. will be installed.)
Following a method prescribed by the Personal Data Protection Board.
In order for third parties to apply on behalf of personal data owners, a special power of attorney issued by the data owner through a notary public on behalf of the person to apply must be present. www.afrikaplatformu.org may request information from the data subject in order to determine whether the applicant is the owner of personal data, and may ask questions about the application of the personal data owner in order to clarify the issues specified in the application. In cases where the application is rejected in accordance with Article 14 of the Personal Data Law, the response given is insufficient or the application is not answered in due time; www.afrikaplatformu.org can apply to the KVK Board within thirty days from the date of learning the answer and in any case within sixty days from the date of application.
VI. DATA OWNER AND PERSONAL DATA CATEGORIZATION
VI.I. DATA OWNER CATEGORY
www.afrikaplatformu.org has categorized the owners of the personal data it processes as follows. The data owner categorization created within the scope of this Policy is associated with the following personal data owners. Data owners outside this scope may also direct their requests to www.afrikaplatformu.org in line with the Policy.
Personal Data Owner Category
Customer/User: Real persons who use or have used the products and services offered by our Company, regardless of whether they have any contractual relationship with www.afrikaplatformu.org
Potential Customer: Real persons who have requested or interested in using our products and services or who have been evaluated in accordance with commercial practices and honesty rules that they may have.
Customer Shareholder, Officer, Employee: Real persons who are employees, shareholders and authorized persons of legal entity customers who use or have used the products and services offered by www.afrikaplatformu.org, regardless of whether they have any contractual relationship with www.afrikaplatformu.org
Third Parties: Other natural persons who are not covered by this Policy and www.afrikaplatformu.org Employees Personal Data Protection and Processing Policy
Business Partner: Companies that transmit information to users who have a contractual relationship with www.afrikaplatformu.org
Business Partner Shareholder, Officer, Employee: Real persons, including employees, shareholders and officials of institutions with which www.afrikaplatformu.org has all kinds of business relations
Supplier Shareholder, Official, Employee: Natural persons, including employees, shareholders and officials of institutions that www.afrikaplatformu.org provides products or services and has business relations with.
Business Partner Candidate: Natural persons or natural persons who are employees, shareholders and officials of natural persons or legal entities with whom www.afrikaplatformu.org envisages to establish any business relationship, Visitor who has entered the physical campuses owned by www.afrikaplatformu.org for various purposes or visited our websites. natural persons who visited
VI.II. PERSONAL DATA CATEGORY
Personal data processed by www.afrikaplatformu.org are categorized within the scope of this Policy. The personal data of the personal data owners in the above-mentioned categories of data subjects are associated with the following categories of personal data.
Personal Data Categorization
Identity Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; data containing information about the identity of the person
Contact Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; information such as telephone number, address, e-mail address, fax number, IP address
Location Data: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Within the framework of the operations carried out by the business units of the personal data owner, www.afrikaplatformu.org, information that determines the location of the employees of the institutions with which we cooperate with www.afrikaplatformu.org when using the tools of www.afrikaplatformu.org
Customer Information: Clearly belonging to an identified or identifiable natural person and included in the data recording system; Information such as records for the use of our products and services and the customer's instructions and requests for the use of products and services Customer Transaction Information: Clearly belonging to an identified or identifiable natural person and included in the data recording system; Information such as records for the use of our products and services and the customer's instructions and requests for the use of products and services
Family Members and Close Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; In order to protect the legal and other interests of www.afrikaplatformu.org and the personal data owner, within the framework of the operations carried out by the business units of www.afrikaplatformu.org, information about the family members, relatives and other persons who can be reached in case of emergency.
Physical Location Security Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Personal data regarding the records and documents taken at the entrance to the physical space, during the stay in the physical space
Transaction Security Information: Clearly belonging to an identified or identifiable natural person and included in the data recording system; Personal data such as IP address, (system login information) log in credentials, logging of resources accessed by suppliers while providing support services, to ensure our technical, administrative, legal and commercial security while carrying out our commercial activities
Incident Management Information: Information and evaluations collected about events that are associated with the personal data owner and that have the potential to affect our company - employees - shareholders (e.g., to prevent news about our company's commercial activities and negative communication about our company in this direction with a person who is prosecuted as a defendant in a criminal case. Information gathered on this person and the scope of the criminal investigation and the correct management of the public opinion that will develop in this direction.
Financial Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Personal data, bank account number, IBAN number, credit card information, financial profile, asset data, and personal data processed for information, documents and records showing all kinds of financial results created according to the type of legal relationship that www.afrikaplatformu.org has established with the personal data owner, data such as income information
Visual and Audio Data: Clearly belonging to an identified or identifiable natural person; Photographs and camera recordings (excluding the recordings included in the Physical Space Security Information), audio recordings and data contained in documents that are copies of documents containing personal data
Legal Transaction and Compliance Information: Clearly belonging to an identified or identifiable natural person and included in the data recording system; Personal data processed within the scope of determination, follow-up and performance of our legal receivables and rights, and compliance with our legal obligations and our company's policies
Audit and Inspection Information: Information on the audit and inspection records, reports and the examinations made within this scope, and the information and comments collected, associated with the personal data owner.
Marketing Information: Clearly belonging to an identified or identifiable natural person and included in the data recording system; Personal data processed for the marketing of our products and services by customizing them in line with the usage habits, tastes and needs of the personal data owner, and the reports and evaluations created as a result of these processing results
Reputation Management Information: Information that is associated with the person and collected for the purpose of protecting the commercial reputation of our company (for example, information from complaint sites, information collected about the shares made against our company, our senior executives and shareholders via social media tools such as Twitter, Facebook, etc. information on actions taken)
Request/Complaint Management Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Personal data regarding the receipt and evaluation of any request or complaint directed to www.afrikaplatformu.org.
VII. PRINCIPLES REGARDING THE STORAGE PERIOD OF PERSONAL DATA
Personal data is stored by www.afrikaplatformu.org for the periods stipulated in the relevant legislation and in line with its legal obligations. If a period of time is not regulated in the legislation regarding how long personal data should be stored, personal data is processed for the period that requires it to be processed in accordance with the practices of www.afrikaplatformu.org and commercial practices in connection with the activity carried out by www.afrikaplatformu.org while processing that data. deleted, destroyed or anonymized. If the personal data whose purpose of processing has expired and the personal data requested to be deleted/anonymized by the personal data owners have expired, the storage periods determined by the relevant legislation and www.afrikaplatformu.org; It can only be kept to constitute evidence in possible legal disputes or to assert the relevant right related to personal data or to establish a defense. While determining the retention periods of personal data, www.afrikaplatformu.org is based on the statute of limitations stipulated in the relevant legislation. The personal data stored for this purpose is only accessed by limited persons when it is required to be used in the relevant legal dispute and is not accessed for any other purpose other than this purpose. At the end of this period, personal data is deleted, destroyed or anonymized.
VIII. CONDITIONS FOR DELETING, DESTROYING AND ANONYMIZING PERSONAL DATA
Although it has been processed in accordance with the provisions of the relevant law as regulated in Article 138 of the Turkish Penal Code and Article 7 of the Law, in the event that the reasons requiring processing are eliminated, personal data is deleted pursuant to the decision of www.afrikaplatformu.org or upon the request of the personal data owner. is destroyed or anonymized.
IX. KOLEJINISEC.COM MANAGEMENT STRUCTURE REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA
A Personal Data Protection Committee (“Committee”) has been established within the company at www.afrikaplatformu.org in order to manage this Policy, related policies and other outputs, to monitor and maintain the compliance process with the Law. Duties of this Committee;
To establish, update and enforce the basic policies regarding the protection and processing of personal data.
To take actions regarding the implementation and control of the policies regarding the protection and processing of personal data, and to ensure coordination by making internal assignments regarding this.
To ensure compliance with the law and relevant legislation, to follow the developments related to the protection and processing of personal data and to take necessary actions within this framework.
Raising awareness on the protection and processing of personal data in www.afrikaplatformu.org and in the institutions that www.afrikaplatformu.org cooperates with.
Evaluating the applications of personal data owners and resolving them in accordance with the law.
To determine the risks that may occur in the personal data processing activities of www.afrikaplatformu.org and to ensure that the necessary measures are taken.
Carrying out relations with the KVK Board and Institution.