Personal Data Protection Notice

As Fazla Gıda Anonim Şirketi (“FG” veya “Company”), we have drawn up this Notice in order to inform

  • Our employees,
  • Employee Candidates,
  • Customers (Natural Person),
  • Employees/Authorized Persons of our Customers (Legal Entity),
  • Employees/Authorized Persons of our Suppliers (Legal Entity),
  • Association Officers,
  • Website Visitors,
  • Our Application Users and
  • Social Media Users

about the processing, storage and transfer of your personal data arising from Company’s activities within the framework of the Personal Data Protection Law No. 6698 (“KVKK”) and the relevant legislation and legal regulations.

1. Which of Your Personal Data is Processed and What are the Purposes of Processing Your Personal Data?

Our Employees 
Detailed information about the personal data of employees has been published within the Company in a manner accessible only to our employees.
You can submit your requests regarding your personal data processed by using one of the application methods in this Notice and exercise your rights. 
Employee Candidates  
Processed Personal Data Purposes of Processing Personal Data 
  • Identification Data
  • Communication Data
  • Professional Experience Data
  • Information on References
  • Military Service Status
  • Carrying out the Application Processes of Employee Candidates,
  • Planning of Human Resources Processes,
  • Conducting Communication Activities,
  • Reference Research

Legal Reason: 

Processing of data is necessary for the legitimate interests pursued by the data controller. 

Association Officer 
Detailed information on the processing of personal data has been provided to them in a manner accessible to the Association officials.
You can submit your requests regarding your personal data processed by using one of the application methods in this Notice and exercise your rights.		 
Employees/ Authorized Officers of our Customers (Legal Entity)
Processed Personal Data Purpose of Processing Personal Data 
  • Identification Data
  • Communication Data
  • Customer Transaction Information
  • Location Data
  • Process Security Data
  • Other (type/amount of donation)

 

  • Execution of Communication Activities
  • Execution of Information Security Processes
  • Execution of Business Activities
  • Tracking User Movements
  • Execution of Finance and Accounting Affairs
  • Execution of Goods/Service Production and Operation Processes
  • Execution of Business Continuity Ensuring Activities
  • Execution of Contract Processes
  • Execution of Logistics Activities
  • Execution of Social Responsibility and Civil Society Activities
  • Opening Current Account
  • Execution of Goods/Service Sales Processes

Legal Reason: 

Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract, it is necessary for compliance with a legal obligation to which the data controller is subject; processing of data is necessary for the legitimate interests pursued by the data controller; data processing is necessary for the establishment, exercise or protection of any right, explicit consent (location data). 

Customers (Natural Person) 
Processed Personal Data Purpose of Processing Personal Data 
  • Identification Data
  • Communication Data
  • Financial Data
  • Customer Transaction Data
  • Other (type/amount of donation)
  • Location Data
  • Transaction Security Data 
  • Execution of Information Security Processes
  • Execution of Goods/Service Sales Processes
  • Execution of Finance and Accounting Affairs
  • Execution of Communication Activities
  • Execution of Business Activities
  • Execution of Contract Processes
  • Execution of Logistics Activities
  • Execution of Social Responsibility and Civil Society Activities
  • Management of Customer Relationship Management Processes
  • Execution of Goods-Service Production and Operation Processes
  • Receiving Requests/Complaints
  • Tracking User Movements 

Legal Reason: 

Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract; it is necessary for compliance with a legal obligation to which the data controller is subject, data processing is necessary for the establishment, exercise or protection of any right, explicit consent (location data). 

Employees/Authorities of our Suppliers (Legal Entity)  
Processed Personal Data Purposes of Processing Personal Data 
  • Identification Data
  • Communication Data 
  • Execution of Goods / Service Procurement Processes
  • Execution of Training Activities
  • Execution of Supply Chain Management Processes
  • Execution of Contract Processes
  • Monitoring and Execution of Legal Affairs
  • Execution of Communication Activities
  • Execution/Supervision of Business Activities
  • Execution of Logistics Activitiesi 

Legal Reason: 

Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract, processing of data is necessary for the legitimate interests pursued by the data controller.

Website Visitors 
Processed Personal Data Purposes of Processing Personal Data 
  • Identification Data
  • Communication Data
  • Transaction Security DataVerisi
  • Execution of Business Activities
  • Execution of Goods / Services Production and Operation Processes
  • Execution of Communication Activities
  • Execution of Potential Customer Relationship Management Processes
  • Execution of Information Security Processes
  • Tracking User Movements 

Legal Reason: 

Processing of data is necessary for the legitimate interests pursued by the data controller; it is necessary for compliance with a legal obligation to which the data controller is subject.

Our Visitors 
Processed Personal Data Purposes of Processing Personal Data 
  • Physical Space Security Records 
  • Ensuring the Security of Movable Property and Resources
  • Ensuring Physical Space Security 

Legal Reason: 

Processing of data is necessary for the legitimate interests pursued by the data controller.

Social Media Users
Processed Personal Data Purposes of Processing Personal Data 
  • Other (username, request/complaint information, award information) 
  • Management of Customer Relationship Management Processes
  • Receiving Requests / Complaints
  • Organization and Event Management 

Legal Reason: 

Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data belonging to the parties to the contract; processing of data is necessary for the legitimate interests pursued by the data controller.

Our Application Users 
You can find detailed information about personal data processed through our application at fazla.com.

2. What are the Methods of Collecting Your Personal Data?

Your personal data categorized above are collected through printed and electronic forms, contracts, resumes, e-mail, invoices, information systems, electronic devices, business cards, social media accounts, references and documents provided by the relevant person.

3. Do We Transfer Your Personal Data to a Third Party?

Your personal data that you share with the Company is transferred

  • To cloud service providers abroad based on your explicit consent for the purposes of conducting information security processes, ensuring internal information and document management and conducting business activities;
  • To authorized institutions and organizations based on the legal reason that it is necessary for compliance with a legal obligation to which the data controller is subject, for the purposes of conducting activities in accordance with the legislation and informing authorized persons, institutions and organizations;
  • To our suppliers based on the legal reasons that it is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract for the purposes of ensuring coordination between the relevant stakeholders in order to carry out the transportation organization without disruption and the execution of logistics activities;
  • To associations and our buyer-seller customers to ensure coordination among relevant stakeholders to carry out the donation operation.

4. What Are Your Rights as a Data Subject?

The rights you have set forth in the PDPL with regards to your personal data are:

  • To learn whether your personal data have been processed or not,
  • To demand for information if your personal data has been processed,
  • To learn the purpose for processing your personal data and whether they are used in compliance with the purpose,
  • To know the third parties to whom your personal data is transferred in country or abroad,
  • To request the rectification of incomplete or inaccurate data, if any,
  • To request the erasure or destruction of your personal data under the conditions referred in the PDPL,
  • When you request the correction of incomplete or inaccurate data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data,
  • To object to the occurrence of a result against you by analyzing the data processed solely through automated systems,
  • To claim compensation for the damage arising from the unlawful processing of your personal data.

5. How Can You Use Your Rights?

You can submit your requests and applications regarding your personal data via Data Subject Application Form ,

  • By applying to FG in person with a valid identity document,
  • By sending it to our address Maya Meridien İş Merkezi, Akat Mah., Ebulula Mardin Cad., No:16 K:6 Beşiktaş, İstanbul with the original signed document and copy of identity card.
  • By sending an e-mail to [email protected] address of FG with a petition signed with mobile signature or secure electronic signature,
  • You can send a signed petition from your Registered Electronic Mail (REM / KEP in Turkish) address to FG [email protected] address.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in the application of the Data Subject must include the name, surname, signature if the application is written, T.R. identification number, (passport number if the applicant is a foreigner), residence or workplace address for notification, e-mail address, telephone number and fax number, if any, as well as information on the subject of the request.

The Data Subject must clearly and comprehensibly state the request in the application, submitted to exercise above-mentioned rights which includes explanations regarding the right to be exercised. Information and documents related to the application must be attached to the application

Although the subject of the request must be personal to the applicant, if the applicant is acting on behalf of someone else, the applicant should be exclusively authorized in this regard and document the authorization (power of attorney). In addition, the application must contain identity and address information, and documents confirming identity must also be attached to the application.  The requests made by unauthorized third party on behalf of someone else will not be evaluated.

6. How Long Will It Take to Answer Your Requests Regarding the Processing of Your Personal Data?

Your requests regarding your personal data will be evaluated and answered in or against your favor within 30 days at the latest from the date of arrival to us. In case your application is concluded unfavorable, the reasons for rejection will be sent to the address you specified in your application by e-mail or postal mail, or by one of the methods selected in the Data Subject Application Form, which you can also access on our website.