1. Introduction
Robotistan Elektronik Ticaret A.Ş. (“Robotistan”, “Company”) attaches utmost importance to protecting the fundamental rights and freedoms of individuals, particularly the right to privacy regulated under Article 20 of the Constitution, in the protection and processing of personal data. Within this framework, in accordance with the Law No. 6698 on the Protection of Personal Data (“Law” or “Personal Data Protection Law”), the Company takes due care to ensure that personal data is protected and processed lawfully and acts accordingly in all its planning and activities.
Our Company does not consider the protection and processing of personal data, which constitutes the basis of the right to privacy, solely as a matter of compliance with legislation, but places the value it attaches to individuals at the core of its approach. Acting with this awareness, our Company takes all necessary administrative and technical measures to ensure that personal data is protected and processed lawfully.
2. Purpose of the Policy
The purpose of the Personal Data Protection and Processing Policy (“Policy”) is, in accordance with the purpose of the Law, to protect the fundamental rights and freedoms of individuals to the maximum extent, particularly the right to privacy regulated under Article 20 of the Constitution, in the protection and processing of personal data processed by fully or partially automated means or by non-automated means provided that it forms part of any data recording system, and to inform personal data subjects (data subjects) about the obligations of our Company and the procedures and principles to be followed in accordance with the Law. In line with the purpose of the Policy, our Company aims to ensure full compliance with applicable legislation in activities involving the protection and processing of personal data and to protect the personal data subjects' right to privacy and data security.
3. Scope of the Policy
This Policy has been prepared in connection with the use of services accessed through Robotistan. It covers all our services accessed through our website www.robotistan.com, through social media, by calling our communication lines, via e-mail, by completing return forms, or by any other means. The Policy has been prepared for our customers and potential customers and their employees/authorized representatives, persons to whom products are delivered, and visitors to our website. It shall apply to the persons specified within this scope. The Company informs these personal data subjects about the Law by publishing this Policy on its website. This Policy shall not apply to legal entities regardless of their capacity.
This Policy shall apply to the relevant persons mentioned above where their personal data is processed by our Company through fully or partially automated means or by non-automated means provided that it forms part of any data recording system. This Policy shall not apply where the data does not fall within the scope of “Personal Data” specified below or where the personal data processing activity carried out by our Company is not performed through the methods specified above.
4. Collection of Personal Data
We collect, process and store your personal data when you create a membership account through our website, perform membership transactions through social media channels, contact us through our social media accounts, fill out a form available on www.robotistan.com or any communication form we publish, update your account information or add information, purchase products and/or services, during product delivery, when you communicate with our order and support line/create an order, fill out a return form, communicate via e-mail, and visit our website.
The personal data collected when you create a membership account through our website, perform membership transactions and communicate through social media channels, fill out a form available on www.robotistan.com, update your account information or add information, or purchase products and/or services is listed below:
1. Full name, e-mail address and mobile phone number,
2. Products added to the cart, products ordered and previous order information,
3. Turkish ID number, or information indicating that the person is not a Turkish citizen, or tax identification number,
4. Date of birth, gender and occupation information,
5. Address information, business telephone number and preferred communication language,
6. Member shopping list, price alert list and stock alert list,
7. Gift voucher and points information,
8. Financial information such as IBAN and account number obtained depending on your purchase option,
9. Membership account type, member order tracking code, tracking code and tracking information required for shipping transactions,
10. Information such as profile information and profile photo that you have permitted to be accessed during membership transactions conducted through social media,
11. Profile information, shared photos, reviews and requests when contacted through social media,
12. Information contained in forms available on the website and updated user information,
13. Addresses provided when purchasing products (delivery address, billing address)
14. Information required to be obtained under applicable legislation for identity verification
The personal data collected during transactions carried out through our communication lines is listed below:
1. Voice recordings of telephone conversations,
2. Full name, e-mail address and telephone number,
3. Billing and delivery address information
4. Product information
5. Products added to the cart, products ordered and previous order information,
6. Financial information such as IBAN and account number obtained depending on your purchase option,
7. Member order tracking code, tracking code and tracking information required for shipping transactions,
8. Profile information that you have permitted to be accessed during membership transactions conducted through social media,
9. Information required to be obtained under applicable legislation for identity verification
The personal data collected when you fill out a return form is listed below:
1. Returned and requested products,
2. Full name and IBAN of the account holder to whom the refund will be made,
3. Full name, telephone number, address and signature information of the person making the return, and the reason for the return,
The personal data collected when you communicate via e-mail is listed below:
1. E-mail address,
2. Request and order information,
3. Other information provided by the person making contact
For information about the data collected when you visit our website and mobile application, you may review the www.robotistan.com’s Cookie Policy and Privacy Notice.
You undertake that you have obtained the explicit consent of the relevant persons for the transfer to us of personal data that does not belong to you (such as a delivery or billing address belonging to another person, information concerning the holder of a card that does not belong to you, or bank and account information belonging to third parties).
5. Legal Basis for the Collection of Personal Data
Our Company does not process personal data without the explicit consent of the relevant person. Personal data may only be processed without seeking the explicit consent of the relevant person where one of the following conditions exists:
♦ It is expressly provided for by law;
♦ The personal data has been made public by the relevant person themselves,
♦ It is necessary to process the personal data of the parties to a contract, provided that such processing is directly related to the establishment or performance of the contract,
♦ It is mandatory for our Company to fulfill its legal obligation,
♦ Data processing is mandatory for the establishment, exercise or protection of a right,
♦ Data processing is mandatory for the legitimate interests of our Company, provided that the fundamental rights and freedoms of the relevant persons are not harmed.
6. Purposes of Processing Personal Data
Our Company takes utmost care to ensure that the personal data specified above is processed in accordance with applicable legislation and the principle of good faith, and that it is accurate and up to date. Our Company clearly and precisely determines the purpose of data processing and ensures that such purpose is legitimate. Our Company does not process data for purposes other than those specified. Accordingly, it pays particular attention to complying with the principle of clarity and transparency in legal transactions and texts in which the purposes of personal data processing are explained.
Our Company ensures that the personal data processed is suitable for achieving the specified purposes and avoids processing data that is unrelated to or unnecessary for achieving the purpose. Our Company does not collect or process personal data for purposes that do not currently exist but may arise in the future. In order to process data to meet needs that may arise later, our Company fulfills the processing conditions stipulated in the Law as if the processing were being initiated for the first time. In addition, it limits the processed data to what is necessary to achieve the purpose. Within the scope of the principle of proportionality, it establishes a reasonable balance between data processing and the purpose intended to be achieved.
Where a period for retaining data is prescribed under applicable legislation, our Company complies with such periods; otherwise, it retains personal data only for the period necessary for the purposes for which it is processed. If there is no valid reason for our Company to retain personal data for a longer period, such data is deleted, destroyed or anonymized. Procedures regarding the retention and destruction of personal data are detailed in our Company’s Personal Data Retention and Destruction Policy.
Within this framework, your personal data described above is processed and retained for the following purposes:
♦ Carrying out goods/services sales processes,
♦ Carrying out after-sales support services for goods/services,
♦ Carrying out customer relationship management processes,
♦ Carrying out activities related to customer satisfaction,
♦ Carrying out goods/services/production and operational processes,
♦ Carrying out contract processes,
♦ Carrying out/supervising business activities,
♦ Carrying out communication activities
♦ Carrying out logistics activities,
♦ Carrying out finance and accounting operations,
♦ Ensuring that activities are conducted in compliance with legislation,
♦ Carrying out marketing analysis activities,
♦ Carrying out advertising/campaign/promotion processes,
♦ Carrying out supply chain management processes,
♦ Carrying out product/service marketing processes
♦ Monitoring requests/complaints,
♦ Carrying out audit/ethics activities,
♦ Providing information to authorized persons/institutions and organizations,
♦ Creating and monitoring visitor records
and are processed and retained within the scope of these purposes.
7. Purposes of Transfer of Personal Data and Persons/Organizations to Whom Data Is Transferred
Our Company transfers personal data only for the following purposes and within the conditions specified in Articles 8 and 9 of the Law:
♦ Ensuring that activities are conducted in compliance with legislation,
♦ Carrying out finance and accounting operations,
♦ Carrying out communication activities,
♦ Carrying out goods/services sales processes,
♦ Carrying out customer relationship management processes,
♦ Carrying out activities related to customer satisfaction,
♦ Carrying out goods/services/production and operational processes,
♦ Monitoring and conducting legal affairs
♦ Carrying out goods/services production and operational processes
♦ Carrying out marketing analysis activities,
♦ Carrying out advertising/campaign/promotion processes,
♦ Carrying out product/service marketing processes,
♦ Carrying out contract processes,
♦ Monitoring requests and complaints,
♦ Providing information to authorized persons/institutions and organizations,
♦ Carrying out management activities,
♦ Carrying out logistics activities,
♦ Carrying out audit/ethics activities
Our Company may transfer personal data, limited to the categories of data subjects and data required by the purpose of transfer, to the following persons and organizations:
♦ Business partners,
♦ Suppliers,
♦ Authorized public institutions and organizations (including authorities abroad where necessary)
♦ Natural persons or private-law legal entities (Cooperating organizations: Cargo companies, independent audit firms, insurance companies, law firms and banks, etc.)
8. Purposes of Transfer of Personal Data and Persons/Organizations to Whom Data Is Transferred
8.1. Destruction of Personal Data
Without prejudice to the provisions of other laws concerning the destruction of personal data, our Company shall, in accordance with this Law and other applicable laws, delete, destroy or anonymize personal data that it has processed where the reasons requiring its processing cease to exist, either ex officio or upon the request of the relevant person, in accordance with the Personal Data Retention and Destruction Policy.
Deletion of personal data means rendering personal data inaccessible and unusable in any way for the relevant users.
Destruction of data means rendering personal data inaccessible, irretrievable and unusable in any way by anyone.
Anonymization of data means rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even if matched with other data, through techniques such as masking, extracting variables, generalization, etc.
8.2. Retention Periods of Personal Data
Our Company retains personal data for the periods prescribed under laws and other applicable legislation. Where no retention period is prescribed under laws or other applicable legislation, personal data is retained for the period required to achieve the purpose of processing such personal data in accordance with our Company’s Personal Data Retention and Destruction Policy, and is subsequently deleted, destroyed or anonymized within the framework of periodic destruction periods.
8.3. Information and Rights of the Relevant Person
Our Company informs relevant persons during the collection of personal data in accordance with Article 10 of the Personal Data Protection Law. Within this scope, it clarifies the identity of the Company representative, if any, the purposes for which personal data will be processed, to whom and for what purposes the processed personal data may be transferred, the method and legal basis of personal data collection, and the rights of the relevant person.
9. Information and Rights of the Relevant Person
Our Company informs relevant persons during the collection of personal data in accordance with Article 10 of the Personal Data Protection Law. Within this scope, it clarifies the identity of the Company representative, if any, the purposes for which personal data will be processed, to whom and for what purposes the processed personal data may be transferred, the method and legal basis of personal data collection, and the rights of the relevant person.
9.1. Cases Where the Policy and Law Shall Not Apply Fully or Partially The provisions of this Policy and the Law shall not apply in the following cases:
♦ Processing of personal data by natural persons within the scope of activities relating entirely to themselves or family members living in the same household, provided that such data is not disclosed to third parties and obligations relating to data security are complied with,
♦ Processing of personal data for purposes such as research, planning and statistics by anonymizing it through official statistics,
♦ Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that national defense, national security, public security, public order, economic security, privacy or personal rights are not violated and that the processing does not constitute a crime,
♦ Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized and assigned by law for the purpose of ensuring national defense, national security, public security, public order or economic security,
♦ Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.
Provided that they are proportionate and compatible with the purpose and fundamental principles of this Policy and the Law, Articles 10, which regulates the data controller’s obligation to provide information, 11, which regulates the rights of the relevant person except for the right to request compensation for damages, and 16, which regulates the obligation to register with the Registry of Data Controllers, shall not apply in the following cases:
♦ Where the processing of personal data is necessary for the prevention of a crime or for a criminal investigation,
♦ Processing of personal data made public by the relevant person themselves,
♦ Where the processing of personal data is necessary for public institutions and organizations and professional organizations having the status of public institutions, acting on the authority granted by law, to carry out their supervisory or regulatory duties or disciplinary investigations or proceedings,
♦ Where the processing of personal data is necessary for the protection of the economic and financial interests of the State relating to budgetary, tax and financial matters.
9.2. Rights of the Relevant Person Under the Personal Data Protection Law Our Company informs relevant persons of their rights pursuant to Article 10 of the Law, provides guidance on how such rights may be exercised, and establishes the necessary internal procedures and administrative and technical arrangements for this purpose. The rights of persons whose personal data is processed under Article 11 of the Law are listed below:
♦ Learning whether their personal data has been processed,
♦ Requesting information if their personal data has been processed,
♦ Learning the purpose of processing personal data and whether it is used in accordance with that purpose,
♦ Knowing the third parties to whom personal data has been transferred domestically or abroad,
♦ Requesting the correction of personal data if it has been processed incompletely or incorrectly,
♦ Requesting the deletion or destruction of personal data within the conditions stipulated in Article 7 of the Law,
♦ Requesting that the transactions carried out pursuant to paragraphs (d) and (e) of Article 11 of the Law (correction and destruction) be notified to third parties to whom personal data has been transferred,
♦ Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
♦ Requesting compensation for damages in the event of suffering damage due to the unlawful processing of personal data.
Requests and applications regarding the implementation of the Law may be submitted in writing in person to “Atatürk Bul. No:108/8 İkitelli Başakşehir/İSTANBUL” or sent through a Notary Public, or may be submitted electronically using the registered electronic mail (REM) address ( [email protected]), secure electronic signature or mobile signature. Applications and requests must contain the following:
♦ First name, surname and signature if the application is submitted in writing,
♦ Turkish ID number for citizens of the Republic of Türkiye; nationality, passport number or, if available, identification number for foreigners,
♦ Residential or business address for notification purposes,
♦ E-mail address, telephone and fax number, if any, for notification purposes,
♦ Subject of the request
must be included. Information and documents relating to the matter must be attached to the application. Our Company concludes requests included in applications free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Board. Our Company may accept the request submitted to it or reject it by explaining the reasons and notify the relevant person of its response in writing or electronically. If the request included in the application is accepted, our Company shall fulfill the request as soon as possible and inform the relevant person. If the application is caused by an error on the part of our Company, the fee charged shall be refunded to the relevant person. If the application is rejected, the response is found to be insufficient, or no response is provided within the prescribed period, the relevant person has the right to file a complaint with the Board within thirty days from the date they learn of the response and in any event within sixty days from the date of application.
|
EN
