Customer Information Notice Pursuant to the Legislation on the Protection of Personal Data
In this Information Notice, the principles regarding the processing of your personal data in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) and relevant legislation by BMVA ELEKTRONİK San. ve Tic. A.Ş. (“Company”), acting as the data controller and located at Osmangazi Mah. 2644 Sk. No: 3/2, Esenyurt/İstanbul, are set out below.
1. Purpose of Processing Personal Data
Your personal data, including identity, contact, address, and financial information such as name, surname, e-mail address, Turkish Republic Identification Number (to be included on invoices in case of being a taxpayer, or when shared by final consumers), delivery address, billing address, and phone number, obtained within the scope of purchasing products and/or services through our Company’s website, are processed for the purposes of enabling you to benefit from our services within the scope of e-commerce activities; managing contractual relationships; managing order processes; carrying out goods/services sales processes and after-sales support services; conducting finance and accounting activities and monitoring and analyzing business development projects in this field; performing the necessary activities by our relevant business units to carry out the commercial activities conducted by the Company and managing related business processes; planning and executing the Company’s commercial and/or business strategies; ensuring the legal, technical, and commercial/workplace security of the Company and the relevant persons with whom the Company has business relations; and carrying out communication activities.
2. Method and Legal Basis for Collecting Personal Data
Your personal data collected within the scope of your distance sales transactions for products and/or services created through the website are collected as part of a data recording system by sharing your information with our Company via the system, through electronic and/or physical environments, verbally/in writing, by non-automatic or partially automatic methods.
The Company processes personal data based on the following legal grounds:
• Explicit consent pursuant to Article 5/1 of the Law,
• Necessity of processing personal data directly related to the establishment or performance of a distance sales contract pursuant to Article 5/2(c) of the Law,
• Necessity of processing personal data for the data controller to fulfill its legal obligations pursuant to Article 5/2(ç) of the Law (e.g., Tax Procedure Law General Communiqué No. 509),
• Necessity of processing personal data for the establishment, exercise, or protection of a right pursuant to Article 5/2(e) of the Law, to be used in potential future consumer disputes,
• Necessity of processing personal data for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed, pursuant to Article 5/2(f) of the Law.
In addition, your contact information may be processed, subject to your explicit consent, for the purpose of sending commercial electronic messages to you within the scope of marketing activities.
3. Transfer of Processed Personal Data and Purpose of Transfer
The purpose of processing personal data and the purpose of transferring such data are aligned. Our Company may transfer the personal data it collects, in connection with the purposes specified in this Information Notice, to service providers enabling the implementation of rights and obligations arising from purchase transactions; business partners with whom the Company cooperates to conduct its activities (e.g., contracted cargo and transportation companies for the delivery and shipment of purchased products); intermediary business partners that enable the collection of payments online; the Company’s affiliates and subsidiaries; official authorities, institutions, and organizations upon request; and business partners providing infrastructure support for the website and application, within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law.
4. Application Methods to the Data Controller and Your Rights
Pursuant to Article 11 of the Law, by applying to our Company, you have the right to:
a) Learn whether your personal data are processed,
b) Request information if your personal data have been processed,
c) Learn the purpose of processing and whether personal data are used in accordance with that purpose,
d) Know the third parties to whom personal data are transferred domestically or abroad,
e) Request correction of personal data if they are incomplete or inaccurate,
f) Request deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
g) Request notification of the actions taken pursuant to items (e) and (f) to third parties to whom personal data have been transferred,
h) Object to the occurrence of a result against you through analysis exclusively by automated systems,
i) Request compensation for damages in case personal data are processed unlawfully.
You may submit your requests regarding the above-mentioned rights to our Company in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You may submit your applications by filling out the BMVA ELEKTRONİK San. ve Tic. A.Ş. Data Subject Application Form, accessible via www.kiwi.com.tr, and sending it by post to Osmangazi Mah. 2644 Sk. No: 3/2, Esenyurt/Istanbul, or by e-mail to [email protected].
Our Company will conclude your requests as soon as possible and no later than thirty (30) days, free of charge for the first request, depending on the nature of the request. However, a fee may be charged for subsequent requests regarding the same matter or if the initial request requires an additional cost. The Company may accept and process the request or reject it in writing by explaining the reasons.
If the application made in accordance with the procedure described above is rejected, the response is deemed insufficient, or no response is provided within the prescribed period, you have the right to lodge a complaint with the Personal Data Protection Board (“Board”) within thirty (30) days following the notification of the response and, in any case, within sixty (60) days from the date of application. However, a complaint may not be filed without first exhausting the application procedure.
Upon a complaint or ex officio, the Board conducts the necessary examination on matters within its scope of duty. Following a complaint, the Board examines the request and provides a response to the relevant parties. If no response is provided within sixty (60) days from the date of the complaint, the request shall be deemed rejected. If, as a result of the examination, a violation is identified, the Board decides that the identified unlawfulness be remedied by the data controller and notifies the relevant parties. This decision shall be fulfilled without delay and no later than thirty (30) days from the date of notification. In cases where irreparable or difficult-to-compensate damages may occur and there is clear unlawfulness, the Board may decide to suspend data processing or the transfer of data abroad.
We emphasize that your data are protected with utmost care by our Company and thank you for the trust you place in us.
