NOVATEL HABERLEŞME SOLUTIONS INC.
PERSONAL DATA PROTECTION AND PROCESSING POLICY

This document prepared by Novatel İletişim Çözümleri A.Ş. (Novatel) contains the policy of protection and processing of personal data for all real persons, except for its employees, whose personal data are processed.

The purpose of this policy is to be clear about personal data processing activities carried out in accordance with the law and the systems adopted for the protection of personal data, and to ensure transparency by informing the methods of protecting personal data security and the persons whose personal data are processed by our Company.

PURPOSE AND SCOPE

Protection of personal data is an issue that Novatel attaches great importance to and prioritizes with sensitivity.

According to the Constitution of the Republic of Turkey and the Personal Data Protection Law (KVKK), everyone has the right to request the protection of their personal data.

Within the framework of this purpose, Novatel; With our principles of protection of personal data, which is a constitutional right, it is necessary to protect the personal data of Candidate Employees, Company Shareholders, Officials, Visitors, Employees, Shareholders and Officials of the Institutions we cooperate with, and Third Parties, individuals and customers doing business and transactions in our company, in short, real persons whose data are processed. shows care.

For this reason, necessary legal, administrative and technical measures are taken to protect personal data processed in accordance with the relevant legislation.

During the processing of personal data, Novatel

Processing personal data in accordance with the law and the rules of honesty,
Keeping personal data accurate and updated when necessary,
Processing personal data for specific, clear and legitimate purposes,
Limited and measured processing of personal data in connection with the purpose for which they are processed,
It is bound to retain personal data for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed.

Within the framework of these principles, Novatel

To enlighten and inform personal data owners,
Establishing the necessary system for personal data owners to exercise their rights,
To take the necessary administrative, technical and legal measures to preserve personal data,
It complies with the relevant legislation, international legislation and Personal Data Protection Authority (KVKKr) regulations in transferring personal data to third parties in line with the requirements of the purpose of processing.
In the processing of special personal data, it acts in accordance with the relevant legislation and the Personal Data Protection Authority (KVKKr) regulations, and by taking all measures to process and protect special personal data, it shows sensitivity to these data and adheres to the basic principles.

PROCESSED PERSONAL DATA

Within the scope of the obligation to inform within the framework of KVKK provisions, Novatel notifies groups of personal data owners that it processes their personal data, the purposes of processing and the storage periods.

Although the data processed by personal data categories are also included below, the concept of "personal data", as expressed in this Policy, is accepted as any direct or indirect information that is processed automatically or kept in a data recording system, even if not automatic, and has the ability to distinguish one individual from another. is done.

Identity Information: Information such as name-surname, TR ID number, nationality information, mother's name-father's name, place of birth, date of birth, gender, and documents containing this information such as driver's license, identity card and passport, as well as tax number, SSI number, signature information. documents, vehicle license plate etc.

Contact Information: Information such as telephone number, address, e-mail address, fax number, IP address.

Location Data: Information such as GPS location etc.

Family Members and Relative Information: Information about the personal data owner's family members (e.g. spouse, mother, father, child), relatives and other persons who can be reached in case of emergency.

Physical Space Security Information: Processed partially or fully automatically or non-automatically as part of the data recording system; Personal data regarding records and documents taken upon entering the physical location and during the stay in the physical location; camera records, fingerprint records and records taken at security points, etc.

Financial Information: Clearly belonging to an identified or identifiable natural person; Personal data processed regarding information, documents and records showing all kinds of financial results and data such as bank account number, IBAN number, credit card information, financial profile, asset data, income information,

Visual/Audio Information: Photographs and camera records (except for records falling within the scope of Physical Space Security Information), voice recordings and data contained in documents that are copies of documents containing personal data.

Personal Information: All kinds of personal data processed to obtain information that will be the basis for the formation of personal rights of real persons who are in an employment relationship.

Personal Data of Special Qualification: Data regarding individuals' race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric data and genetic data.

PROCESSING OF PERSONAL DATA

Novatel carries out processing activities in a limited and measured manner, in compliance with the Constitution, KVKK and other legal regulations and international regulations, in accordance with the law and the rules of honesty in the processing of personal data, accurate and up-to-date, pursuing specific, clear and legitimate purposes, in connection with the processing purpose.

Data processing activity carried out by Novatel;

It is clearly prescribed by law.
It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity.
It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
It is mandatory for the data controller to fulfill its legal obligation.
It has been made public by the person concerned.
Data processing is mandatory for the establishment, exercise or protection of a right.
Provided that it does not harm the fundamental rights and freedoms of the person concerned, data processing is mandatory for the legitimate interests of the data controller or, if necessary, directly based on the explicit consent of the data owner.

In terms of private data, the processing activity is limited to the cases stipulated by law, excluding sexual life and health information. Sexual life and health information is processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

In accordance with the Constitution and KVKK regulations, Novatel informs personal data owners and provides the necessary information if personal data owners request information.

a. Processing in Compliance with the Law and the Rules of Honesty

Novatel acts in accordance with legal regulations, principles, general and honesty rules in the processing of personal data, and does not process personal data for purposes other than those announced to the data owners, with the obligation to enlighten the personal data.

b. Ensuring Personal Data is Accurate and Up to Date

Novatel takes the necessary measures and makes arrangements to ensure that the personal data it processes are as accurate and up-to-date as possible, taking into account the rights and legitimate interests of personal data owners.

c. Processing Pursuant to Service Request of Specific, Clear and Legitimate Data Owner

Novatel clearly determines the legitimate and lawful purpose of the data owner and processes it as much as is necessary for the commercial activity it carries out and the requested service.

D. Being Related to the Purpose for Processing, Limited and Proportionate

Novatel processes the data subject as much as is necessary for the commercial activity it carries out and the requested service, by clearly determining the legitimate and lawful purpose of the data owner. It avoids the processing of personal data that is not relevant or needed to achieve the purpose.

to. Preservation for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose for which they are Processed

Novatel stores personal data for the period specified in the relevant legislation or necessary for the purpose for which they are processed. If the period expires or the reasons requiring processing disappear, personal data is deleted, destroyed or brought into compliance with legal regulations.

f. Informing the Personal Data Owner

During the collection of personal data, Novatel clearly informs personal data owners about its identity as the data controller, the purposes for which it will process personal data, to whom and for what purposes it can transfer personal data, the legal basis and collection method for collecting personal data, and the rights of the data owner.

The personal data owner has the right to "request information". The personal data owner is also informed by Novatel about the methods, procedures and principles regarding the use of the right in question.

g. Taking Care in Processing Special Personal Data

Novatel avoids processing data designated as "special quality", which carries the risk of causing victimization or discrimination when processed unlawfully, especially by not receiving the data, and shows the necessary care and sensitivity in cases where it is mandatory not to process it;

If the personal data owner has explicit consent and is mandatory for information processing, or

If there is no explicit consent of the personal data owner;

-Special personal data, other than the health and sexual life of the personal data owner, in cases stipulated by law
-In compulsory cases where the personal data owner will suffer damage and express consent is not possible,
-It processes sexual life and health information in accordance with the Law only for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

PURPOSES OF PROCESSING PERSONAL DATA

Novatel processes personal data limited to the processing purposes and conditions set out in KVKK and other legislation. These purposes and conditions;

Processing of personal data is clearly foreseen in the laws to which Novatel is subject,

The processing of personal data by Novatel is directly related to and necessary for the establishment or performance of a contract,

Processing of personal data is mandatory for Novatel to fulfill its legal obligation.

Provided that personal data has been made public by you; processing of you by Novatel in a limited way for publicization purposes,

The processing of your personal data by Novatel is mandatory for the establishment, exercise or protection of the rights of Novatel or you or third parties,

It is mandatory to process personal data for Novatel's legitimate interests, provided that it does not harm your fundamental rights and freedoms,

If personal data processing by Novatel is mandatory to protect the life or physical integrity of the personal data owner or someone else, and in this case, the personal data owner is unable to express his/her consent due to actual or legal invalidity,

It is mandatory and prescribed by law in terms of special categories of personal data other than the health and sexual life of the personal data owner,

In terms of special personal data regarding the health and sexual life of the personal data owner, individuals or authorized institutions and organizations under the obligation of confidentiality, for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing. is processed by.

For these purposes and within the scope of the work carried out, Novatel;

Planning and execution of corporate and business activities
Event (organization) management
Management of relationships with business partners, solution partners or suppliers or contractual service providers
Novatel, execution of personnel recruitment processes
Execution and monitoring of Novatel financial reporting and risk management transactions
Novatel, legal requirements and execution and follow-up of legal affairs
Carrying out accounting transactions,
Planning and execution of corporate communication activities
Execution of corporate governance activities
Carrying out company and partnership law transactions
Request and complaint management
Supporting the planning and execution processes of fringe rights and benefits to be provided to Novatel's senior managers and the company.
Carrying out work to protect Novatel's reputation
Managing investor relations
Providing information regarding legislation to authorized institutions
Procurement and service acquisition and ensuring service continuity,
Creating and tracking visitor records
Creating and tracking customer records
Keeping records and tracking the work carried out with the corporate partnership
It is processed for the purposes of sharing and tracking information with affiliated companies for the purpose of purchasing or providing services in accordance with the contract for the purpose of performing the work and/or providing the service.

If the processing activity carried out for the aforementioned purposes does not meet any of the purposes and conditions listed above, your express consent is obtained.

TRANSFER OF PERSONAL DATA

Novatel may transfer the personal data and sensitive personal data of the personal data owner to third parties by taking the necessary security measures in line with legal personal data processing purposes.

If the personal data owner has explicit consent,

If there is a clear regulation in the law regarding the transfer of personal data,
If it is necessary to protect the life or physical integrity of the personal data owner or someone else and the personal data owner is unable to express his/her consent due to actual impossibility or if his/her consent is not given legal validity;
If it is necessary to transfer personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
If personal data transfer is mandatory to fulfill a legal obligation,
If personal data has been made public by the personal data owner,
If personal data transfer is mandatory for the establishment, exercise or protection of a right,
If personal data transfer is mandatory for Novatel's legal interests, provided that it does not harm the fundamental rights and freedoms of the personal data owner, your personal data may be transferred to third parties by taking the necessary security measures.
As for your special personal data, the transfer is clearly foreseen by law in terms of your special personal data other than your sexual life and health information, provided that adequate precautions are taken; Your sexual life and health information can only be transferred to persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing.

For transfers to be made abroad, in addition to the basic principles and rules above; in the foreign country to which personal data will be transferred;

Having adequate protection,
In case there is no adequate protection, the data controllers in Turkey and the relevant foreign country must undertake in writing to provide adequate protection and have the permission of the Board,
is required.

THIRD PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED AND THE PURPOSES OF TRANSFER

Within the scope of the legislation regarding the protection of personal data that it is subject to, Novatel notifies the personal data owner of the groups of persons to whom personal data is transferred. Novatel may transfer the personal data of data owners to the categories of persons listed below.

Business partners, suppliers, shareholders, company officials and employees who will carry out the work, Legally authorized public institutions and organizations, Legally authorized private legal persons and Audit authorized persons-institutions and organizations, Necessary units for the realization of accounting transactions, In accordance with the work and affairs in which Novatel is engaged. It may transfer and process personal data to institutions and organizations that need to be transferred, to domestic or international ancillary and auxiliary service organizations and third parties required by the service or contract that the data owner has received or wishes to receive.

ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA AND ENSURING SECURITY


Novatel, in accordance with the KVKK regulations; to prevent unlawful processing and access of personal data; has taken all necessary legal, technical and administrative measures to ensure the appropriate level of security in order to ensure the preservation of the data in question. It carries out or has the necessary inspections carried out to protect personal data. Within the framework of this purpose;

Personal data processing activities carried out within Novatel are audited by established technical systems.
The technical measures taken are periodically inspected and reported by the internal mechanism.
Technically knowledgeable personnel are employed.
Technical measures are taken in accordance with the developments in technology, and the measures taken are periodically updated and renewed.
Access and authorization technical solutions are implemented in accordance with legal compliance requirements determined on a business unit basis.
Access authorizations are limited and authorizations are reviewed regularly.
The technical measures taken are periodically reported to the relevant person in accordance with the internal audit mechanism, and the issues that pose a risk are re-evaluated and the necessary technological solutions are produced.
Software and hardware including virus protection systems and firewalls are installed.
Regular security scans are carried out to detect security vulnerabilities in applications where personal data is collected; The existing gaps are closed.
Employees are informed and trained about personal data protection law and the lawful processing of personal data.
The personal data processing activities carried out by Novatel business units are determined by the internal functioning of a business unit and its activities necessary to ensure compliance with the personal data processing conditions required by KVKK.
In order to ensure legal compliance as required by the business, relevant work units are informed and implementation rules are determined; Necessary administrative and legal measures are taken to ensure the control of these issues and the continuity of the application.
There are provisions in the contracts and documents between Novatel and employees that impose the obligation not to process, disclose or use personal data, except for instructions and exceptions imposed by law, and periodic audits are carried out in this regard.
Employees have been informed that they cannot disclose the personal data they have learned to anyone else in violation of the provisions of KVKK and that they cannot use it for purposes other than processing, and the consequences of these, and the necessary contractual and administrative measures have been taken.

STORING PERSONAL DATA IN A SECURE ENVIRONMENT

Novatel has taken the necessary technical and administrative measures, according to technological possibilities and implementation costs, to store personal data in secure environments and to prevent them from being processed, destroyed, lost, changed or disclosed for unlawful purposes.

Systems compatible with technological developments are used to store personal data in secure environments.
Personnel specialized in technical matters have been employed.

Technical security systems are established for hiding areas and the technical measures taken are periodically inspected by the internal audit mechanism, technological solutions are produced when necessary and support is received from solution partners.

Programs are used in accordance with the law to ensure that personal data is stored securely.

Improper access or access attempts to data storage areas containing personal data are reported to the relevant parties and technological and legal solutions are produced when necessary.

Employees are trained to ensure that personal data is stored securely.
In case of outsourcing services due to technical requirements for the storage of personal data, the contracts concluded with the relevant companies to which personal data are transferred in accordance with the law contain provisions stating that the necessary security measures will be taken to protect personal data and that these measures will be ensured in their own organizations.

Novatel has taken the necessary measures to ensure that personal data processed in accordance with the regulations of the KVKK are not obtained by others through illegal means. However, if personal data is obtained through illegal means despite all precautions taken, Novatel operates a system that ensures that this situation is notified to the relevant personal data owner, KVKKr and Legal Units as soon as possible.

Within the scope of protection of personal data, great sensitivity is shown in the protection of personal data determined as "special nature" by KVKK and processed in accordance with the law. Regarding the special data in question, all kinds of technical and administrative precautions and precautions listed above have been taken in order not to obtain or process personal data, and to ensure the protection of data if collection is compulsory and necessary.

 PROCESSING DATA OBTAINED THROUGH THE WEBSITE AND THE INTERNET

Novatel, on its own websites; To ensure that the data of people who visit these sites and make transactions and receive services through the website are processed in accordance with the purposes of reporting their data on the sites; It can record internet movements and personal data on the site through technical means in order to show them customized content, engage in online advertising activities, and access the services and information they want.

Novatel processes personal data in accordance with its basic policy and principles, as well as its website and General Privacy Policy. Personnel who have access to this information have declared and undertaken to protect the confidentiality of the data they access with the confidentiality agreement, by informing them about their legal and criminal responsibilities. Your personal data is also secured in the internal structure with the confidentiality agreement. Necessary legal, technical and administrative measures have been taken by Novatel to ensure the security of personal data shared through its website.

RIGHTS OF PERSONAL DATA OWNERS

Novatel guides the personal data owner by informing him of his rights in accordance with the legislation regarding the regulation of personal data; It carries out the necessary administrative and technical arrangements to evaluate the rights of personal data owners and provide the necessary information to personal data owners.

Owner of Personal and Private Personal Data

Learning whether personal data is processed or not,
If personal data has been processed, to request information regarding the processing of the data,
Learning the purpose of processing personal data and whether they are used for their intended purpose,
Knowing the third parties to whom personal data is transferred at home or abroad,
Requesting correction of personal data if personal data has been processed incompletely or incorrectly by Novatel, and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,
Requesting the deletion or destruction of personal data in case the reasons requiring processing no longer exist, even though it has been processed in accordance with the provisions of KVKK and other relevant laws, and requesting that the transaction carried out in this context be notified to third parties to whom personal data has been transferred,
Objecting to the emergence of a result against the person by analyzing the processed data through automatic systems,
In case of damage due to unlawful processing of personal data, they have the right to demand compensation for the damage.

Situations in which the Personal Data Owner Cannot Assert Their Rights

In the event of the following situations, personal data owners do not have the opportunity to assert their right to information listed above, except for their right to compensation for damage. These;

Processing personal data is necessary for the prevention of crime or criminal investigation,
Processing of personal data made public by the personal data owner,
Processing of personal data is necessary for the execution of auditing or regulatory duties and disciplinary investigation or prosecution by public institutions and organizations and professional organizations that are public institutions, based on the authority granted by the law,
These are situations where personal data processing is necessary to protect the economic and financial interests of the State regarding budget, tax and financial issues, and dangerous and mandatory situations determined by the Law and practices.

Personal data owners may exercise their right to obtain information from Novatel's website, from the official e-mail address published on the site, in person with an identity document with a wet signature, or through a notary public at "Oruç Reis Mh. Vadi Cd. They can be used by sending it to the address "İstanbul Ticaret Sarayı No:108/301 Esenler/İstanbul".

In order for third parties to request an application on behalf of personal data owners, the data owner must have a special power of attorney issued through a notary on behalf of the person who will apply. If the applicant is a guardian, a copy of the Decision given by the Court must be submitted.
If the personal data owner submits his/her request in accordance with the procedure, Novatel will finalize the relevant request within thirty days at the latest, depending on the nature of the request, free of charge for up to the first 10 pages and then charging 1 lira for each page.

Novatel may reject requests regarding the situations listed above in which the Personal Data Owner cannot request information, and situations that are contrary to the rules of proportionality, proportionality, good faith and honesty and prohibited by Law, and requests where the subject of the request and/or the requester cannot be understood and/or the requester is unauthorized.
In cases where the application made by the personal data owner is rejected, the answer given is found to be insufficient, or the application is not answered in time, and/or within thirty days from the date of learning the answer, and in all cases within sixty days from the date of application, the personal data owner may file a complaint with the Personal Data Protection Board (KVKK).

Click to download the application form.