Personal Data Processing and Protection Policy

INTRODUCTION

Our Company Miss Diamond is a legal entity located at Abdurrahman Nafiz Gürman Mah. Ahmet Kutsi Tecer Cad. No: 55/E Merter-İstanbul. Miss Diamond acts as a data controller within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as the "KVKK Law"). Personal data owners are real persons whose personal data is collected, processed, and transferred for the purposes specified below, in accordance with the KVKK Law No. 6698 and other legal provisions to which Miss Diamond is subject.

Miss Diamond attaches great importance to the security of personal data. With this awareness, personal data of data owners is processed and maintained in compliance with the KVKK Law No. 6698, the Regulation on the Deletion, Destruction, or Anonymization of Personal Data published in the Official Gazette on October 28, 2017 (constituting the secondary legislation of the Law), the Regulation on the Data Controllers Registry which came into force on January 1, 2018, and other relevant frameworks.

PURPOSE AND SCOPE OF THE POLICY

The purpose of this Policy is to ensure that the regulations introduced within the framework of fundamental principles to comply with the KVKK Law by Miss Diamond are effectively implemented internally by Miss Diamond's shareholders, executives, employees, and business partners.
In line with the fundamental regulations prescribed by the Policy, all kinds of administrative and technical measures will be taken regarding the processing and protection of personal data within Miss Diamond's operations, necessary internal procedures will be established, all required trainings will be carried out to raise awareness, and all necessary measures will be taken to ensure compliance of Miss Diamond's shareholders, executives, employees, and business partners with KVKK processes, establishing appropriate and effective audit mechanisms.
The Policy regulates the core principles to be observed in all these processes and the matters Miss Diamond is obliged to fulfill in order to guide internal workflows in accordance with the regulations introduced by the KVKK Law. Internal procedures to be created under the KVKK Law and related legislation will govern Miss Diamond's alignment activities on data protection. All employees of Miss Diamond are required to act in accordance with the provisions introduced by this Policy, the KVKK Law, and all other relevant legislation while performing their duties.
In case of non-compliance with the Policy and relevant legislative provisions, in addition to the criminal and legal responsibilities prescribed by law, internal sanctions up to the justified termination of contracts will be applied within Miss Diamond, depending on the nature of the incident, within the framework of labor regulations.

DEFINITIONS

The following terms used in this Policy shall mean;

Explicit consent: Consent that is related to a specific subject, based on information and expressed with free will,
Anonymization: Rendering personal data impossible to be associated with an identified or identifiable real person under any circumstances, even by matching them with other data,
President: The President of the Personal Data Protection Authority,
Relevant person (Data Subject): The real person whose personal data is processed,
Personal data: Any information relating to an identified or identifiable real person,
Processing of personal data: Any operation performed on data such as obtaining, recording, storing, retaining, altering, re-arranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data by fully or partially automated means or by non-automated means provided that it forms part of any data filing system,
Deletion of Personal Data: The process of rendering personal data inaccessible and non-reusable for the relevant users in any way,
Destruction of Personal Data: The process of rendering personal data inaccessible, irretrievable, and non-reusable by anyone in any way,
Board: The Personal Data Protection Board,
Authority: The Personal Data Protection Authority,
Special Category Personal Data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing and dress, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data,
Data processor: The real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,
Data filing system: The recording system where personal data is structured and processed according to specific criteria,
Regulation: The Regulation on the Data Controllers Registry,

In accordance with Paragraph 1 of Article 11 of the Regulation, responsible persons have been assigned by Miss Diamond regarding the KVKK procedure and necessary measures have been taken.

GENERAL PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

Miss Diamond accepts that it will process personal data falling within the scope of this Policy in accordance with the following principles, in line with Article 4 of the KVKK Law:

Compliance with the law and honesty rules: Miss Diamond, in its capacity as data controller and as a prudent merchant, accepts that it will carry out personal data processing activities in compliance with all legislative provisions in force and to be enacted, primarily the Constitution and the KVKK Law, and in accordance with the rule of honesty stipulated in Article 2 of the Civil Code.

Accuracy and being up-to-date: Miss Diamond takes all necessary measures to ensure the accuracy and up-to-date status of personal data in its processing activities, to the extent permitted by technical capabilities. In line with requests submitted by the data subject to Miss Diamond in their capacity as data controller or in cases Miss Diamond deems necessary, administrative and technical mechanisms established by Miss Diamond will be operated to correct erroneous or outdated personal data and verify their accuracy.

Processing for Specific, Explicit, and Legitimate Purposes: Personal data is processed lawfully by Miss Diamond, limited to the requirements of the relevant legislative provisions and the services offered or to be offered, and the purpose of processing personal data is determined clearly and precisely before data processing begins.

Processing data in a relevant, limited, and proportionate manner to the purposes for which they are processed: Personal data is processed by Miss Diamond in a relevant and limited manner to its processing purposes and to the extent required for the realization of this purpose. In this context, it is a fundamental rule to avoid processing personal data that is not related to the processing purpose or not needed.

Processing for the period stipulated by legislative provisions or required by the processing purpose: Personal data is retained in accordance with the periods stipulated in the relevant legislative provisions or for the duration required by the purpose of data processing. At the end of the period prescribed by law or required by the processing purpose, personal data is deleted, destroyed, or anonymized by Miss Diamond. Necessary administrative and technical measures will be taken to prevent data from being retained beyond the required period.

CONDITIONS FOR PROCESSING PERSONAL DATA

The conditions for processing personal data are regulated by the KVKK Law, and personal data is processed by Miss Diamond in compliance with these specified conditions below.

Conditions for Processing General Personal Data

Except for the exemptions listed in the Law, Miss Diamond processes personal data only by obtaining the explicit consent of data owners. In the presence of the following situations listed in the Law, personal data may be processed even without the explicit consent of the data owner:

It is explicitly stipulated in the laws,
It is mandatory for the protection of life or physical integrity of the person or someone else who is unable to express their consent due to actual impossibility or whose consent is not granted legal validity,
Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
It is mandatory for the data controller to fulfill its legal obligation,
It has been made public by the data owner themselves,
Data processing is mandatory for the establishment, exercise, or protection of a right,
Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner.

Conditions for Processing Special Category Personal Data

Miss Diamond demonstrates special sensitivity in processing special category personal data, which is believed to be of more critical importance to protect from various aspects for data owners. In this context, such data is not processed without the explicit consent of data owners, provided that adequate measures determined by the Board are taken. However, special category personal data other than health and sexual life may be processed without the explicit consent of the data owner in cases prescribed by law. On the other hand, data concerning health and sexual life can be processed without explicit consent only by persons under a non-disclosure obligation or authorized institutions and organizations, provided that adequate measures are taken, for the following reasons:

Protection of public health,
Operation of preventive medicine,
Medical diagnosis,
Execution of treatment and care services,
Planning and management of healthcare services and their financing.

METHODS OF OBTAINING AND PROCESSING PERSONAL DATA

In this context, your personal data may be collected by Miss Diamond or by real or legal persons processing data on behalf of Miss Diamond, written or electronically, through methods including but not limited to those listed below;

Communications made during campaigns via interaction channels such as email, telephone, and social media accounts,
Employment contract and internship platforms,
The institutions themselves with which our company has professional relationships, signature circulars,
Powers of attorney, contracts,
Various contracts you signed with our Company and all kinds of emails, requests, work orders, faxes, and letters you sent to our Company,
Third-party company/companies processing data on behalf of our company or supporting our company at any stage of the membership program process,
Our employees, our customer service channels including digital marketing and call center,
Social media channels,

and is processed into the data filing system and inventory in this manner.

Furthermore, we would like to mention that the legal grounds for data processing are cases where it is explicitly stipulated in laws pursuant to KVKK Art. 5/2/a and Art. 6/3;

For the establishment, performance, and termination of a contract with the data owner or the institution they are affiliated with, if any, pursuant to Art. 5/2/c,
For the Company to fulfill its legal obligations pursuant to Art. 5/2/ç,
It has been made public by you pursuant to Art. 5/2/d,
It is mandatory for the legitimate interests of the data controller, such as the promotion of the institution, provided that it does not harm the fundamental rights and freedoms of the data subjects pursuant to Art. 5/2/f.

In cases where none of the legal grounds specified here and in the Law exist, your personal data will be processed by obtaining your explicit consent in accordance with Art. 5/1 and Art. 6/2, when required.

Data Subject Groups Subject to Personal Data

Data Subject Groups Subject to Personal Data	Description
Miss Diamond Shareholders	Real persons who are shareholders of Miss Diamond
Miss Diamond Executives	Board members and other authorized real persons of Miss Diamond
Employees/Interns	Real persons working or interning within Miss Diamond
Employee Candidates	Real persons who have applied for a job by any means or opened their CV and related information to Miss Diamond's review, but do not work or intern within Miss Diamond
Employees, Shareholders, and Executives of Institutions in Cooperation (Miss Diamond's goods and service suppliers, business partners, etc.)	Real persons, including shareholders, employees, and executives of institutions with which Miss Diamond has established business relations (such as, but not limited to, business partners, goods, and service suppliers) within a contractual relationship or without any contractual relationship to provide operational services, develop investments, and conduct commercial activities

Data Categorization

Data Categorization	Data Categorization Description
Identity Information	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; containing information about the person's identity; documents such as driver's license, national identity card, and passport containing info like name-surname, T.R. identity number, nationality, mother's name-father's name, place of registry, birth place, birth date, gender, marital status, as well as tax number, SGK number, signature information, etc.
Contact Information	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; information such as phone number, address, email address, fax number, etc.
Location	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; information regarding the location of the personal data owner (location coordinates, etc.) within the scope of activities carried out by Miss Diamond, to protect the legal and other interests of the data subject.
Personnel File (Employment Record)	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; legally mandatory information to be included in the personnel file that forms the basis for the employment rights of real persons in a working relationship with Miss Diamond (Education status, certificate and diploma info, foreign language skills, training and talents, CV, courses taken, leave seniority base date, extra leave days, leave group, exit/return date, days, reason for taking leave, address/phone during leave, position name, department and unit, title, latest employment entry date, entry/exit dates, insurance registration/retirement, social security no, flexible working status, travel status, number of working days, projects worked on, monthly total overtime info, severance pay base date, extra severance days, days spent on strike, employee internet access logs, entry-exit logs, and performance data required for progress like training records, date and type of training, email, signed attendance form, customer interaction quality evaluation form, monthly performance evaluation and goal completion status, activity data).
Financial	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; financial personal data processed regarding information, documents, and records varying according to the type of legal relationship established between Miss Diamond and the data owner, such as bank account number, bank account details (IBAN no, account holder, etc.), credit card information, etc., and financial and salary details for employees, payrolls, bonus entitlements, bonus amounts, file and debt info regarding execution proceedings, bank passbook, minimum living allowance info, private health insurance amount, etc.
Legal Transaction	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; personal data obtained as a result of communications with judicial authorities, lawsuits, and execution tracking processes.
Customer Transaction	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; personal data obtained through documents such as invoices, checks, promissory notes, counters, receipts, request, and order forms.
Physical Space Security, Visual/Auditory Records	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; personal data obtained via security cameras operating at Miss Diamond.
Professional Experience	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; Employee, Job Candidate, Intern.
Marketing	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; Potential Product or Service Buyer, Product or Service Recipient, Supplier Employee, Supplier Executive.
Health Information	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; Employee, Intern.
Transaction Security	Data clearly belonging to an identified or identifiable real person; processed fully or partially automated, or non-automated as part of a data filing system; Potential Product or Service Buyer, Product or Service Recipient.

PRINCIPLES OF PERSONAL DATA TRANSFER

Miss Diamond may transfer personal data of data owners to third parties and institutions within the scope of the personal data processing conditions specified in Articles 5 and 6 of the KVKK Law No. 6698, limited to the purposes specified in this Policy, and in compliance with Articles 8 and 9 of the KVKK Law.

The scope of the aforementioned persons to whom transfers are made and the data transfer purposes are specified below. These persons and Institutions are;

Miss Diamond business partners, affiliates, and subsidiaries,
Miss Diamond suppliers,
Miss Diamond departments and executives,
Miss Diamond Sanayi Ticaret Ltd. Şti. shareholders/partners,
Banks,
Public institutions and organizations legally authorized to obtain information,
Private law/public law legal entities legally authorized to obtain information.

RECIPIENT GROUPS TO WHOM DATA CAN BE TRANSFERRED	DEFINITION	TRANSFER PURPOSE OF PROCESSED DATA
Business Partner/ Affiliates/Subsidiaries	Defines the parties with whom Miss Diamond establishes partnerships to carry out various projects together, receive services, etc., while conducting its commercial activities.	Limited to ensuring the fulfillment of the establishment purposes of the business partnership.
Supplier	Defines the parties that provide services to Miss Diamond on a contractual basis or individually without a contract, in accordance with Miss Diamond's orders and instructions, while conducting its commercial activities.	To ensure that the services required for Miss Diamond to execute its commercial activities are provided to Miss Diamond by the supplier.
Banks	Private and public banks with which Miss Diamond works and carries out operations in various fields, including monthly wage payments.	Limited to contracts, deeds of assignment, and information required to be shared under relevant legal regulations regarding Miss Diamond's rights and claims.
Company Executives	Miss Diamond board members and other authorized real persons.	Limited to designing strategies for Miss Diamond's commercial activities, ensuring management at the highest level, and auditing purposes in accordance with relevant legislative provisions.
Legally Authorized Public Institutions and Organizations	Public institutions and organizations authorized to receive information and documents from Miss Diamond according to relevant legislative provisions.	Limited to the purposes requested by the relevant public institutions and organizations within their legal authority.
Legally Authorized Private Law Persons	Private law persons authorized to receive information and documents from Miss Diamond according to relevant legislative provisions.	Limited to the purpose requested by the relevant private law persons within their legal authority.

Within the scope of KVKK Article 5, our Company transfers data of personal data owners without explicit consent in the following cases:

If processing of personal data is directly related to and necessary for the establishment or performance of a contract,
If processing of personal data is mandatory for our company to fulfill its legal obligation,
Provided that personal data has been made public by the data owner; strictly limited to the purpose of making it public,
If processing of personal data is mandatory for the establishment, exercise, or protection of the rights of our company, the data owner, or third parties,
If personal data processing activity is mandatory for the legitimate interests of our company, provided that it does not harm the fundamental rights and freedoms of data owners.

For the transfer of special category data, the explicit consent of the data owner is mandatory, except for the exemptions specified in KVKK Article 6 and detailed below.

The relevant exemptions apply to special category personal data concerning the data owner's health and sexual life, which can be transferred without explicit consent only for the purposes of protecting public health, operating preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of healthcare services and their financing, by persons under a non-disclosure obligation or authorized institutions and organizations.

As a rule, no data transfer abroad is carried out by our Company, and all necessary administrative and technical measures are taken to ensure personal data is not transferred outside the country.

STORAGE OF PERSONAL DATA

The personal data we obtain is safely stored in a physical or electronic environment for an appropriate duration to ensure the continuity of Miss Diamond's activities. Within the scope of these activities, actions are taken by Miss Diamond in accordance with the obligations prescribed in all relevant legislation, primarily the KVKK Law, regarding the protection of personal data. Except for cases where personal data is permitted or required to be stored for a longer period, personal data obtained will be deleted, destroyed, or anonymized by Miss Diamond ex officio or upon the request of its owners if the purposes for processing personal data cease to exist.

In cases where the data controller has a legally legitimate interest, personal data may be stored within the general statute of limitations (ten years), provided that it does not harm the fundamental rights and freedoms of data owners, even if the processing purpose and the periods specified in the relevant laws have expired. Following the expiration of the aforementioned statute of limitations, personal data is deleted, destroyed, or anonymized according to the procedure in the Disposal Policy (We strongly recommend checking our Disposal Policy regarding the Deletion, Destruction, and Anonymization of Personal Data on our website or by contacting [email protected] for detailed information).

MEASURES TAKEN REGARDING THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the KVKK Law, Miss Diamond takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent unlawful processing of the personal data it processes, prevent unlawful access to data, and ensure data retention, carrying out or commissioning necessary audits within this scope. If processed personal data is acquired by third parties through unlawful means despite all technical and administrative measures taken, Miss Diamond will notify the relevant units of this situation as soon as possible.

Technical Measures

Taking into account conscious or unconscious threats that may be posed by individuals within the organization, necessary security controls have been implemented via log reporting through software and hardware devices in all relevant fields to control access to information and prevent unauthorized access.
Layered network security measures have been established in the Company against threats that may come from external networks.
Technical measures matching technological developments are taken, and the measures taken are periodically updated and renewed.
Access and authorization technical solutions are deployed in accordance with legal compliance requirements determined on a business unit basis.
Access authorizations are restricted.
Technical measures taken are periodically checked, risk-posing matters are re-evaluated, and required technological solutions are produced.
Software and hardware containing virus protection systems and firewalls are installed.
Firewalls, antivirus software, VPN software/hardware, content controllers, and centralized management software are used in Company computer systems.
Personnel knowledgeable in technical matters are employed.
Regular security scans are performed to detect vulnerabilities in applications where personal data is collected. Detected vulnerabilities are closed.
When a need arises, penetration testing services are obtained to check system vulnerabilities.
Destruction of personal data is ensured in a way that is irreversible and leaves no audit trail.

Administrative Measures

Provisions are added to contracts concluded with persons to whom personal data is lawfully transferred by Miss Diamond, stating that the persons to whom personal data is transferred will take necessary security measures to protect personal data and ensure compliance with these measures within their own organizations.
Records have been added to all kinds of documents regulating the relationship with Miss Diamond personnel and containing personal data, stating that obligations prescribed by the KVKK Law must be followed for personal data to be processed lawfully, personal data must not be disclosed, personal data must not be used unlawfully, and the confidentiality obligation regarding personal data continues even after the termination of the employment contract with Miss Diamond; failure of personnel to comply with these obligations requires the application of sanctions that may extend to the termination of the employment contract.
Employees are trained on the technical measures to be taken to prevent unlawful access to personal data.
Personal data access and authorization processes within Miss Diamond are designed and implemented in line with legal compliance requirements for data processing on a business unit basis.
Employees are informed that they cannot disclose personal data they learn to others in violation of the provisions of the KVKK Law and cannot use it outside the scope of processing purposes, and that this obligation will continue after they leave office, and necessary commitments are obtained from them accordingly.
In the event that processed personal data is obtained by others through unlawful means, it notifies the data subject and the Board as soon as possible.
It employs personnel knowledgeable and experienced in personal data processing and provides its staff with necessary training within the scope of personal data protection legislation and data security.
It carries out or commissions necessary audits within its own legal entity to ensure the implementation of the provisions of the Law. It resolves confidentiality and security vulnerabilities resulting from audits.
Miss Diamond is responsible under Article 12 of the KVKK Law for ensuring that third parties to whom it transfers personal data fulfill their obligations to process and protect data lawfully and access data lawfully in line with this Policy and the provisions of the KVKK Law. Therefore, Miss Diamond must secure commitments including the provision of these conditions and the granting of audit authority to itself in contracts and all kinds of arrangements made while transferring data to third parties. Likewise, Miss Diamond must specifically inform all its personnel about responsibilities arising from personal data transfer processes to third parties.

Audit of Measures Taken Regarding the Protection of Personal Data

Within the scope of the KVKK Law, Miss Diamond has registered with the VERBİS system in its capacity as data controller. Paragraph 1 of Article 11 of the Regulation states: "The obligations of legal entities resident in Türkiye under the Law as data controllers shall be fulfilled through the authorized organ authorized to represent and bind the legal entity according to relevant legislative provisions or the person or persons specified in the relevant legislation. The organ authorized to represent the legal entity may assign one or more persons regarding obligations to be fulfilled for the implementation of the Law." Pursuant to this regulation, KVKK officers have been designated by our company, and audits are carried out by these officers periodically and at specific times.

OBLIGATION OF THE DATA CONTROLLER TO INFORM

Within the scope of Article 10 of the KVKK Law, data owners must be informed before or at the latest during the collection of personal data. The information that must be conveyed to data owners within the framework of the said obligation to inform includes:

The identity of the data controller and its representative, if any,
The purpose for which personal data will be processed,
To whom and for what purpose processed personal data can be transferred,
The method and legal grounds for collecting personal data,
Other rights listed in Article 11 of the KVKK Law.

In this context, our Company informs the personal data owner of their rights in compliance with Article 10 of the KVKK Law, guides the personal data owner on how to exercise these rights, and Miss Diamond operates necessary channels, internal workflows, administrative and technical arrangements in accordance with Article 13 of the KVKK Law for the evaluation of data owners' rights and provision of required information to personal data owners.

To fulfill its obligation to inform, Miss Diamond has prepared clarification statements to be presented to data owners under the aforementioned provision of the KVKK Law, based on processes and individuals whose data is processed. Following the presentation of clarification statements to data owners, explicit consent declarations have also been prepared for data processing activities and data categories that require the data owner's explicit consent for Miss Diamond to execute its commercial activities. In explicit consent declarations prepared for data owners, in parallel with European Union regulations forming the basis of the KVKK Law, data owners are granted a right of choice on whether their personal data can be processed by Miss Diamond or not, and information has been provided regarding the consequences that may occur if explicit consent cannot be secured.

OTHER OBLIGATIONS OF THE DATA CONTROLLER

Obligation to Inform: A Clarification Text has been drawn up regarding data processed by Miss Diamond, and relevant persons have been informed about the process.

Obligations Regarding Data Security: Our Company undertakes that it fulfills all obligations to prevent unlawful processing of personal data, prevent unlawful access to this data, and ensure its retention in accordance with the law. The Company has established the data filing system determining the purposes and means of processing personal data.

Obligation to Perform or Commission Audits: Our Company undertakes that it performs/commissions necessary audits in ensuring the implementation of legal provisions, with the purpose of processing personal data in accordance with the procedures and principles prescribed in the law.

Obligation to Maintain Secrecy: Our Company undertakes that it will not disclose or make available to others the personal data it processes, except for data where information on transfer is provided and explicit consent is obtained in accordance with the law. This commitment continues even when the data controller or data processors assigned during processing leave their posts.

Obligation to Notify in Case of Breach: In the event that processed data is acquired by others through unlawful means, our Company will notify the relevant person and the Board as soon as possible.

Obligation to Answer Applications Made by Relevant Persons and Fulfill Board Decisions: Miss Diamond will answer requests directed to it regarding the implementation of the Law by data owners in writing or through other methods determined by the Board, free of charge, as soon as possible and within thirty days at the latest, depending on their nature. If this operation requires a cost, Miss Diamond may request the fees in the tariff determined by the Board from the requesting relevant person.

Obligation to Register with the Data Controllers Registry: Miss Diamond will complete its registry registration within the date and period to be announced by the Personal Data Protection Board.

RIGHTS OF THE DATA OWNER AND EXERCISE OF THESE RIGHTS

Rights of the Data Owner

We would like to state that as a data owner, you have the following rights pursuant to Article 11 of the Law:

Learn whether your personal data is processed or not,
Request information if your personal data has been processed,
Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
Know the third parties to whom your personal data is transferred at home or abroad,
Request correction of your personal data if it is processed incompletely or incorrectly and request notification of the transaction made within this scope to the third parties to whom your personal data has been transferred,
Request the deletion or destruction of personal data if the reasons requiring its processing disappear despite having been processed in accordance with the Law and other relevant law provisions, and request notification of the transaction made within this scope to the third parties to whom your personal data has been transferred,
Object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
Demand the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.

In case you apply to our company regarding your rights listed above, your applications will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request; however, if the transaction requires an additional cost, a fee may be requested from you according to the tariff to be determined by the Personal Data Protection Board. Detailed and additional information may be requested in cases deemed necessary to better understand the request. The procedures and principles of application are explained below.

Personal data owners cannot assert their rights listed in section 11 on these matters, since the following cases are excluded from the scope of the KVKK Law pursuant to Article 28 of the KVKK Law:

Processing of personal data for purposes such as research, planning, and statistics by rendering them anonymous with official statistics.
Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, right to privacy, or personal rights or constitute a crime.
Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized and empowered by law to ensure national defense, national security, public safety, public order, or economic security.
Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution proceedings.

Pursuant to Article 28/2 of the KVKK Law; data owners cannot assert their other rights listed in section 11, except for the right to demand compensation for damages, in the following cases:

Personal data processing is necessary for the prevention of committing a crime or for a crime investigation.
Processing of personal data made public by the personal data owner themselves.
Personal data processing is necessary for the execution of inspection or regulation duties and for disciplinary investigation or prosecution by authorized and empowered public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by law.
Personal data processing is necessary for the protection of the economic and financial interests of the State regarding budget, tax, and financial matters.

Exercise of Rights by the Personal Data Owner

Data owners will be able to convey their requests regarding their rights listed above to Miss Diamond free of charge by filling out and signing the Application Form in ANNEX-1 with information and documents confirming their identity, using the methods specified below or other methods determined by the Personal Data Protection Board:

An email they will send to the [email protected] email address
They have the right to learn by sending the Application Form via a notary public or in person to the address Ehlibeyt Mah. 6.Sokak No:25-B Balgat Çankaya/ANKARA.

In order for third parties to make an application request on behalf of personal data owners, a special power of attorney issued through a notary public by the data owner in the name of the person making the application must be present.

Right of the Personal Data Owner to File a Complaint with the KVKK Board

Pursuant to Article 14 of the KVKK Law, in cases where the application is rejected, the answer given is found insufficient, or the application is not answered in due time, the personal data owner may file a complaint with the KVKK Board within thirty days from the date they learn Miss Diamond's answer and in any case within sixty days from the application date.

MISS DIAMOND'S RESPONSE TO APPLICATIONS

Procedure and Duration of Miss Diamond's Response to Applications

In case the personal data owner conveys their request to Miss Diamond in accordance with the procedure set out in this policy, Miss Diamond will conclude the relevant request free of charge within thirty days at the latest, depending on the content of the request. However, if a fee is prescribed by the KVKK Board, the fee in the tariff determined by the KVKK Board will be collected from the applicant by Miss Diamond.

Information Miss Diamond May Request from the Applicant Personal Data Owner

Miss Diamond may request information from the relevant individual to determine whether the person making the application is the personal data owner. Miss Diamond may direct questions to the personal data owner regarding their application to clarify the matters located in the request of the personal data owner.

Miss Diamond's Right to Reject the Application of the Personal Data Owner

Miss Diamond may reject the application of the applicant by explaining its justification in the following cases:

Processing of personal data for purposes such as research, planning, and statistics by rendering them anonymous with official statistics.
Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, right to privacy, or personal rights or constitute a crime.
Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized and empowered by law to ensure national defense, national security, public safety, public order, or economic security.
Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution proceedings.
Personal data processing is necessary for the prevention of committing a crime or for a crime investigation.
Processing of personal data made public by the personal data owner themselves.
Personal data processing is necessary for the execution of inspection or regulation duties and for disciplinary investigation or prosecution by authorized and empowered public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by law.
Personal data processing is necessary for the protection of the economic and financial interests of the State regarding budget, tax, and financial matters.
The possibility that the personal data owner's request may hinder the rights and freedoms of other persons.
Requests requiring disproportionate effort have been made.
The requested information is publicly available information.

REVISION AND ABROGATION

In case this Policy is revised or abrogated, the revised version of the Policy or the new policy example will be announced in relevant locations.

ENFORCEMENT

The execution of this Policy is under the responsibility of the data controller and all department managers, primarily the Information Technology Manager, assigned to be responsible for the tracking and coordination of all business and operations within the scope of the KVKK Law and Data Protection Board regulations by the board of directors of Miss Diamond, which is obliged to fulfill the obligations of the data controller.