KVKK Illumination Text

1. Data Controller's Identity

In accordance with KVKK, your personal data may be processed by ESG Yazılım Elektronik Arge Hizmetleri ve Otomasyon San. Tic. A.Ş., located at Reşitpaşa Mah. Katar Cad. Arı 4 Binası No: 2 / 50 / 6 Sarıyer / İstanbul, as the Data Controller, within the scope specified below.

The Data Controller Representative, to be appointed by ESG Yazılım if deemed necessary, will be announced separately in the Data Controllers' Registry and on ESG Yazılım's website.

2. Purpose and Legal Basis for Processing Personal Data

Kişisel veri, kimliği belirli veya belirlenebilir gerçek kişiye ilişkin her türlü veriyi ifade etmektedir. Kişisel verilerin işlenmesi ise tamamen veya kısmen otomatik olan ya da herhangi bir veri kayıt sisteminin parçası olmak kaydıyla otomatik olmayan yollarla elde edilmesi, kaydedilmesi, depolanması, muhafaza edilmesi, değiştirilmesi, yeniden düzenlenmesi, açıklanması, aktarılması, devralınması, elde edilebilir hâle getirilmesi, sınıflandırılması ya da kullanılmasının engellenmesi gibi veriler üzerinde gerçekleştirilen her türlü işlemi ifade etmektedir.

Your personal data is processed by ESG Yazılım for the following purposes in accordance with Articles 4, 5, and 6 of the Law:

Carrying out Membership and Agreement Processes

• Creation and management of your membership account
• Ensuring that you benefit from the services offered via the Website/Mobile Application
• Establishment and performance of contracts, fulfillment of service terms

Execution of Financial and Accounting Processes

• Execution of payment transactions
• Invoicing and record keeping, execution and auditing of necessary financial transactions

Conduct and Oversight of Company Operations

• The provision, development, and improvement of our services
• Management of operational processes, planning and execution of business processes
• Execution of information security processes and ensuring system security

User Relations and Communication Management

• Talep, şikâyet ve önerilerinizin değerlendirilmesi ve sonuçlandırılması
• Communication activities carried out through our call center and other communication channels

Fulfillment of Legal Obligations

• Fulfilling legal obligations towards authorized persons, institutions, and organizations
• Prevention and/or management of disputes, follow-up of legal and litigation affairs

Activities Carried Out Within the Scope of Legitimate Interests

• Analysis and reporting activities for the improvement of our services
• Improving user experience, enhancing site and application security
• Conducting strategic analysis studies

Marketing and Promotion Activities in Case of Explicit Consent

• Sending you personalized campaigns, advertisements, promotions, and similar commercial electronic messages
• Conducting satisfaction and marketing analysis studies
• Providing information regarding the products and services of ESG Yazılım and its affiliated companies/subsidiaries

Kişisel verileriniz, her türlü sözlü, yazılı ya da elektronik ortamda, yukarıda yer verilen amaçlar doğrultusunda Şirketimizce sunduğumuz hizmetlerin belirlenen yasal çerçevede sunulabilmesi ve bu kapsamda şirketimizin sözleşme ve yasadan doğan mesuliyetlerini eksiksiz ve doğru bir şekilde yerine getirebilmesi, şirketimizin daha etkin bir şekilde çalışması gayesi, doğrudan tarafınızca paylaşılması ile KVKK'nın 5. ve 6. maddelerinde belirtilen kişisel veri işleme şartları ve amaçları ile uygun olarak edinilir.

3. To Whom and for What Purposes Can Your Personal Data Be Transferred?

Your collected personal data may be transferred within the framework of the personal data processing conditions specified in Articles 8 and 9 of the Law, with the data security measures specified in the Law being taken, to service provider companies, our business partners, solution partners, legally authorized public institutions, institutions we receive services from, domestic and international servers we use, domestic/international institutions from which we receive cloud services, data processors on behalf of the data controller, individuals and institutions providing measurement, targeting, and profiling support, audit firms, contracted payment institutions for the fulfillment of payments and financial obligations, advertising and promotion agencies, cargo companies, and private individuals for the realization of the purposes stated above.

Your data may be transferred to servers located domestically and abroad and to institutions from which we receive cloud services, provided that explicit consent is obtained in accordance with Article 9 of the KVKK, the countries with adequate protection are determined by the Board, or the necessary security measures are taken within the scope of commitments and standard contracts approved by the Board.

Based on the legal grounds that data processing is necessary for the establishment, exercise, or protection of a right, is expressly provided for in the legislation to which our company is subject, and is necessary for the fulfillment of our legal obligations;

• Within the scope of fulfilling legal obligations, with lawyers, auditors, forensic IT specialists, cybersecurity consultants, tax consultants, and other third parties and business partners from whom we receive consultancy and services,
• With regulatory and supervisory bodies, and authorized public institutions and organizations such as courts and enforcement directorates,
• with other public institutions or organizations authorized to request your personal data, with our domestic and/or international affiliates, suppliers, business partners, banks we have agreements with, and third parties from whom we receive products or services

can be shared.

Transfer Abroad

As ESG Yazılım, some of your personal data may be transferred abroad to improve your user experience and ensure platform security. In this context:

• Data regarding your website/mobile application usage (cookies, browser type, session duration, etc.) may be transferred to countries where Google LLC servers are located, through service providers such as Google Analytics and Google Tag Manager.

Data transfer abroad:

1. Limited only to the purpose of data processing and by taking the necessary technical/administrative security measures,
2. In accordance with Article 9 of KVKK, within the framework of commitments and standard contracts determined by the Board as having adequate protection or approved by the Board,
3. By obtaining your explicit consent in relevant cases

is being carried out.

You have the right to withdraw your explicit consent at any time. If you withdraw your explicit consent, cross-border transfer transactions based on explicit consent will be immediately suspended.

4. Method and Legal Basis of Personal Data Collection

Kişisel verileriniz, tarafınızca ESG Yazılım ile temasa geçilmesi halinde; elektronik ortamda internet sitesi, çağrı merkezi, mobil uygulama, çevrim içi uygulamalar, çerezler (Çerezler hakkında detaylı bilgi için lütfen Çerez Politikamızı inceleyiniz), elektronik postalar, sosyal medya kanalları ile, şirket çalışanlarımız, basılı formlar, üyelik formları, çözüm ortaklarımız aracılığı ile başta sözleşmenin kurulması veya ifası olmak üzere, KVKK'nın 5. ve 6. maddelerinde belirtilen hukuki sebeplere dayanılarak toplanacaktır.

Within the scope of this Clarification Text, primarily identity, communication, customer transaction, transaction security, marketing, legal transaction, and audio-visual record data are processed for website and mobile application users. Data such as personal details, professional experience, and physical space security may only be relevant for specific internal processes (e.g., employee, job application, etc.).

Your personal data is collected by the Company through various channels and based on different legal grounds. Within this process, your personal data is processed through our website in the internet environment and our applications in the mobile environment, based on the purposes listed above. The personal data collected can be processed and transferred for the purposes stated in this Disclosure Text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

5. Protection and Storage of Personal Data

Personal data collected by ESG Yazılım verbally, in writing, or electronically is stored only for the period specified in the relevant legislation or required for the processing purpose. Personal data whose storage period has expired or whose processing purpose has ceased to exist is deleted, destroyed, or anonymized within the framework of the Law and relevant legislation. In cases required by commercial, financial, and legal obligations, some personal data may be stored for a longer period.

In this context;

• According to Turkish Commercial Code No. 6102, commercial books and documents are kept for 10 years,
• According to Tax Procedure Law No. 213, financial documents must be kept for 5 to 10 years.
• Other personal data, such as consumer transactions, invoices, payments, and dispute records, may be retained for the duration of the relevant statutes of limitations.

When the retention period expires, data is destroyed or anonymized in accordance with the Data Categorization and Retention Periods Policy.

ESG Yazılım takes technical and administrative measures such as access controls, encryption technologies, penetration tests, risk analyses, SSL infrastructure, and similar measures to ensure the security of personal data; and regularly updates its data security policies.

6. Commercial Electronic Message

Kabul etmiş olmanız halinde size doğrudan pazarlama yöntemleriyle (ör. telefon, e-posta, SMS, sosyal ağlar, posta) ESG Yazılım'ın hizmet ve kampanyaları için güncellemeler ve teklifler sunabiliriz. İleti Yönetim Sistemi'ne ("İYS") ilişkin olarak bilgilendirme, söz konusu sitenin oluşturulması, altyapı çalışmalarının tamamlanması ve İYS'ye kayıt için öngörülen sürenin dolması sonrası yapılabilecektir.

Within this framework, we may use other personal data provided to us to determine our services, tailor them to your requests, and compile them; and to help us offer campaigns that may be of interest to you.

When we contact you as part of email, message, or other direct marketing activities, you are always presented with an "unsubscribe" option. You can change your marketing preferences by contacting us at any time.

Records related to commercial electronic messages are kept for the periods stipulated by Law No. 6563 and related legislation.

7. Data Subject's Rights

Pursuant to Article 11 of the Law on the Protection of Personal Data No. 6698, the data subject may apply to the data controller regarding themselves;

1. learning whether personal data is processed,
2. Requesting information about whether personal data has been processed,
3. Learning the purpose of personal data processing and whether it is used in accordance with its purpose,
4. Knowing the third parties to whom personal data is transferred domestically or abroad,
5. Kişisel verilerin eksik veya yanlış işlenmiş olması hâlinde bunların düzeltilmesini isteme,
6. Requesting the deletion or erasure of personal data within the framework of the conditions stipulated in Article 7,
7. Requesting that the actions taken for the correction and deletion/destruction of data be notified to third parties to whom personal data has been transferred,
8. Objecting to a result arising to their detriment solely through the analysis of processed data by automated systems,
9. Kişisel verilerin kanuna aykırı olarak işlenmesi sebebiyle zarara uğraması hâlinde zararın giderilmesini talep etme,

has the rights.

İlgili kişiler, veri sahibi olarak haklarına ilişkin talepleri belirtmek ve haklarını kullanmak amacıyla; yazılı olarak ıslak imzalı veya kayıtlı elektronik posta (KEP) adresi, güvenli elektronik imza, mobil imza ya da ilgili kişi tarafınca veri sorumlusuna daha önceden bildirilen ve veri sorumlusunun sisteminde kayıtlı olan elektronik posta adresi vasıtasıyla başvurarak gerekli değişiklik, güncelleme, silme, yok etme gibi işlemleri ve ilgili taleplerini iletebilirler.

If requests are submitted through the specified methods, the Company will resolve the requests free of charge within a maximum of thirty days, depending on the nature of the request. However, if the transaction requires an additional cost, the Company may charge the fees determined by the Communiqué on the Procedures and Principles of Application to the Data Controller.

*To the application form from here you can reach.

ESG Yazılım reserves the right to update this Clarification Text at any time in accordance with applicable legislation. Changes will be published on the website and notified via e-mail.

ESG Yazılım Elektronik Arge Hizmetleri ve Otomasyon San. Tic. A.Ş.

Relevant Documents

Privacy Policy  ·  Terms of Use  ·  KVKK Application Form (PDF)