Privacy Notice on the Processing of Personal Data
As Citio Dijital Teknoloji ve Ticaret Anonim Şirketi (“Citio” or the “Company”), we have prepared this privacy notice to inform you about your personal data processed within the scope of our activities, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the relevant legislation.
Which of Your Personal Data Is Processed, and for What Purpose? What Are the Legal Grounds?
Personal data we process when you visit our website
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Transaction Security Data | Legitimate interest of the data controller |
|
| Legal obligation of the data controller |
|
Personal data we process when you create an account on our website
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Identity Data & Contact Data & Transaction Security Data | Conclusion and Performance of a Contract |
|
| Legal obligation of the data controller |
|
Personal data we process when you purchase a service through our website
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Identity Data | Conclusion and Performance of a Contract |
|
| Legitimate interest of the data controller |
|
|
| Legal obligation of the data controller |
|
|
| Contact Data | Conclusion and Performance of a Contract |
|
| Legitimate interest of the data controller |
|
|
| Financial Data | Conclusion and Performance of a Contract |
|
| Legitimate interest of the data controller |
|
|
| Legal obligation of the data controller |
|
|
| Customer Transaction Data | Conclusion and Performance of a Contract |
|
| Legitimate interest of the data controller |
|
|
| Legal obligation of the data controller |
|
The personal data specified above may be processed directly by you being directed to our own websites when you purchase our services, or it may be processed by the websites or personnel of the organisations with which we cooperate and subsequently transferred to us. In cases where your personal data is not processed directly by us, we would like to emphasise that you will also need to review the privacy notices prepared for you by our business partners who process your personal data.
Personal data processed in our operations regarding your requests and complaints
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Identity Data, Contact Data, Customer Transaction Data | Conclusion and Performance of a Contract & Legitimate interest of the data controller |
|
Personal data processed within the scope of our marketing processes
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Identity Data, Contact Data | Explicit Consent |
|
Personal data processed when you contact us through our social media accounts
| Personal Data Processed | Legal Ground | Purpose of Processing |
|---|---|---|
| Identity Data, Request/Complaint Information | Legitimate interest of the data controller |
|
Other Data Subject Groups
You can find below the explanations regarding the other data subject groups whose personal data is processed within the scope of our Company's activities:
- Our Employees: Detailed information regarding the processing of our employees' personal data is provided within our Company in a manner that they can always access easily.
- Our Job Candidates: You can obtain detailed information from the Privacy Notice regarding the processing of our job candidates' personal data.
- Employees/Representatives of Our Business Partners and Suppliers: For detailed information regarding the processing of personal data, you can review the Business Partner Employee/Representative Privacy Notice and Supplier Employee/Representative Privacy Notice pages.
What Are the Methods of Collecting Your Personal Data?
The personal data specified above is obtained through automated and non-automated methods, via the infrastructures of the providers from which we receive services for the management of our website, the information shared by you during membership creation and the purchase of our services, the information our business partners obtain from you and transmit to us, the information shared by our supplier from which we benefit for payment services, social media, and the physical and online forms you fill in.
Do We Transfer Your Personal Data to a Third Party?
The personal data specified above is transferred:
- to infrastructure service providers located abroad, for the purposes of providing infrastructure for the delivery of our online services, conducting storage and archiving activities, and conducting information security processes, based on a standard contract signed pursuant to Article 9/4 (c) of the KVKK,
- to the e-mail service provider and messaging and call service providers located abroad, from which we receive services, for the purposes of conducting communication activities and conducting information security processes, based on a standard contract signed pursuant to Article 9/4 (c) of the KVKK,
- depending on the type of service you receive (for example, cargo delivery, vehicle transfer), to the suppliers with whom we work for the performance of the service you purchased, based on the legal ground under Article 5/2 (c) of the KVKK that processing personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of a contract, and
- to authorised persons, institutions and organisations where necessary, for the purpose of providing information to authorised persons, institutions and organisations and the follow-up and conduct of legal affairs, based on the legal ground under Article 5/2 (ç) of the KVKK that it is mandatory for the data controller to fulfil its legal obligation.
What Are the Rights You Can Exercise Regarding Your Personal Data?
Regarding your personal data, you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether it is used in accordance with its purpose,
- Know the third parties to whom your personal data is transferred domestically or abroad,
- Request the correction of your personal data if it has been processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,
- Request that the correction of incomplete or inaccurate data and the deletion or destruction of your personal data be notified to the third parties to whom your personal data has been transferred,
- Object to the emergence of a result against yourself by analysing the processed data exclusively through automated systems,
- Request the compensation of the damage in the event that you suffer damage due to the unlawful processing of your personal data.
How Can You Exercise Your Rights?
You may submit your applications and requests regarding your personal data through the Data Subject Application Form, as follows:
- By applying to Citio in person together with a valid identity document,
- By post to our address “Akat Mah. Selçuklar Sk. Eti Apt No: 12 İç Kapı No: 6 Beşiktaş / İstanbul” with a wet signature and a copy of your identity document,
- By e-mail to Citio's address kvkk@citioapp.com with a petition signed with a mobile signature or a secure electronic signature.
Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, the application of the Data Subject must include the name, surname, signature (if the application is in writing), Republic of Türkiye identity number (or passport number if the applicant is a foreigner), the residential or business address for notification, the e-mail address for notification (if any), telephone number and fax number, as well as information regarding the subject of the request.
To exercise the rights specified above, the Data Subject must clearly and understandably state the requested matter in the application containing the explanations regarding the right they wish to use. The information and documents relating to the application must be attached to the application. Although the subject of the request must concern the applicant personally, if acting on behalf of someone else, the applicant must be specially authorised in this regard and this authorisation must be documented (a special power of attorney). In addition, the application must contain identity and address information and identity-verifying documents must be attached to the application.
Requests made by unauthorised third parties on behalf of others will not be evaluated.
How Long Does It Take to Respond to Your Requests Regarding the Processing of Your Personal Data?
Your requests regarding your personal data are evaluated and answered within 30 days at the latest from the date they reach us. In the event that your application is evaluated negatively, the reasoned grounds for rejection are sent to the address you specified in your application, primarily by electronic mail or post, or by one of the methods selected in the Data Subject Application Form available on our website.