Privacy Notice on the Processing of Personal Data
for Supplier Employees and Representatives
As Citio Dijital Teknoloji ve Ticaret Anonim Şirketi (“Citio” or the “Company”), we have prepared this privacy notice to inform you about your personal data processed within the scope of our activities, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the relevant legislation.
Which of Your Personal Data Is Processed, and for What Purpose? What Are the Legal Grounds?
Personal Data Processed |
Legal Ground |
Purpose of Processing |
|
Identity Data |
Conclusion and performance of a contract |
|
|
Contact Data |
|||
Legal obligation of the data controller |
|
What Are the Methods of Collecting Your Personal Data?
The personal data specified above is obtained through the information you share by e-mail and telephone within the scope of our supplier relationship.
Do We Transfer Your Personal Data to a Third Party?
The personal data you share with our Company is transferred:
- to our supplier located in Türkiye, from which we procure accounting system infrastructure, for the purpose of conducting finance and accounting affairs, based on the legal ground under Article 5/2 (c) of the KVKK that processing personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of a contract; and
- to our supplier located abroad, from which we receive services, for the purposes of conducting information security processes, in-house information and document management, storage and archiving activities, and communication activities, based on the existence of a standard contract pursuant to Article 9/4 (c) of the KVKK.
What Are the Rights You Can Exercise Regarding Your Personal Data?
Regarding your personal data, you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether it is used in accordance with its purpose,
- Know the third parties to whom your personal data is transferred domestically or abroad,
- Request the correction of your personal data if it has been processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,
- Request that the correction of incomplete or inaccurate data and the deletion or destruction of your personal data be notified to the third parties to whom your personal data has been transferred,
- Object to the emergence of a result against yourself by analysing the processed data exclusively through automated systems,
- Request the compensation of the damage in the event that you suffer damage due to the unlawful processing of your personal data.
How Can You Exercise Your Rights?
You may submit your applications and requests regarding your personal data through the Data Subject Application Form, as follows:
- By applying to Citio in person together with a valid identity document,
- By post to our address “Akat Mah. Selçuklar Sk. Eti Apt No: 12 İç Kapı No: 6 Beşiktaş / İstanbul” with a wet signature and a copy of your identity document,
- By e-mail to Citio's address kvkk@citioapp.com with a petition signed with a mobile signature or a secure electronic signature.
Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, the application of the Data Subject must include the name, surname, signature (if the application is in writing), Republic of Türkiye identity number (or passport number if the applicant is a foreigner), the residential or business address for notification, the e-mail address for notification (if any), telephone number and fax number, as well as information regarding the subject of the request.
To exercise the rights specified above, the Data Subject must clearly and understandably state the requested matter in the application containing the explanations regarding the right they wish to use. The information and documents relating to the application must be attached to the application. Although the subject of the request must concern the applicant personally, if acting on behalf of someone else, the applicant must be specially authorised in this regard and this authorisation must be documented (a special power of attorney). In addition, the application must contain identity and address information and identity-verifying documents must be attached to the application.
Requests made by unauthorised third parties on behalf of others will not be evaluated.
How Long Does It Take to Respond to Your Requests Regarding the Processing of Your Personal Data?
Your requests regarding your personal data are evaluated and answered within 30 days at the latest from the date they reach us. In the event that your application is evaluated negatively, the reasoned grounds for rejection are sent to the address you specified in your application, primarily by electronic mail or post, or by one of the methods selected in the Data Subject Application Form available on our website.