1. INTRODUCTION
This Personal Data Protection and Processing Policy (the "Policy") sets out the principles adopted by Kosmos Vize Hizmetleri Anonim Şirketi (hereinafter referred to as "Kosmos") in carrying out its personal data processing activities and the fundamental principles adopted to ensure that Kosmos' data processing activities comply with the provisions of Law No. 6698 on the Protection of Personal Data (the "Law"), and informs data subjects about the legal provisions and general principles adopted by our Company.
Fully aware of our responsibility in this respect, your personal data is processed and reasonably protected within the scope of this Policy.
2. PURPOSE OF THE POLICY
The main purpose of this Policy is to set out the principles regarding the personal data processing activities lawfully carried out by Kosmos and the protection of personal data, and thereby to ensure transparency by informing the persons whose personal data is processed by our Company.
3. SCOPE OF THE POLICY
This Policy covers the principles for processing personal data and personal health data processed by Kosmos, the purposes and conditions of such processing, their transfer within Türkiye and abroad, their destruction, and the practices and principles regarding your rights over the processed data.
4. ACCESS AND UPDATES
The Policy is published on our Company's website, made available to data subjects upon their request, and updated when necessary. (Pursuant to Article 4 of Law No. 6698 on the Protection of Personal Data, the personal data we collect and process must be accurate and, where necessary, up to date. For this reason, if any change occurs in your personal data, you may notify us of your current and accurate personal information using the methods explained in the Privacy Notice published on our website.)
Our Company reserves the right to amend the Policy in line with legal regulations.
In the event of a conflict between the applicable legislation, in particular the Law, and the provisions of this Policy, the provisions of the legislation shall prevail.
5. DEFINITIONS
The definitions used in this Policy are set out below:
| Explicit consent |
Consent on a specific subject, based on information and declared with free will. |
| Anonymization |
Rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching it with other data. |
| Personal data |
Any information relating to an identified or identifiable natural person. |
| Processing of personal data |
Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, acquiring, making retrievable, classifying or preventing the use of personal data, wholly or partly by automated means or by non-automated means provided that it forms part of a data recording system. |
| PDP Law |
Law No. 6698 on the Protection of Personal Data. |
| PDP Board |
The Personal Data Protection Board. |
| PDP Authority |
The Personal Data Protection Authority. |
| Special categories of personal data |
Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data. |
| Data subject |
The natural person whose personal data is processed, referred to as the "relevant person" in the PDP Law. |
| Data controller |
The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. |
| Data processor |
The natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller. |
| Data Controllers' Registry |
The registry of data controllers (VERBİS) kept by the Presidency under the supervision of the Personal Data Protection Board. |
| Data Inventory |
The inventory created and detailed by Kosmos, associating the personal data processing activities it carries out in connection with its business processes with the purposes of processing, the recipient groups to whom personal data is transferred and the relevant data subject groups. |
6. PERSONAL DATA INVENTORY AND CLASSIFICATION OF PERSONAL DATA
Within Kosmos, in line with Kosmos' legitimate and lawful personal data processing purposes, based on and limited to one or more of the processing conditions set out in Article 5 of the PDP Law, and in compliance with the general principles set out in the PDP Law — in particular the principles regarding the processing of personal data set out in Article 4 — and with all obligations regulated in the PDP Law, personal data of the data subjects within the scope of this Policy (Persons Receiving Products and Services, Potential Buyers of Products and Services, Employees, Job Candidates, Visitors, Supplier Employees, Supplier Officials, Shareholders/Partners, Employee Relatives, Consultants, Trainers, Parents, Spouses and Children, Persons to Be Travelled With, Inviting Persons and Reference Persons), without being limited to these, is processed for the following purposes:
- Fulfilling the information sharing, reporting and notification obligations towards public authorities and authorized third parties, in particular the requirements and requests of the relevant Mission,
- Carrying out the relevant procedures during the visa application process,
- Carrying out consultancy activities relating to visa procedures,
- Ensuring that our company's activities are carried out in accordance with company procedures and relevant legislation,
- Carrying out customer relationship management processes,
- Carrying out contractual processes,
- Carrying out and auditing business activities,
- Carrying out communication activities,
- Evaluating requests and complaints,
- Fulfilling the obligations to retain information and documents arising from legislation,
- Carrying out finance and accounting operations,
- Managing our legal processes,
- Providing you with uninterrupted, better and more reliable service.
Personal data will be processed for the purposes stated above, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of Law No. 6698.
Kosmos has created a personal data inventory in accordance with the Regulation on the Data Controllers' Registry issued by the Personal Data Protection Authority. This data inventory includes data categories, the source of the data, the purposes of processing, the processing procedure, the recipient groups to whom the data is transferred and the retention periods.
In this context, the following categories of data exist within Kosmos, without being limited to these:
| Identity Data |
Information stated on your identity card; name, surname, mother's name, father's name, place of birth, date of birth, marital status, religion, blood type, province, district and neighbourhood of registration, and, without limitation, the information stated on your identity card. |
| Contact Data |
Contact data requested from you or provided by you so that you can be contacted, such as home telephone number, mobile telephone number, residential address or other address information, and e-mail address. |
| Personnel File Data |
Copy of identity card, civil registry copy, certificate of residence, medical report, copy of diploma, criminal record, passport photograph, document showing family status, military service status document, employment/service contract, social security employment declaration, your criminal record, and information and documents relating to your state of health. |
| Professional Experience |
Diploma details, courses attended, in-service training details, certificates and similar. |
| Bank Account Data (Finance) |
Bank account number, IBAN number and other information relating to your bank card. |
| CV Data |
Education details stated in your CV or requested by Kosmos or provided by you, school details relating to your education, certificate details, educational status and information about your education; place, date and duration details of your work experience, information about your previous jobs and positions, and all information relating to your work experience; your photograph; your driving licence and the information stated on it; your references and information relating to your references. |
| Location |
Location information of the place where the person is. |
| Physical Premises Security (Visitor Data) |
Camera recordings and internet access records of visitors to the company. |
| Health Data |
All health information and data obtained when creating a personnel file and during private insurance and visa procedures (information on disability status, blood type information, personal health information). |
| Criminal Conviction Data |
Criminal record information. |
| Customer Transaction Data |
Invoices, information on counter receipts, order information, request information and similar. |
| Legal Proceedings Data |
Information in correspondence with judicial authorities, information in case files and similar. |
| Marketing Data |
Past service records, surveys, cookie records, and information obtained through campaign activities. |
| Transaction Security |
IP address information, website login and logout records, password and passcode information and similar. |
| Financial Data |
Your bank account number, IBAN number, credit card details, payment details, invoicing details, assets and similar financial data. |
| Audio and Visual Records |
Audio and visual recordings. |
| Biometric Data |
Biometric fingerprint data. |
| Other |
Insurance policy details, passport details, salary and payroll details, travel details, accommodation details, signature, type of travel document, travel document number, school information, other countries to be visited, parents' name and surname, parents' year of birth, parents' nationality, spouse's/child's name and surname, spouse's/child's nationality, spouse's/child's year of birth; name, surname and nationality of the person you will be travelling with, and similar data. |
7. GENERAL PRINCIPLES FOR PROCESSING PERSONAL DATA
7.1. Lawfulness
Our Company carries out its personal data processing activities in accordance with the law and the rules of good faith, in compliance with the Constitution, the PDP Law and the relevant legislation. In this context, our Company acts by determining the legal grounds requiring the processing of personal data, takes into account the requirements of proportionality, does not use personal data beyond what the purpose requires, and does not carry out processing activities without the knowledge of the persons concerned.
7.2. Accuracy and, Where Necessary, Currency of Data
Taking into account the fundamental rights of data subjects and its own legitimate interests, our Company ensures that the personal data it processes is accurate and up to date and takes the necessary measures accordingly. In this context, data relating to all categories of persons is kept up to date, and all administrative and technical measures are taken to ensure its accuracy and currency.
7.3. Specific, Legitimate and Explicit Purposes
Our Company processes personal data only for clearly and definitively determined legitimate purposes and does not carry out data processing activities beyond these purposes. The purpose for which personal data will be processed is determined by our Company before the processing activity and is also recorded in the "Personal Data Inventory".
7.4. Data Being Relevant, Limited and Proportionate to the Purposes of Processing
Personal data is processed by our Company only to the extent necessary to achieve the determined purposes. Data processing activities are not carried out on the assumption that the data may be used later. In this context, processes are continuously reviewed and the principle of data minimization is implemented.
7.5. Retaining Personal Data Only as Long as Necessary and Deleting It Afterwards
Our Company retains personal data only for the period stipulated in the relevant legislation or required for the purpose for which it is processed. In this context, our Company first determines whether a retention period is stipulated in the relevant legislation; if a period has been determined, it acts in accordance with that period, taking into account the civil and criminal statutes of limitations, and retains personal data for the period necessary for the purpose of processing. Upon expiry of the period or when the reasons requiring processing cease to exist, personal data is deleted, destroyed or anonymized in accordance with our Company's "Data Destruction Policy".
8. CONDITIONS FOR PROCESSING PERSONAL DATA
Personal data may only be collected, processed or used within the scope of the legal grounds stated below.
8.1. Explicit Consent
Article 3 of the Law defines explicit consent as "consent on a specific subject, based on information and declared with free will". In addition, Article 20/3 of the Constitution provides that personal data may only be processed in the cases stipulated by law or with the explicit consent of the person concerned. Under Law No. 6698, explicit consent is envisaged as the fundamental ground of lawfulness both for special categories of personal data and for other personal data.
Articles 5, 6, 8 and 9 of the Law set out the cases in which the processing conditions are not met and consent is required. Accordingly, our Company processes personal data by obtaining explicit consent declared with free will and obtained in a provable manner (in writing, electronically, or verbally with a recording). Where special categories of personal data are processed, explicit consent will be obtained in writing where necessary.
Process owners who process personal data are obliged to verify the existence and validity of the relevant data subject's explicit consent when the personal data they process is collected. If it is determined that there is no explicit consent, no data processing activity will be carried out (except for the exceptions below).
8.2. Processing Personal Data Without Explicit Consent
In the presence of one of the following conditions, personal data may be processed without seeking the explicit consent of the data subject:
- It is expressly provided for by law,
- It is mandatory for the protection of the life or physical integrity of the person concerned or of another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,
- Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract,
- It is mandatory for the data controller to fulfil its legal obligations,
- The data has been made public by the data subject,
- Data processing is mandatory for the establishment, exercise or protection of a right,
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
8.3. Processing Special Categories of Personal Data
Our Company exercises particular care in processing special categories of personal data, the protection of which is more critical for data subjects in various respects. In this context, provided that the adequate measures determined by the Board are taken, such data is not processed without the explicit consent of the data subjects. However, provided that adequate measures are taken and in the presence of the reasons listed below, it may be processed without obtaining explicit consent:
- It is expressly provided for by law,
- It is mandatory for the protection of the life or physical integrity of the person concerned or of another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,
- It relates to personal data made public by the data subject and is in line with their intention to make it public,
- It is mandatory for the establishment, exercise or protection of a right,
- It is necessary for the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning, management and financing of health services, by persons under an obligation of confidentiality or by authorized institutions and organizations,
- It is mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
- It relates to current or former members or affiliates of foundations, associations and other non-profit organizations or entities established for political, philosophical, religious or trade union purposes, or to persons in regular contact with such organizations and entities, provided that it complies with the legislation to which they are subject and with their purposes, is limited to their fields of activity, and is not disclosed to third parties.
The KVKK Committee will be informed in every case where special categories of personal data need to be processed.
9. TRANSFER OF PERSONAL DATA
Your personal data may be transferred to the relevant Mission, to the supervisory and regulatory authorities in Türkiye and abroad and the relevant public institutions stated in the privacy notice of the relevant mission, to public and private legal entities legally authorized, limited to the purpose requested within their legal authority, and to our company's consultants, auditors and service providers, within the scope of the personal data processing conditions and purposes set out in Articles 8 and 9 of Law No. 6698.
In order to maintain our company's activities and business processes, your personal data may be transferred to our suppliers located in Türkiye and/or abroad with whom we cooperate, to our insurance companies, to notaries, banks and financial institutions, to consultancy firms from which we receive support in fields such as law, financial advisory and taxation, to legally authorized public institutions and private persons, and to service providers from which we receive support in areas such as storage, archiving and information technology support (servers, hosting, software, cloud computing, etc.) located in Türkiye and/or abroad and processing personal data on behalf of our company, within the scope of the personal data processing conditions set out in Articles 8 and 9 of Law No. 6698 and the purposes stated above.
10. RIGHTS OF DATA SUBJECTS
Kosmos will respond within 30 days to the requests of the data subjects whose personal data it processes, within the scope of the following rights:
- To learn whether personal data is processed,
- To request information if personal data has been processed,
- To learn the purpose of processing personal data and whether it is used in accordance with that purpose,
- To know the third parties in Türkiye or abroad to whom personal data is transferred,
- To request the correction of personal data if it has been processed incompletely or incorrectly, and to request that this be notified to the third parties to whom the personal data has been transferred,
- To request the erasure or destruction of personal data if the reasons requiring its processing cease to exist, even though it has been processed in accordance with the PDP Law and other relevant legislation, and to request that this be notified to the third parties to whom the personal data has been transferred,
- To object to a result against the person arising from the analysis of the processed data exclusively by automated systems,
- To claim compensation for damages arising from the unlawful processing of personal data.
Data subjects may submit applications within the scope of the rights stated above, together with information and documents establishing their identity, by the methods stated above or by the other methods determined by the Personal Data Protection Board, using the KVKK Application Form available on the website.
11. CONFIDENTIALITY AND DATA SECURITY MEASURES
All personal data processed within Kosmos is confidential, and all necessary technical and administrative measures are taken to ensure the appropriate level of security for the purposes set out in Article 12 of the Law, namely:
- To prevent the unlawful processing of personal data,
- To prevent unlawful access to personal data,
- To ensure the retention of personal data.
11.1. Technical Measures Taken to Ensure the Lawful Processing of Personal Data and to Prevent Unlawful Access to Personal Data
Kosmos has taken all kinds of technical and technological security measures to protect your personal data and protects your personal data against possible risks. For example:
- Network security and application security are ensured.
- Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
- Access logs are kept regularly.
- The authorizations of employees who change positions or leave the company are revoked in this area.
- Up-to-date anti-virus systems are used.
- Firewalls are used.
- Personal data security is monitored.
- Necessary security measures are taken regarding entry to and exit from physical environments containing personal data.
- The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
- The security of environments containing personal data is ensured.
- Personal data is backed up and the security of the backed-up personal data is also ensured.
- A user account management and authorization control system is implemented and monitored.
- Log records are kept in a way that prevents user intervention.
- Penetration testing is carried out.
- Encryption is applied.
11.2. Administrative Measures Taken to Ensure the Lawful Processing of Personal Data and to Prevent Unlawful Access to Personal Data
- A management framework has been established within the organization to initiate and control information security operations and implementation.
- A KVKK Committee and a contact person have been appointed and their job descriptions have been determined.
- KVKK application channels have been determined.
- Workflows for managing breaches, requests and complaints have been determined.
- The main principles, policies and procedures regarding the processing and protection of personal data have been determined.
- A Data Processing and Retention Policy has been created.
- A Personal Data Processing and Protection Policy has been created.
- A Policy on the Security of Special Categories of Personal Data has been created.
- Existing risks and threats regarding the personal data processed have been identified.
- Training and awareness activities on personal data security are carried out for employees.
- Roles, responsibilities and job descriptions regarding data security have been determined to ensure that employees and contractors are aware of and fulfil their information security responsibilities.
- Confidentiality undertakings are signed.
- Privacy notices have been published for employees, customers, suppliers, etc.
- The processes requiring explicit consent have been determined and are implemented.
- Periodic and/or random internal audits are carried out and commissioned. Confidentiality and security vulnerabilities identified as a result of audits are remedied.
- Whether the personal data in question is needed for the purpose of processing is assessed, and personal data is minimized as far as possible.
- Necessary measures are taken by employees to notify the relevant person and the Board as soon as possible if data is obtained by others through unlawful means.
11.3. Measures to Be Taken in Case of Unlawful Disclosure of Personal Data
If the processed personal data is obtained by others through unlawful means, our Company will notify the relevant data subject and the Board as soon as possible (within a maximum of 72 hours).
12. CONDITIONS FOR THE DESTRUCTION OF PERSONAL DATA (ERASURE, DESTRUCTION AND ANONYMIZATION)
Pursuant to Article 138 of the Turkish Penal Code, Article 7 of the PDP Law and the "Regulation on the Erasure, Destruction and Anonymization of Personal Data" issued by the Authority, personal data is erased, destroyed or anonymized at Kosmos' own decision or upon the request of the data subject if the reasons requiring its processing cease to exist, even though it has been processed in accordance with the provisions of the relevant law. Kosmos has created a Policy on this matter in accordance with the provisions of the regulation, and destruction is carried out according to the nature of the data in line with that Policy. Pursuant to this regulation, periodic destruction dates have been determined by Kosmos, and a calendar has been created for periodic destruction to be carried out at various intervals once the obligation commences.
13. IMPLEMENTATION
A management structure has been established for the implementation of this Policy and to ensure that Kosmos acts in accordance with the provisions of the PDP Law.
14. EFFECTIVE DATE OF THE POLICY
This Policy entered into force on 07.01.2022 and was updated on 06.08.2024.