Unofficial translation. This English text is provided for information only. The legally binding version is the Turkish original of this page (“Gizlilik ve Kişisel Verilerin Korunması İlkeleri”), which you can open with the language selector at the top of the site. In the event of any discrepancy, the Turkish text prevails.

1. Purpose and Scope

These Privacy and Personal Data Protection Principles (hereinafter the “Principles”) set out the principles adopted by YSF SEBZE MEYVE SAN. TİCARET LTD. ŞTİ (hereinafter the “Company”) in relation to the protection of personal data, and aim to inform all relevant categories of data subjects within the scope of Law No. 6698 on the Protection of Personal Data (hereinafter “Law No. 6698”).

2. Principles Governing the Processing of Personal Data

As the Company, acting in the capacity of Data Controller, we process your personal data within the framework of the following principles.

2.1 Processing in Compliance with the Law and Good Faith

In processing your personal data we act in accordance with the principles introduced by legal regulations and with the general rules of trust and good faith. Under this principle, in pursuing our personal data processing purposes we take your interests and reasonable expectations into account, we do not abuse our rights, and we act in accordance with the principle of transparency in our data processing activities.

2.2 Ensuring That Personal Data Is Accurate and, Where Necessary, Up to Date

In line with this principle, which emphasises the importance of the accuracy and currency of personal data, periodic checks and updates are carried out having regard to your legitimate interests, and the necessary measures are taken to that end. In this context, systems for checking the accuracy of personal data and making the necessary corrections are established within the Company. In addition, the accuracy of the sources from which personal data is collected is verified, and requests arising from the inaccuracy of personal data are taken into consideration. This principle is therefore applied consistently with your right to request rectification of personal data under Law No. 6698.

2.3 Processing for Specified, Explicit and Legitimate Purposes

Your personal data is processed on the basis of explicit, specified and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by data subjects, and we identify and clearly state the purposes and legal grounds of processing on which they rely in Article 3 of these Principles.

2.4 Being Relevant, Limited and Proportionate to the Purposes of Processing

Your personal data is processed in a manner that is proportionate, relevant and limited to what is necessary in order to achieve the envisaged purpose or purposes, and the processing of personal data that is unrelated to, or not required for, the achievement of the purpose is avoided. Likewise, under this principle, personal data is not collected or processed for purposes that do not currently exist and are merely contemplated for the future.

2.5 Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose of Processing

Your personal data is retained only for the period stipulated in the relevant legislation or required for the purpose for which it is processed. In this respect the Company takes and applies the relevant administrative and technical measures. Accordingly, it is first determined whether the relevant legislation prescribes a retention period for the personal data; if a period has been prescribed, that period is complied with, and if no period has been prescribed, the personal data is retained for as long as is necessary for the purpose of processing. Where the necessity of the relevant processes ceases to exist, access to your personal data by unrelated departments is prevented within the scope of the deletion action set out in Law No. 6698. Upon expiry of the period, or where the reasons requiring processing cease to exist, and in the absence of a legal ground permitting longer processing, your personal data is destroyed or anonymised in accordance with personal data protection legislation.

3. Conditions for the Processing of Personal Data

Within the scope of Law No. 6698, your personal data and special categories of personal data may be processed within the framework of the conditions set out below.

3.1 Expressly Provided for by Law

The fundamental rule is that personal data may not be processed without the explicit consent of the data subject. Under this exception, your personal data may be processed where the processing of personal data is expressly provided for by law.

3.2 Inability to Obtain Explicit Consent Due to Actual Impossibility

Your personal data may be processed where it is necessary to process the personal data of a data subject who is unable to express consent due to actual impossibility, or whose consent cannot be given legal validity, in order to protect the life or physical integrity of that person or of another person.

3.3 Direct Relation to the Conclusion or Performance of a Contract

Your personal data may be processed where it is necessary to process personal data belonging to the parties to a contract, provided that the processing is directly related to the conclusion or performance of that contract.

3.4 Fulfilment of the Company's Legal Obligations

Your personal data may be processed where processing is mandatory in order for the Company to fulfil its legal obligations arising from legislation, contracts and similar instruments to which it is subject and for which it is responsible.

3.5 Personal Data Made Public by the Data Subject

Where your personal data has been made public by you, that is to say shared by you with the public, it may be processed in a manner related and proportionate to the purpose of that disclosure.

3.6 Processing Necessary for the Establishment or Protection of a Right

Your personal data may be processed where processing is mandatory for the establishment, exercise or protection of a right within the scope of the conduct and management of processes relating to the legal and commercial rights held by the Company.

3.7 Processing Based on Legitimate Interests

Your personal data may be processed where processing is necessary for the legitimate interests of the Company. Where it is necessary to process data on the basis of this condition, our Company carries out an assessment that also takes into account your fundamental rights and freedoms, and decides in accordance with the outcome of that assessment.

3.8 Processing Based on Explicit Consent

Although processing personal data on the basis of explicit consent is the principal rule, where any of the other conditions set out in this article exists, the explicit consent of the data subject is not relied upon. To do otherwise could amount to an abuse of right. In this context, where your personal data is not processed on the basis of any of the conditions set out in these Principles, it is processed on the basis of your explicit consent.

3.9 Processing of Special Categories of Personal Data

We process your special categories of personal data on the basis of your explicit consent in accordance with Article 6 of Law No. 6698. Also under that article, we may process, without seeking your explicit consent, your special categories of personal data other than those relating to health and sexual life only in the cases provided for by law, and your special categories of personal data relating to health and sexual life only for the purposes of protection of public health, preventive medicine, medical diagnosis, the conduct of treatment and care services, and the planning and management of healthcare services and their financing, by persons or authorised institutions and organisations under an obligation of confidentiality, observing the requirements applicable to those matters.

4. Transfer of Personal Data

Your personal data and special categories of personal data may be transferred, within the scope of Article 2 of these Principles, to our business partners located in Türkiye, to public institutions and organisations and to similar recipients. Compliance with Article 8 of Law No. 6698 is observed when such transfers are carried out. Where necessary, your explicit consent is obtained and the transfer is made on that basis.

5. Security of Personal Data

The Company takes all reasonable administrative and technical measures to ensure the security of personal data, to prevent unlawful processing, and to prevent risks of unauthorised access, accidental loss of data, intentional deletion of data or damage to data.

All reasonable technical and physical measures are taken to prevent access to personal data by persons other than those authorised to access it. In this context, the authorisation system in particular is designed so that persons and systems cannot access more personal data than is necessary.

The Company carries out and commissions the necessary audits within its own institution or organisation in order to ensure the implementation of the provisions of Law No. 6698.

The measures taken are as follows. Network security and application security are ensured. A closed-system network is used for personal data transfers over networks. Security measures are taken within the scope of the procurement, development and maintenance of information technology systems. The security of personal data stored in the cloud is ensured. Disciplinary rules containing data security provisions are in place for employees. Training and awareness activities on data security are carried out for employees at regular intervals. An authorisation matrix has been established for employees. Access logs are kept regularly. Corporate policies on access, information security, use, retention and destruction have been prepared and put into practice. Confidentiality undertakings are executed. The relevant authorisations of employees who change duties or leave employment are revoked. Up-to-date anti-virus systems are used. Firewalls are used. Contracts entered into contain data security provisions. Additional security measures are taken for personal data transferred on paper and the relevant documents are sent in classified-document format. Personal data is backed up and the security of the backed-up personal data is also ensured. A user account management and authorisation control system is implemented and monitored. Log records are kept in a manner that precludes user intervention. Protocols and procedures for the security of special categories of personal data have been determined and are implemented. Cyber security measures have been taken and their implementation is continuously monitored.

6. Rights of the Data Subject, Application Procedures and Principles

6.1 Rights of the Data Subject

The rights of the data subject are set out in Article 11 of Law No. 6698 as follows. Everyone has the right, by applying to the data controller, to:

• a) learn whether their personal data is being processed;
• b) request information if their personal data has been processed;
• c) learn the purpose of the processing of their personal data and whether it is used in accordance with that purpose;
• ç) know the third parties in Türkiye or abroad to whom their personal data has been transferred;
• d) request rectification of their personal data where it has been processed incompletely or inaccurately;
• e) request the erasure or destruction of their personal data within the framework of the conditions set out in Article 7 of the Law;
• f) request notification of the operations carried out pursuant to subparagraphs (d) and (e) to the third parties to whom their personal data has been transferred;
• g) object to a result arising against the person themselves as a consequence of the analysis of the processed data exclusively by automated systems;
• ğ) claim compensation for damage suffered as a result of the unlawful processing of their personal data.

6.2 Application Procedures and Principles

As a data subject, you may submit your requests concerning the rights set out in Article 11 of Law No. 6698 to us by completing the Application Form on the Protection of Personal Data available from our website, or by way of an application meeting the minimum conditions prescribed by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the methods set out below. As the Company, we will conclude your application free of charge as soon as possible and in any event within thirty days at the latest, according to the nature of your request. However, where the operation additionally entails a cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company.

Methods of Application

Method of Application	Address for Application
Message sent from your email address, or with a secure electronic signature or mobile signature	trendhasat@gmail.com
Application in writing, in person or through a notary public	Atatürk Mah. 22054 Sk. No:12 Merkez/Aksu ANTALYA, Türkiye