ARTICLE 1- PARTIES
This Personal Data Protection and Processing Policy is an annex and an integral part of the User Agreement (“Agreement”) currently in force between GOCADA TEKNOLOJİ VE TİCARET LTD. ŞTİ and you, the User. This Policy is valid together with and subject to the Agreement. No provision of this Policy may be interpreted separately or differently from the Agreement, and in the event of a conflict between the two texts, the Agreement shall prevail.
Within the scope of this Policy, GOCADA TEKNOLOJİ VE TİCARET LTD. ŞTİ and the User will be referred to as the Parties.
ARTICLE 2- SUBJECT
Pursuant to the provisions of the Law No. 6698 on the Protection of Personal Data (“KVKK”), any information that makes the identity of the user specific or identifiable, including the identity information of the user, including special categories of personal data, will be processed by Gocada as the Data Controller within the following scope as Personal Data.
Gocada prioritizes the protection and secure processing of personal data in all services provided to the User through the Site by paying the utmost attention to the security of the personal data of the User by taking all measures to protect the personal data of the User. In the same context, Gocada also aims to protect the privacy of the User’s private life, fundamental rights and freedoms.
ARTICLE 3- DEFINITIONS
Explicit Consent: Consent on a specific issue, based on information and expressed with free will.
Processing of Personal Data: Refers to all kinds of operations performed on the data such as obtaining, recording, storing, storing, maintaining, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of such data by Gocada through the Site.
Personal Data Owner: The natural person whose personal data is processed.
Personal Data: Any information relating to an identified or identifiable natural person. Therefore, the processing of information on legal entities is not covered by the Law. For example, name-surname, TRKN, e-mail, address, date of birth, credit card number, bank account number, etc.
Sensitive Personal Data: Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are special categories of personal data.
Data Controller: The person who determines the purposes and means of processing personal data and manages the place where the data is kept systematically (data recording system) is the data controller.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller.
Data Recording System: The recording system where personal data is structured and processed according to certain criteria.
Law: Law No. 6698 on the Protection of Personal Data.
Anonymization: Making the data previously associated with a person impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data.
ARTICLE 4- ISSUES REGARDING THE PERSONAL DATA PROCESSING POLICY
4.1. General Principles for Processing Personal Data
Gocada processes and protects the personal data of Users within the scope of the Constitution of the Republic of Turkey and the Law on the Protection of Personal Data.
In this context, Gocada acts in line with the following principles:
Gocada,
-as a prudent merchant, acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty in the processing of personal data,
-ensures that the personal data it processes is accurate and up-to-date, taking into account the fundamental rights and legitimate interests of personal data owners within the scope of the Law on the Protection of Personal Data, together with other laws that it must comply with within the scope of its activities,
-clearly and precisely determines the legitimate and lawful purpose of personal data processing. In this context, personal data is processed limited to the services provided or to be provided and legal obligations. The purpose for which personal data will be processed is determined before the personal data processing activity begins,
-processes personal data in a manner that is conducive to the realization of the specified purposes and avoids the processing of personal data that is not related to the realization of the purpose or is not needed,
-retains personal data only for the period specified in the relevant legislation that it is obliged to comply with or for the period required for the purpose for which they are processed.
4.2. Terms of Processing Personal Data
Protection of personal data is a constitutional right. Fundamental rights and freedoms may be restricted without prejudice to their essence only for the reasons specified in the relevant articles of the Constitution and only by law.
Pursuant to the Constitution, personal data may only be processed in cases stipulated by law or with the consent of the individual. In this direction and in accordance with the Constitution; Gocada processes personal data only in cases stipulated by law or with the explicit consent of the person.
The explicit consent of the personal data subject is only one of the legal grounds that make it possible to process personal data in accordance with the law. Apart from explicit consent, personal data may also be processed in the presence of one of the other conditions listed below.
The basis of the personal data processing activity may be only one of the following conditions, or more than one of these conditions may be the basis of the same personal data processing activity.
One of the conditions for processing personal data is the explicit consent of the owner. The explicit consent of the personal data owner must be related to a specific subject, based on information and free will. Everyone who becomes a member of the website declares and undertakes that he/she has read and accepts in advance the usage agreement and the information on the processing of personal data. In this context, all rights of objection, lawsuit, complaint and demand regarding the processing of personal data are deemed to be waived in advance.
The personal data of the data subject may be processed in accordance with the law without obtaining his/her explicit consent, if expressly provided for in the law.
The personal data of the data subject may be processed if it is mandatory to process the personal data of the person who is unable to disclose his/her consent due to actual impossibility or whose consent cannot be recognized as valid, in order to protect the life or physical integrity of himself/herself or another person.
Provided that it is directly related to the establishment or performance of a contract, it is possible to process personal data if it is necessary to process the personal data of the parties to the contract.
Personal data may be processed if the personal data has been made public by the data subject himself/herself.
Personal data of the data subject may be processed if data processing is mandatory for the establishment, exercise or protection of a right.
Gocada sensitively complies with the regulations stipulated in the Personal Data Protection Law in the processing of personal data determined as “special quality” by the Personal Data Protection Law.
In Article 6 of the Law on the Protection of Personal Data, certain personal data which, when processed unlawfully, carries the risk of causing victimization or discrimination of persons, are defined as “special categories”.
These data include data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
In accordance with the Law on the Protection of Personal Data, special categories of personal data are processed by Gocada in the following cases, provided that adequate measures to be determined by the Personal Data Protection Board are taken:
With or without the explicit consent of the personal data owner; while sensitive personal data other than the health and sexual life of the personal data owner may be processed in cases stipulated by law, sensitive personal data relating to the health and sexual life of the personal data owner are processed only by persons or authorized institutions and organizations under the obligation of confidentiality for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, personal data shall be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the data subject if the reasons requiring its processing disappear.
When the retention periods stipulated in the relevant legislation or required by the purpose of processing expire, within the 6-month period stipulated for periodic destruction; Gocada deletes or anonymizes the personal data it processes by using one or more techniques that are most appropriate for its business processes and activities from the deletion and anonymization methods specified in the guide on Deletion, Destruction or Anonymization of Personal Data published by the KVK Board.
ARTICLE 5- DISCLOSURE OBLIGATION
According to the Constitution of the Republic of Turkey, everyone has the right to be informed about personal data concerning him/her. Accordingly, Article 11 of the Law on the Protection of Personal Data lists “requesting information” among the rights of the personal data subject.
In this context, Gocada provides the necessary information in case the personal data owner requests information in accordance with the Constitution and KVKK.
At the same time, in accordance with Article 10 of the KVKK, Gocada also informs the personal data owners about the purpose for which personal data will be processed during the acquisition of personal data, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data and the rights of the personal data owner under Article 11 of the KVKK. Each User who accepts the User Agreement on the Site and becomes a member of the Site accepts that this clarification has been made to him/her.
In addition, Gocada ensures informing and transparency in personal data processing activities by announcing to personal data owners and those concerned that it carries out personal data processing activities in accordance with all matters in the KVKK and “law and honesty rule” through various public documents, especially this Policy.
ARTICLE 6- PROCESSING OF PERSONAL DATA BELONGING TO THE USER
Although your personal data may vary depending on the service provided by Gocada and Gocada’s commercial activities, in order to be used in all kinds of services to be provided to the User regarding cryptocurrency trading transactions carried out through the Site, to determine the identity of the User accurately and in accordance with the legislation and to prevent all kinds of illegal money movements; Your personal data may be collected verbally, in writing or electronically by automatic or non-automatic methods, through Gocada’s work units, website, call center, telephone calls, SMS records, e-mail addresses, social media channels, mobile applications and similar means and will continue to be updated and processed during the period you benefit from the products and services offered and / or within the legal periods.
Your collected personal data is processed for the following purposes:
-Fulfillment of legal and administrative obligations by Gocada,
-Establishment and performance of your contracts with Gocada,
-To be used in the products and services you have received/will receive from Gocada,
-Communication regarding the product and service you have purchased/will purchase,
-Provide an effective user service, and can be used for marketing activities if you have given your consent to do so,
-Product/service offering, modeling, reporting, scoring, risk monitoring, intelligence, existing or new product studies and potential user identification,
-Ensuring the legal and commercial security of persons who have a business relationship with Gocada,
-Determining and implementing Gocada’s commercial and business strategies,
-Ensuring and improving coordination, cooperation and efficiency within and between units within Gocada,
-Resolving existing and future legal disputes, responding to requests and questions from our users,
-Ensuring the security of Gocada’s website and other electronic systems and physical environments,
-Notification of changes in the legislation or in the rules and policies adopted by Gocada,
-In accordance with Article 5 of the Law No. 6698 on the Protection of Personal Data to fulfill our legitimate interests such as investigating, detecting, preventing, and notifying the relevant administrative or judicial authorities of violations of the contract and the law in order to carry out our activities we offer to you and to make other notifications concerning you.
Your data is processed under the following conditions,
-In the presence of explicit consent of the data subject,
-If expressly provided for by law,
-If it is necessary for the protection of the life or physical integrity of the person or of another person who is unable to give his/her consent due to actual impossibility or whose consent is not legally valid,
-Provided that it is directly related to the conclusion or performance of the contract with Gocada concluded with your consent and/or signature,
-If it is necessary to process personal data of the parties to the contract,
-If it is necessary for Gocada to fulfill its legal obligation,
-If it has been made public by you personally,
-If data processing is mandatory for the establishment, exercise or protection of a right,
-Provided that it does not harm your fundamental rights and freedoms,
-If data processing is necessary for the legitimate interests of Gocada and with the explicit consent of the data subject in accordance with Article 6, in cases stipulated in the laws, personal data is processed within the specified personal data processing conditions and purposes.
ARTICLE 7- TRANSFER OF PERSONAL DATA OF THE USER
For the purposes listed above, the personal data of the Users held by Gocada are securely stored and not disclosed to third parties outside the legal framework.
Gocada may transfer user personal data to the following persons, institutions and/or legal entities:
-To persons, institutions and/or organizations required/permitted by the legislation in force,
-To Business partners
-To All authorities and channels necessary for the performance of the User Agreement,
-To Public legal entities and authorities authorized to receive personal data such as Courts, Public Prosecutors’ Offices, BDDK, SPK, MASAK, BKM,
-To our domestic/foreign subsidiaries,
-To Companies operating as an agent/agency,
-Third parties from whom services are received and provided to carry out the activities of the Site,
-To partner institutions, organizations, domestic/foreign banks, funds, cooperating organizations,
-To domestic/ international/ international organizations that provide services /support /consultancy or are project/ program/ financing partners,
Shall be able to transfer user personal data to organizations that receive independent audit and support services due to legal obligations, but within the framework of legal limitations
ARTICLE 8- RIGHTS OF THE USER PURSUANT TO ARTICLE 11 OF THE KVKK NUMBERED 6698
Pursuant to Article 11 of the KVKK No. 6698, personal data owners have the following rights regarding themselves:
-Learning whether personal data is processed or not,
-Requesting information if personal data has been processed,
-Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
-Having knowledge about the third parties to whom personal data are transferred domestically or abroad,
-Requesting correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
-Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the KVKK and other relevant laws, and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
-Objecting to the occurrence of a result to the detriment of the person himself/herself by analysing the processed data exclusively through automated systems,
-Requesting the compensation of the damage in case of damage due to processing in violation of the Law on Protection of Personal Data.
The User also declares, accepts and undertakes that, together with the use of the Site, they accept the provisions of the paragraph above, that they are informed about these matters and, in particular, that they have read and understood the regulations in Articles 5 and 6 of the Personal Data Protection Law No. 6698, and that they have given “explicit consent” as a data owner within the framework of these articles.
ARTICLE 9- DATA CONTROLLER UNDER THE LAW
In order to exercise your rights specified in Article 11 of the KVKK, you can contact Gocada in writing or by other means determined by the Personal Data Protection Board by using the contact information specified below or you can contact us by filling out the Application Form on our Website and sending an e-mail to [email protected]
E-mail: [email protected]
ARTICLE 10- FINAL PROVISIONS
In case of incompatibility between the provisions of the KVKK and other relevant legislation and this Policy, the provisions of the KVKK and other relevant legislation will be applied first.
Gocada may change the content of this Policy whenever it deems necessary. The updated Policy will enter into force on the date it is published on the Site. The last update date is at the beginning of the text. In case of any dispute, Gocada records alone shall be valid and binding on the parties.