Online Catalogue
#DiscoverWhatIsOurs

A. SCOPE

The Personal Data Protection and Privacy Policy (the “Policy”) has been prepared to explain the set of rules governing the processing of personal data and to provide the necessary information. The Policy has been approved by the Board of Directors of Meysu Gıda Sanayi ve Ticaret A.Ş. (the “Company”) and has entered into force.

B. DEFINITONS

Personal Data: Any information relating to an identified or identifiable individual, including all information that contains tangible content expressing the physical, economic, cultural, social or psychological identity of the individual or that enables the individual to be identified as a result of being associated with any record, such as an identity, tax or insurance number.

Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical beliefs, religion, sect or other beliefs, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Explicit Consent: Consent relating to a specific matter, based on being informed and expressed freely.

Anonymization: Rendering personal data in such a way that it can no longer, by any means whatsoever, be associated with an identified or identifiable natural person, even when matched with other data.

Personal Data Inventory: The inventory established by the Company by associating its personal data processing activities carried out in connection with its business processes with the purposes of processing personal data, data category, recipient group to which the data is transferred and the group of data subjects, and detailing the maximum period required for the purposes for which personal data are processed, personal data intended to be transferred to foreign countries and the measures taken regarding data security.

Processing of Personal Data: Any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, rearranging, disclosing, transferring, acquiring, making available, classifying or preventing the use of personal data, whether carried out wholly or partially by automated means or by non-automated means, provided that it forms part of a data recording system. All types of operations performed on data, starting from the initial collection of the data, are covered by this definition.

Data Subject: A natural person whose personal data are processed.

Data Recording System: A recording system in which personal data are processed by being structured according to specific criteria.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Personal Data Protection Law (“KVKK”): The Law No. 6698 dated 24 March 2016, published in the Official Gazette No. 29677 dated 7 April 2016, which is also the subject matter of this Policy.

Board: The Personal Data Protection Board.

Authority: The Personal Data Protection Authority.

Policy: The Personal Data Protection and Privacy Policy.

C. AMENDMENTS

Any amendments to this Policy made upon the entry into force of additional legislation within the scope of the Law or at various times may be followed via the Company’s corporate website. The current version of this Policy is also available on the same corporate website.

1. SCOPE

The Company processes, in its capacity as the Data Controller and in compliance with applicable laws, the personal data it obtains verbally, in writing or electronically in order to carry out its activities of providing products and services and to ensure the uninterrupted continuation of its services.

The purpose of this Policy is to inform the relevant persons by providing explanations regarding the processing activities carried out by the Company and the systems related to personal data, thereby ensuring transparency concerning personal data.

In this context, the Company has set out and explained in detail in this Policy the processing of personal data within the scope of the Personal Data Protection Law, the data subjects whose data are subject to such processing, and the rights of such persons.

2. PERSONAL DATA

2.1. General Principles on the Processing of Personal Data

Pursuant to Article 4, paragraph 2 of the Personal Data Protection Law and for the purposes exemplified in the “Purposes of Processing Personal Data” section of this Policy, the Company processes personal data in accordance with the following principles:

  • Being in compliance with the law and the principles of good faith;
  • Being accurate and, where necessary, up to date;
  • Being processed for specific, explicit and legitimate purposes;
  • Being relevant, limited and proportionate to the purposes for which they are processed; and
  • Being retained for the period stipulated in the relevant legislation or necessary for the purposes for which they are processed.

2.2. Personal Data Processed by the Company, Purposes of Processing, Transfer, Collection Channels, Retention Periods and Rights of Data Subjects

Pursuant to Article 10 of the Personal Data Protection Law, titled “Data Controller’s Obligation to Inform,” which aims to protect individuals’ fundamental rights and freedoms, particularly the right to privacy, in the processing of personal data, and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Obligation to Inform, published in the Official Gazette No. 30356 dated 10 March 2018, the Privacy Notice on the personal data processed by the Company in its capacity as the Data Controller is publicly available on our website at the following link: https://meysu.com.tr/MEYSU-KVKK-ve-Gizlilik-Politikasi.pdf.

3. MEASURES ON PERSONAL DATA SECURITY

3.1. Administrative Measures on Personal Data Security

3.1.1. Identification of Existing Risks and Threats

The Company utilizes its “Personal Data Inventory” to identify the risks and threats associated with the personal data it processes. The processes in which personal data are processed within this inventory shall be kept up to date by the Company.

When identifying such risks, the Company determines whether the personal data it processes constitute special categories of personal data, the level of confidentiality required, and the potential harm that may arise in the event of a security breach.

3.1.2. Employee Training and Awareness Activities

The Company provides its employees with training on the protection of personal data and cybersecurity and conducts awareness activities on these matters.

The unlawful disclosure or sharing of personal data constitutes one of the most common types of breaches. In order to prevent such breaches,

  • The Company provides awareness training on personal data to everyone who works with personal data.
  • The Company clearly defines employees’ roles and responsibilities on personal data in their job descriptions.
  • The Company ensures that the principle of “everything is prohibited unless permitted,” rather than “everything is permitted unless prohibited,” is followed with regard to personal data.
  • The Company ensures that employees comply with this Policy and other relevant policies and procedures, and initiates disciplinary procedures in cases of non-compliance.

3.1.3. Minimization of Personal Data Where Possible

In order to fulfill the requirements set forth in the Law and other applicable legislation, such as “keeping personal data accurate and, where necessary, up to date” and “retaining personal data for no longer than is necessary for the purposes for which they are processed”:

  • The Company regularly reviews the personal data in its possession, updates those that are necessary but no longer serve any purpose and are not up to date, and deletes, destroys or anonymizes the remaining data.
  • Personal data that are needed but do not require frequent access are kept in more secure environments.
  • Authorizations are reviewed to ensure that only employees in positions that need to view personal data have access to such data.
  • All policies and procedures on deletion, destruction and anonymization are kept up to date and implemented systematically.

3.1.4. Management of Relations with Data Processors

The Company ensures that data processors with whom it enters into agreements for the procurement of information technology-related services attach at least as much importance to information security as the Company itself and act with an awareness of their shared responsibility, and secures this obligation contractually.

In accordance with the definition set forth in the applicable legislation, data processors process personal data solely in accordance with the Company’s instructions, within the scope of the agreement executed with the Company, and in compliance with applicable legislation. Data processors are subject to an indefinite obligation of confidentiality.

In the event of any data breach, the incident shall be immediately reported to the Company and shall also be formally documented under the relevant contractual arrangements. The Company shall notify the relevant data subjects and the Board of such data breaches as required by applicable legislation.

In agreements to be executed between the Company and data processors, the categories and types of data transferred to the data processor shall be specified as a separate provision, to the extent permitted by the nature of the agreement.

In its capacity as the “Data Controller,” the Company conducts or has conducted the necessary audits of the systems of the data processor containing personal data and may review the reports resulting from such audits and inspect the service provider on site. This matter shall also be mutually agreed upon and stipulated in the agreement.

3.2. Technical Measures on Personal Data Security

3.2.1. Ensuring Cybersecurity

The company develops the necessary software for cybersecurity purposes and, if necessary, purchases services and products.

The company regularly scans its existing products, ensuring that unnecessary and outdated products are removed from the devices on which they are installed, and regularly checks the updates of those that are still necessary and ensures they are up-to-date. If deemed necessary, the company makes improvements or purchases products related to patch management.

In order to ensure controlled access to systems containing personal data, the company keeps access and authorization management up-to-date and informs its employees about the use of secure passwords. For this purpose, the company creates an “access and authorization control matrix” and access policies and procedures.

The company makes the necessary improvements or purchases products related to password management. The company acknowledges and declares that it will take the necessary measures to prevent more than a certain number of password entry attempts, ensure regular password changes, ensure that passwords are chosen with sufficient complexity to maintain a high level of security, and ensure that the privileges of employees whose employment contracts have been terminated are revoked without delay.

The company takes the necessary measures to ensure that antivirus software, which regularly scans networks and computers to detect threats, is used and kept up-to-date. In cases where personal data is obtained from websites outside the company network, it is necessary to ensure that connections to these sites are made via SSL or a more secure method.

3.2.2. Monitoring of Personal Data Security

For the purpose of monitoring personal data security:

  • The Company ensures that the software and services operating on its networks are identified and monitored.
  • The Company takes the necessary measures to detect any unauthorized access, intrusion or improper activity on its networks.
  • The Company performs log management.
  • The Company raises employees’ awareness to ensure that security breaches are reported promptly and establishes a “reporting procedure” for this purpose. Such reports may be generated automatically by the system and, when necessary, consolidated by the system administrator and submitted to the relevant department.
  • The Company ensures the regular review of all reporting tools used to maintain the security of personal data at the system level and ensures that alerts are duly taken into consideration.
  • The Company regularly conducts or commissions vulnerability scans and penetration tests.
  • In the event of any cyberattack, the Company ensures that all evidence is collected completely and stored securely.

3.2.3. Ensuring the Security of Environments Containing Personal Data

The Company takes the necessary internal and external physical security measures at its Headquarters, Archives, branches and other locations where personal data are physically and logically stored.

As part of these measures, the Company ensures that facilities and structures containing personal data are protected against disasters such as earthquakes, fires and floods. To ensure the security of personal data stored in physical environments, the Company controls access to and exit from the locations where such data are stored and raises the awareness of employees processing such personal data to prevent potential loss or theft.

The Company acts with the awareness that a significant proportion of personal data breaches occur as a result of the theft or loss of devices containing personal data and takes the necessary measures to minimize such incidents. These measures may include access control authorization and encryption methods.

Where the Company uses encryption methods, it utilizes internationally recognized solutions and, where asymmetric encryption methods are used, takes the necessary measures with regard to key management processes.

3.2.4. Procurement, Development and Maintenance of Information Technology Systems

The Company takes care to prioritize security when procuring services for the procurement, development and maintenance of IT systems. For this purpose,

  • The Company ensures that control mechanisms are in place to verify that personal data entered through application systems are processed in a manner that does not compromise the integrity of the data entered.
  • The Company ensures that the data storage media of devices containing personal data that are to be sent to third-party supplier companies for reasons such as maintenance or repair are not sent along with the devices. Where personnel of an external supplier company visit the Company, the Company ensures that the necessary measures are taken to prevent any data from being transferred outside the Company.

3.2.5. Backup of Personal Data

The Company maintains one or more backups of the personal data in its possession in order to ensure the security of such data.

The Company develops data backup strategies against ransomware and other malicious software that encrypts files and demands a ransom, and takes the necessary measures in this regard.

The Company ensures that only the system administrator has access to backed-up personal data and stores such backups offline.

The Company takes the necessary measures to ensure the physical security of such backups.

4. ENFORCEMENT AND UPDATES

This Policy will enter into force on the date it is approved by the Company’s Board of Directors. The Policy is reviewed and updated annually. However, in line with legislative changes, changes in a referenced technical standard, the actions and/or decisions of the Personal Data Protection Board, and court decisions, the Company reserves the right to review this Policy and, if necessary, update, amend, or abolish it and create a new policy. The authority to decide on the abolition of the Policy belongs to the Company’s Board of Directors.