THE HOUSESEAT PERSONAL DATA PROTECTION POLICY AND INFORMATION NOTICE
Law No. 6698 on the Protection of Personal Data (“Law”) entered into force on 7 April 2016. The said law contains regulations regarding the processing of all information relating to “an identified or identifiable natural person”.
TheHouseSeat Personal Data Protection and Processing Policy (“Policy”) explains the policies of Tiyatronet Bilişim Teknoloji A.Ş., acting as the data controller (“Company”), regarding all personal data of individuals processed fully or partially by automatic means or by non-automatic means provided that such processing forms part of a data recording system.
1. PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
Within the framework of Article 4 of the Law, the Company, as data controller, shall act in accordance with the following principles in the processing of personal data.
(a) Compliance with law and the rules of honesty
Personal data shall be processed in accordance with law and the rules of honesty. The Company shall act in compliance with the applicable legislation in all personal data processing processes and shall observe the rules of honesty.
(b) Accuracy and up-to-dateness
The Company shall enable data subjects to update their data in order to ensure that the personal data it processes is accurate and up to date, and shall take the necessary measures to ensure that the data is accurately transferred to databases.
(c) Processing for legitimate and specific purposes
The Company is obliged to inform data subjects about the purposes of processing personal data in line with its disclosure obligations. Accordingly, the Company shall limit its data processing activities to specific and legitimate purposes and shall clearly inform data subjects through information notices.
(d) Processing in a manner relevant, limited and proportionate to the purpose
The Company shall process personal data to the extent necessary for the purpose notified to the data subject, in connection with that purpose and in a limited manner.
(e) Retention for the period stipulated in the relevant legislation or necessary for the purpose
If there is a retention period specified in the legislation, the Company shall retain data for that period. If no such period exists in the legislation, reasonable data retention periods shall be determined and the data shall be retained for such period. Upon the expiry of such periods, the data shall be deleted or anonymized.
2. PERSONAL DATA PROCESSED
Through the website, mobile applications, Smart TV and other digital platforms, and within the framework of the services provided in connection with these platforms, the following personal data of users are processed.
For the relevant person who is a member
• Identity Information: Name, surname, date of birth, Turkish ID Number, gender
• Contact Information: E-mail address, phone number, address
• Customer Transaction: Preferences, commercial communication permission, followed content, watched content, service start and end time, type of service used, amount of transferred data, commercial electronic communication consent given electronically by the relevant person, approved membership agreement, distance sales agreement, cookie policy and privacy agreement, etc.
• Transaction Security Information: Password, passcode information, username, IP address
• Marketing Information: Cookie records, targeting information, evaluations showing habits and likes, e-mail messages sent for marketing purposes within the scope of the commercial electronic communication consent given by the relevant person
• Visual/Audio Records: Call center call recordings
For the relevant person who is a visitor
• Identity Information: Name, surname
• Contact Information: E-mail address, phone number
• User Transaction Information: Call center call recordings, followed content, watched content
• Legal Transaction Information: IP address
• Marketing Information: Cookie records
• Audio Data: Call center call recordings
• Customer Transaction: Service start and end time, type of service used, amount of transferred data, website, mobile application, mobile website, smart TV application regarding the service used by the relevant person, complaints and/or requests and records relating to their evaluation
3. METHOD OF PROCESSING PERSONAL DATA
Personal data is processed in accordance with the legislation through www.thehouseseat.com, the Company's mobile applications, smart TV application and other digital platforms, contracts, forms, social media accounts, cookies, call center, e-mail and other communication channels, or by being provided directly by the relevant person.
4. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Pursuant to Articles 5 and 6 of the Law, the conditions for processing personal data and special categories of personal data have been determined.
Personal data is processed by the Company for the following purposes:
• Processing users' traffic information (IP address, service start and end date, type of service used, amount of transferred data and subscriber identity information) in accordance with the applicable legislation,
• Carrying out user transactions,
• Determining our geographical location and providing content or content-related advertisements and services according to your region or country,
• Improving services and content and developing new services/content,
• For the performance of the User Agreement, and for users who have given commercial electronic communication consent, analyzing the user's preferences and likes and recommending services/content specific to the user,
• Tracking member/user movements to increase user experience and service/content quality,
• Providing relevant information to users who have commercial electronic communication consent,
• Conducting direct marketing, digital marketing, remarketing, targeting, profiling and analysis in line with the information in the cookie policy in order to promote and market applications, products and services in line with the preferences and likes of the member/user,
• Resolving complaints and problems,
• Providing support for technical problems,
• Improving user experience on the website, mobile application, mobile website and smart TV application,
• Carrying out user satisfaction and loyalty processes,
• Conducting statistical evaluations and market research,
• Managing corporate reputation and media communications,
• Determining and implementing the Company's commercial and business strategies,
• Monitoring accounting and purchasing transactions,
• Conducting legal processes and acting in compliance with legislation,
• Fulfilling legal obligations,
• Responding to information requests from administrative and judicial authorities,
• Planning internal reporting and business development activities,
• Ensuring information and transaction security and preventing malicious use.
Personal data is processed by the Company on the following legal grounds:
• It is explicitly stipulated in the laws.
• Explicit consent.
• It is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.
• It is mandatory for the data controller to fulfill its legal obligation.
• It has been made public by the relevant person.
• Data processing is mandatory for the establishment, exercise or protection of a right.
• It is mandatory to process data for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the relevant person.
5. TRANSFER OF PERSONAL DATA BY THE COMPANY
Pursuant to Article 8 of the Law, a distinction is made in the transfer of personal data according to whether the personal data is a special category of personal data or not. Accordingly, non-special category personal data may be transferred by the Company to third parties if one of the processing conditions exists.
Personal data may be transferred for the purposes of providing products and services, contacting the user or visitor, obtaining e-mail delivery services, determining the user's usage preferences and browsing history, segmentation, determining customer profile, carrying out statistical studies, and contacting the user regarding member/user likes and preferences, to natural or legal persons with whom the Company cooperates.
Personal data transferred within the framework of the above principles is secured by data security agreements and/or contractual provisions prepared by considering whether the receiving party is a data controller or data processor.
6. RIGHTS OF DATA SUBJECTS AND EXERCISE OF THESE RIGHTS
According to Article 11 of the LPPD, the rights of personal data subjects are as follows:
i. To learn whether personal data relating to them is processed.
ii. To request information if their personal data has been processed.
iii. To learn the purpose of processing personal data and whether they are used in accordance with their purpose.
iv. To know the third parties to whom personal data is transferred at home or abroad.
v. To request correction of personal data if it is processed incompletely or inaccurately.
vi. To request deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation.
vii. To request notification of the transactions made as a result of requests for correction, deletion and destruction to third parties to whom personal data has been transferred.
viii. To object to the emergence of a result against the person by means of analysis of processed data exclusively through automated systems.
ix. To request compensation for damages in case of damage due to unlawful processing of personal data.
7. PROTECTION OF PERSONAL DATA
The Company takes technical and administrative measures to prevent unauthorized access, data loss and damage in order to ensure the security of personal data.
Within this scope, the Company:
• Keeps records of access to personal data
• Ensures data security through anti-virus systems and firewalls
• Carries out personal data processing activities
• Ensures that audits are conducted in order to ensure the implementation of the provisions of the Law
• Makes authorizations appropriate to the nature of the data accessed within the Company
• Makes authorizations appropriate to the nature of the data in access to data
• Subjects special categories of personal data, if any, to stricter access measures
• Obtains commitments from external service providers to ensure compliance with the Law where access to personal data occurs from outside the Company due to outsourcing, supplier use or other reasons
• Trains all employees, especially those authorized to access personal data, and obtains undertakings from them
Right to Delete Personal Data
Users have the right to request the deletion of their accounts as well as their personal data. To make this request, they can send an e-mail to destek@thehouseseat.com or contact the live support team. After your request is reviewed, action will be taken as soon as possible.