1. Introduction
Protection of personal data is among the top priorities of Toyi Oyun ve Tasarım A.Ş. ("Company" or "TOYİ"), and our Company makes every effort to comply with all legislation in force on this matter. The most important part of this is this Personal Data Protection and Processing Policy ("Policy").
This Policy explains the principles adopted in our Company's personal data processing activities, including the personal data of children, and the basic principles adopted for compliance with the Personal Data Protection Law No. 6698 ("Law"). In this way our Company provides the necessary transparency by informing data subjects. With full awareness of our responsibility, your personal data is processed and protected within the scope of this Policy.
Scope
This Policy covers all personal data of persons other than our Company's employees, processed by automatic means or by non-automatic means as part of a data recording system.
The protection of our employees' personal data is managed under the TOYİ Employee Personal Data Protection and Processing Policy, written in parallel with the principles of this Policy.
2. Processing of Personal Data
2.1 Processing in Line with the Principles in the Legislation
2.1.1 Lawfulness and fairness. Personal data is processed in accordance with the general rules of trust and good faith, without harming the fundamental rights and freedoms of individuals. Personal data is processed only to the extent required by our Company's business activities.
2.1.2 Accuracy and keeping data up to date where necessary. Our Company takes the necessary measures to keep personal data accurate and up to date throughout the period it is processed, and sets up mechanisms to ensure accuracy at regular intervals.
2.1.3 Specific, explicit and legitimate purposes. Our Company states the purposes of processing clearly and processes personal data for purposes connected with its business activities.
2.1.4 Relevant, limited and proportionate. Our Company collects personal data only of the type and to the extent required by its business activities and processes it only for the stated purposes.
2.1.5 Retention for the period set by law or needed for the purpose. Our Company retains personal data for the period needed for the purpose of processing and the minimum period set in the relevant legislation. Our Company first checks whether the legislation sets a retention period; if so, it follows that period. If not, personal data is kept for as long as needed for the purpose. At the end of the retention period, personal data is destroyed in line with the periodic destruction schedule or the data subject's request, by deletion, destruction and/or anonymisation.
2.2 Conditions for Processing Personal Data
The explicit consent of the data subject is only one of the legal grounds that allow personal data to be processed lawfully. Where one of the conditions below is met, our Company processes personal data without seeking the data subject's explicit consent.
A processing activity may rely on only one of the conditions below or on more than one. Where the data is special category personal data, the conditions in section 2.3 ("Processing of Special Category Personal Data") apply.
2.2.1 Expressly provided for by law. Where the law clearly provides for the processing of personal data, the data subject's personal data may be processed by our Company within the framework of that legislation.
2.2.2 Inability to obtain explicit consent due to actual impossibility. Where processing is necessary to protect the life or physical integrity of a person who cannot give consent due to actual impossibility, or whose consent is not legally valid, or of another person, the data subject's personal data may be processed.
2.2.3 Directly related to the establishment or performance of a contract. Where processing is necessary and directly related to the establishment or performance of a contract to which the data subject is a party, this condition is met.
2.2.4 Fulfilment of the Company's legal obligations. Where processing is necessary for our Company to fulfil its legal obligations, the data subject's personal data may be processed.
2.2.5 Personal data made public by the data subject. Where the data subject has made their personal data public, that data may be processed limited to the purpose of making it public.
2.2.6 Necessary for establishing or protecting a right. Where processing is necessary for the establishment, exercise or protection of a right, the data subject's personal data may be processed.
2.2.7 Necessary for our Company's legitimate interest. Where processing is necessary for our Company's legitimate interests, provided it does not harm the data subject's fundamental rights and freedoms, the data subject's personal data may be processed.
2.3 Processing of Special Category Personal Data
The Law gives special importance to sensitive personal data because, if processed unlawfully, it carries a risk of harm or discrimination. This "special category" personal data is data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Special category personal data is processed by our Company in line with the principles in this Policy, by taking all necessary administrative and technical measures, including the methods set by the Board, and under the following conditions:
- (i) Special category personal data other than health and sexual life may be processed without the data subject's explicit consent where the law clearly provides for it. Otherwise, the data subject's explicit consent is obtained.
- (ii) Personal data on health and sexual life may be processed without explicit consent by persons under a duty of confidentiality or by authorised institutions for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing. Otherwise, the data subject's explicit consent is obtained.
2.4 Categories of Personal Data Processed and Purposes of Processing
In line with the Law and other relevant legislation, our Company's purposes for processing the personal data detailed in this Policy, including special category personal data and children's personal data, are as follows:
[The list of data categories and purposes is missing from the source text.]
3. Transfer of Personal Data
In line with lawful processing purposes and by taking the necessary security measures, our Company may transfer data subjects' personal data and special category personal data to third parties. Our Company acts in accordance with Articles 8 and 9 of the Law.
3.1 Transfer of Personal Data
Even without the data subject's explicit consent, personal data may be transferred to third parties by our Company with due care and all necessary security measures, including the methods set by the Board, where one or more of the following conditions exist:
- The transfer is expressly provided for by law,
- The transfer is directly related to and necessary for the establishment or performance of a contract,
- The transfer is necessary for our Company to fulfil its legal obligation,
- The data has been made public by the data subject, and the transfer is limited to the purpose of making it public,
- The transfer is necessary for the establishment, exercise or protection of the rights of the Company, the data subject or third parties,
- The transfer is necessary for the Company's legitimate interests, provided it does not harm the data subject's fundamental rights and freedoms,
- The transfer is necessary to protect the life or physical integrity of a person who cannot give consent due to actual impossibility, or whose consent is not legally valid, or of another person.
If personal data is to be transferred abroad, in addition to the conditions above, our Company transfers personal data to foreign countries declared by the Board to have adequate protection, or, where adequate protection does not exist, to foreign countries where the data controllers in Türkiye and in the relevant country have undertaken adequate protection in writing and the Board has given permission, or on condition that Binding Corporate Rules, which provide a written undertaking of adequate protection for multinational group companies operating in countries without adequate protection, have been approved by the Board.
3.2 Transfer of Special Category Personal Data
Special category personal data may be transferred by our Company in line with the principles in this Policy, by taking all necessary administrative and technical measures, including the methods set by the Board, and under the following conditions:
- (i) Special category personal data other than health and sexual life may be transferred without the data subject's explicit consent where the law clearly provides for it. Otherwise, the data subject's explicit consent is obtained.
- (ii) Personal data on health and sexual life may be transferred without explicit consent by persons under a duty of confidentiality or by authorised institutions for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing. Otherwise, the data subject's explicit consent is obtained.
If special category personal data is to be transferred abroad, in addition to the conditions above, it is transferred to foreign countries with adequate protection or to foreign countries where a data controller has undertaken adequate protection.
4. Informing Data Subjects
In line with Article 10 of the Law and secondary legislation, our Company informs data subjects, by category (for example employees, potential employees, customers, visitors and children), about who processes their personal data as data controller, for what purposes, with whom and for what purposes it is shared, by which methods it is collected, its legal basis, and the rights data subjects have.
5. Retention and Destruction of Personal Data
Our Company retains personal data for the period needed for the purpose of processing and the minimum period set in the relevant legislation, taking all technical security measures. Our Company first checks whether the legislation sets a retention period; if so, it follows that period. If not, personal data is kept for as long as needed for the purpose. At the end of the retention period, personal data is destroyed in line with the periodic destruction schedule or the data subject's request, by deletion, destruction and/or anonymisation.
6. Protection of Personal Data
In line with Article 12 of the Law, our Company takes measures appropriate to the nature of the data to prevent unlawful disclosure, access, transfer or other security failures. In this context, our Company takes the technical and administrative measures needed to ensure the required level of security in line with the guidelines published by the Personal Data Protection Board ("Board"), and carries out or commissions audits.
The technical and administrative measures taken to protect personal data are applied with extra care for special category personal data, and the necessary audits are carried out within our Company.
6.1 Raising and Auditing Awareness of Business Units
Our Company provides regular training to business units to raise awareness of preventing unlawful processing of and access to personal data and of keeping data safe.
Our Company sets up systems to build awareness of personal data protection among current and new employees and works with consultants where needed. It evaluates participation in related training, seminars and information sessions and organises new training as the legislation is updated.
7. Rights of Data Subjects and How to Exercise Them
7.1 Rights of the Data Subject
Data subjects have the right to:
- Learn whether their personal data is processed,
- Request information if their personal data has been processed,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties in Türkiye or abroad to whom their personal data is transferred,
- Request correction of incomplete or inaccurate data and that this be notified to the third parties to whom the data was transferred,
- Request deletion or destruction of personal data where the reasons for processing no longer exist, even though it was processed in line with the Law and other relevant laws, and that this be notified to the third parties to whom the data was transferred,
- Object to a result against them arising from analysis of the processed data solely by automated systems,
- Request compensation for damage suffered due to unlawful processing of personal data.
7.2 Exercising the Rights
Data subjects may send their requests regarding the rights listed in section 7.1 to our Company at hello@toyi.io, by the methods set by the Board and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.
7.3 Our Company's Response to Applications
Our Company takes the administrative and technical measures needed to conclude applications by data subjects in line with the Law and secondary legislation.
Where a data subject properly submits a request regarding the rights in section 7.1, our Company will conclude the request free of charge as soon as possible according to its nature, and within 30 (thirty) days at the latest. However, if the process requires an additional cost, a fee may be charged according to the tariff set by the Board.