Privacy Notice on the Protection and the Processing of Personal Data
As THY Hava Kargo Taşımacılık A.Ş. (hereinafter referred to as “Widect” or “We” or “Company”), we pay the utmost sensitivity on the lawful processing of the personal data pertaining to our customers.
We have prepared the Widect Privacy Notice on the Protection and the Processing of Personal Data(“Notice”), in order to ensure compliance with national and international legislation in effect, in particular the Turkish Personal Data Protection Law (the “Law”) and the European Union General Data Protection Regulation (“GDPR”).
The security of our customers’ personal data is at the forefront of our work. Therefore, in order to prevent any unlawful access to personal data or leak and to ensure the secure retention of personal data relating to our customers, such data are only transferred to trusted business partners and on a minimum level, by taking necessary security measures in accordance with the legislation in force.
Transparency is one of the most important subjects of our personal data protection program. In this respect, we have prepared this Notice in order to provide our customers with all possible information while we are processing personal data for the purposes of compliance with our legal obligations and to ensure a better customer experience. Detailed information regarding the types of personal data and the purposes for processing personal data are detailed under the “For Which Purposes Do We Process Your Personal Data?” heading.
Another issue that we also pay close attention to is customers’ right to have control over their personal data. We implement measures to ensure that our customers manage their preferences regarding their own personal data and highly respect our customers preferences. In this regard, you may convey your requests to us by communication channels listed under section “The Exercise of Rights by the Data Subjects”, and detailed explanations regarding the matter are provided within the section named “Rights of the Data Subjects”.
Data security, transparency and individuals’ right to have control over their personal data are fundamentals for us in ensuring compliance with the Law. In this respect, detailed information regarding the processing of your personal data is presented to your attention within this Notice.
This Notice contains our declarations and explanations concerning the processing of personal data relating to our customers and other natural persons establishing contact with us, excluding our employees, in compliance with the provisions of the Law and the GDPR.
We reserve the right to make changes to this Notice in order to provide accurate and up-to-date information concerning practices and regulations relating to the protection of personal data. Additionally, data subjects will be informed by appropriate means in the event of a substantial change to the Notice.
This Notice is prepared in order to provide information concerning which personal data Widect processes within the scope of its commercial activities, the purposes for processing, the parties to whom personal data are transferred and the purposes for such transfers.
Our Company collects your personal data through the agencies authorized for sale of Widect products and services, sales offices, suppliers from whom service is received within the scope of transportation services, Widect website, social media accounts, e-mail, mail, CCTV, cookies and other communication channels, in audio, electronic or written form, in accordance with the conditions for processing of personal data as specified in the Law, for the purposes as set forth in this Notice.
Personal data processed by our Company differ in accordance with the nature of the legal relationship established with our Company. In this respect, categories of personal data collected by our Company through all channels, including digital environments, are as follows:
As per the Law, personal data can only be processed in the presence if at least one of the conditions set forth under Articles 5 and 6 of the Law and/or required by international legislation. In this respect, as Widect, we may rely on different legal bases, including: i) it is expressly provided for by the laws, ii) the necessity to establish a contractual relationship with you and to perform our obligations under a contract (provision of airline transport services and other related services) iii) complying with obligations under national and international regulations and iv) our legitimate interests provided that such interests do not have a negative impact on our customers’ fundamental rights and freedoms.
In addition to the above-listed conditions for processing personal data, we may request you to explicitly consent to the processing of your personal data. If this is the case, personal data will be processed limited to the scope of your freely given explicit consent. You may revoke your explicit consent at any time.
In this regard, personal data will be processed by Widect, within the framework of national and international legislation, in accordance with the conditions for processing personal data set forth under Articles 5 and 6 of the Law and within the scope of the below-listed purposes:
Your personal data may be shared with parties who provide product or service to us or on behalf of our Company and with our suppliers and business partners that we get support for the establishment, execution and termination of our relationship, including the parties collaborating with us for the purposes of providing products and services to you. Your personal data may also be shared with public institutions and private persons authorized by law within the scope of their authorization. In such cases, our company takes all precautionary measures to ensure that the parties carry processing and transfer activities in accordance with the rules stated in this Notice and other related law.
Personal data may be shared with group companies, business partners, public institutions and private persons authorized by law pursuant to conditions and purposes of processing personal data as stated under Article 8 and 9 of the Law, and may be transferred abroad, limited with the stated purposes and in accordance with the principles and procedures stated under Article 9 of the Law and decisions of the Personal Data Protection Board.
In this context regarding the services provided within the scope of cargo activities, your personal data may be shared with the supplier companies within the scope of pick-up and distribution services to meet operational requirements, airline companies or other companies that will carry out transportation, companies that provide services for shipment security or customs control, insurance companies, Turkish customs authorities, foreign customs authorities of the country where your cargo services are carried out and companies that will make the final delivery after the customs operation abroad in order to fulfill the operational requirements.
Your personal data may only be transferred abroad other than those described above where;
Our company determines the retention periods by taking into consideration of the applicable law and purposes of data processing. In this respect, where applicable, we particularly consider the issues of period of limitation and legal obligations regarding the processing of personal data. Once the purpose for processing personal data ceases, unless another legal reason or basis allowing the retention of the personal data exists, data will be deleted, destroyed or anonymized.
Our company acts in accordance with the principles stated below in all data processing activities. “Acting in accordance with the law and in good faith”, “Authenticity and Being Up-to-date”, “Processing for specific, clear and legitimate purposes”, “Being relevant, limited and proportionate with the purposes”, “Retention as stated in the related law or as long as necessary for the relevant purpose”
As Widect, we utilize technologies such as cookies, pixels, GIFs (“Cookies”) to improve your user experience during your use of our websites and applications. The use of these technologies is in accordance with the Law and other related regulations that we are subjected to. For further information regarding cookies, please refer to the Widect Cookie Privacy Notice.
When you visit our company premises, your visual and audial data may be obtained via CCTV and may be preserved only for a period necessary to fulfill the following purposes. With the use of CCTV, prevention and detection of any criminal act incompatible with the law and company policies, maintaining the security of company premises and equipment located within the premises, protection of visitors’ and workers’ well-being is pursued. All necessary technical and administrative measures will be taken by us regarding the security of your personal data obtained via CCTV.
In accordance with Article 11 of the Law, data subjects are entitled to the following rights:
Under the GDPR you are entitled to the following rights (further information is available under https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en):
Under the GDPR or national laws, these rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which We are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in the GDPR or in applicable national laws. We will inform you of relevant exemptions We rely upon when responding to any request you make.
In order to exercise these rights please contact the above-mentioned contact addresses. Please specify which individual rights according to Art. 15 et seq. you want to exercise. For this purpose, We may have to confirm your identity before responding to your request. Please provide the following details so that We can identify you:
If you send us a copy of your ID, please black out all other information apart from your first and last name and address. When sending copies of the ID card, it must be clear that this is a copy. Therefore, please make a note on the copy of the ID as following: “This is a copy”.
In order to be able to process your request, as well as for identification purposes, please note that We will use your personal data in accordance with Art. 6 para. 1 (f) of the GDPR as legal obligation.
If you believe that We have failed to comply with data protection regulations when processing your personal data, you can lodge a complaint with the competent supervisory authority in accordance with Art. 77 GDPR. The competent supervisory authority can be identified according to the list provided under: https://edpb.europa.eu/about-edpb/board/members_en.
As indicated above, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6 (1) (e) or (f) of the GDPR, including profiling based on those provisions.
We shall no longer process the personal data unless We demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
You can easily use your rights mentioned above and easily communicate the related requests to us via contact information below.
Data subjects’ requests concerning the above-listed rights shall be concluded by us within thirty days at the latest, in accordance with the limitations provided by the Law.
In principle, data subject requests shall be concluded free of charge. However, Widect reserves its right to demand a fee from the tariff specified by the Board, in case the request requires additional costs.
Our Company may request certain information from the data subject in order to determine that the applicant is in fact the Data Subject, and additional questions can be directed to the applicant to clarify matters regarding the applications.
We take all appropriate technical and organizational measures to safeguard your personal data and to mitigate risks arising in connection with unauthorized access, accidental data loss, deliberate erasure of or damage to personal data.
In this respect our Company;