Privacy Policy | BuildIt

PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

1. What is personal data, and who processes it?

Pursuant to Article 3 of the Personal Data Protection Law No. 6698, “personal data” refers to any information relating to an identified or identifiable natural person. INFERA Technology, acting as the “data controller” under the Personal Data Protection Law No. 6698, will record, store, update, process, disclose, and transfer your personal data to third parties in accordance with the law.

2. For what purposes may your personal data be processed?

Of the personal data collected from you, as listed individually below:

Identity Data;

As expressly provided by law (Art. 5/2.a)
Where it is necessary for the data controller to fulfill its legal obligation (Art. 5/2.c)
Processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract (Art. 5/2.c)

Contact Information Data;

Physical Premises Security Information Data;

Where the processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract (Art. 5/2.c)
Where expressly provided for by law (Art. 5/2.a)
It is necessary for the data controller to fulfill its legal obligations (Art. 5/2.ç)
Data processing is necessary for the establishment, exercise, or protection of a right (Art. 5/2.d)
Provided that it does not infringe upon the fundamental rights and freedoms of the data subject,

Data on Legal Proceedings;

It is necessary for the data controller to fulfill its legal obligation (Art. 5(2)(c))

Special Category Personal Data;

Subject to the data subject’s explicit consent (Art. 5(1)) and within the conditions for processing personal data;

Electronically, by automated or non-automated means, through our website at www.buildit.com.tr and any other websites that may be established in the future;
Electronically, by automated or non-automated means, through cookies (“Cookies”) that communicate with your devices on the Website (data collected through cookies is generally anonymous);
Electronically, by automated or non-automated means, through accounts operated on behalf of the Company on various social media platforms (“Social Media”);
Verbally and electronically, by automated or non-automated means, through call centres managed by the Company (“Call Centre”);
Electronically, by automated or non-automated means, via email through the entire sales and marketing network established and managed by the Company;
Verbally, electronically or in writing, by automated or non-automated means, through contracts, email correspondence and user devices;
In writing, through business cards provided verbally or by hand by visitors to the Company;
Verbally, in writing or electronically, by automated or non-automated means, through our employees acting on behalf of the Company and working within the sales and marketing network;
Electronically, by automated or non-automated means, through websites, email, mobile communication channels and mobile applications, by the Company or by natural or legal persons processing data on behalf of the Company, based on various legal grounds;
Physically, through advertising management channels and panel environments;
Through correspondence conducted via our email addresses, short messages or multimedia messages sent for other purposes related to the Company’s activities, and any other communication methods and channels;
Verbally, in writing or electronically, by automated or non-automated means, within the scope of sales, marketing and after-sales services, through all service sales and marketing networks belonging to the Company or established or operated by third parties outside the Company;
Verbally, in writing or electronically, by automated or non-automated means, through all other after-sales service networks established or operated by the Company or by third parties outside the Company;
Through third parties such as group companies to which the Company provides services or from which it receives services, business partners, manufacturers, product or service suppliers, online sales platforms, dealers, solution partners, institutions and organisations;
Verbally or electronically, by automated or non-automated means, through your website, social media accounts or other channels on which you have made your Personal Data publicly available;
Electronically, by retaining system log records from devices used by guests who connect to the Company’s Wi-Fi network;
Electronically, through IP camera systems used for security purposes in relation to visitors entering the Company’s or its dealers’ premises;
Electronically, by automated or non-automated means, for the purpose of receiving and evaluating requests and complaints;
Electronically, by automated or non-automated means, for the purpose of monitoring and conducting legal affairs;
Electronically, by automated or non-automated means, for the purpose of fulfilling requests from public authorities;
Electronically, by automated or non-automated means, for the purpose of carrying out information security processes;
Electronically, by automated or non-automated means, for the purpose of conducting audit and ethics activities;
Electronically, by automated or non-automated means, for the purpose of planning and executing internal processes;
Verbally, in writing or electronically, by automated or non-automated means, through all other after-sales service networks established or operated by the Company or by third parties outside the Company;
Through third parties such as group companies to which the Company provides services or from which it receives services, business partners, manufacturers, product or service suppliers, online sales platforms, dealers, solution partners, institutions and organisations;
Through information that you provide verbally, in writing, electronically or via paper forms to our employees or suppliers for the purpose of obtaining information about our infrastructure and other services;
Through business cards, résumés (CVs) and proposals submitted verbally, in writing or electronically, in a physical or virtual environment, either face-to-face or remotely, for purposes such as establishing a commercial relationship with our organisation, applying for employment or submitting a proposal;
Verbally or electronically, by automated or non-automated means, through your website, social media accounts or other channels on which you have made your Personal Data publicly available.

Data collected automatically or non-automatically, verbally, in writing, or electronically through the channels listed above and any other channels that may be added in the future may be processed in accordance with the reasons and purposes specified below.

Your Personal Data collected through the channels and by the methods mentioned in this Privacy Notice is processed by the Company for the following purposes:

Within the scope of Articles 5.2 and 6.3 of the KVKK:
As a general rule, we process your Personal Data on the basis of your explicit consent. However, in exceptional circumstances permitted under the KVKK, your Personal Data may also be processed without obtaining your explicit consent. Within this scope, we process your Personal Data: (i) to fulfil our legal obligations, including those arising from tax legislation, consumer protection legislation, the Turkish Code of Obligations, the Turkish Commercial Code and other applicable legislation; (ii) where you are unable to express your consent due to actual impossibility; (iii) where processing is necessary for the establishment or performance of a contract; (iv) to fulfil our legal obligations, including receiving your questions and complaints regarding our services, responding to you and, where necessary, using such records in the event of a potential dispute; (v) to establish, exercise or protect a right, including transactions carried out to retain records as evidence within the scope of after-sales services and any other processing activities that may be applicable under the relevant regulations; and (vi) to protect our legitimate interests, provided that such processing does not prejudice your fundamental rights and freedoms, including reducing costs, ensuring the efficient use of resources, monitoring call centre service quality, ensuring your security, measuring the quality of the services provided to you, and evaluating and resolving the requests you submit within this scope. Furthermore, the processing of Personal Data that you have made publicly available, within the limits prescribed by the KVKK, does not require your explicit consent. Our processing of Personal Data that you have made publicly available through social media platforms, your website or other channels, as well as any other processing activities that may be applicable under the relevant regulations, may be cited as examples of such processing. Where a processing activity requires your explicit consent beyond the circumstances described above, your explicit consent will be obtained separately
Your Personal Data collected through the channels and by the methods specified above may also be processed for the following purposes, subject to obtaining your explicit consent pursuant to Articles 5.1 and 6.2 of the KVKK:
To carry out communication, advertising, marketing, product/service offering, informational, promotional and sales activities;
To create communication, targeted advertising and marketing archives and to contact you regarding potential future collaborations;
To ensure effective contract management;
To collect participants’ information, issue venue access permits and prepare event agreements for fairs and events, as well as to provide better services to users through our Website and improve our services;
To ensure the legal and commercial security of the Company, its Affiliated Companies and persons who have established or maintain a business relationship with the Company;
To enable our business units to carry out the necessary activities so that you may benefit from the products, services or commercial activities offered by the Company;
To determine and implement the Company’s commercial and business strategies;
To retain visitor records for the purpose of ensuring the Company’s security;
To provide you with personalised advertisements, campaigns, benefits and other advantages, particularly within the scope of sales, telesales, online sales and marketing activities, and to conduct other marketing and Customer Relationship Management activities;
To ensure the continuity of communication and marketing activities;
To provide personalised content during your visits to the Websites;
To develop new product and service models;
To send commercial electronic communications, including bulletins, campaign announcements, newsletters, customer satisfaction surveys, and product and service advertisements;
To send gifts, bulletins, promotional materials and other magazines or periodical publications;
To conduct corporate communication activities; organise other events and invitations within this scope and provide information about them; process applications for meeting attendance, admission and all related procedures; complete other necessary meeting notification procedures; and carry out procedures relating to participation in congresses, symposiums, and scientific and educational meetings;
Your Special Categories of Personal Data are processed where you are unable to express your consent due to actual impossibility; where processing is necessary for the establishment or performance of a contract; to fulfil our legal obligations; to establish, exercise or protect a right; and to protect our legitimate interests, provided that such processing does not prejudice your fundamental rights and freedoms.

3. To whom and for what purpose may your processed personal data be transferred?

Your personal data that we collect;

To fulfil our Company’s legal obligations;
To conduct the necessary operational activities through our business units;
To plan and implement our human resources policies in the most effective manner and to properly plan and manage our commercial partnerships and strategies;
To ensure the legal, commercial and physical security of our Company and our business partners;
To ensure the proper functioning of our Company’s corporate operations;
To fulfil requests from public authorities;
To monitor and conduct legal affairs;
To carry out the necessary activities to enable you to benefit from the products and services offered by our Company in the best possible manner; to customise and recommend such products and services according to your requests, needs and preferences; to maintain the highest possible level of data security; and to create databases;
To improve the services offered through our Company’s website and to communicate with individuals who submit requests or complaints to our Company;
To take the necessary steps for the Company to make, implement and execute commercial decisions for the purpose of resolving errors occurring on our Company’s website;
To plan and execute our Company’s human resources policies and processes.
Our business partners;
Our suppliers;
Company officials; and
Legally authorised public institutions and private persons.

4. On what legal basis and by what means do we collect your personal data?

Personal data is collected in all forms—whether oral, written, or electronic—through technical and other methods, via various channels such as our Company’s website, for the purpose of fulfilling the objectives set forth in this Policy, within the framework of legal grounds based on legislation, contracts, requests, and consent, in order to fully and accurately fulfill the legal obligations arising from the law, and are processed by our Company or by data processors appointed by our Company. The processing of your personal data

5. Conditions for the Transfer of Personal Data

In line with its Personal Data processing purposes, the Company may transfer the Personal Data and Special Categories of Personal Data of data subjects to third parties in accordance with the Law, provided that the necessary confidentiality conditions are established and appropriate security measures are implemented. The Company complies with the provisions stipulated under the Law when transferring Personal Data. In this context, and in line with its legitimate and lawful Personal Data processing purposes, the Company may transfer Personal Data to third parties on a limited basis, relying on one or more of the Personal Data processing conditions specified below and set out in Article 5 of the Law: Upon expiration of the applicable retention period or when the purpose of processing no longer exists, personal data is deleted or anonymized.

Where the data subject has given explicit consent;
Where the law expressly provides for the transfer of Personal Data;
Where the transfer is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to express consent due to actual impossibility or their consent is not legally valid;
Where the transfer of Personal Data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract;
Where the transfer of Personal Data is necessary for the Company to fulfil its legal obligations;
Where the Personal Data has been made publicly available by the data subject;
Where the transfer of Personal Data is necessary for the establishment, exercise or protection of a right; or
Where the transfer of Personal Data is necessary for the Company’s legitimate interests, provided that it does not prejudice the fundamental rights and freedoms of the data subject.

Conditions for the Domestic Transfer of Special Category Personal Data

Our company may transfer the special category personal data of data subjects to third parties in accordance with the principles adopted for the processing of personal data.

We take great care to obtain the data subject’s consent when transferring special category personal data to third parties, and such data is transferred within the country with adequate technical and administrative safeguards in place. However, in the cases listed below, provided that adequate technical and administrative safeguards are in place,

Personal Data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data, may be processed in cases prescribed by law;
Personal Data relating to health and sexual life may only be processed by persons subject to a confidentiality obligation or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

Conditions for Transferring Personal Data Abroad

In line with its Personal Data processing purposes and by implementing the necessary security measures, the Company may transfer the Personal Data and Special Categories of Personal Data of data subjects to third parties located abroad.

Pursuant to Article 9 of the Law, the Company may transfer Personal Data to foreign countries declared by the Personal Data Protection Board (“Board”) to provide an adequate level of protection. Where an adequate level of protection is not available, Personal Data may be transferred to foreign countries provided that the data controllers in Türkiye and the relevant foreign country undertake in writing to ensure adequate protection and the Board authorises the transfer.

Conditions for Transferring Special Categories of Personal Data Abroad

The Company may transfer the Personal Data of data subjects abroad in accordance with the principles adopted for processing Personal Data.

Provided that an adequate level of protection exists in the country to which the data will be transferred, or that the data controller receiving the Personal Data provides a written undertaking to ensure adequate protection and the Board authorises the transfer, Personal Data may be transferred abroad without obtaining the data subject’s explicit consent where any of the following conditions applies:

Personal Data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data, may be transferred in cases prescribed by law;
Personal Data relating to health and sexual life may only be transferred by persons subject to a confidentiality obligation or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

6. What personal data related to communication is processed?

For the reasons specified in Article 2 of this Privacy Notice, the contents of our Company’s corporate email addresses, your contact information recorded through the website, and the IP addresses of the devices you use to access the site, as well as correspondence and communication records with Company officials, employees, call center staff, and customer relations representatives, may be backed up by the Company and/or its authorized representative(s), reported, and, where necessary, subjected to detailed reviews.

7. How long is your personal data processed?

The Personal Data you have shared with the Company through the channels mentioned in this Privacy Notice will be processed in accordance with the Personal Data Protection Law (KVKK) and other applicable legislation regarding the protection of personal data, as well as the retention periods mandated by such legislation, and in any case, as long as the legitimate purposes stated above remain valid.

8. What are your rights under the Personal Data Protection Law No. 6698?

Pursuant to Article 11 of the Personal Data Protection Law No. 6698, you have the right to:

Learn whether your Personal Data is being processed;
Request information if your Personal Data has been processed;
Learn the purpose for which your Personal Data is processed and whether it is being used in accordance with that purpose;
Know the third parties to whom your Personal Data has been transferred, whether in Türkiye or abroad;
Request the correction of your Personal Data if it has been processed incompletely or inaccurately, and request that such correction be notified to the third parties to whom your Personal Data has been transferred;
Except where otherwise required by law, request the deletion or destruction of your Personal Data under the conditions set out in Article 7 of the Law, and request that such deletion or destruction be notified to the third parties to whom your Personal Data has been transferred;
Object to any outcome that is detrimental to you and arises from the analysis of your processed Personal Data exclusively through automated systems; and
Claim compensation for damages incurred as a result of the unlawful processing of your Personal Data.

9. How do you contact the data controller?

You may exercise the rights listed above by submitting an application to the Company in writing with a wet-ink signature; through a registered electronic mail (KEP) address, secure electronic signature or mobile signature; or by using an email address that you have previously notified to the Company and that is registered in the Company’s systems.

The address for written applications is: “ÖMER AVNİ MAH. İNEBOLU SK. İŞ HANI NO: 1 A, BEYOĞLU/İSTANBUL”. Where an application is submitted by a person other than the Personal Data owner, that person must hold a special power of attorney issued by the Personal Data owner specifically authorising them to submit the application.

Duly submitted requests received by the Company will be processed free of charge within no more than thirty days. If the response exceeds ten pages, a processing fee of TRY 1 may be charged for each page exceeding ten pages. If the response is provided on a data storage medium, such as a CD or USB flash drive, the cost of the relevant storage medium may be charged.