Personal Data Protection Law

Information on the Protection of Personal Data

Türk Telekom’s (“Türk Telekom, TTNET and TT Mobil”) Clarification Text for its subscribers/customers within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”) was updated in July 2019. This text contains all details regarding;

a) The identity of data controller,

b) The purpose of processing personal data,

c) To whom and for which purpose personal data may be transferred,

d) The method and legal grounds of collection of personal data and other rights of the data subject under Article 11 of the Law.

In addition, clarification texts are designed and published for employees, visitors, etc. related person categories and different Türk Telekom sites.

Rights of the data subject in the KVKK

ARTICLE 11 – (1) Each person has the right to request to the data controller about himself/herself;

a) to learn whether his/her personal data are processed or not,

b) to request for information as to if his/her personal data have been processed,

c) to learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose,

d) to know the third parties to whom his personal data are transferred in country or abroad,

e) to demand the rectification of the incomplete or inaccurate data, if any,

f) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7 (personal data shall be erased, destructed or anonymised by the data controller, ex officio or on the request of the data subject, in the event that the reasons for the processing no longer exist.),

g) to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,

h) to object to the occurrence of a result against the person himself/herself by analysing the data processed solely through automated systems,

i) to claim compensation for the damage arising from the unlawful processing of his/her personal data.

Data processing parties on behalf of Türk Telekom

Türk Telekom has authorised dealers, which process the data of customers as a third party on behalf of itself. All dealer employees are informed on the legislation governing the protection of personal data through circulars and information guide. In addition, all dealers have updated subscriber/customer information notices located on visible areas. Detailed information texts are provided to subscribers and dealer employees about the business flows requiring express consent, customer explicit consent templates have been drawn, and all dealers are required to obtain these consents when needed.

All agreements to which Türk Telekom is a party are reviewed and revised in line with the KVKK and the secondary legislation. In addition, trainings, announcements and audits were carried particularly for business partners and dealers as a part of the administrative measure obligation to ensure the security of personal data, and will continue to be carried in line with the possible amendments in the legislation.

Liability of the Company management regarding the protection of personal data

In accordance with the KVKK, the legal entities are responsible for all liabilities arising from this law and the relevant legislation. In terms of Türk Telekom, the Türk Telekom Board of Directors /Executive Committee is responsible for the Confidentiality and Safety of Personal Data as the managing body of the data controllers.

Within this framework, the Board of Directors has decided for the establishment of upper and sub-committees consisting of Assistant General Managers and directors for the monitoring and management of Türk Telekom’s compliance process.

With the aforementioned decision, the Committees were assigned on behalf of the Company within the scope of fulfilling their obligations arising from the KVKK and in accordance with Article 11 of the Regulation on the Registry of Data Controllers (“Regulation”).

Türk Telekom General Manager/CEO has been authorised to determine and change the working principles and duties of the committees and persons to take part in the committees.

The purpose of the mentioned committees is the coordination and organisation of the activities carried out in the field of governance regarding the protection of personal data throughout the Company, monitoring and reporting the actions to ensure full compliance with their requirements, supporting the governance structure, taking and following up strategic decisions, determining resource needs, creating an agenda at the level of the Board of Directors/Executive Committee.

Upper and Sub Committee Members

ı. Upper Committee Members

1- Permanent Members

Legal and Regulation Assistant General Manager
Technology Assistant General Manager
Marketing and Customer Care Assistant General Manager (Marketing and Customer Care Director as representative)
Strategy, Planning and Digital Assistant General Manager

2- Advisory Members

Regulation Compliance Director (permanent)
Regulation Compliance Director (permanent)

II. Sub Committee Members

Regulation Compliance Director
Cyber Security Director
Legal Affairs (Corporate Law and Commercial) Director
Employee Experience and Wage Management Director
Facility Management Director
Technology Audit Vice President
Marketing Intelligence and Customer Experience Director
Product and Service Management Director
Purchasing Director
Retail Sales Operations and Control Group Manager
Digital Product and Service Development Director
IT Architecture and Quality Assurance Director
Technology Governance Group Manager
Wholesale Customer Service Director

Employee trainings related to personal data security and confidentiality

Personal data security and confidentiality trainings have been assigned online to all permanent employees of Türk Telekom, TT Mobil and TTNET, while regional class trainings were provided to the sales teams, regional employees and dealers’ employees.

The regular trainings provided address the following topics:

History and the legal basis of the EU Data Protection Regulation and Turkish legislation governing personal data protection
The Company’s main responsibilities on the issue
Personal Data Processing Inventory and VERBIS (Data Controller Registry Information System)
Rights of the data subject
Data storage periods and deletion/destruction
Penalties set forth in the applicable law and regulations
Special measures that need to be taken in the Company business processes
Actions to be taken specifically for sensitive personal data
Information security awareness

Türk Telekom has also started compliance studies within the scope of the “Regulation on the Processing of Personal Data and Protection of Privacy in the Electronic Communication Sector”, which was published by BTK on December 4, 2020 and will enter into force on June 4, 2021.