1. Introduction
The protection of personal data is among the top priorities of RG İnternet Reklam ve Bilişim Teknolojileri Ltd. Şti. (the "Company" or "RG Labs"), and the utmost effort is made to comply with all applicable legislation in this regard. This Personal Data Protection and Processing Policy (the "Policy") sets out the principles adopted in carrying out the personal data processing activities performed by our Company and the fundamental principles adopted to ensure that our Company’s data processing activities comply with the provisions of Law No. 6698 on the Protection of Personal Data (the "Law"), and in this way our Company informs data subjects and provides the necessary transparency.
Fully aware of our responsibility in this regard, personal data is processed within the scope of this Policy.
Data Controller: RG İnternet Reklam ve Bilişim Teknolojileri Ltd. Şti.
Tax ID: 0110043048
Address: Küçükbakkalköy, Selvili Sok. No:4/79, 34750 Ataşehir/Istanbul
2. Purpose
RG Labs undertakes to comply with the provisions of the Constitution of the Republic of Turkey, Law No. 6698 on the Protection of Personal Data (KVKK) and related legislation on the protection of personal data, and to protect the rights of data subjects.
In this context, our company has adopted a written personal data protection policy in order to ensure the security of the personal data processed concerning employees, interns, job applicants, representatives and employees of legal entities that are customers or potential customers of the company, representatives and employees of external service providers, website or digital platform users, event and training participants and supplier contact persons, and to ensure that such data is processed in compliance with the legislation.
The objectives of this policy are: to turn KVKK compliance into a system under a corporate umbrella, to ensure accountability in data processing processes, to record and audit personal data processing activities, to keep data sharing processes with third parties under control, to increase employee awareness and provide training, to process personal data in accordance with the law and the rules of good faith, to ensure transparency, to implement data security controls suited to the company’s own processes, and to fulfill obligations regarding the protection of personal data.
3. Scope
This policy applies to personal data that RG Labs processes in its own internal processes. The policy covers personal data processing activities concerning employees, job applicants, interns, representatives and employees of legal entities that are customers or potential customers of the company, representatives and employees of external service providers, website or digital platform users, event and training participants, supplier employees, and operational data processed to a limited extent within the scope of the company’s activities.
Since the personal data belonging to the customers of legal or natural persons who are customers of the company is not processed or stored in RG Labs systems, this policy does not cover such customer data.
The provisions of the Policy cover all units and employees within RG Labs and all internal stakeholders involved in personal data processing processes under KVKK.
Third parties with whom the company cooperates while providing its services are independent data controllers for their own personal data processing activities, and this policy governs only RG Labs' own processing activities.
4. Objective
This policy aims to raise awareness within RG Labs of processing and protecting personal data in compliance with the legislation, to operate data security processes in a sustainable structure, and to make KVKK compliance a standard within the company.
In this context, the PDP Policy provides a guiding framework for implementing the obligations set out in KVKK and related legislation, and supports the implementation of administrative and technical controls suited to the company’s own data processing activities.
5. Definitions and Abbreviations
| Term | Definition |
|---|---|
| Company | RG İnternet Reklam ve Bilişim Teknolojileri Ltd. Şti. |
| Explicit Consent | Consent relating to a specific matter, based on information and given freely. |
| Anonymization | Altering personal data in such a way that it loses its character as personal data and this cannot be reversed. |
| Data Subject | The natural person whose personal data is processed. E.g.: employees, job candidates, supplier contact persons. |
| Personal Data | Any information relating to an identified or identifiable natural person. E.g.: name and surname, Turkish ID number, email, address, date of birth, etc. |
| Special Categories of Personal Data | Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. |
| Processing of Personal Data | Any operation performed on personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automatic means or by non-automatic means provided that they form part of a data recording system. |
| Data Controller | The natural or legal person who determines the purposes and means of processing personal data and manages the place where the data is kept systematically. |
| KVKK | Law No. 6698 on the Protection of Personal Data dated March 24, 2016, published in Official Gazette No. 29677 dated April 7, 2016. |
| Policy | The Company’s Personal Data Protection and Processing Policy. |
| Periodic Destruction | The deletion, destruction or anonymization process to be carried out at recurring intervals when all of the conditions for processing personal data set out in the Law cease to exist. |
| KEP | The Registered Electronic Mail system, which preserves all your commercial and legal correspondence and document exchanges exactly as sent and conclusively identifies the recipient. |
| KVKK Committee | The committee established within the Company to coordinate KVKK processes and continuously monitor compliance with the legislation. |
6. Classification of Personal Data Processed
Personal data means any information relating to an identified or identifiable natural person. The protection of personal data concerns natural persons only; information belonging to legal entities that contains no information about a natural person is outside the scope of personal data protection.
| Personal Data Categories | Subcategories and Descriptions |
|---|---|
| Identity | Documents containing information such as name and surname, Turkish ID number, nationality, mother’s and father’s names, place of birth, date of birth and gender, as well as tax number, social security (SGK) number, signature information, etc. |
| Contact | Phone number, address, email address, fax number, etc. |
| Personnel File | Payroll information, disciplinary investigations, employment start and termination records, resume information, performance evaluation reports, etc. |
| Legal Transactions | Correspondence with judicial authorities, information in case files, etc. |
| Customer Transactions | Invoice, promissory note and check information, request information, order information, etc. |
| Physical Premises Security | Employees' entry and exit records at the company office, camera (video and audio) recordings, etc. |
| Transaction Security | Website login and logout information, IP address information, password and passcode information, etc. |
| Professional Experience | Diploma information, courses attended, in-service training information, transcript information, certificates, etc. |
| Visual and Audio Recordings | Video and audio recordings captured by in-office cameras. |
| Special Categories of Personal Data | Data specified in Article 6 of the KVKK (for example, health data including blood type, biometric data, etc.). |
In its business processes, RG Labs processes special categories of data only where required, and only those relating to employees that the legislation makes mandatory; no special category data of customers or third parties is processed.
7. Environments Where Personal Data Is Kept
| Electronic Media | Non-Electronic Media |
|---|---|
| Servers (domain, backup, email, database, web, file sharing, etc.), software, information security devices, personal computers, mobile devices | Printers, scanners, photocopiers, paper, written/printed/visual media, unit cabinets |
8. Purposes of Processing Personal Data
The Company processes personal data only to the extent necessary to carry out its business activities and limited to the following purposes:
8.1. Conducting Employment Relationship Processes
- Evaluating job candidates and conducting recruitment processes
- Creating employee personnel files and carrying out salary, fringe benefit and payroll transactions
- Conducting employee performance and competency evaluation processes
8.2. Ensuring Occupational Health and Safety and Workplace Order
- Keeping occupational health and safety (OHS) records within the scope of legal obligations
- Ensuring the security of company offices and operating camera systems
- Controlling access to office areas
8.3. Conducting Administrative, Financial and Operational Processes
- Conducting accounting and finance transactions
- Conducting contract and supplier management processes
- Conducting invoicing, purchasing, expense and payment processes
- Conducting internal audit, reporting and control activities
8.4. Operating Information Security and Technology Infrastructure
- Managing and logging system access
- Implementing cybersecurity processes and operational security controls
- Conducting data backup, loss/breach prevention and access authorization processes
8.5. Fulfilling Legal Obligations
- Providing information to authorized public institutions and organizations within the scope of the legislation
- Meeting obligations arising from audits, investigations and official correspondence
- Conducting judicial processes such as lawsuits and enforcement proceedings
8.6. Ensuring Corporate Communication and Internal Coordination
- Conducting internal communication with employees
- Carrying out training, announcement and information processes
- Conducting events, orientation and employee support activities
9. Matters Concerning the Protection of Personal Data
9.1. Ensuring the Security of Personal Data
The Company takes the necessary technical and administrative measures under Article 12 of the KVKK to prevent unlawful processing of personal data, unauthorized access, disclosure or the emergence of security vulnerabilities.
Within this scope, access permissions are restricted, user accounts are managed, network and system security controls, recording and logging mechanisms, and secure storage and destruction processes are applied; personal data can be accessed only by employees authorized as required by their duties.
In all processes where personal data is processed, information is provided to raise employees' data security awareness, and employees are obliged to protect the confidentiality of the personal data they access in the course of their duties and not to share such data with unauthorized persons or parties.
9.2. Protection of Special Categories of Personal Data
RG Labs processes special categories of personal data only in cases relating to employees where the legislation makes it mandatory. Special category data processed within this scope consists of limited records such as health data required to fulfill occupational health and safety obligations or under social security (SGK) legislation.
With respect to this limited special category personal data, our Company takes the necessary technical and administrative measures in accordance with Article 6 of the KVKK, restricts access to such data to authorized persons only, and ensures that such data is stored securely.
9.3. Raising Awareness and Supervision of Business Units
The Company aims to raise employees' awareness of their obligations regarding the protection of personal data and provides the necessary information within this scope. Newly hired employees receive basic KVKK and data security awareness training; in addition, employees are informed on the subject whenever needed in business processes.
9.4. Raising Awareness of Business Partners and Suppliers
To ensure that obligations regarding the protection of personal data are also fulfilled by suppliers and business partners, the Company includes provisions on confidentiality and the protection of personal data in its contracts with such parties.
10. Matters Concerning the Processing of Personal Data
The Company attaches importance to acting in accordance with the general principles set out in the legislation when processing personal data. Accordingly, it acts in line with the following principles in accordance with the Constitution and the KVK Law.
10.1. Processing Personal Data in Accordance with the Principles Set Out in the Legislation
10.1.1. Compliance with the Law and the Principle of Good Faith
In accordance with Article 4 of the KVK Law, the Company carries out personal data processing activities in compliance with the law and the principle of good faith; accurately and, where necessary, kept up to date; for specific, explicit and legitimate purposes; and in a manner that is relevant, limited and proportionate to those purposes.
10.1.2. Being Accurate and, Where Necessary, Up to Date
To ensure that processed data is accurate and up to date, the necessary measures are taken in data processing procedures, and data subjects are given the opportunity to apply to update their data and to have any errors in their processed data corrected.
10.1.3. Processing for Specific, Explicit and Legitimate Purposes
Personal data is processed in a manner that is relevant, limited and proportionate to clearly and explicitly defined purposes. Processing of personal data that is irrelevant or not needed is avoided.
10.1.4. Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed
Personal data is processed in a manner that is relevant, limited and proportionate to clearly and explicitly defined purposes. Unless legally required, special categories of personal data are not processed; where they are processed, this is done only under the conditions set out in the relevant legislation and with the necessary technical/administrative measures in place.
10.1.5. Retention for the Period Stipulated in the Relevant Legislation
The Company retains the personal data it processes only for the period stipulated in the relevant legislation and laws or required by the purpose of processing. At the end of the specified retention periods, personal data is destroyed in accordance with the periodic destruction intervals or upon the data subject’s application, using the specified destruction methods (deletion and/or destruction and/or anonymization).
10.2. Conditions for Processing Personal Data
Apart from the explicit consent of the data subject, one or more of the following conditions may serve as the basis for personal data processing activities:
- It is expressly provided for by law
- The explicit consent of the data subject cannot be obtained due to actual impossibility
- It is directly related to the establishment or performance of a contract
- It is necessary for the data controller to fulfill its legal obligation
- The data subject has made their personal data public
- Data processing is mandatory for the establishment or protection of a right
- Data processing is mandatory for the legitimate interests of the data controller
10.3. Processing of Special Categories of Personal Data
The Company exercises particular care in processing special categories of personal data. Special categories of personal data other than health and sexual life may be processed without the data subject’s explicit consent where expressly provided for by law. Special categories of personal data relating to health and sexual life may be processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, and carrying out treatment and care services, by persons under an obligation of confidentiality or by authorized institutions and organizations.
10.4. Informing the Data Subject
The Company informs data subjects in accordance with Article 10 of the Law and secondary legislation. Within this scope, the Company informs data subjects of who processes the personal data as data controller, for which purposes it is processed, with whom and for which purposes it is shared, by which methods it is collected, its legal basis, and the rights of data subjects.
10.5. Transfer of Personal Data
With regard to the transfer of personal data, the Company acts in accordance with the KVKK and the decisions and regulations issued by the KVK Board. Personal data processed by the Company may be transferred only where required by the legislation and limited to the purpose of processing, to the relevant official institutions and organizations or to parties acting as data processors from which services are obtained under a contractual relationship.
Where personal data is transferred, the data subjects are informed about the data processing and transfer processes within the scope of the privacy notice.
11. Retention and Destruction of Personal Data
Our Company retains personal data for the period necessary for the purpose for which it is processed and in accordance with the minimum periods stipulated in the legislation applicable to the relevant activity. If no legal period exists, personal data is retained for the period necessary for the purpose for which it is processed. At the end of the specified retention periods, personal data is destroyed in accordance with the periodic destruction intervals or upon the data subject’s application, using the specified destruction methods (deletion and/or destruction and/or anonymization).
12. Rights of Data Subjects and Exercise of These Rights
12.1. Rights of the Data Subject
The data subject has the following rights regarding their personal data:
- To learn whether their personal data is being processed
- To request information if their personal data has been processed
- To learn the purpose of processing their personal data and whether it is used in accordance with that purpose
- To know the third parties, in Turkey or abroad, to whom their personal data is transferred
- To request the correction of personal data if it has been processed incompletely or inaccurately
- To request the deletion or destruction of personal data if the reasons requiring its processing no longer exist
- To request that the correction, deletion or destruction operations be notified to third parties to whom the personal data has been transferred
- To object to a result to their detriment arising from the analysis of the processed data exclusively by automated systems
- To claim compensation for damages if they suffer damage due to unlawful processing of their personal data
12.2. Exercising Rights
Data subjects may exercise the rights listed above by submitting the data subject application form available at www.rglabs.io.
12.3. Our Company’s Response to Applications
If the data subject duly submits a request regarding their rights to our Company, our Company will conclude the request free of charge as soon as possible, depending on the nature of the request, and within 30 (thirty) days at the latest. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff set by the Board.
12.4. Cases in Which the Data Subject Cannot Assert Their Rights
Pursuant to Article 28/2 of the KVKK, data subjects cannot exercise their rights in the following cases, except for the right to claim compensation for damages:
- Personal data processing is necessary for the prevention of a crime or for a criminal investigation
- Processing of personal data made public by the data subject themselves
- Personal data processing is necessary for the performance of supervisory or regulatory duties by authorized public institutions and organizations based on the authority granted by law
- Personal data processing is necessary for the protection of the State’s economic and financial interests regarding budget, tax and financial matters
13. Special Cases in Which Personal Data Is Processed
13.1. Camera Surveillance Activities
Camera recordings of the entrances and common areas of the building housing the RG Labs offices are kept by the building management, and no recordings relating to these areas are processed by RG Labs.
There is a camera system installed by the company in the RG Labs office areas, and this system records video and audio for security purposes only. Access to these recordings is granted to a limited number of authorized personnel, the recordings are stored in secure environments and managed in accordance with the KVKK and related legislation.
13.2. Tracking Visitor Entries and Exits
For security purposes, personal data is processed to track visitor entries and exits in company buildings. Data obtained to track visitor entries and exits is processed solely for this purpose, and the relevant personal data is recorded in a physical data recording system.
13.3. Website Visitors
Cookie records are used to improve the functioning and usage of the company’s official website. Certain cookies are used to remember preferences made on the website, providing users with an improved and personalized experience. For detailed information on the cookies used on the website, see the Cookie Privacy Notice on the official website.
14. Obligations Regarding Personal Data Processing Activities
14.1. Obligation to Register with the Data Controllers Registry and Notify
In accordance with Article 16 of the KVK Law and the procedures and principles of the Regulation on the Data Controllers Registry, our Company is obliged to register with the Data Controllers Registry (VERBIS), and this obligation has been fulfilled by our Company.
14.2. Obligation to Inform the Data Subject
When collecting personal data, the Company explicitly informs data subjects in accordance with Article 10 of the KVKK. The privacy notices include the company’s title, full address and contact information, the categories of personal data, the purposes for which the personal data will be processed, to whom and for which purposes the processed personal data may be transferred, the method and legal basis of data collection, and the rights of the data subject listed in Article 11 of the KVKK.
14.3. Obligation to Ensure the Security of Personal Data
In accordance with Article 12 of the KVK Law, the Company takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data and ensure the safekeeping of personal data.
14.3.1. Administrative Measures
- Privacy notices have been prepared
- Disciplinary regulations containing data security provisions are in place for employees
- Training and awareness activities on data security are carried out for employees at regular intervals
- Confidentiality undertakings are signed
- Signed contracts contain data security provisions
- A personal data processing inventory has been prepared
- A Personal Data Protection Committee has been established
- Personal data security policies and procedures have been defined
- Protocols and procedures for the security of special categories of personal data have been defined and are being implemented
14.3.2. Technical Measures
- Network security and application security are ensured
- A permission matrix has been created for employees
- Access logs are kept regularly
- Corporate policies on access, information security, use, retention and destruction have been prepared
- Permissions of employees who change roles or leave the company are revoked
- Up-to-date antivirus systems are used
- Personal data is backed up and the security of backed-up personal data is ensured
- Log records are kept in a way that prevents user intervention
- Periodic and/or random internal audits are performed
14.4. Obligation to Comply with KVK Board Decisions
The Company acts in accordance with the decisions issued by the KVK Board, the executive body of the Personal Data Protection Authority (KVK Authority).
14.5. Obligation to Respond to Data Subject Applications
As data controller, pursuant to Article 13 of the KVK Law, the Company concludes data subjects' requests regarding their personal data as soon as possible, depending on the nature of the request, and within thirty (30) days at the latest.
14.6. Obligation to Delete, Destroy and Anonymize Personal Data
If all of the conditions for processing personal data set out in Articles 5 and 6 of the KVKK cease to exist, the personal data must be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the data subject.
15. Implementation of the Policy and Related Legislation
The relevant legal regulations in force on the processing and protection of personal data shall apply first. In the event of any inconsistency between the legislation in force and the Policy, our Company accepts and undertakes that the legislation in force shall apply.
16. Entry into Force of the Policy
This Policy enters into force on 01.07.2025.
This Policy is published on the Company’s website and made available to data subjects upon their request.