This Framework Agreement on the Protection of Personal Data (KVKK Framework Agreement) has been drawn up between the COMPANY and the CUSTOMER, as an addition to the agreement(s) dated …………. signed between ALGA MÜMESSİLLİK VE FOREIGN TRADE INC. (Hereinafter referred to as the “COMPANY”) and ……………………………………… (Hereinafter referred to as the “CUSTOMER”) and also as an annex and part of any agreements that may be signed hereinafter (Agreement). The COMPANY and the CUSTOMER will hereinafter be referred to collectively as the “Parties” and individually as a “Party”.
Article 1. Subject
This agreement sets forth the parties' obligations regarding personal data, in accordance with Personal Data Protection Law No. 6698 (KVKK), relevant legislation, and the decisions of the Personal Data Protection Board. This agreement also applies to all agreements between the parties that have entered into force and/or will enter into force, as well as all matters related to obligations arising from and/or that may arise under the KVKK and other legislation currently in force and/or that may come into force regarding the protection of personal data.
The COMPANY acknowledges that it may have the title of both Data Controller and Data Processor within the scope of the matters specified below and that the provisions within the scope of this KVKK Framework Agreement will be applied depending on whether it acts as Data Controller and/or Data Processor during the execution of its activities.
CUSTOMER also acknowledges that it may have the title of both Data Controller and Data Processor within the scope of the matters specified below and that the provisions within the scope of this KVKK Framework Agreement may be applied depending on whether it acts as Data Controller and/or Data Processor during the execution of its activities.
Article 2. Rights and Obligations of the Parties Regarding the Personal Data Protection Law No. 6698
1. The parties are obligated to use any data shared with them, defined as Personal Data and Special Personal Data (collectively, "Personal Data") under the KVKK and other relevant laws, solely and solely within the scope of the performance of the Agreement. The parties may not transfer this data to third parties or institutions for any other purpose without each other's written consent, or use it in any other contractual relationship or other commercial or non-commercial activity. The party receiving the data is solely responsible for ensuring the confidentiality and protection of this information, and preventing unauthorized transfer. In particular, the parties may not use, process, distribute, transfer to third parties or institutions or abroad, or process in any other way, any Personal Data obtained as a result of their work in connection with the Agreement, and all documents, tools, and equipment related to this data, for purposes other than those intended.
2. The parties are obligated to take all measures regulated in the KVKK regarding the protection of Personal Data they have learned during the execution of this KVKK Framework Agreement, to ensure its confidentiality, to act in accordance with the principles of confidentiality, to prevent the use of this information by unauthorized persons, to fully and without exception fulfill the requests for destruction, deletion, destruction, and anonymization given by the data controller, and to take all physical and technical measures to protect against any misuse. This obligation of the parties shall continue until the end of the destruction period for the obtained data, even in the event of termination of this protocol.
3. Except for the exceptions listed in the Personal Data Protection Law, the CUSTOMER is obligated to take all technical and administrative measures to ensure the level of security at the standards that may be set forth in the decisions of the Personal Data Protection Board or the regulations and other legal regulations to be issued based on the Personal Data Protection Law in order to prevent the unlawful processing of Personal Data obtained from the COMPANY, to prevent unlawful access to Personal Data, and to ensure the preservation of Personal Data. All legal, administrative, and criminal liability that may arise from the violation of this provision shall be borne by the CUSTOMER, and the CUSTOMER shall also be liable for compensation for any damages arising from the violation of these provisions.
4. If the COMPANY is subject to an administrative fine or has to pay compensation to third parties as a result of the CUSTOMER’s violation of these provisions, the amount of this administrative fine and/or compensation and its ancillary actions will be recoursed to the CUSTOMER by the COMPANY.
5. The CUSTOMER is obliged to carry out or have carried out the necessary audits within the scope of the KVKK in order to ensure the implementation of the KVKK provisions within its own organization, its affiliates and the suppliers with whom it shares personal data.
6. The CUSTOMER agrees, declares, and undertakes to immediately notify the COMPANY through a secure means in the event that the Personal Data shared with the COMPANY is obtained by others through illegal means and/or if an issue arises that prevents the processing of the Personal Data. Otherwise, the CUSTOMER will be liable for any direct or indirect damages that the COMPANY may suffer.
7. The CUSTOMER is obliged to take all kinds of security measures to ensure that the Personal Data shared with it is preserved and not disclosed, without prejudice to the exceptions in the KVKK, to inform and train its employees, and to make and maintain the necessary legal arrangements to ensure the fulfillment of the obligations under the KVKK.
8. The CUSTOMER accepts and declares that, following the elimination of the reasons requiring the processing of Personal Data obtained within the scope of the execution of the Agreement, it will delete, destroy or anonymize the existing personal data within the legal periods specified in the law, unless otherwise stated in the law, and will notify this matter to the COMPANY in writing.
Within the scope of the above provisions, this Protocol has been signed on ..../..../2019 in addition to the contract dated …./…./20…. and in cases where there is no provision in this additional protocol, the provisions of the Contract shall apply.
COMPANY
ALGA MÜMESSİLLİK VE DIŞ TİC. A.Ş.
|
VENDOR/CUSTOMER
………………………………..
|
