This is a courtesy translation. In the event of any discrepancy, the Turkish version prevails.
At Hector Kurumsal Yönetim Danışmanlık Hizmetleri A.Ş. (the “Company”) we take the security of your personal data seriously. This notice is provided to meet our duty to inform under Article 10 of the Personal Data Protection Law No. 6698.
Data controller
- Name: Hector Kurumsal Yönetim Danışmanlık Hizmetleri A.Ş.
- Address: Tomtom Mah. İstiklal Cad. Beyoğlu İş Merkezi No:187 İç Kapı No:152, Floor 2, 34433 Beyoğlu / Istanbul, Türkiye
- Trade registry: Istanbul Trade Registry, 422221-5
- Telephone: +90 212 936 10 33
- Email: hector@hectorkurumsal.com
Data processed, purposes and legal bases
Depending on the nature of your relationship with the Company, your personal data may be processed in the categories below, for the stated purposes and on the stated legal bases.
| Data category | Purpose of processing | Legal basis |
|---|---|---|
| Identity (name, surname, title) | Performing services and contracts; managing client relationships | Establishment or performance of a contract; legal obligation |
| Contact (email, telephone, address) | Responding to enquiries and complaints; communication activities | Establishment or performance of a contract; legitimate interest |
| Client transaction (enquiry and service details) | Providing advisory services; risk management; audit and ethics activities; retention and archiving | Performance of a contract; legal obligation; legitimate interest |
| Financial (invoice and payment details) | Finance and accounting; compliance with tax and commercial legislation | Legal obligation; performance of a contract |
| Legal transaction | Handling legal matters; providing information to authorised institutions | Legal obligation; establishment, exercise or protection of a right |
| CV and application details | Assessing human resources applications | Steps necessary to enter into a contract; explicit consent (for retention in the candidate pool) |
| Transaction security (IP address, access records) | Ensuring information security and business continuity | Legal obligation; legitimate interest |
How personal data is collected
Your personal data is collected verbally, in writing or electronically through the contact and application forms on our website, email, telephone and in-person meetings, contracts, and documents you provide during the course of our services.
Transfer of personal data
In line with the principle of proportionality, and only for the stated purposes, your personal data may be transferred to authorised public bodies, accountants, auditors and legal advisors, banks, IT and hosting service providers and, where the service requires, business partners. Any transfer abroad is made only in accordance with Article 9 of the Law.
Retention period
Your personal data is kept for the period required by applicable legislation or by the purpose of processing. After that period it is deleted, destroyed or anonymised.
Your rights as a data subject
Under Article 11 of the Personal Data Protection Law No. 6698 (the “Law”), you may apply to the Company to exercise the following rights:
- To learn whether your personal data is being processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether it is used in accordance with that purpose,
- To know the third parties to whom your data is transferred, in Türkiye or abroad,
- To request correction if the data is incomplete or inaccurate,
- To request erasure or destruction under the conditions set out in the Law,
- To request that correction, erasure and destruction be notified to the third parties to whom your data has been transferred,
- To object to an outcome against you that results from analysis of your data exclusively by automated systems,
- To claim compensation for damage arising from unlawful processing.
The method and timing of applications are described in the “Procedure for Applications to the Data Controller”.
We reserve the right to amend this notice in line with regulations issued by the Personal Data Protection Authority.