Cookie Disclosure Text

1. PURPOSE AND SCOPE

This Cookie Disclosure Text aims to set forth the procedures and principles regarding the general definitions of cookie data relating to visitors on the website of GÜVEN HOLDİNG A.Ş. (hereinafter “Güven Holding”), the identification of their types, and the processing and management of cookie data by taking into account the regulations contained in the “GUIDE ON COOKIE PRACTICES” published by the Board and the Law on the Protection of Personal Data No. 6698.

This disclosure text covers the processing of personal data through cookies; cookies that are not used in the processing of personal data fall outside its scope. It shall be valid for desktop and mobile websites or web applications within the body of Güven Holding.

We may update this disclosure text when necessary; therefore, please ensure that you access the current disclosure text on the date you use our web and mobile services.

2. DEFINITION OF COOKIES

A cookie is a type of text file placed on a user’s device by website operators and transmitted as part of an HTTP(S)3 (Hyper Text Transfer Protocol) request; when a web page is visited, it is a low-size rich-text formatted text file that allows certain information regarding users to be stored on users’ terminal devices.

3. TYPES OF COOKIES

Cookies are categorized according to their durations, purposes of use, and parties. The cookie types and their descriptions are as follows.

3.1. Cookies by Duration

Session Cookies

Also referred to as temporary cookies, a session cookie is used to ensure the continuity of the session. When the user closes the internet browser, session cookies are also deleted.

Persistent Cookies

When the internet browser is closed, a persistent cookie that is not deleted is automatically removed on a specific date or after a certain period. Through this cookie, each time a user visits a website, the processed data of the user are transmitted to the server. Therefore, persistent cookies are sometimes also referred to as tracking cookies. For example, advertisers may record and use information regarding a user’s web browsing habits over a long period. They may also be used to ensure that users do not have to re-enter their login information each time they log into their accounts on websites.

3.2. Cookies by Purpose of Use

Strictly Necessary Cookies (Mandatory Cookies)

These cookies are necessary for the operation of the website. Such cookies are mandatorily used to perform an information society service (such as logging in, filling out forms, remembering privacy preferences) requested by the user.

Cookies used for the purposes covered under Criteria A and B discussed in Article 5 of this disclosure text can be presented as examples of strictly necessary cookies. In general, they can be considered among the types of cookies for which processing is carried out based on legal grounds other than explicit consent. If mandatory cookies are blocked, some parts of the website will not function, and these cookies are not used for marketing purposes.

Functional Cookies

These are cookies used for personalization and remembering preferences on websites or applications (including applications on desktop, mobile, or IoT devices). These cookies are used to provide functionalities other than strictly necessary cookies. In cases where it is not evident that the data subject explicitly requests an information society service, reliance on explicit consent will be required.

Performance–Analytical Cookies

These are cookies that enable statistical measurement to analyze users’ behaviors on websites. These cookies are frequently used to improve the site and include measuring the impact of advertisements on data subjects. They are used by website owners to estimate the number of unique visitors, determine the most important search engine keywords leading to a web page, or monitor navigation on the website.

Advertising/Marketing Cookies

With cookies for advertising and marketing purposes, users’ online activities are tracked in the internet environment to determine personal areas of interest and to display advertisements to users in the internet environment tailored to these interests. Although there are many types of advertisements on the internet, the main reason why online behavioral advertising is the most preferred type is that advertising can be done according to individuals’ tendencies and preferences, and time and financial resources can be used more efficiently from the advertiser’s perspective. Online behavioral advertising practices consist of the stages of monitoring individuals’ activities on the internet, analyzing these activities to create profiling, matching the profiled person with appropriate advertisements, and showing the relevant advertisements to the relevant person.

3.3. Cookies by Party

Whether a cookie is first-party or third-party varies according to the website or domain that places the cookie.

First-party cookies are placed directly by the website that the user visits, i.e., the URL shown in the browser’s address bar (guvenholding.com).

Third-party cookies are placed by a third party different from the website (or domain) visited by the user.

4. Conditions for Processing Personal Data in Terms of Cookies

Güven Holding takes into account the presence of “explicit consent” or, as a result of “the assessment to be made by the data controller specifically regarding the personal data processing activity through cookies,” other data processing conditions set forth in Articles 5 and/or 6 of the Law.

Within the scope of applying the processing conditions in Articles 5 and/or 6, if the processing of personal data is based on one of the conditions other than explicit consent set out in the Law, then there is no need to obtain explicit consent from the data subject. Güven Holding primarily evaluates whether the purpose of the personal data processing activity is based on one of the other processing conditions in the Law apart from explicit consent; if this purpose does not meet any of the conditions other than explicit consent set out in the Law, then the data processing activity will be based on the explicit consent of the data subject.

For cookies used on our website other than mandatory cookies, users’ explicit consents are obtained, and they are provided with the opportunity to change their consents at any time. Through the cookie management panel, users can see the types of cookies used on our website and can set their preferences with “on” or “off” options for all cookies other than Mandatory Cookies. Again, through this panel, if you do not approve the use of cookies, we kindly ask you to save your preferences according to the cookie preferences on the website or to change your cookie preferences from your browser. We would like to remind you that if cookies are not allowed, some features of the website may lose functionality.

Mandatory cookies are processed based on the legal ground set out in Article 5/2 of the Law on the Protection of Personal Data (KVKK), namely, “Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller,” and on the processing ground that “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.”

4.1. Cookie Use Based on the Condition of Explicit Consent

Considering example cookie usage scenarios that do not fall within the scope of the mandatory cookies explained above:

Social Plug-in Tracking Cookies

Many social networks offer social plug-in modules that website owners can integrate into their websites to provide certain services that can be deemed “explicitly requested” by their members. However, these modules can be used, with the help of third-party cookies, to track both members and non-members for additional purposes such as behavioral advertising, analytics, or market research. For such purposes, since these cookies cannot be considered “strictly necessary” to provide a functionality explicitly requested by the user, such tracking cookies do not fall within the scope of mandatory cookies. In the absence of explicit consent, it is unlikely that there is any legal basis for social networks to collect data through social plug-ins about those who are not members of their networks. By default, social plug-ins do not place third-party cookies on pages shown to non-members.

Online Behavioral Advertising Cookies

Cookies used for behavioral advertising require explicit consent. In this case, the requirement for explicit consent covers the relevant cookies used for advertising purposes, including those used for impression frequency, financial record-keeping, ad partnerships, detecting click fraud, research and market analysis, product development, and debugging; as it is clear that none of these purposes is a service or functionality within the scope of information society services explicitly requested by the user as required by mandatory cookies.

4.2. Use of Cookies Within Processing Conditions Other Than Explicit Consent

Güven Holding explains below the purposes of use of example cookies that may rely on other personal data processing conditions than explicit consent within the scope of usage scenarios.

Load Balancing Session Cookies (Criterion A)

Load balancing is a technique that allows web server requests to be distributed across a pool of machines rather than a single machine. Accordingly, web requests from users are directed to a load-balancing gateway, and the request is forwarded to the available internal servers in the pool. In this case, the said redirection needs to remain persistent throughout the session; all requests from a specific user are always directed to the same server in the pool to ensure the consistency of the process. These are session cookies, and the sole purpose of the information held in this cookie is to identify the communication endpoints (one of the servers in the pools). The cookie is necessary for the communication over the network and does not require explicit consent within the scope of Criterion A.

Cookies Used for the Security of the Website (Criterion B)

Since a website’s inability to provide service due to a security vulnerability, being taken out of service, or the user’s inability to access the service requested would occur, cookies used for the security of the website are considered strictly necessary for the service requested by the user. For example, a cookie used by a web application firewall to identify the user and limit the number of user requests per session can be considered strictly necessary for the security of the site and the user’s accessibility to the service, and therefore strictly necessary for a service requested by the user within the scope of Criterion B. For the use of cookies serving this purpose, Güven Holding may rely on other processing conditions than explicit consent, for example the processing condition that “Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller.”

5. WHICH COOKIES DO WE USE

Mandatory Cookies

They are mandatorily used to ensure the proper functioning of our website and to perform an information society service that you have requested. These cookies are processed on the basis of the processing condition set out in subparagraph (f) of the second paragraph of Article 5 of the Law on the Protection of Personal Data No. 6698, namely “Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller.”

Analytical Cookies

If you give explicit consent, with Analytical Cookies it is aimed to analyze visitor session data to improve our website and to monitor its usage statistics.

6. COOKIE WALLS

Cookie walls are practices that prevent a visitor from viewing the content of a website unless they consent to the use of all cookies on the website. Güven Holding avoids the use of cookie walls that are unlawful and that hinder the legal conditions of explicit consent.

7. RESPONSIBILITY OF THE PARTIES

In cases where third-party cookies are placed on the website, both Güven Holding as the data controller and the third party are obliged to ensure that users are clearly informed about cookies and that their consents are obtained.

8. TRANSFER OF PERSONAL DATA

Your personal data may be transferred to domestic and foreign suppliers from whom services are obtained for ensuring commercial security, the secure storage of your personal data, and the provision of electronic or physical data storage, backup services, or systems, in accordance with the data transfer conditions set out in Article 8 of the Law on the Protection of Personal Data No. 6698.

Additionally, you may access information regarding the management of cookies in commonly used browsers via the following links:

• Enabling or disabling cookies in Google Chrome

• Google Analytics Opt-out Browser Add-on

• Deleting cookies in Mozilla Firefox to remove information stored by websites on your computer

• Deleting cookies in Safari on Mac

• Deleting your Safari history, cache, and cookies on iPhone

• Opera Web Settings

• Managing cookies in Microsoft Edge: viewing, allowing, blocking, deleting, and using

• Facebook Privacy Policy

9. OUR INFORMATION AND CONTACT

By applying to Güven Holding in your capacity as a data subject, you have the right to:

• Learn whether your personal data are processed,

• Request information if your personal data have been processed,

• Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

• Know the third parties to whom your personal data are transferred domestically or abroad,

• Request the correction of your personal data if they are incompletely or incorrectly processed and request that the transactions carried out in this context be notified to the third parties to whom your personal data are transferred,

• Request the deletion or destruction of your personal data in the event that the reasons requiring their processing cease to exist, even though they have been processed in accordance with the Law No. 6698 and other relevant laws, and request that the transactions carried out in this context be notified to the third parties to whom your personal data are transferred,

• Object to the emergence of a result to your detriment by analyzing your processed data exclusively through automated systems,

• Request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

If you submit your requests regarding your rights listed above to Güven Holding in accordance with the application procedures set forth in the Communiqué on the Principles and Procedures of Application to the Data Controller, we will conclude your request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, Güven Holding may charge the fee in the tariff determined by the Personal Data Protection Board.

GÜVEN HOLDİNG A.Ş.

Address: Mutlukent Mah. Gökırmak Sok. No:24 Çankaya / ANKARA
Phone: +90 312 440 25 40
E-mail: [email protected]
KEP Address: [email protected]