CORPORATE PERSONAL DATA PROTECTION POLICY
Article 1 — Purpose
The purpose of this Policy is to establish the fundamental principles, rules, organisational structure, allocation of duties and protection mechanisms governing the conduct of personal data processing activities by Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi in compliance with Personal Data Protection Law No. 6698 and the applicable legislation.
This Policy establishes the corporate framework for the lawful processing, retention and protection of personal data processed within Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi and, where necessary, the erasure, destruction or anonymisation of such data.
This Policy also aims to support the effective exercise of data subjects’ rights in relation to their personal data and to foster a sustainable data protection culture within the Company.
Article 2 — Scope
This Policy covers all personal data processing activities carried out by Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi in its capacity as a data controller.
The Policy applies to the personal data of employees, job applicants, former employees, members, customers, prospective customers, suppliers, suppliers’ employees and representatives, website users, persons interacting with authorised public institutions and organisations, and other natural persons associated with Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi.
This Policy covers the processing of personal data wholly or partly by automated means, or by non-automated means provided that such processing forms part of a data filing system.
Article 3 — Legal Basis
This Policy has been prepared on the basis of Personal Data Protection Law No. 6698, the relevant secondary legislation, decisions of the Board and other applicable legislation concerning the protection of personal data.
Where a conflict arises between the provisions of the legislation in force and this Policy in the course of personal data processing activities, the Company shall give precedence to mandatory statutory provisions.
Article 4 — Definitions
The following terms used in this Policy shall have the meanings set out below:
Explicit Consent: Consent relating to a specific matter, based on information and freely given.
Anonymisation: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching such data with other data.
Data Subject: The natural person whose personal data are processed.
Law / KVKK: Personal Data Protection Law No. 6698.
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, disclosing, transferring, classifying or preventing the use of such data.
Board: The Personal Data Protection Board.
Authority: The Personal Data Protection Authority.
Special Categories of Personal Data: Personal data designated as special categories under the Law.
Data Processor: A natural or legal person that processes personal data on behalf of the data controller, based on the authority granted by the data controller.
Data Filing System: A filing system in which personal data are processed by being structured according to specific criteria.
Data Controller: A natural or legal person that determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.
Data Controller Representative / Contact Person: A person responsible for notification and communication processes before the Authority, where required under the legislation.
Article 5 — Corporate Principles
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall comply with the following fundamental principles when processing personal data:
Personal data shall be processed lawfully and fairly.
Reasonable measures shall be taken to ensure that personal data are accurate and, where necessary, up to date.
Personal data shall be processed for specified, explicit and legitimate purposes.
Personal data shall be relevant to, limited to and proportionate to the purposes for which they are processed; the processing of excessive data shall be avoided.
Personal data shall be retained for the period prescribed by the applicable legislation or required for the purpose of processing.
The principles of accountability, transparency, data minimisation and security shall be observed in personal data processing activities.
Article 6 — Conditions for Processing Personal Data
As a general rule, Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall process personal data with the explicit consent of the data subject.
However, personal data may also be processed without explicit consent in the circumstances prescribed by the Law. In such cases, the Company shall identify and document the appropriate legal basis for each processing activity.
In conducting personal data processing activities, the necessity of obtaining explicit consent for the relevant operation shall be assessed on a case-by-case basis. Where reliance on explicit consent is not mandatory, explicit consent shall not be conflated with other legal bases.
For processing activities based on explicit consent, explicit consent texts shall be prepared separately from the fulfilment of the obligation to inform.
Article 7 — Processing of Special Categories of Personal Data
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall apply the stricter protection regime prescribed by the Law when processing special categories of personal data.
Special categories of personal data shall be processed only where one of the processing conditions prescribed by the Law is met and the necessary additional technical and organisational measures have been implemented.
The Company shall separately identify processes requiring the processing of special categories of personal data, restrict and document access permissions for such data, and comply with the principle of data minimisation wherever possible.
Additional protective measures shall be applied to high-risk data categories, such as biometric data, health data, and data relating to criminal convictions and security measures.
Article 8 — Purposes of Processing Personal Data
Depending on the nature of its activities, Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi may process personal data for the following purposes:
Conducting human resources processes.
Establishing, performing and terminating employment contracts.
Creating membership records.
Managing customer and member relations and carrying out service delivery processes.
Conducting accounting, finance, collection, payment and audit processes.
Handling legal matters and establishing, exercising or protecting a right.
Ensuring internal operations, information security, business continuity and corporate governance processes.
Ensuring the security of physical premises and information systems.
Fulfilling statutory obligations and reporting to competent authorities.
Conducting communication activities, responding to requests and managing data subject applications.
The purposes of processing in specific processes shall be set out in greater detail in the relevant privacy notices.
Article 9 — Categories of Personal Data
Depending on the nature of the activity, the personal data processed by Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi may fall within the following categories:
Identity information: Your first name, surname and date of birth.
Contact information: Your telephone number and email address.
Membership information.
Financial information: Payment of salaries and fringe benefits, and collection transactions relating to services provided to members.
Employee and personnel information.
Transaction security information.
Visual and audio recordings: Such recordings shall be obtained provided that the necessary information has been given and, in the case of audio recording, explicit consent has been obtained.
Physical premises security data.
Legal transaction and compliance data.
Professional experience and education information.
Request, complaint and application information.
The Company shall process only those categories of data that are necessary for its business activities and the purpose of processing.
Article 10 — Methods of Collecting Personal Data
Personal data may be collected through physical media, electronic media and verbal communication channels.
In this context, personal data may be obtained through contracts, application forms, curricula vitae, emails, telephone calls, websites, mobile applications, the membership register, information systems, security cameras and similar channels.
The methods of collecting personal data and the relevant legal bases shall also be explained in the privacy notices addressed to the relevant groups of data subjects.
Article 11 — Obligation to Inform
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall inform data subjects in accordance with the legislation at the time their personal data are obtained.
The information provided in fulfilment of the obligation to inform shall include, at a minimum, the identity of the data controller, the purposes of processing personal data, the recipient groups to which personal data may be transferred and the purposes of such transfers, the method of data collection, the legal basis, and the rights of the data subject.
Privacy notices shall be prepared in clear, understandable, plain and specific language. General, abstract, misleading or ambiguous statements shall not be included.
For processing activities requiring explicit consent, the processes of providing information and obtaining explicit consent shall be conducted separately.
Article 12 — Transfer of Personal Data
As a general rule, Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall not transfer personal data to third parties without the explicit consent of the data subject.
However, personal data may be transferred within Türkiye without explicit consent where one of the conditions for transfer prescribed by the Law is met.
Depending on the nature of the activity, personal data may be transferred to authorised public institutions and organisations, courts, enforcement authorities, certified public accountants, lawyers, banks and service providers.
When transfers are carried out:
Only the necessary data shall be transferred.
Proportionality between the category of data and the purpose of transfer shall be maintained.
Recipient groups shall be identified.
Contractual and technical security measures shall be implemented.
Article 13 — Transfer of Personal Data Abroad
Where personal data are transferred abroad, Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall comply with the regime governing transfers abroad under the Law.
For processes requiring transfers abroad, the legal basis for the transfer, the nature of the transfer, the appropriate safeguard mechanism to be used, and the measures for protecting data subjects’ rights shall be assessed separately.
All processes that may result in the transfer of data abroad due to cloud services, email infrastructure or software services shall be subject to the Company’s internal control mechanisms to be introduced.
The necessary information shall also be provided separately in relation to processes involving transfers abroad.
Article 14 — Data Security Measures
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall take technical and organisational measures to ensure an appropriate level of security in order to prevent the unlawful processing of, and unlawful access to, personal data and to ensure the secure retention of such data.
14.1. Technical Measures
The Company shall take, or arrange for the implementation of, the following technical measures, as appropriate to the nature of the activity:
Implementing access authorisation and an authorisation matrix.
Maintaining and monitoring logs.
Ensuring network security.
Using antivirus software, firewalls and intrusion detection/prevention mechanisms.
Using encryption and, where necessary, masking methods.
14.2. Organisational Measures
The Company shall take, or arrange for the implementation of, the following organisational measures, as appropriate to the nature of the activity:
Defining duties, powers and responsibilities in writing.
Providing employees with regular training on the KVKK and information security.
Securing confidentiality obligations through contracts and undertakings.
Entering into agreements with data processors containing appropriate data protection provisions.
Preparing and updating policies, procedures and instructions.
Ensuring the security of physical documents and archives.
Article 15 — Management of Data Processors
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall carefully select third parties that process personal data on its behalf.
In its relationships with data processors:
Confidentiality and security obligations shall be set out contractually.
In respect of processing activities carried out by data processors, the Company shall act in accordance with the principle of joint responsibility to the extent prescribed by the legislation.
Article 16 — Retention and Disposal of Personal Data
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall retain personal data for the periods prescribed by the applicable legislation or for the period necessary for the purpose of processing.
The retention period shall be determined by reference to:
The provisions of the applicable legislation.
Contractual obligations.
Evidentiary needs and applicable limitation periods.
Whether the purpose of processing continues to exist.
Legitimate corporate needs.
Where the reasons requiring the processing of personal data cease to exist, such personal data shall be erased, destroyed or anonymised, either on the Company’s own initiative or at the request of the data subject.
Retention and disposal processes shall be detailed in a separate Personal Data Retention and Disposal Policy to be prepared.
Article 17 — Rights of the Data Subject
Data subjects may exercise the following rights in relation to their personal data by applying to Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi in accordance with the legislation:
To learn whether their personal data are being processed.
To request information concerning the processing of their personal data, if such data have been processed.
To learn the purpose of processing their personal data and whether such data are used in accordance with that purpose.
To learn the third parties to whom their personal data have been transferred within Türkiye or abroad.
To request rectification of their personal data if such data have been processed incompletely or inaccurately.
To request the erasure, destruction or anonymisation of their personal data.
To request that rectification, erasure, destruction or anonymisation operations be notified to third parties to whom the data have been transferred.
To object to an adverse outcome arising from the analysis of processed data exclusively through automated systems.
To claim compensation for damage suffered as a result of the unlawful processing of their personal data.
Article 18 — Management of Applications and Requests
Data subjects may submit requests concerning their personal data to Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi in writing or by other methods recognised by the legislation.
The processes for receiving applications, verifying identity, assessing applications, responding to applications and keeping records shall be conducted in accordance with the application procedure separately established by the Company.
Applications shall be concluded within the periods prescribed by the legislation and free of charge. However, where the operation entails an additional cost, a fee may be charged to the extent permitted by the legislation.
Article 19 — Data Breach Management
Falcon Tactical Range Club Silah Eğitim ve Güvenlik Hizmetleri Limited Şirketi shall establish an incident management process covering the acquisition of personal data by third parties through unlawful means, unauthorised access, data leakage, loss, destruction, manipulation and similar security breaches.
Where a data breach is suspected:
The incident shall be recorded immediately.
An analysis of its impact and scope shall be conducted.
Urgent measures shall be taken to mitigate harm.
The necessary internal reporting shall be carried out.
Notifications shall be made to the data subjects and the Board where required by the legislation.
Data breach notification, response and remediation processes shall be detailed in separate internal procedures.
The implementation of this Policy shall be monitored through internal audits, process reviews, document checks, technical tests and, where necessary, support from external experts.
Corrective and preventive actions shall be planned and monitored in respect of identified instances of non-compliance.
Article 20 — Related Policies and Documents
This Policy shall be applied together with the Company’s other internal regulations concerning the protection of personal data.
Depending on the nature of the activity, the following documents may be prepared or maintained in force to supplement this Policy:
Privacy notices.
Explicit consent texts.
Personal Data Retention and Disposal Policy.
Cookie Policy.
Application and Response Procedure.
Data Breach Response Procedure.
Access Authorisation and Information Security Procedures.
In the event of a conflict between this Policy and other internal regulations, the document containing provisions specific to the process concerned shall be assessed together with the mandatory statutory provisions.
Article 21 — Amendments
This Policy may be updated in line with legislative amendments, decisions of the Board, judicial case law, the Company’s organisational structure, business processes or technical requirements.
Updates shall enter into force upon approval by the authorised Company representative.
The current version shall be made accessible to employees and, where necessary, data subjects through methods deemed appropriate.
Article 22 — Entry into Force
This Policy was approved and entered into force on 7 October 2026.