CLARIFICATION TEXT AND POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
I. Data Controller
Corporate Benefits Turkey Internet Pazarlama ve E-Ticaret Platformu Aracılık Hizmetleri A.Ş. ("cb Turkey")
Address Ataturk Mah. Ertugrul Gazi Sk. Metropol Istanbul C1 block no: 2 b Interior Door no:187 Ataşehir/ Istanbul
As the owner of the website provided by Cb Turkey with a separate domain dedicated to you or your company (hereinafter referred to as the "Website"), Corporate Benefits Turkey Internet Pazarlama ve E-Ticaret Platformu Aracılık Hizmetleri A.Ş. aims to take all necessary technical, legal and managerial measures regarding the processing and protection of personal data and to fully demonstrate all due diligence.
The Clarification Text and Policy on the Processing and Protection of Personal Data ("cb Turkey KVK Policy") regulates the principles adopted in the protection and processing of personal data of natural persons ("User") who register on the Website to benefit from the goods and services of the sellers offered at advantageous prices on the Website.
II. General Information on Personal Data
1. Scope of Processing Personal Data
1.1 In principle, cb Turkey collects and uses the personal data of its Users only to the extent necessary to provide content and services through a functional Website. The collection and processing of Users' personal data regularly takes place only with the consent of the User. Regarding the exceptions to this, cb Turkey is subject to the regulations of the Law No. 6698 on the Protection of Personal Data ("LPPD").
2. Legal Basis for Data Processing
2.1 cb Turkey does not process personal data without the explicit consent of the data subject.
2.2 In the presence of one of the following conditions, it is possible for cb Turkey to process personal data without seeking the explicit consent of the data subject:
- Explicitly stipulated in the law.
- It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.
- Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract.
- cb It is necessary for Turkey to fulfill its legal obligation.
- It has been made public by the person concerned.
- Data processing is mandatory for the establishment, exercise or protection of a right.
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
3. Data Retention Period
cb Turkey retains personal data for the purpose of providing its services for the period during which the services are provided.
cb Turkey may also store and process personal data in accordance with the provisions of other laws to which it is subject within the scope of the service it provides.
cb Turkey deletes, destroys or anonymizes personal data ex officio or upon the request of the data subject in the event that the reasons requiring the processing of personal data disappear or the periods in other personal data processing/storage regulations to which it is subject expire.
III. Scope of Stored and Processed Personal Data
4. Website and log files
4.1 Type and scope of processed data
Each time the Website is accessed, the following data and information are received from the computer accessing the Website through the cb Turkey data recording system:
a) Information about the browser type and version used
b) User's operating system
c) IP address of the user
d) Date and time of access
e) Websites accessed by the user's system through the Website
The data is also stored in the log files of the data recording system. This data is not stored together with other personal data.
When a voucher code is generated, the following personal data is stored to protect against misuse (e.g. commercial resale)
a) Coupon Code
b) Offer
c) Company portal where the voucher code is offered
d) Name, surname
e) User's e-mail address
f) Time of generation of the voucher code (date and time)
g) User's IP address
4.2 Legal basis
The legal basis for the temporary storage of data and log files is paragraph 5.2(f) of KVKK.
4.3 Purpose of Data Processing
The temporary storage of the IP address by the data recording system is necessary for the Website to be made available to the user's computer. For this purpose, the User's IP address is stored for the duration of the session.
The storage in log files is done in order to ensure the functionality of the Website. Furthermore, the data is used to optimize the Website and to ensure the security of cb Turkey information technology systems. In this context, data is not processed for marketing purposes.
Cb Turkey's data processing activities within this scope are based on its legitimate interests.
4.4 Rights of the data subject
Collecting data and storing data in log files for the purpose of presenting the Website to the User's computer is necessary for the Website to function correctly. For this reason, the User cannot be granted the right to object to a result that arises against him by analyzing the data exclusively through automated systems or to request the deletion of this data.
5. Use of Cookies
5.1 Type and scope of processed data
The Website uses cookies. Cookies are low-dimensional rich text formats that allow certain information about users to be stored on users' terminal devices when a website is visited. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is revisited.
cb Turkey uses cookies to make the Website user-friendly. Some elements of the Website require the browser to be re-identified even when a new page is visited.
The following data is stored and transmitted in cookies:
- An identity that allows user identification
The Website uses external services and cookies to collect statistical data and improve advantageous offers. The figures obtained as a result of these services are used to show the "top 5 offers from colleagues" on a company platform.
Each time the User accesses the Internet content provided by the cb Turkey portal, certain information transmitted by the User's browser during the registration process for web control is collected and evaluated. Such collection is carried out through a pixel placed on each page. The data collected are as follows:
- Request (filename of the requested file)
- Browser type/version (e.g. Internet Explorer 6.0)
- Browser language (e.g. Turkish)
- Operating system used (e.g. Windows XP)
- internal resolution of the browser window
- screen resolution
- JavaScript activation
- Turn Java on/off
- cookie information on/off
- color depth
- referrer URL (previously visited page)
- abbreviated IP address for geographic identification
- access time
- Clicks on the Website
The Service Provider stores the IP address of the User only in a shortened (anonymized) form and uses it only for session recognition, geolocation and to fend off cyber-attacks. The IP address is then immediately deleted so that the data collected remains anonymous.
The following cookies are used in this context:
- Session cookie (for session recognition)
5.2 Legal basis
The legal basis for the processing of cookies containing personal data is paragraph 5.2(f) of the KVKK.
5.3 Purpose of Data Processing
The purpose of using technically necessary cookies is to facilitate the use of websites for users. Some features of the Website cannot be provided without the use of cookies. Therefore, the browser must be re-recognized each time a new page is visited.
6. Use of a Content Delivery Network (CDN) and Security Services (MyraSecurity)
Description, Purpose and Scope of Data Processing
For optimizing loading times (performance), increasing reliability and protecting our IT infrastructure against malicious attacks (e.g. so-called DDoS attacks) we have implemented a content delivery network (CDN).
For this purpose, we use the services of Myra Security GmbH, Landsberger Straße 187, 80687 Munich, Germany ("MyraSecurity").
A CDN is a network of regionally distributed servers that helps making available content from our website to you faster and more securely – including but not limited to static files, such as images, JavaScript and CSS files. From a technical point of view, MyraSecurity serves as a so-called reverse proxy. This means that the traffic between your device and our servers is routed through MyraSecurity's infrastructure for speeding up delivery and analyzing and defending against potential threats.
Within such process, technical protocol data (so-called access logs) are processed. These include, but shall not be limited to:
- Your IP address
- Date and time of access
- The requested content (e.g. URL) and
- Information about your browser and operating system (e.g. user-agent)
The processing of this data is technically required to ensure the stability, performance and security of our website.
Legal basis for data processing.
The legal basis for the use of MyraSecurity is our legitimate interest in providing our platform securely, quickly and reliably in accordance with Art. 6 (1) (f) GDPR.
MyraSecurity acts for us solely as a technical service provider bound to our instructions. We have concluded a contract processing agreement with MyraSecurity in accordance with Art. 28 GDPR. This ensures that the data is processed only according to our instructions and not for MyraSecurity's own purposes. The data processing takes only place in data centres within the European Union (EU) or the European Economic Area (EEA). MyraSecurity does not use its own cookies for this service to analyze user behavior.
Duration of storage
The access logs containing your IP address are stored for a maximum period of 10 days to ensure stability and security and are automatically deleted or anonymized afterwards.
7. Authorized Electronic Message (Newsletter) Sending
7.1 Type and scope of processed data
Free newsletters can be subscribed to on the Website. Registration for the monthly newsletter can be done at the same time as registration on the Website. In addition, the newsletter can be subscribed to at any time in the "My data" field. Below are the data taken from the login form when registering for the newsletter:
- Gender (for addressing purposes)
- Name and surname
- Date of birth
- Company e-mail address
- Password
- Registration date and time
- Distributor engagement (company platform)
In addition to monthly newsletters, once the registration and login process is complete, you can subscribe to a special newsletter that will be sent at irregular intervals.
User consent is obtained during the registration process for the purpose of data processing and cb Turkey's KVK Policy is referred to.
For the purpose of sending newsletters, data is shared with a marketing automation and digital data analysis company. This data is only used for sending the newsletters.
In order to send the newsletters, the following personal data is shared with the service provider company:
- Gender (for addressing purposes)
- Company e-mail address
- Surname
- Distributor engagement (company platform and newsletter type)
7.2 Legal basis
In case the User consents after the User registers to the newsletter, the legal basis for data processing is paragraph 5.2(f) of the KVKK.
7.3 Purpose of Data Processing
Data on the user's e-mail address is collected for the purpose of transmitting the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or the e-mail address used.
7.4 Rights of the data subject
The newsletter subscription can be terminated at any time by the user concerned. For this purpose, each newsletter contains a link to the employee's "My Data" section. Using this link, the employee can unsubscribe from the newsletters.
The "My data" section transparently shows when a monthly newsletter or special newsletter was ordered or canceled.
The right of the user to change or remove communication permissions from the settings section of the membership is secured by the Electronic Communication Law No. 5809.
8. User Registration
8.1 Type and scope of processed data
On the Website, Users are offered the opportunity to register on the portal by providing their personal data. This data is entered into a login form, transmitted to cb Turkey and stored. None of this data is transferred to third parties. Below are the data collected during the registration process:
- Gender (for addressing purposes)
- Name and surname
- Date of birth
- Company e-mail address and permission for electronic submission
- Password
- Registration date and time
The User's consent to the processing of this data is obtained as part of the registration process. In addition, the following data is stored:
- Language preference for multilingual platforms
- Location (web browser shared by the user. The user can also specify the location manually)
- Registration date
- Timestamp registration code
- Timestamp with registration for monthly email newsletter
- Timestamp with registration in a special newsletter
- Acceptance of the User Agreement and Privacy Policy
- Connected business platform
- Login with timestamp
- APP Usage iOS / Android Yes / No
- Bids saved in the watchlist
- Generation of coupon codes
- Storage of vouchers
- Content of contact forms
- Content of the recall form
- User reviews with timestamp of offers
iOS/Android app
- Access to location (automatic detection of location / new - send push message if the branch in the watchlist is nearby)
- Access to the camera (QR code scanning)
- Receiving push messages - New offers Yes / No
- Receiving push messages - Expired offers Yes / No
- Receiving push messages - Near the branch in the watchlist Yes / No
8.2 Legal basis
The processing of data collected during subscription takes place due to different legal grounds:
- The legal basis for the processing of the data that is essential for providing access to the Portal and user administration (first name, last name, email address), shall be Art. 6 para. 1 lit. b GDPR (performance of contract).
- The legal basis for the processing of the optional data (e.g. title, date of birth, postal code) shall be Art. 6 (1) (a) GDPR if the user has provided his consent
- The legal basis for collecting the salutation is Art. 6 (1) (f) GDPR (legitimate interest). The details of our legitimate interest and the balancing of interests carried out can be found under Section 3.
- The legal basis with respect to the fingerprinting for access control and abuse prevention is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interest).
8.3 Purpose of Data Processing and Legitimate Interests
For making available certain content and services on our website the user needs to subscribe. With successful subscription, the user gains access to our platform for employee offers. [...] Collecting personal data within the subscription process serves to identify and address users, support requests, legal evidence, marketing and target group analyses and to display saved offers.
Justification of the legitimate interest in collecting the salutation (Art. 6 para. 1 lit. f GDPR):
The salutation is collected for safeguarding our legitimate interest in high-quality, addressee-oriented and professional communication. We consider appropriate communication in the context of support, system notifications, and general provision of information to be essential for ensuring the quality of service and maintain the relationship of trust with our users. In our opinion, your interests and fundamental rights do not outweigh our stated interest in the necessary balancing, as the use of a customary form of address ("Mr" or "Mrs") is a common and reasonably expected practice in business transactions. Our analysis has shown that our interest in a structured basis for professional communication outweighs the interest of the data subjects in these circumstances.
Justification of the legitimate interest for fingerprinting (Art. 6 para. 1 lit. f GDPR):
We process a fingerprint generated by your device or browser to safeguard our legitimate interests in ensuring platform integrity and preventing abuse. Our business model is based on granting exclusive benefits to authorized users only (employees of partner companies). This model is existentially endangered by the unauthorized disclosing of access data, automatically creating accounts and commercially using discounts.
Protecting your account only with username and password is not sufficient for this purpose, as access data can be easily shared. Fingerprinting is therefore necessary to detect and stop patterns of abuse and to ensure that the terms of use are respected. The affection of your rights is kept as low as possible: The fingerprint created is pseudonymous, is used exclusively for this security purpose, is not passed on to uninvolved third parties and is not used for advertising or tracking purposes beyond our platform. When balancing the interests, our compelling interest in protecting our service and the entire user community from fraud and abuse outweighs your interest in protecting this specific technical data, particularly with you as authorized user also having an interest in the exclusivity and security of the platform.
8.4 Rights of the data subject
Users have the option to cancel their registration at any time. Stored data on users can be changed at any time. The access account can be deleted or changes can be made in this area through the "Delete Access" link in the "My Data" section.
9. Contact Form and Email Contact
9.1 Type and scope of processed data
The Website contains a contact form to contact cb Turkey online. When the User accepts this option, all data entered in the input form is transmitted to cb Turkey and stored. These data are the following:
- Gender (for addressing purposes)
- Name and surname
- Email address
- Subject of the message
- Content of the message
- Browser type/version
- Operating system used
When the message is sent, the following data is also stored:
- User IP address
- Date and time of sending the message
Instead of the contact forum, it is also possible to contact cb Turkey via e-mail. In this case, the personal data transmitted by the user via e-mail will be stored.
9.2 Legal basis
In case the User consents, the legal basis for data processing is Article 5.1 of the LPPD.
The legal basis for the processing of data transmitted during e-mail transmission is Article 5.2/f of the KVKK. If it is intended to conclude a contract by e-mail communication, in this case, the additional legal basis for the processing of data is Article 5.2/c of the KVKK.
9.3 Purpose of Data Processing
Personal data received from the contact form is processed only for the purpose of processing the communication. In the communication via e-mail, the relevant data is processed due to the necessary legitimate interest as well as the processing of the communication.
Other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.
9.4 Rights of the data subject
The User has the option to withdraw his/her consent to the processing of his/her personal data at any time. The User may object to the storage of his/her personal data at any time by contacting cb Turkey by e-mail. In such a case, the communication cannot be continued. All personal data stored during the communication will be deleted in this case.
IV. Transfer of Personal Data
9. Transfer of Personal Data Abroad
Our Company may also transfer personal data abroad for processing in Turkey or for processing and storage outside Turkey, including outsourcing, in accordance with the conditions stipulated in the KVKK and other relevant legislation and by taking the security measures specified in the legislation, as mentioned above.
Cb Turkey, KVKK 5. Within the scope of Article 5; (i) the processing of the User's personal data is necessary in this context, directly related to the establishment and performance of the contract with the User, and (ii) the User has the opportunity to exercise his/her rights and to apply for effective legal remedies in the country of transfer, provided that the User's fundamental rights and freedoms are not harmed, since data processing is mandatory for the legitimate interests of the User, The standard agreements announced by the Board, including data categories, purposes of data transfer, recipient and recipient groups, technical and administrative measures to be taken by the data recipient, are first transmitted to corporate benefits GmbH, the main partner of cb Turkey, and corporate benefits IT solutions GmbH, which is under the roof of corporate benefits group of companies, for the provision of services.
In addition, data may be transferred by corporate benefits GmbH and corporate benefits IT solutions GmbH, the main partner of cb Turkey, for data processing purposes to the best of our knowledge and in accordance with subparagraphs c, e and f of Article 5 of the KVKK, to request processors, companies that store portal data in the capacity of technical service providers, service providers that determine location, each of which is based abroad, for the purpose of processing service requests via e-mail or through "service portal forms", with standard contracts in accordance with EU legislation between the relevant parties.
V. Rights regarding Personal Data
Pursuant to Article 11 of the LPPD, the rights of data subjects regarding their personal data are as follows:
- Learning whether personal data is processed by cb Turkey,
- Request information if personal data has been processed,
- To learn the purpose of processing personal data and whether they are used for their intended purpose,
- To know the third parties to whom personal data are transferred domestically or abroad,
- To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
- Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
- To object to the occurrence of a result to the detriment of the data subject by analyzing the processed data exclusively through automated systems,
- In case of damage due to unlawful processing of personal data, to demand compensation for the damage.
These requests can be submitted to cb Turkey via the contact form.
11.2025