Protection of Personal Data

Data controller

Under KVKK, you may send requests to the legal entity or authorised unit responsible for operating the CHCO.tc™ platform, in its capacity as data controller, through the Contact channels. Reasonable steps may be taken to verify your identity when you make a request.

Categories of personal data processed

Depending on the nature of the platform, data in the following categories may be processed; the list may widen or narrow with the scope of the service:

• Identity and contact: first name, surname, job title, work or personal email address, telephone number.
• Transaction security: session and authentication data, IP address, device and browser information, log records.
• Customer transactions and use: application and form contents, assessment and survey responses, support requests, preference and notification settings.
• Legal proceedings: records that may be shared with the competent authorities in the event of a dispute.

Purposes of processing

Your data may be processed for the purposes below, on the basis of the formation and performance of a contract, legitimate interest, explicit consent or another legal ground provided for by law:

• Carrying out the CHCO.tc™ measurement, assessment and certification processes.
• Account creation, authentication and authorisation.
• Providing customer relations, information and support services.
• Statistical analysis, improving service quality and maintaining security.
• Meeting legal obligations and responding to requests from competent authorities.
• Pursuing legal disputes and exercising the right of defence.

Transfers

To the extent the service requires it, data may be transferred to business partners such as hosting, email delivery, analytics or database service providers, and to service providers inside or outside Türkiye in accordance with articles 8 and 9 of KVKK. Transfers are limited by data processing agreements and by technical and administrative measures.

Method of collection and legal basis

Data may be collected electronically through the website, mobile-friendly interfaces, forms, email and support channels, by automated or partly automated means. Processing is carried out in accordance with the conditions set out in articles 5 and 6 of KVKK.

Retention period

Personal data is retained for as long as the purpose of processing requires and for the limitation periods laid down in the applicable legislation; at the end of that period it is deleted, destroyed or anonymised.

Rights of the data subject

Under article 11 of KVKK you have the right to learn whether your data is being processed; to request information about the processing if it is; to learn the purpose of the processing and whether the data is used in line with that purpose; to know the third parties inside or outside Türkiye to whom it has been transferred; to have it corrected if it is incomplete or inaccurate; to request its deletion or destruction within the conditions KVKK provides for; to ask that any correction or deletion be notified to the third parties the data was transferred to; to object to a result reached to your detriment through analysis carried out solely by automated systems; and to claim compensation where unlawful processing has caused you harm.

You may submit your requests to the data controller following the prescribed application procedure. For information about responses to your request and the routes for a complaint, use our Contact page.

Updates

This notice may be updated in line with changes in legislation or in the service model. The current version is always published on this page.