Son Güncelleme: 06 Kasım 2026
This Privacy Notice has been prepared by Nba Ambalaj Şirketi (the "Company") to inform the Company's customers regarding the processing of their personal data by the Company within the scope of the Law on the Protection of Personal Data No. 6698 (the "Law").
Detailed information regarding the processing of your personal data within the scope of this Privacy Notice can be found in the Nba Ambalaj Şirketi Personal Data Protection and Processing Policy available at [www.nba.com.tr].
-
a) Methods and Legal Grounds for the Collection of Personal Data Your personal data is collected in electronic or physical environments. Your personal data collected for the legal reasons stated in this Privacy Notice can be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.
-
b) Purposes of Processing Personal Data Your personal data is processed within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law for the purposes of: planning and executing the necessary activities to customize the products and services offered by the Company according to the tastes, usage habits, and needs of the relevant persons and recommending and promoting them; carrying out the necessary work by business units to enable the relevant persons to benefit from the products and services offered by the Company and executing the relevant business processes; carrying out the necessary work by the relevant business units for the realization of the commercial activities carried out by the Company and executing the related business processes; planning and executing the commercial and/or business strategies of the Company; and ensuring the legal, technical, and commercial-occupational safety of the Company and the relevant persons in a business relationship with the Company.
-
c) Parties with Whom Personal Data May Be Shared and Purposes of Sharing Your personal data may be shared with the Company's business partners and suppliers, legally authorized institutions and organizations, and legally authorized private law legal entities, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, for the purposes of: planning and executing the necessary activities to customize the products and services offered by the Company according to the tastes, usage habits, and needs of the relevant persons and recommending and promoting them; carrying out the necessary work by business units to enable the relevant persons to benefit from the products and services offered by the Company and executing the relevant business processes; carrying out the necessary work by the relevant business units for the realization of the commercial activities carried out by the Company and executing the related business processes; planning and executing the commercial and/or business strategies of the Company; and ensuring the legal, technical, and commercial-occupational safety of the Company and the relevant persons in a business relationship with the Company.
-
d) Rights of Data Subjects and the Exercise of These Rights If you, as personal data subjects, submit your requests regarding your rights stated below to the Company using the methods specified under the heading Exercise of Rights by Data Subjects, your requests will be evaluated and finalized by our Company as soon as possible and in any case within 30 (thirty) days.
In accordance with Article 11 of the Law, as a personal data subject, you have the following rights:
-
To learn whether your personal data is processed,
-
To request information if your personal data has been processed,
-
To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
-
To know the third parties to whom your personal data is transferred domestically or abroad,
-
To request the correction of your personal data if it is incomplete or incorrectly processed, and to request that the transaction carried out in this context be notified to the third parties to whom the personal data has been transferred,
-
To request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, despite having been processed in accordance with the provisions of the Law and other relevant laws, and to request that the transaction carried out in this context be notified to the third parties to whom the personal data has been transferred,
-
To object to the occurrence of a result against the person themselves by analyzing the processed data exclusively through automated systems,
-
To claim compensation for the damage arising from the unlawful processing of your personal data.
-
Paragraph 2 of Article 28 of the Law lists the cases where data subjects do not have the right to request, and in this context;
-
Personal data processing being necessary for the prevention of committing a crime or for a criminal investigation,
-
Processing of personal data made public by the relevant person themselves,
-
Personal data processing being necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorized and competent public institutions and organizations and professional organizations with the status of public institution, based on the authority granted by the law,
-
Personal data processing being necessary for the protection of the economic and financial interests of the State with regard to budget, tax, and financial matters,
-
the rights specified above regarding the data cannot be exercised in these cases.
-
According to Paragraph 1 of Article 28 of the Law, since the data will be outside the scope of the Law in the following cases, the requests of data subjects will not be processed regarding such data either:
-
Processing of personal data by natural persons within the scope of activities completely related to themselves or family members living in the same residence, provided that they are not given to third parties and obligations regarding data security are complied with.
-
Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics.
-
Processing of personal data for art, history, literature, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, right to privacy, or personal rights, or constitute a crime.
-
Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security.
-
Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution proceedings.
Exercise of Rights by Data Subjects
-
Data subjects will be able to use the "Form for Applications to be Made to the Data Controller by the Personal Data Subject" available at the [www.www.nba.com.tr/] link to exercise the aforementioned rights.
-
Applications shall be made using one of the following methods, along with documents establishing the identity of the relevant data subject:
-
Following a method prescribed by the Personal Data Protection Board.
-
The Company responds to data subjects who wish to exercise the said rights within the limits prescribed by the Law, within a maximum of thirty (30) days as foreseen in the Law. In order for third parties to make an application request on behalf of personal data subjects, there must be a special power of attorney issued through a notary public by the data subject on behalf of the person who will make the application.
-
As a rule, data subject applications are processed free of charge; however, charging may be made based on the fee schedule foreseen by the Personal Data Protection Board.
The Company may request information from the relevant person in order to determine whether the applicant is the personal data subject, and may direct questions to the personal data subject regarding their application in order to clarify the matters stated in the application.