Adonis Exchange Terms and Conditions

Law on the Protection of Personal Data

Law No: 6698
Date of Adoption: March 24, 2016
Official Gazette: April 7, 2016 – No. 29677

---

PART ONE

Purpose, Scope, and Definitions

Purpose – Article 1

The purpose of this Law is to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, in the processing of personal data, and to regulate the obligations, procedures, and principles to be followed by natural and legal persons who process personal data.

Scope – Article 2

This Law applies to:

• Natural persons whose personal data is processed

• Natural or legal persons who process personal data fully or partially by automated or non-automated means, provided that the data forms part of a data recording system

Definitions – Article 3

For the purposes of this Law:

• Explicit Consent: Freely given, informed consent relating to a specific subject

• Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person

• Data Subject: The natural person whose personal data is processed

• Personal Data: Any information relating to an identified or identifiable natural person

• Processing of Personal Data: Any operation performed on personal data such as collection, recording, storage, modification, disclosure, transfer, classification, or prevention of use

• Data Controller: The natural or legal person who determines the purposes and means of processing personal data

• Data Processor: A natural or legal person processing personal data on behalf of the data controller

• Data Recording System: A system where personal data is structured and processed according to specific criteria

• Board: Personal Data Protection Board

• Authority: Personal Data Protection Authority

---

PART TWO

Processing of Personal Data

General Principles – Article 4

Personal data shall be processed:

• In accordance with law and good faith

• Accurately and kept up to date

• For specific, explicit, and legitimate purposes

• In a manner that is relevant, limited, and proportionate

• Retained only for the period required by law or purpose

Conditions for Processing – Article 5

Personal data cannot be processed without explicit consent, unless:

• It is explicitly provided by law

• It is necessary to protect life or physical integrity

• It is directly related to the establishment or performance of a contract

• It is required for the data controller’s legal obligation

• It has been made public by the data subject

• It is necessary for legal claims

• It is required for legitimate interests, provided fundamental rights are not violated

Special Categories of Personal Data – Article 6

Sensitive personal data includes:

• Race, ethnicity, political opinion, religion

• Health, sexual life

• Criminal records, biometric and genetic data

Processing of sensitive data is prohibited without explicit consent, except under strict legal conditions and safeguards determined by the Board.

Deletion, Destruction, or Anonymization – Article 7

Personal data shall be deleted, destroyed, or anonymized when the reasons for processing no longer exist.

Transfer of Personal Data – Article 8

Personal data cannot be transferred without explicit consent, except under lawful conditions.

Transfer Abroad – Article 9

Personal data may be transferred abroad only if:

• Explicit consent exists, or

• Adequate protection exists in the recipient country, or

• Written undertakings are provided and approved by the Board

---

PART THREE

Rights and Obligations

Obligation to Inform – Article 10

The data controller must inform the data subject about:

• Identity of the data controller

• Purpose of processing

• Recipients of data

• Method and legal basis

• Rights of the data subject

Rights of the Data Subject – Article 11

Data subjects have the right to:

• Learn whether their data is processed

• Request information

• Know the purpose of processing

• Request correction, deletion, or destruction

• Object to automated decision-making

• Claim compensation for unlawful processing

Data Security Obligations – Article 12

Data controllers must take technical and administrative measures to:

• Prevent unlawful processing

• Prevent unauthorized access

• Ensure data security

---

PART FOUR

Applications, Complaints, and Data Controllers Registry

• Applications must be answered within 30 days

• Complaints may be filed with the Board

• Data Controllers must register with VERBIS (Data Controllers Registry) unless exempted

---

PART FIVE

Crimes and Administrative Fines

• Violations are subject to criminal sanctions under the Turkish Penal Code

• Administrative fines range from TRY 5,000 to TRY 1,000,000

---

PART SIX

Personal Data Protection Authority

• An independent public authority headquartered in Ankara

• Governed by a 9-member Board

• Responsible for enforcement, supervision, and regulation

---

PART SEVEN

Miscellaneous Provisions

Exemptions – Article 28

Certain processing activities are exempt, including:

• Personal or household use

• Anonymized statistical processing

• National security, public order, judicial processes

---

Entry into Force – Article 32

• Certain articles entered into force 6 months after publication

• Remaining provisions entered into force on the publication date