This Personal Data Protection Policy has been prepared pursuant to the clarification obligation under the Personal Data Protection Law numbered 6698 (“PDPL”) regarding the personal data obtained within the scope of CANTO 21 İÇ MİMARİ VE TASARIM LTD ŞTİ.’s activities. While we are processing your personal data, we act pertinent to the rules of the PDPL and other relevant laws and take the appropriate technical and administrative security measures to protect your personal data.


The Purpose of Processing Personal Data

Personal data can only be processed in accordance with the procedures and principles stipulated in the PDPL and other relevant legislations. Personal data refers to any information relating to an identified or identifiable natural person. Processing of personal data refers to operations that are carried out on personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use of thereof, fully or partially through automatic or non-automatic means.


Personal data processing is possible with the explicit consent of the data subject. In accordance with Article 5/2 of the PDPL, the processing of personal data by Canto 21 without the explicit consent of the data subject is possible under the following circumstances:

  • When it is explicitly provided for by the laws,
  • When it is mandatory for the protection of life or to prevent the physical injury of a person, in cases where that person cannot express consent or whose consent is legally invalid due to physical disability,
  • When processing personal data of the parties of a contract is necessary, provided that it is directly related to the conclusion or fulfillment of that contract,
  • When it is mandatory for Canto 21 to fulfill its legal obligations,
  • When the data is made manifestly public by the data subject,
  • When data processing is mandatory for the establishment, exercise or protection of any right,
  • When it is mandatory for the legitimate interests of Canto 21, provided that such processing shall not violate the fundamental rights and freedoms of the data subjects.


As Canto 21, we undertake to process your personal data in accordance with the PDPL. Your personal data is processed by Canto 21 for the purpose of carrying out the supply of goods/service, carrying out invoicing, payment, and accounting processes, notification of discounts and campaigns. In addition to these, your personal data can also be processed in one of the situations regulated in the above-mentioned art.5 / 2 of PDPL.



Data Transfer to Third Parties

Personal data cannot be transferred without the explicit consent of the data subject. However, personal data can be transferred without the consent of the relevant person in the presence of one of the conditions specified in art. 5/2 and art.6/3 provided that sufficient measures are taken.


Your personal data may be transferred to third parties by Canto 21 in accordance with the legislation within the scope of articles 8 and 9 of the PDPL for the purposes stated above.


Personal Data Collection Means and Legal Grounds

As Canto 21, we collect your personal data through verbal, written or electronic media by automatic or non-automatic methods within the framework of art.5 of the PDPL.


Your Rights as Data Subject

According to the article 11 of the PDPL, you have the following rights as to processing of your personal data;

– Right to access information whether your personal data is processed or not, and if so, request information on processed personal data, the purpose of the processing, to whom your personal data is transferred,

– Right to rectification of personal data in cases of any incomplete or inaccurate information and to have the third parties that your personal data had been transferred being informed as to this rectification,

– Right of destruction/erasure within the context of the “Law” and to have the third parties that your personal data had been transferred being informed about the destruction/erasure

– Right to object to any conclusion that is a result of the analysis of the processed data though automated systems,

– Right to request compensation if any damages incurred as a result of processing your personal data against the law

Pursuant to art. 5 of the Communiqué on the Procedure and Principles for the Application to the Data Controller, data subjects, for the exercise of the above-mentioned rights, are required to send their request in written or through registered electronic mail address, secured electronic signature, mobile signature or through the electronic mail address that is previously notified by the data subject to Canto 21 and registered in the Canto 21’S system, or by means of a software or application developed for the purpose of application to which is the electronic address of Canto 21, or to the postal address of Canto 21, Kuruçeşme mah. Arnavutköy Kuruçeşme cad. No 57/4 Beşiktaş İstanbul.


Data subjects are required to include following information into their applications: name, surname, signature (if the application is written); identity number for Turkish Republic citizens; nationality, passport number or identity number for foreigners; place of residence or workplace for notification; e-mail address for notification; telephone and fax number, and the subject of the request. Information and documents on the subject are attached to the application.