Data Protection (KVKK)

This policy applies to natural persons whose personal data are processed, and to the DATA CONTROLLER that processes such data wholly or partly by automated means, or by non-automated means provided that they form part of any data recording system, within the framework of national and international laws, statutes, regulations, circulars, decisions of regulatory and supervisory institutions and organizations, directives, international agreements and contracts, primarily the KVK Law, and of all kinds of legal, commercial and financial contracts and contract annexes made or to be made with all persons, institutions and organizations, whether official, natural or legal persons, that are in communication, interaction, cooperation or a solution partnership with the DATA CONTROLLER, or under whatever name, and with the shareholders, customers, employees and suppliers of the DATA CONTROLLER.

In this policy, the following terms refer to:

as defined above.

For terms and concepts not included in this article, the definitions of terms and concepts in the relevant legislation apply.

This Policy has been approved by the ARCANUS HOTELS SORGUN Board of Directors. It is the competent approval mechanism for ensuring that the Policy is established, implemented and, where necessary, updated.

The Legal Counsel's Office, together with the IT Directorate, is responsible for the preparation, development, implementation and updating of this Policy. The Legal Counsel's Office evaluates this Policy, where necessary, in terms of whether it is up to date and of development needs.

The IT Directorate, together with the Legal Counsel's Office, is responsible for the preparation, development, implementation and updating of this Policy. The IT Directorate evaluates this Policy, where necessary, in terms of whether it is up to date and of development needs. Publication of the prepared document is the responsibility of the IT Department Manager.

The DATA CONTROLLER adopts as the basic principles of the Personal Data Protection Policy: processing every kind of personal data at its workplace or establishments transparently, in accordance with ethics and national and international legal rules, within the rules of honesty, adopting the principles of openness, accessibility and accountability; doing so in a manner that is appropriate to the purpose, limited, proportionate and impartial, acting in line with objective criteria; protecting and maintaining the accuracy, currency and integrity of the personal data of data subjects that are in interaction and communication with the data controller; protecting and retaining these personal data securely, for periods in line with the purpose of processing and the legislation and under current technological conditions, in compliance with commercial and professional ethical rules and with respect for fundamental human rights and freedoms guaranteed by international and national legal rules, primarily personal privacy and the privacy of private life; and, after retaining them for the period envisaged in the legislation or necessary for the purpose for which they are processed, deleting, destroying or anonymizing them.

In the process of processing personal data under the KVK Law, the DATA CONTROLLER acts in the awareness that it is a requirement and obligation to act in accordance with the legislation in force nationally and internationally, and with the rule of honesty that is part of the legal order and regulated in Article 2 of the TMK.

In accordance with the principle of compliance with the rule of honesty, the DATA CONTROLLER accepts, undertakes and declares that, while seeking to achieve its objectives in data processing, it must take into account the interests and reasonable expectations of data subjects; that it must act so as to prevent results that the person whose personal data are processed does not expect or that cannot be expected of that person; and that, in addition to making the data processing activity clear and understandable, it must act in accordance with its obligations to inform and warn the data subject.

While acting in accordance with the rules of honesty, the DATA CONTROLLER also accepts as a duty and responsibility to act, when exercising its rights envisaged for the processing of personal data, in line with the rules of trust, as expected of a reasonable person, within the limits of the right granted to it and in accordance with its purpose.

The DATA CONTROLLER, which follows a policy that respects the data subject's right to have his or her own data corrected, a right also protected by the Constitution and the KVK Law, declares, accepts and undertakes, in line and in harmony with this policy, to act consciously, carefully and attentively regarding keeping the personal data it processes accurate and up to date, ensuring that they are up to date at every stage of the processing and where necessary, keeping open the channels that will ensure the data subject's information is accurate and up to date, and the fact that damage suffered by the data subject, materially and morally, because of out-of-date or incorrectly held personal data will result in compensation.

On the other hand, the DATA CONTROLLER believes that acting in line with this principle is necessary for the protection of the fundamental rights and freedoms of the data subject, primarily the privacy of private life.

Knowing and foreseeing that acting from such a perspective protects its own interests as well as the rights of the personal data owner, the DATA CONTROLLER, in order to ensure that personal data can be kept accurate and up to date, has adopted as a principle to take reasonable measures within the scope of this policy and the legislation, by taking care that the sources from which personal data are obtained are specific or identifiable and that the accuracy and reliability of these sources are tested and confirmed, and by taking into account requests arising from the inaccuracy of personal data.

Within the scope of the KVK Policy, the DATA CONTROLLER declares and accepts that it will create the conditions that will enable:

in line with the purpose for which this principle was established.

In line with this principle, the DATA CONTROLLER declares and accepts as a policy that the personal data of the data subject are and will be processed for explicit, precise and legitimate purposes that comply with the rules envisaged in law and forming the basis of this policy, are connected with the work and services it offers, and are determined because they are required for these.

Again as a requirement of the principle of specificity and explicitness, the DATA CONTROLLER has adopted and accepted as its KVK Policy that appropriate arrangements are made in the legal acts, transactions and texts concerning the persons it is in interaction and communication with, in which the purposes of processing personal data are explained (such as explicit consent, the disclosure notice, responding to data subjects' applications, application to the data controllers' registry, contracts and similar documents); that care is taken not to use technical and legal terminology that cannot be understood by everyone while making these arrangements, and that they are kept up to date; that no data will be processed without approval or permission for purposes other than those declared to the data subject; and that, if data are processed for other purposes, legal and criminal liabilities will arise from these acts.

The DATA CONTROLLER acts in the awareness that the data of persons it is in interaction and communication with must be suitable for achieving the purposes determined and explained in advance, that the processing of personal data unrelated to the achievement of the purpose or not needed should be avoided, and that data processing cannot be undertaken to meet needs that may arise later.

In parallel with this, the DATA CONTROLLER considers it a requirement of the KVK Policy that data processing for possible needs would mean a new data processing activity, that in such a case one of the conditions for processing personal data regulated in Article 5 of the KVK Law must be or will be met, that the data processed will be limited only to the personal data necessary for achieving the purpose, and that processing data beyond what is necessary for the purpose would constitute a violation of the principle of limitation.

The DATA CONTROLLER knows and acts accordingly that the principle of proportionality addressed within the framework of this article means establishing a reasonable balance between data processing and the purpose desired to be achieved by it, in other words, that data processing must take place to an extent appropriate to and compatible with the purpose of data processing.

As a requirement of the "principle of purpose limitation", one of the most important principles of the KVK Policy, the DATA CONTROLLER has taken and is taking the necessary legal and administrative measures to retain personal data for the period appropriate to the purpose for which it processes them, within the framework of the provisions of national or international legislation, also taking limitation periods and forfeiture periods into account; to keep them for the reasonable period necessary for the purpose for which they are processed if no such statutory period is envisaged; and to delete, destroy or anonymize the data if there is no valid reason for retaining them any longer.

While on the one hand fulfilling the requirement of the principle of retention in accordance with these periods, on the other hand, within the framework of the provision in Article 12 of the KVK Law, the DATA CONTROLLER keeps the appropriate physical and technological security level secure and up to date in order to prevent the unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the safekeeping of personal data.

In line with the purpose referred to in this article and within the scope of this policy, a personal data retention and destruction policy and principles have been established by the DATA CONTROLLER, retention periods and the technical and administrative measures required for retention have been determined, and the necessary legal, administrative, physical and technological measures have been put into practice to ensure that personal data are retained in accordance with these principles.

When applying for registration with the registry under Article 16 of the KVK Law, the DATA CONTROLLER determines the maximum period necessary for the purpose of processing personal data, also taking Article 9 of the VSSH Regulation into account, declares this period, and notifies the registry of the processing purposes of the data categories notified to the registry and of the maximum retention periods necessary for their processing on the basis of those purposes and envisaged in the legislation, providing that limitation periods or the longest period be taken as the basis for retention since these periods may differ from the periods envisaged in the legislation or limitation periods may apply.

Finally, when the retention periods determined and notified by the DATA CONTROLLER, taking into account both the periods envisaged under the legislation to which the DATA CONTROLLER is subject by virtue of its legal obligations and the limitation periods, expire, personal data are deleted, destroyed or anonymized by the DATA CONTROLLER.

Within the framework of Article 5 of the KVK Law, before starting to process the data of persons it is in interaction and communication with, the DATA CONTROLLER evaluates whether reliance can be placed on one of the other data processing conditions specified below and found in the legislation, and if, as a result of this evaluation, none of the other relevant conditions for data processing exists, it proceeds to obtain the data subject's explicit consent.

For this purpose, arrangements have been made in the physical and electronic environments containing the data of persons in interaction and communication with the DATA CONTROLLER, and in all legal acts, transactions and texts (such as explicit consent, the disclosure notice, responding to data subjects' applications, application to the data controllers' registry, forms, declarations, contracts and similar documents), and the whole process has been brought into compliance and harmony with the legislation.

The DATA CONTROLLER, as in every field, is an institution that acts in accordance with the provisions and rules envisaged in national and international legislation and respects the law within the scope of the KVK Policy.

Within the scope of the KVK Law, where one of the data processing conditions expressly envisaged in the legislation arises or there is a mandatory rule for the processing of personal data, the DATA CONTROLLER carries out the processing of personal data without the need for the data subject's explicit consent.

Where it is necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility, or who has legal capacity but for any reason does not or cannot have capacity to act, or whose consent is not legally valid for other reasons, or of another person, the DATA CONTROLLER may process that person's personal data without obtaining the data subject's explicit consent.

In order to be able to carry out activities relating to the services and products required by the sector in which it operates, the DATA CONTROLLER enters into contracts with natural or legal persons that are in interaction and communication with it, and assumes mutual obligations and responsibilities under these contracts.

Where the processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of these contracts, it processes the data of the data subjects, limited to this purpose. Because of the data processing activity carried out within this scope, the DATA CONTROLLER does not need the data subject's explicit consent.

The DATA CONTROLLER may process personal data without resorting to the data subject's explicit consent, as required by a legal responsibility or obligation within the framework of other legislative provisions envisaged by national or international legislation, primarily the KVK Law, or in line with the requests of official institutions and organizations, public prosecutors, courts or other state departments. It may share them with these institutions.

The DATA CONTROLLER may subject to data processing, within the envisaged purpose, the personal data that the data subject it is in interaction and communication with has disclosed to the public, announced, shared in a manner open to the access of third parties, or made public by his or her own explicit and free will. In such a case, it does not need to resort to the data subject's explicit consent.

The DATA CONTROLLER processes the personal data of the data subject in cases that are necessary for the establishment, exercise or protection of a right, such as documenting an investigation conducted in its favour or against it, proving a lawsuit, and retaining invoices relating to legal proceedings and documents for the use of contracts in official transactions for the duration of the limitation period. In such a case, it does not need to resort to the data subject's explicit consent.

Within the framework of the KVK Law, where data processing is necessary for the legitimate interests of the DATA CONTROLLER, provided that it does not harm the fundamental rights and freedoms of the data subject, it is possible to process the data subject's personal data. In such a case, the data subject's explicit consent is not sought.

In other words, as against the protection of the data subject's fundamental rights and freedoms, where the DATA CONTROLLER has a legitimate, sufficiently effective and presently existing interest, where this interest is in line with the spirit and purpose of the legislation, and where the personal data processing activity makes it necessary to carry out current activities, there is no legal obstacle to the DATA CONTROLLER processing the data subject's personal data.

The DATA CONTROLLER regards data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, as special categories of personal data.

The processing of special categories of personal data is, as a rule, prohibited under the legislation. However, the processing of these data is also possible where:

Where the Board envisages that adequate measures determined by it must also be taken in the processing of special categories of personal data, these Board decisions are also complied with.

The DATA CONTROLLER has separately and expressly established the KVSİ (Personal Data Retention and Destruction) Policy in order to determine its activity policies on the deletion, destruction or anonymization of personal data. Nevertheless, to explain briefly:

Under the provision on the deletion, destruction or anonymization of personal data regulated in Article 7 of the KVK Law, even though personal data have been processed in accordance with the law, where the reasons requiring their processing cease to exist, these data are deleted, destroyed or anonymized by the DATA CONTROLLER ex officio or upon the request of the data subject.

Accordingly, the DATA CONTROLLER may delete, destroy or anonymize personal data in cases such as:

and similar cases.

In the presence of one of the conditions listed above, deleting, destroying or anonymizing personal data is the obligation and responsibility of the DATA CONTROLLER, without the need for an application by the data subject. However, the data subject, too, if the conditions are met, has the right to request the DATA CONTROLLER to delete, destroy or anonymize his or her personal data.

On the other hand, the KVSİ Policy has been prepared by the DATA CONTROLLER within the framework of the provisions envisaged in Article 7 and the following articles of the KVSYH Regulation. The retention, deletion, destruction or anonymization of the personal data processed by the DATA CONTROLLER is carried out within the framework of the principles in the KVSİ Policy related to this policy.

The principles in the KVSİ Policy also apply to the situations concerning bringing data processed by the DATA CONTROLLER before the entry into force of the KVK Law, or before any amendment of the law where applicable, into compliance with the law and up to date and, if necessary, deleting, destroying or anonymizing them.

As a rule, personal data cannot be transferred without the explicit consent of the data subject.

However, the DATA CONTROLLER may transfer personal data where:

If one of these conditions exists, personal data may also be transferred without obtaining the explicit consent of the data subject.

Again, on condition of taking adequate measures, the DATA CONTROLLER may transfer special categories of personal data where:

If one of these conditions exists, special categories of personal data may also be transferred without obtaining the explicit consent of the data subject.

In addition, the DATA CONTROLLER knows that it is obliged and responsible for also taking the adequate measures determined by the KVK Board in the transfer of these special categories of personal data.

The transfer of personal data abroad is also possible under the following conditions.

Personal data may be transferred abroad by the DATA CONTROLLER and by data processors where one of the conditions specified above and in the articles referred to in this Article 8 exists and there is an adequacy decision, given by the KVK Board and published in the RG, concerning the country, the sectors within the country or the international organizations to which the transfer will be made.

In the absence of the adequacy decision mentioned above, where one of the conditions specified above in this Article 8 exists, provided that the data subject has the opportunity to exercise his or her rights and to apply to effective legal remedies in the country to which the transfer will be made,

If one of these appropriate safeguards is provided by the parties, personal data may be transferred abroad by the DATA CONTROLLER or by data processors.

Where a standard contract is involved, this contract is notified by the DATA CONTROLLER to the KVK Authority within five business days of its signature.

In the absence of an adequacy decision and where none of the appropriate safeguards can be provided, the DATA CONTROLLER and data processors may transfer personal data abroad, provided that it is occasional and necessary, only if one of the following cases exists. These incidental conditions are as follows:

Under Article 12 of the KVK Law No. 6698, the DATA CONTROLLER is obliged to take all kinds of technical and administrative measures to ensure the appropriate level of security for the purposes of:

and has taken, and is taking, the administrative and technical measures in this respect.

On the other hand, the DATA CONTROLLER accepts that, where personal data are processed by another natural or legal person on its behalf, it is jointly responsible with these persons for taking the administrative and technical measures mentioned above; that it is obliged to carry out or have carried out the necessary audits in its own institution or organization in order to ensure the implementation of the provisions of the legislation; that the DATA CONTROLLER and data processors cannot disclose the personal data they learn to anyone else in violation of the provisions of the legislation and cannot use them outside the purpose of processing, and that these obligations continue after they leave their duties; that, where processed personal data are obtained by others through unlawful means, it is obliged to notify the data subject and the Board of this as soon as possible; and that the KVK Board may, where necessary, announce this on its own website or by another method it deems appropriate.

In addition, it carries out the requirements of the regulatory acts issued by the KVKK in order to determine obligations regarding data security. The details of the technical and administrative measures, and the personal data processed and classified by sector by taking the minimum criteria determined by the KVK Board, are shown in the tables, diagrams and graphs prepared within the scope of the KVK Policy.

The DATA CONTROLLER knows and accepts that, where personal data are processed by another natural or legal person on its behalf, that is, where a data processor is involved, it is jointly responsible with these persons for taking the measures mentioned above.

The DATA CONTROLLER is obliged to carry out or have carried out the necessary audits in its own institution or organization, in person, through its representative or through a third party it appoints, in order to ensure the implementation of the provisions of this KVK Law. In addition, data processors do not disclose the personal data they learn to anyone else in violation of the provisions of this KVK Law and do not use them outside the purpose of processing. This continues even after they leave their duties.

Under Article 10 of the KVK Law, the DATA CONTROLLER is obliged to provide the data subject with the following information, in person or through the person it authorizes, at the time personal data are obtained:

On the other hand, the DATA CONTROLLER has adopted as a principle to comply with the following obligations under Articles 5 and 6 of the AYYGE Communiqué, published by the KVKK on the procedures and principles that data controllers must follow within the scope of the obligation to inform.

When fulfilling the obligation to inform, orally, in writing, by voice recording or through a physical or electronic medium such as a call center, by the DATA CONTROLLER or by the person it authorizes, it has accepted the procedures and principles listed below:

According to Article 6 of the same regulation, where personal data are not obtained from the data subject, that is, where there are personal data obtained from a third person, the DATA CONTROLLER, within the scope of the obligation to inform,

informs the data subject.

Under Article 13 of the KVK Law and the VSBUH Communiqué published in the RG dated 10.03.2018 pursuant to this article, applications concerning personal data made by data subjects in writing, or by using the registered electronic mail (KEP) address specified in the said Communiqué, a secure electronic signature, a mobile signature or the e-mail address registered by the data subject in the DATA CONTROLLER's system, or through software or an application developed by the DATA CONTROLLER for the purpose of applications, are concluded by the DATA CONTROLLER free of charge, according to their nature, as soon as possible and within thirty days at the latest.

However, where the transaction requires an additional cost, the DATA CONTROLLER has the right to charge the applicant data subject the fees in the tariff determined by the KVK Board.

If the DATA CONTROLLER accepts the data subject's application request, or rejects it by explaining its reasons, it notifies the data subject of this response in writing or in electronic form. If the request subject to the application is accepted, the requirements of this request are fulfilled by the DATA CONTROLLER as soon as possible. If the application resulted from the fault of the DATA CONTROLLER, the fee collected is refunded to the data subject.

In cases where the application is rejected by the DATA CONTROLLER, the response given is found insufficient, or the application is not answered in time, the data subject has the right to lodge a complaint with the KVK Board within thirty days from the date of learning the DATA CONTROLLER's response and, in any case, within sixty days from the date of application.

Under Article 16 of the KVK Law, the DATA CONTROLLER, as an organization registered in the VERBİS system kept publicly accessible by the KVKK, has adopted as a principle to comply with the criteria for processing and transferring personal data, determined in the VSSH Regulation and by the KVK Board and listed below.

Accordingly, the criteria in question are:

Where processed personal data are obtained by others through unlawful means, the DATA CONTROLLER notifies the data subject and the KVK Board of this as soon as possible.

The KVK Board has the right and authority, where necessary, to announce this on its own website or by another method it deems appropriate.

Under Article 11 of the KVK Law, the data subject may at any time apply to the DATA CONTROLLER and, in relation to himself or herself, has the right to:

as rights held by the data subject.

In addition to applying directly to the judicial route to protect their rights regarding their personal data held by the DATA CONTROLLER, data subjects may use the following methods of seeking remedies introduced by Articles 13, 14 and 15 of the KVK Law.

Under Article 11 of the KVK Law, data subjects have the right to apply to the DATA CONTROLLER to learn whether personal data relating to themselves are being processed, to request information about them if they have been processed, to request the correction of the data if their content is incomplete or inaccurate, and, if they are unlawful, their deletion, destruction or anonymization, and the notification of the operations carried out accordingly to the third parties to whom the data have been disclosed, and to request compensation for their damages arising from the unlawful processing of the data.

In order to exercise their right to complain, data subjects must first apply to the DATA CONTROLLER. Without exhausting this route, it is not possible to resort to a complaint to the KVK Board. Data subjects who do not wish to resort to the complaint route may go directly to the judicial route.

The data subject's request is answered by the DATA CONTROLLER, according to the nature of the request, as soon as possible and within 30 days at the latest.

Data subjects whose application is rejected, who find the response given insufficient, or whose application is not answered in time may, after this stage, exercise the right to complain to the KVK Board or apply directly to the judicial route.

Data subjects' rights to claim compensation are reserved.

The data subject may apply, in writing or by e-mail, to the addresses and means of communication of the DATA CONTROLLER specified on the first page above, regarding his or her personal data.

The data subject may apply to the DATA CONTROLLER regarding his or her personal data with a written document bearing a wet signature, or by using a secure electronic signature or a mobile signature.

These applications may be made to the DATA CONTROLLER by data subjects in writing, or by using the registered electronic mail (KEP) address specified in the VSBUH Communiqué, a secure electronic signature, a mobile signature or the e-mail address previously notified by the data subject to the DATA CONTROLLER and registered in VERBİS, or through software or an application developed for the purpose of applications. The DATA CONTROLLER concludes the applications made, according to their nature, as soon as possible and within thirty days at the latest, free of charge.

The DATA CONTROLLER may accept the requests addressed to it, and has the right and authority to reject them by explaining its reasons.

If the request addressed to it is accepted by the DATA CONTROLLER, the requirements of this request are fulfilled directly and immediately. Failure to fulfil the requirements of the request despite its acceptance means that the request has been rejected by the DATA CONTROLLER.

In cases where the data subject's application is rejected by the DATA CONTROLLER, the response given is found insufficient, or it does not respond in time, the data subject may apply to the KVK Board.

Under Article 13 of the KVK Law, the DATA CONTROLLER meets data subjects' application requests free of charge. However, where the operation to be carried out requires an additional cost, it is possible to charge the data subject a fee according to the tariff determined by the KVK Board.

According to this tariff, if the DATA CONTROLLER is to respond to the data subject's application in writing, no fee is charged up to 10 pages, and a transaction fee of 1 Turkish Lira is charged for each page above 10 pages. If the response to the application is to be given on a recording medium such as a CD or flash drive, the fee that may be requested by the DATA CONTROLLER cannot exceed the cost of that recording medium.

If the DATA CONTROLLER is at fault in relation to the data subject's request concerning the implementation of the KVK Law, the fee collected is refunded to the data subject.

Data subjects whose application to the DATA CONTROLLER is rejected, who find the response given insufficient, or whose application is not answered in time may exercise the right to complain to the KVK Board.

In the case of unlawful processing of personal data, that is, in the case of any violation, the KVK Board has the authority to conduct an investigation under Article 15 of the KVK Law.

The KVK Board may exercise this authority upon complaint or ex officio without a complaint.

In order for notifications and complaints to the KVK Board to be processed, they must be submitted in accordance with the provisions set out in Article 6 of the DHKD Law No. 3071 and must meet the following conditions together.

In order to be able to lodge a complaint separately after applying to the DATA CONTROLLER, the data subject must also comply with certain time limits. Accordingly, the data subject may lodge a complaint with the KVK Board within thirty days from the date of learning the DATA CONTROLLER's response. In every case, it is possible for the data subject to lodge a complaint with the KVK Board within sixty days from the date of application to the DATA CONTROLLER.

When examining the requests sent by the data subject, the KVK Board has the right and authority to request all necessary information and documents from the DATA CONTROLLER, to carry out an on-site inspection, to have facilities provided for the purpose of the on-site inspection, and to request that the documents it wishes be sent to it within fifteen days, except for documents in the nature of state secrets.

Before the investigation process is concluded, the KVK Board may also decide to stop the processing of data or the transfer of data abroad in cases where damage that is difficult or impossible to compensate would arise and there is a clear unlawfulness.

The KVK Board must give the data subject a response within a sixty-day period. If no response is given to the applicant during this period, the request is deemed rejected.

There is no time limit in investigations initiated ex officio by the KVK Board.

The KVK Board makes a decision as a result of an investigation conducted upon complaint or initiated ex officio. Under the KVK Law, if no response is given within sixty days from the date of the data subject's complaint, the data subject's complaint and the request subject to the complaint are deemed rejected.

If the KVK Board concludes, as a result of its investigation, that the right concerning the protection of personal data has been violated, it decides that the unlawfulness it has identified be remedied by the DATA CONTROLLER and notifies this decision to both the DATA CONTROLLER and the data subject.

The DATA CONTROLLER fulfils the requirements of the decision given by the KVK Board and sent to it without delay and within thirty days at the latest from the date of notification.

Compliance with the principle decisions taken by the KVK Board is mandatory both for those concerned and for other persons concerned in similar cases.

This policy is reviewed and updated at least once a year.

This Policy is deemed to have entered into force after it is published on the data controller's websites.

This policy can be repealed only by the preparation and entry into force of another written policy.