Personal Data Request Procedure

1. Requests you may make

You may exercise the rights listed in Article 11 of Turkish Law No. 6698, including information, access, purposes and recipients, correction, deletion or destruction, notification to recipients, objection to solely automated adverse outcomes, and compensation for unlawful processing.

Where the GDPR applies, requests concerning access, rectification, erasure, restriction, objection, portability, withdrawal of consent and supervisory-authority complaints are also considered.

2. Submission channels

If an ordinary email cannot be associated with the applicant, we may request additional information or another channel to verify identity.

• Deliver a signed written request in person, through a notary or by registered post to Zafer Mahallesi, Adile Naşit Bulvarı No:1/1, City Center Home Office, Kat: 9 Daire: 111, Esenyurt / İstanbul
• Use registered electronic mail (KEP), secure electronic signature or mobile signature through an official company communication channel
• Send an email with the subject “Personal Data Request” to [email protected] from an address you previously notified to Cen Medya and that is recorded in our systems
• Use any other verifiable method accepted by applicable law

3. Information required in the request

• Name and surname, and signature for a written request
• Turkish identity number for Turkish citizens; nationality, passport number or available identity number for foreign applicants
• Residential or business address for notifications
• Email address, telephone and fax number, if available
• The subject and scope of the request and information helping identify the data or operation
• Supporting information and documents

4. Identity and authority verification

Identity is verified using measures proportionate to the request to prevent disclosure to unauthorised persons. A copy of an identity document is requested only where necessary, and unrelated fields may be redacted.

A representative, parent or guardian must provide a valid power of attorney, guardianship record or other evidence of authority.

5. Assessment and response time

Requests under Law No. 6698 are answered free of charge as soon as possible and no later than thirty days, depending on their nature. A fee based on the tariff set by the Turkish Personal Data Protection Board may apply if the process creates an additional cost.

Requests under the GDPR are answered without undue delay and generally within one month. If complexity or volume requires an extension, the applicant is notified with reasons within the original period.

6. Response, refusal and complaint

The response is sent through the selected or another legally compliant channel. A refusal, partial response or delay is explained.

For Turkish-law requests, a complaint may be made to the Personal Data Protection Board within thirty days of learning the response and in any event within sixty days of the original application. Where the GDPR applies, a complaint may be made to the competent authority where the person lives or works or where the alleged infringement occurred.

7. Secure submission

Provide only information necessary to assess the request. Do not send passwords, payment-card details, health records or unrelated third-party data. Identity and contact data obtained for a request is used only to verify, answer and maintain legally required records of that request.