Last updated: 13.09.2026
This document is published in Turkish. In case of any discrepancy, the Turkish text prevails.
1. Purpose
This Policy sets out how DRD Group Sigorta Aracılık Hizmetleri Limited Şirketi ("the Company"), as data controller, processes personal data in line with Personal Data Protection Law no. 6698 ("KVKK") and related legislation.
2. Scope
The Policy covers all personal data processed by the Company, wholly or partly by automated means or as part of a filing system, relating to:
- Customers and prospects: policyholders, insured persons, beneficiaries and people requesting quotations
- Website visitors
- Employees and job applicants
- Suppliers and service providers, and their representatives and staff
- Business partners such as insurers and loss adjusters, and their representatives and staff
3. Relationship with legislation
Applicable legislation prevails where it differs from this Policy.
4. Definitions
- Explicit consent: consent on a specific matter, based on information and freely given.
- Personal data: any information relating to an identified or identifiable natural person.
- Special categories of data: data listed in Article 6 of the KVKK, including health data.
- Processing: any operation performed on personal data, such as collection, recording, storage, alteration, disclosure or transfer.
- Data controller / data processor: the person who determines the purposes and means of processing / the person who processes data on the controller's behalf.
5. Principles
Under Article 4 of the KVKK, personal data is processed lawfully and fairly; kept accurate and up to date where necessary; processed for specified, explicit and legitimate purposes; limited to what is relevant and necessary; and retained only for the period required by law or by the purpose.
6. Legal grounds
Data is processed with explicit consent or, under Article 5/2, where processing is expressly provided for by law; necessary to protect life or physical integrity; necessary for concluding or performing a contract; necessary to meet a legal obligation; made public by the data subject; necessary to establish, exercise or defend a right; or necessary for the controller's legitimate interests without harming the data subject's fundamental rights.
Health data is processed only for health, life and personal accident insurance and bodily injury claims, to the extent the insurer requires, on one of the grounds in Article 6 (including explicit consent) and with the adequate safeguards set by the Board.
7. Data categories and purposes
We process identity, contact, insured asset, customer transaction, financial, legal, health (special category), transaction security and employment data in order to prepare quotations, issue and renew policies, handle claims, meet legal obligations, communicate with you, manage requests and complaints, run finance and HR processes and keep information secure. Marketing communications are sent only with your consent.
8. Transfers
Data may be transferred, under Articles 8 and 9 of the KVKK and only as necessary, to:
- Insurers from which quotations are obtained and which issue policies
- The Insurance Information and Monitoring Centre (SBM)
- SEDDK and other authorised public bodies and courts
- Loss adjusters and parties involved in claims handling
- IT, hosting, e-mail, archiving, accounting and legal service providers, and banks for payments
9. Retention and destruction
Policy data is, as a rule, kept for 10 years after the policy relationship ends, in line with insurance legislation and the Turkish Commercial Code. Quotation requests that do not become policies are deleted or anonymised within 2 years at the latest. When retention ends, data is erased, destroyed or anonymised under Article 7 of the KVKK and the related regulation.
10. Data security
We apply appropriate technical and organisational measures under Article 12 of the KVKK, including access restriction, confidentiality undertakings, up-to-date security software, backups, staff awareness and data processing agreements. If data is obtained unlawfully by others, we notify the data subject and the Board as soon as possible.
11. Your rights and applications
Under Article 11 of the KVKK you may learn whether your data is processed and request information about it; learn the purpose and recipients; request correction, erasure or destruction and notification of these to recipients; object to adverse results of solely automated analysis; and claim compensation for unlawful processing.
You may apply in writing to Aktarhüssam Mah. 1. Değirmen Sk. Değirmen İş Hanı No: 9 İç Kapı No: 404, Osmangazi / Bursa or from your registered e-mail address to info@drdgroupsigorta.com, as described on our Data Subject Application page. Applications are concluded within 30 days at the latest. You may then complain to the Personal Data Protection Board under Article 14.
12. Effect and updates
This Policy takes effect when published and may be updated; the current version is always available at drdgroupsigorta.com.