As known, according to Article 12(5) of Law No. 6698, in case the processed data are obtained by third parties by unlawful means, the data controller shall communicate the breach to the data subject (natural person concerned) and notify it to the Board within the shortest time. Where necessary, the Board may announce such breach at its official website or through in any other way it deems appropriate.

Briefly, in the letter dated 09.03.2020 sent to the Personal Data Protection Authority by Gratis Domestic and Foreign Trade Inc. as the data controller, the following issues are reported;

• The breach occurred between 04.04.2020 and 06.03.2020 and was detected on 06.03.2020,
• In 06.03.2020, an e-mail from an unidentified person about the obtainment of the email addresses/passwords of the Web Site members of the Company was received
• More than one entry attempts are made with the e-mail addresses/passwords obtained by the sources out of the Company and after every unsuccessful attempt, another e-mail/password attempts are made. Hence, passwords of accounts of 2092 web site users were verified,
• Personal data categories affected by the breach are identity, contact and transaction data of customer,
• 2092 persons have been affected by the breach, • Data subjects can get information about the data breach from info@gratis.com and the call center by means of the telephone number of 0 850 210 69 00.

While the examination on the subject is continuing, it was decided to announce the notification of the data breach on the website of the Authority pursuant to the Decision of the Personal Data Protection Board dated 09.03.2020 and numbered 2020/221.

Respectfully announced to the public.