Purpose
ARTICLE 1 – (1) The purpose of this Policy is to determine the procedures and principles regarding the processing and protection of personal data as well as the deletion, destruction and anonymization of personal data processed, which is carried out in accordance with the legal legislation constituting the basis for this Policy by Intermed Sağlık Hizmetleri A.Ş. (the “Company”), which is the data controller in accordance with the Law No. 6698.
Scope
ARTICLE 2 – (1) This Policy covers particularly the users, visitors and commentators to whom the Company is related while providing its services, the Company’s employees, employee candidates, managers, relevant users, third parties that the Company cooperates with and their employees, managers and other third parties, in case their personal data are processed by the Company by fully or partly automated means, or by non-automated means provided that they are part of a data recording system.
(2) The entirety of this Policy or only some of its provisions may apply to the personal data subjects specified above.
Legal Basis
ARTICLE 3 – (1) This Policy was prepared based on the Law on the Protection of Personal Data No. 6698, the Regulation on the Registry of Data Controllers No. 30286 and the Regulation on the Deletion, Destruction or Anonymization of Personal Data No. 30224.
(2) In case of any discrepancy between this Policy and the current legislation regarding the processing, protection and destruction of personal data, the provisions of the Legislation shall prevail.
Definitions
ARTICLE 4 – (1) In the implementation of this Policy;
Recipient Group: Refers to the category of natural or legal persons to whom personal data are transferred by the data controller,
Inventory: Refers to the Personal Data Inventory prepared by the Company in accordance with the Legislation,
Inventory: Refers to the Personal Data Inventory prepared by the Company in accordance with the Legislation,
Relevant User: Refers to the persons who process personal data within the data controller’s organization or in line with the power and instructions given by the data controller, other than the person or department responsible for technical retention, protection and backup of data,
Destruction: Refers to deletion, destruction or anonymization of personal data,
Law: Refers to the Law on the Protection of Personal Data No. 6698 dated 24/3/2016,
Recording media: Refers to any media containing personal data which are processed by fully or partly automated means, or by non-automated means provided that they are part of a data recording system.
Personal data: Refers to any information related to an identified or identifiable natural person,
Personal data owner: Refers to a natural person whose personal data are processed,
Personal data processing inventory: Refers to the inventory formed by the Company, where it gives details of its personal data processing activities which are carried out by it according to its business processes, by associating them to the purposes of processing of personal data, the data categories, the recipient group and the data subject group, and by explaining the maximum period for which personal data will be processed for the required purposes, the personal data anticipated to be transferred to foreign countries, and the measures taken regarding data security,
Anonymization of personal data: Refers to the process of rendering it impossible for personal data to be associated with any identified or identifiable natural person in any way, even if they are matched with other data.
Processing of personal data: Refers to any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partly automated means or by non-automated means provided that they are part of a data recording system,
Deletion of personal data: Refers to the process of rendering personal data inaccessible to and non-reusable by relevant users in any manner,
Destruction of personal data: Refers to the process of rendering personal data inaccessible to, non-restorable and non-reusable by anybody in any manner.
Board: Refers to the Personal Data Protection Board,
Authority: Refers to the Personal Data Protection Authority,
Logging: Refers to the record monitoring method, which consists of steps such as analyzing the incident records, in other words logs, produced by information systems covering all critical networks and devices, according to the specified rules, collecting them comprehensively, combining them, retaining them in their original form, and analyzing and presenting them as a text, allows obtaining the indicators and evidence of a possible attack, and helps to obtain important information such as when the attack was performed, which protocols were used and where the attack started,
Private personal data: Refers to data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dressing, membership to associations, foundations or unions, health, sexual life, criminal conviction and security measures as well as biometric and genetic data of persons,
Periodic destruction: Refers to the process of deletion, destruction or anonymization of personal data, as specified in the personal data retention and destruction policy, which shall be carried out ex officio at recurrent intervals, in case all conditions for processing of personal data specified under the Law cease to exist,
Policy: Refers to this Personal Data Retention and Destruction Policy, which the Company, which is deemed to be the data controller in accordance with the law, takes as basis for the process of determining the maximum period necessary for the purpose for which personal data are processed, and for the process of deletion, destruction and anonymization of personal data,
Secure Sockets Layer (SSL): Refers to the security protocol, which means "Secure Socket Layer" in Turkish, aims to establish a secure connection between the website and the user and prevents personal data from being obtained by third parties,
Registry: Refers to the registry of data controllers kept by the Personal Data Protection Authority,
Company: Refers to the company with the trade name of Intermed Sağlık Hizmetleri AŞ,
Data processor: Refers to the natural and legal person who processes personal data on behalf of and based on the authority granted by the data controller,
Data recording system: Refers to any recording system in which personal data are processed by being structured according to specific criteria,
Data controller: Refers to the natural or legal person who determines the purposes and means of processing of personal data, and is responsible for the establishment and management of the data recording system,
(2) For those definitions not included in this Policy, the definitions in the Law shall apply.
Personal Data Recording Media
ARTICLE 5 – (1) The personal data of data subjects are securely retained by the Company in the media listed in the below table, in accordance with the applicable legislation, particularly the provisions of LPPD, and international data security principles:
General principles for the retention and destruction of personal data
ARTICLE 6 – (1) The Company is a Data Controller that is obliged to register with the Registry, and accepts, declares and undertakes that it is obliged to act in accordance with this Policy in order to retain personal data it holds in accordance with the Inventory and to delete, destroy or anonymize them when necessary.
(2) The following principles shall apply to the retention and destruction of personal data:
kayit-saklama.kabul, beyan ve taahhüt eder.
Legal, technical and other reasons requiring the retention and destruction of personal data
ARTICLE 7 – (1) The Company retains personal data of data owners, for those legal, technical and other reasons, including but not limited to;
It is stored for legal, technical and other reasons, but not limited to similar purposes and reasons.
(2) The Company destroys personal data of data owners, for those legal, technical and other reasons, including but not limited to;
For legal, technical and other reasons; but not limited to similar purposes and reasons, it is destroyed.
Technical and administrative measures taken for secure retention of and for prevention of unlawful processing of and access to personal data
ARTICLE 8 – (1) Technical measures taken by the Company for secure retention of and for prevention of unlawful processing of and access to personal data of data subjects, were specified as follows:
(2) Administrative measures taken by the Company for secure retention of and for prevention of unlawful processing of and access to personal data of data subjects, were specified as follows:
ARTICLE 9 – (1) Technical measures taken by the Company for lawful destruction of personal data of data subjects, were specified as follows:
(2) Administrative measures taken by the Company for lawful destruction of personal data of data subjects, were specified as follows:
Departments in charge of the retention and destruction processes of personal data, and their details
ARTICLE 10 – (1) The list showing the titles and job descriptions of the personnel working in the departments of the Company in charge in the personal data retention and destruction processes, is given in ANNEX-1.
Retention and Destruction Periods
ARTICLE 11 – (1) F-LC-TR-017-019 Data retention plan, which contains the table showing the retention and destruction periods of personal data of data subjects according to their categories, was prepared and is available in the company’s quality documentation system.
Periodic destruction periods
ARTICLE 12 – (1) On expiry of the period specified in F-LC-TR-017-019 Data retention plan, which was prepared according to the categories of personal data processed by the Company, periodic destruction shall be performed within 6 months at the latest.
Periods for deletion and destruction of personal data in case of request by the relevant person
ARTICLE 13 – (1) When a data subject files an application to the company and requests the deletion or destruction of his/her personal data pursuant to article 13 of the Law:
Entry into force
ARTICLE 14 – (1) This Policy, which was prepared by the Company, has entered into force as of the date when it was published on the Website.
(2) In case of any controversies between this Policy and the provisions of LPPD and other relevant Legislation, provisions of LPPD and other relevant Legislation shall prevail.
Updates
ARTICLE 15 – (1) The table of updates for this Policy is given in ANNEX-2.
Personal Data Protection Officer
ARTICLE 16 – (1) Details of the Company's Personal Data Protection Officer are as follows;
ANNEX-1: TABLE OF DEPARTMENTS IN CHARGE AND THEIR DETAILS
The titles, departments and job descriptions in the area of protection of personal data, of the Company’s employees involved in the personal data retention and destruction processes, are given in the below table.
Only the job descriptions regarding the protection of personal data were given for all the employees listed below, and all of them are in charge of ensuring compliance with the retention periods of personal data concerning the processes included in their job descriptions.
| TITLE | UNIT | JOB DESCRIPTION |
|---|---|---|
| Information Technologies Manager | Information Technologies Department | Establishing the most up-to-date and technologically necessary security and virus protection systems regarding the retention, destruction and security of personal data, taking the confidentiality and information security measures, providing the necessary security protocols against all kinds of data theft and forgery, establishing authorization, key and password methods for accessing personal data within the Company, using appropriate backup programs, monitoring access to data recording media by using logging methods, conducting penetration tests regularly and when needed, auditing all relevant processes, retaining personal data retained in technical recording media for the technically determined retention period, destroying the same, and reporting to the personal data protection department following the destruction |
| Data Protection Officer (DPO) | Quality Department | Receiving or accepting on behalf of the data controller the notifications or correspondence made by the Authority, forwarding to the data controller the requests made to the data controller by the Authority, forwarding to the Authority the replies to be received from the data controller, in case no other principle is specified by the Authority, receiving on behalf of the data controller and forwarding to the data controller the applications to be made by data subjects to the data controller, in accordance with paragraph one of article 13 of the Law, in case no other principle is specified by the Authority, forwarding to the data subjects the reply of the data controller, in accordance with paragraph three of article 13 of the Law, and carrying out the works and transaction in relation to the Registry on behalf of the data controller |
| Lawyer | Legal Department | Providing legal support in the identification, processing, retention and destruction of personal data, drawing up contracts, and monitoring the relevant legislation |
| Department Heads | Relevant Departments | Destroying personal data retained by the Company in non-technical data recording media (paper, department cabinets, archive), and reporting to the personal data protection department following the destruction |
| All Employees | All Departments | Forwarding to the personal data protection and legal departments the applications made by users in accordance with article 11 of the Law. |
| Data Protection Officer (DPO) | Quality Department | Managing, coordinating, auditing and reporting all personal data protection processes, conducting relations with the Authority, organizing awareness-raising training, informing other departments about retention and destruction processes, taking necessary administrative measures for the retention and destruction of personal data, ensuring that all transactions related to the deletion, destruction and anonymization of personal data are recorded, and retaining the said records for the specified period |
ANNEX-2: TABLE OF UPDATES
The changes made to this Policy are set out in the below table.
| DATE OF UPDATE/VERSION | SCOPE OF UPDATES |
|---|---|
| 8.2.2021 / 00 | Date of publication of the Policy |
