Personal Data Protection and Processing Policy
1.Purpose
2.Scope
3.Authority and Responsibilities
4.Definitions and Abbreviations
5.Personal Data Protection and Processing Policy
5.1.Ensuring the Security of Personal Data
5.1.1.Technical Measures
5.1.2.Administrative Measures
5.1.3.Storage of Personal Data in a Secure Environment
5.1.4.Audits for the Sustainability of Personal Data Protection
5.1.5.Measures Taken in Case of Unauthorized Disclosure of Personal Data
5.1.6.Measures Applied to Ensure Third Parties Protect Personal Data
5.1.7.Measures Applied for the Protection of Special Category Personal Data
5.1.8.Creating Awareness to Ensure Protection of Personal Data
5.2.Principles for Processing Personal Data
5.3.Conditions for Processing Personal Data
5.4.Purposes of Processing Personal Data
5.5.Destruction of Personal Data
5.6.Transfer of Personal Data to Domestic Persons
5.7.Transfer of Personal Data to Foreign Persons
5.8.Categorization of Personal Data
5.9.Printed Documents, Camera Records, Personal Data of Website Visitors
5.9.Printed Documents
5.9.1.Camera Records
5.9.2.Personal Data of Website Visitors and Personal Data Collected for Internet Access Point Service
5.9.3.Personal Data Collected for Internet Access Point Service
5.9.4.Rights of Personal Data Owners
5.9.5.Institution’s Clarification and Information Obligation
5.10.Conditions for Deletion, Destruction, and Anonymization of Personal Data
5.11.Personal Data Protection Committee Working Principles
6.Referenced Documents
7.Related Documents
1.Purpose
This policy aims to describe the methods adopted for personal data processing activities and protection in any activity carried out by Epion Health Services and Trade Ltd. Co. in accordance with the technical and administrative measures under the Personal Data Protection Law No. 6698 (KVKK) and the General Data Protection Regulation (GDPR). The Personal Data Protection and Processing Policy includes principles applied in the processes of collection, use, sharing, storage, and destruction of personal data by Epion Health Services and Trade Ltd. Co. It aims to inform the customers, employees, visitors, employees of cooperating institutions, and third parties whose personal data are processed by the institution.
2. Scope
This policy covers all personal data processed in the processes of our institution, including those of customers, employees, visitors, employees of cooperating institutions, and third parties, regardless of whether the processing is automated or non-automated as part of any data recording system.
3. Authority and Responsibilities
All employees, consultants, external service providers, and anyone who stores and processes personal data on behalf of the institution are responsible for fulfilling requirements related to data destruction specified by laws, regulations, and policies.
Each business unit is responsible for storing and protecting the data it produces in its business processes.
Decisions on destructions that may affect business processes and cause data integrity issues, data loss, and results contrary to legal regulations will be made by the relevant information systems department, considering the type of personal data, the systems involved, and the business unit processing the data.
The data controller contact person is responsible for receiving or accepting notifications or correspondence made with the Personal Data Protection Board on behalf of the data controller and performing registration processes.
4. Definitions and Abbreviations
Explicit Consent; Consent explained freely based on being informed about a specific subject.
Relevant User; Individuals processing personal data within the data controller organization or based on authority and instructions except the person or unit responsible for technical storage, protection, and backup of data.
Destruction; Deletion, eradication, or anonymization of personal data.
Law; Personal Data Protection Law No. 6698.
Recording Environment; Any environment where personal data are processed entirely or partly automatically or non-automatically as part of a data recording system.
Personal Data; Any information relating to an identified or identifiable natural person.
Processing of Personal Data; Any operation performed on data such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, acquiring, making accessible, classifying, or preventing the use of personal data, whether fully or partly by automated means or otherwise as part of a data recording system.
Anonymization of Personal Data; Making personal data in such a way that it cannot be associated with an identified or identifiable natural person even when combined with other data.
Deletion of Personal Data; Making personal data inaccessible and unusable for relevant users in any way.
Erasure of Personal Data; Making personal data permanently inaccessible, irretrievable, and unusable by anyone.
Board; Personal Data Protection Board.
Special Category Personal Data; Data concerning a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, attire, membership of associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Periodic Destruction; Automatic, recurring deletion, erasure or anonymization when all conditions for processing personal data under the law cease to exist, as stated in the personal data retention and destruction policy.
Data Owner/Related Person; The natural person whose personal data are processed.
Data Processor; Real or legal person processing personal data on behalf of the data controller based on the authority granted.
Data Controller; Real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data registration system.
Data Controller Contact Person and Assistants; Since the data controller is a legal entity established in Turkey, a contact person has been appointed. Their main duty is to be the real persons responsible for determining the purposes and means of personal data processing and the establishment and management of the data registration system.
Regulation; Regulation on Deletion, Erasure or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017.
5. Personal Data Protection and Processing Policy
Our institution concretely sets out the necessary measures and the process applied for the protection and processing of personal data through this policy. If this policy conflicts with relevant laws and regulations or updated legislation, Epion Health Services and Trade Ltd. Co. commits to comply with the current legislation. The policy will be revised and updated to fulfill the legal requirements of Epion Health Services and Trade Ltd. Co. in accordance with changes in laws, regulations, and legislation.
5.1.Ensuring the Security of Personal Data
Epion Health Services and Trade Ltd. Co. takes all necessary technical and administrative measures to provide an adequate level of security for personal data protection.
According to Article 12, paragraph 1 of KVKK;
Prevent unlawful processing of personal data,
Prevent unlawful access to personal data,
Ensure the preservation of personal data.
These measures are taken.
The measures applied by our institution to ensure the security of personal data are detailed in the subclauses below.
5.1.1. Technical Measures
Epion Health Services and Trade Ltd. Co. employs knowledgeable and experienced personnel for data security and provides necessary personal data protection training. Internal controls are conducted for established systems. Technical measures are taken in line with technological developments. Infrastructure investments compatible with evolving technology are made. Software and hardware including antivirus systems and firewalls are installed. Access rights of employees working in IT units to personal data are controlled. Technical awareness is promoted to maintain personal data security. Continuous monitoring of security measures is ensured.
5.1.2. Administrative Measures
Epion Health Services and Trade Ltd. Co. takes necessary administrative measures to ensure personal data security and supervises employees’ compliance. Employees are informed that they cannot disclose personal data learned in contradiction to KVKK and GDPR provisions, cannot use it for other purposes, and this obligation continues after termination. Necessary commitments from employees are secured. Contracts with third parties regarding personal data sharing include clauses ensuring data security. Third parties accept provisions to apply necessary safeguards and ensure compliance in their organizations. If unlawfully obtained personal data is detected, the data representative will notify concerned persons and the KVKK Board. The cause of unlawful access is investigated. The institution implements administrative and technical measures to fix vulnerabilities.
5.1.3. Storage of Personal Data in a Secure Environment
Epion Health Services and Trade Ltd. Co. takes necessary technical and administrative measures to store obtained personal data in secure environments according to technological possibilities and implementation costs. Rules and methods regarding secure data storage are detailed in the “Data Retention and Destruction Policy.”
5.1.4. Audits for the Sustainability of Personal Data Protection
Epion Health Services and Trade Ltd. Co. conducts and arranges necessary audits in compliance with Article 12 of the Personal Data Protection Law.
5.1.5. Measures Taken in Case of Unauthorized Disclosure of Personal Data
Epion Health Services and Trade Ltd. Co. notifies the relevant personal data owner and the Personal Data Protection Board in case of unauthorized disclosure according to Article 12 of the Law.
If deemed necessary by the KVKK Board, this situation can be announced on the Board's website or by other means.
5.1.6. Measures Applied to Ensure Third Parties Protect Personal Data
In agreements with third parties, Epion Health Services and Trade Ltd. Co. includes mutual clauses preventing unlawful processing and access of personal data and ensuring data preservation. Confidentiality agreements are signed before sharing data with third parties. Awareness-raising information is provided.
5.1.7. Measures Applied for the Protection of Special Category Personal Data
Sufficient precautions must be taken for special category personal data due to their nature or the potential victimization or discrimination of individuals. Article 6 of the KVKK identifies certain personal data as "special category" due to the risk of causing victimization or discrimination if unlawfully processed.
These data include race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, attire, association or union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Epion Health Services and Trade Ltd. Co. takes necessary measures for protecting special category personal data processed lawfully in accordance with the Law. Technical and administrative measures also pay sensitivity to these data.
Special category personal data processed by Epion Health Services and Trade Ltd. Co. are processed only after explicit consent from the data owner or under legal authority based on the following conditions.
Special category personal data excluding health and sexual life may be processed under conditions foreseen by laws.
Special category personal data relating to health and sexual life may only be transferred to authorized persons or institutions with confidentiality obligations for public health protection, preventive medicine, medical diagnosis, treatment, care services, and related health service planning and management.
5.1.8. Creating Awareness to Ensure Protection of Personal Data
Necessary information and training are provided to units to increase awareness against unlawful processing, unlawful access, and to ensure preservation of data. Related policies including “Personal Data Protection and Processing Policy” are published on our website. Our employees have been informed about this policy.
Policies are revised and re-communicated to employees in case of changes in laws, regulations or legislation.
5.2. Principles of Processing Personal Data
Article 4(2) of KVKK defines principles for processing personal data. Epion Health Services and Trade Ltd. Co. processes personal data in compliance with these principles.
Personal data is processed in accordance with the following principles;
Compliance with law and honesty.
Accuracy and up-to-date when necessary.
Processed for specified, explicit, and legitimate purposes.
Relevant, limited, and proportionate to the purposes they were processed for.
Retained only for the period required by relevant legislation or purposes.
5.3. Conditions for Processing Personal Data
As a public institution, Epion Health Services and Trade Ltd. Co. processes most of the data based on mandatory legal obligations and powers used for public order protection. According to Article 5/2 of the relevant law, conditions for processing data include:
Explicit provision in laws.
Necessity to protect life or physical integrity of a person who cannot express consent legally or physically.
Necessary data processing for establishing or performing a contract.
Legal obligation of data controller.
Data owner made data public.
Data processing necessary for establishing, exercising or protecting a right.
Data processing necessary for the legitimate interests of the data controller without harming the fundamental rights and freedoms of the data owner.
Other conditions not included above require explicit consent of data owners for personal data processing.
5.4. Purposes of Processing Personal Data
The purposes of processing personal data are provided in separate texts clarifying customers, potential customers, employees, and candidates within the personal data inventory and defined business processes under the Personal Data Protection Law.
To perform work requested by our customers,
To conduct appointment scheduling and promote service processes,
To fulfill legal obligations arising from employment contracts for employees,
To fulfill legal obligations and use rights arising from current legislation,
To provide information to public officials regarding public safety upon request and legal obligation,
To increase customer satisfaction,
To offer suggestions and inform customers about our services,
To take and implement necessary physical measures according to legitimate interests,
To promote business activities and inform potential and existing customers via social media,
To evaluate complaints, requests, and suggestions regarding our services,
Personal data processing is necessary to perform these and similar processes.
5.5. Destruction of Personal Data
Our institution destroys obtained personal data upon the request of data owners unless required by law or public order. Personal data belonging to data owners are destroyed when the necessity ends for continuing service, fulfilling legal obligations, and planning employee rights based on institutional decisions. Rules and methods regarding destruction of personal data are detailed in the “Data Retention and Destruction Policy.”
5.6. Transfer of Personal Data to Domestic Persons
Our institution carefully complies with KVKK and other laws when sharing personal data with third parties. Personal data is not transferred without explicit consent of the data owner unless one of the following KVKK conditions applies:
Explicit provision in laws,
Necessity to protect life or physical integrity of a person unable to provide valid consent,
Data processing necessary for establishing or performing a contract,
Legal obligation of data controller,
Data owner made data public,
Data processing necessary for establishing, exercising or protecting a right,
Data processing necessary for the legitimate interests of the data controller without harming fundamental rights and freedoms.
Provided sufficient safeguards; special category personal data excluding health and sexual life may be transferred under legal provisions. For health and sexual life special category data, transfer may be made without consent for public health protection, preventive medicine, medical diagnosis, treatment, care services, and health financing planning and management.
Transfer of special category personal data also complies with the processing conditions.
5.7. Transfer of Personal Data to Foreign Persons
In Epion Health Services and Trade Ltd. Co., explicit consent of the data owner is sought for transferring personal data abroad in accordance with Article 9 of KVKK. However, if conditions permitting processing of personal data including special category data without explicit consent are fulfilled and the foreign country ensures adequate protection, data may be transferred abroad without consent. If the country is not listed by the Board as providing adequate protection, our institution and the data controller/data processor in the relevant country will provide written commitment ensuring adequate protection. If no data is transferred abroad, the statement is: “Epion Health Services and Trade Ltd. Co. does not transfer personal data abroad and does not store personal data on foreign servers.”
5.8. Categorization of Personal Data
Personal data are defined in the data inventory under the Data Subject Group at Epion Health Services and Trade Ltd. Co.
Data Type Categories;
Data Category Personal Data Categorization Description
Identity Information: Information on documents such as driver's license, identity card, residence permit, passport, lawyer ID, marriage certificate (e.g., TCKN, passport number, ID serial number, full name, photo, place of birth, birth date, age, registered address, certified ID copies)
Contact Information: Information used to contact the person (e.g., email address, phone number, mobile number, address)
Customer Transaction Information: Information regarding all transactions by customers using our services (e.g., requests and instructions)
Physical Location Security Information: Personal data related to entry, stay, and documents during presence in physical premises (e.g., entry-exit logs, visitor information, camera records)
Transaction Security Information: Personal data processed for technical, administrative, legal, and commercial security purposes of our institution and related parties (e.g., internet site passwords and credentials linked to the data owner indicating authorization to perform transactions)
Financial Information: Personal data related to financial outcomes depending on the current legal relationship (e.g., financial results of transactions, tax debt amounts, card details, tax payments, interest amounts and rates, balances)
Personnel Records: Personal data forming the basis for employee rights in our institution’s suppliers (all required information and documents for personnel files by law)
Job Applicant Information: Personal data of applicants sharing their details for application processes (e.g., resumes, interview notes, personality test results)
Marketing Information: Data used for marketing activities by our institution (e.g., reports and evaluations of preferences, targeting data, cookie records, data enrichment activities)
Legal Process and Compliance Information: Personal data processed for determination and tracking of legal claims, rights, liabilities, and legal obligations (e.g., information in court and administrative decisions)
Special Category Personal Data: As defined previously (race, ethnic origin, political thought, etc.)
Request/Complaint Management Information: Personal data related to receipt and evaluation of all requests or complaints directed to our institution (e.g., records and reports related to requests and complaints)
Visual and Audio Data: Visual and audio records associated with the data owner (e.g., photos, camera records, audio recordings)
Genetic Data: Includes information about genetic data. Special category personal data sent by email are always sent encrypted via corporate email.
5.9. Printed Documents, Camera Records, Personal Data of Website Visitors,
5.9.1. Printed Documents
Our company sometimes obtains personal data in printed document form for services provided. Such data are processed, stored, and destroyed according to KVKK conditions.
Personnel Records in Human Resources: All personal data processed to support employee rights of our employees or real persons within our working relationship.
Health Service Data: Personal data stored for health services provided to our employees.
Applicant Identification Information: Identifying information submitted during applications for service.
5.9.2. Camera Records
Our institution processes personal data through security cameras in our buildings and facilities to monitor safety and track visitor entry/exit. This constitutes personal data processing.
Our institution acts in compliance with the Constitution, KVKK, and related legislation.
Visitor images are recorded via cameras at entrances and inside the facility.
Camera surveillance aims to increase service quality, ensure reliability, and secure the institution, customers, and others.
The institution acts according to KVKK regulations during camera surveillance.
Only a limited number of employees have access to digitally recorded data, and confidentiality agreements bind them.
Necessary technical and administrative measures are taken in compliance with Article 12 of KVKK for the security of personal data obtained via camera surveillance.
5.9.3. Personal Data of Website Visitors and Personal Data Collected for Internet Access Point Service
Our institution records technical data of visitors' internet movements to websites owned by us to enable visitors to use the sites according to their visit purposes (e.g., cookies).
Details on personal data protection for these activities are available in the “Cookie Policy” of relevant websites.
Our company provides free internet service at open points to all visitors. Log records are kept according to Law 5651 on Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, and to verify access information.
5.9.4. Rights of Personal Data Owners
The full text of your data owner rights under the Personal Data Protection Law, available on the KVKK site, is listed in Article 11:
Article 11- (1) Anyone can apply to the data controller to know;
a) Whether personal data concerning themselves is processed,
b) If personal data is processed, request information about it,
c) To learn the purpose of personal data processing and whether used accordingly,
ç) To know third parties inside or outside the country to whom personal data is transferred,
d) In case of incomplete or incorrect processing, to demand correction.
You can exercise these rights by filling out the “KVKK Request Form.”
Documents of Data Controller, Data Controller Representative and Contact Person are as follows:
5.9.5. Institution's Clarification and Information Obligations
According to Article 10 of KVKK, data owners must be enlightened at or before obtaining personal data. The following information must be provided:
Identity of data controller and representative,
Purpose of personal data processing,
Recipients and purposes for which personal data is transferred,
Method and legal grounds for collecting personal data,
Other rights listed in Article 11 of KVKK.
There are situations exempt from the clarifying obligation under Article 28(1) of KVKK listed below:
Personal data processed concerning private activities of individuals or family members living in the same residence without sharing with third parties and observing data security,
Personal data processed related to official statistics or anonymized for research, planning, and statistics,
Personal data processed for art, history, literature, scientific aims, or freedom of expression without violating national security and rights,
Preventive, protective, and intelligence activities by authorized public institutions for national defense, security, public safety, order, or economic security,
Processing by judicial authorities for investigation, prosecution, judgment, or execution processes.
“Explicit Consent and Clarification Declaration” is prepared to enlighten data owners and obtain explicit consent.
5.10. Conditions for Deletion, Destruction, and Anonymization of Personal Data
Our institution deletes, destroys, or anonymizes obtained personal data upon requests, unless required by law or public order. Rules and methods about these procedures are detailed in the “Data Retention and Destruction Policy.”
5.11. Personal Data Protection Committee Working Principles
Our institution has established the “Personal Data Protection Committee” to comply with KVKK requirements and maintain conformity.
The primary purpose and goal of the Personal Data Protection Committee:
To protect private life confidentiality
To protect fundamental rights and freedoms of individuals
To regulate duties and authorities of data processors
6. Referenced Documents
Personal Data Protection Law No. 6698,
Regulation on Deletion, Erasure or Anonymization of Personal Data,
Explicit Consent and Clarification Declaration
7. Related Documents
Data Retention and Destruction Policy