{"id":28,"date":"2023-03-17T19:21:42","date_gmt":"2023-03-17T16:21:42","guid":{"rendered":"https:\/\/www.daisypoliklinik.com\/en\/?page_id=28"},"modified":"2023-12-06T15:00:16","modified_gmt":"2023-12-06T12:00:16","slug":"personal-data-protection-and-processing-policy","status":"publish","type":"page","link":"https:\/\/www.daisypoliklinik.com\/en\/personal-data-protection-and-processing-policy\/","title":{"rendered":"Personal Data Protection and Processing Policy"},"content":{"rendered":"

PRIVATE DAISY POLYCLINIC<\/span><\/span><\/strong><\/p>\n

PERSONAL DATA\u00a0 <\/span><\/span><\/strong>PROTECTION AND PROCESSING POLICY<\/span><\/span><\/strong><\/p>\n

1. INTRODUCTION<\/span><\/span><\/strong><\/p>\n

PRIVATE DA\u0130SY POLYCLINIC (\u201c <\/span><\/span>DA\u0130SY CLINIC<\/span><\/span><\/strong> \u201d), owned by SONG\u00dcL DURUR ZEVZ\u0130R, attaches utmost importance to protecting the fundamental rights and freedoms of individuals, especially based on the privacy of private life regulated in Article 20 of the Constitution, in the protection and processing of personal data. <\/span>In this context, DA\u0130SY KLIN\u0130K pays attention to the legal protection and processing of personal data in accordance with the Personal Data Protection Law No. 6698 (” <\/span><\/span>KVKK<\/span><\/span><\/strong> “) and the European Union General Data Protection Regulation (” <\/span><\/span>GDPR<\/span><\/span><\/strong> “) and acts with this understanding in all its planning and activities.<\/span><\/span><\/p>\n

Ensuring the security of people’s Personal Data is one of the primary goals of DA\u0130SY KLIN\u0130K. <\/span>For this reason, DA\u0130SY KLIN\u0130K takes the necessary security measures in accordance with the applicable legislation in order to process personal data of individuals safely and to prevent any unlawful access or leakage of these data.<\/span><\/span><\/p>\n

1.1 PURPOSE OF THE POLICY<\/span><\/span><\/strong><\/p>\n

The purpose of the Personal Data Protection and Processing Policy (” <\/span><\/span>Policy<\/span><\/span><\/strong> “) is to protect and process personal data processed by fully or partially automatic means or non-automatic means, provided that it is part of any data recording system, in accordance with the purpose of KVKK and GDPR. To inform Personal Data Owners about its obligations and the procedures and principles it will comply with. <\/span>In line with the purpose of the Policy, it is aimed to ensure full compliance with the legislation in the protection and processing of personal data activities carried out by DA\u0130SY KLIN\u0130K and to protect the right to privacy and data security of Personal Data Owners.<\/span><\/span><\/p>\n

1.2 SCOPE OF THE POLICY<\/span><\/span><\/strong><\/p>\n

This Policy; <\/span>It has been prepared for Customers (Patients\/Clients), Employees, Employee Candidates and Visitors, provided that they are real persons, and will be applied within the scope of these specified persons. <\/span>DA\u0130SY KLIN\u0130K’s purpose in publishing this Policy on its website is to inform Data Owners about the protection and processing of personal data and data security. <\/span>This Policy will not apply to legal entities in any capacity.<\/span><\/span><\/p>\n

This Policy will apply to the above-mentioned Data Owners in case their personal data is processed by DA\u0130SY KLIN\u0130K by fully or partially automatic or non-automatic means provided that it is part of any data recording system. <\/span>This Policy will not apply if the data is not included in the scope of “Personal Data” within the scope specified below or if the personal data processing activity carried out by DA\u0130SY KLIN\u0130K is not carried out in the ways specified above.<\/span><\/span><\/p>\n

1.3 DEFINITIONS<\/span><\/span><\/strong><\/p>\n

The concepts used in the implementation of this Policy have the following meanings:<\/span><\/span><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Explicit Consent<\/span><\/span><\/strong><\/td>\nIt is consent regarding a certain subject, based on informed consent and expressed with free will.<\/span><\/span><\/td>\n<\/tr>\n
Lighting Obligation<\/span><\/span><\/strong><\/td>\nIt is the obligation of the data controller to inform the persons whose personal data it processes, by whom, for what purposes and on what legal grounds these data may be processed, and to whom it may be transferred, and for what purposes.<\/span><\/span><\/td>\n<\/tr>\n
Related User<\/span><\/span><\/strong><\/td>\nPersons who process personal data within the data controller organization or in line with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.<\/span><\/span><\/td>\n<\/tr>\n
Destruction<\/span><\/span><\/strong><\/td>\nIt refers to the deletion, destruction or anonymization of personal data.<\/span><\/span><\/td>\n<\/tr>\n
Processing of Personal Data<\/span><\/span><\/strong><\/td>\nObtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or using Personal Data by fully or partially automatic or non-automatic means provided that it is part of any data recording system. It is any operation performed on data, such as blocking.<\/span><\/span><\/td>\n<\/tr>\n
KVK Board<\/span><\/span><\/strong><\/td>\nIt is the Personal Data Protection Board.<\/span><\/span><\/td>\n<\/tr>\n
Personal Data Owner<\/span><\/span><\/strong><\/td>\nIt refers to the Patients, Clients, Employees, Employee Candidates and Visitors whose Personal Data (including sensitive personal data) is processed.<\/span><\/span><\/td>\n<\/tr>\n
Personal Data<\/span><\/span><\/strong><\/td>\nIt is any information regarding an identified or identifiable natural person.<\/span><\/span><\/td>\n<\/tr>\n
Institution\/Audit Mechanism<\/span><\/span><\/strong><\/td>\nIt is the Personal Data Protection Authority consisting of the Board and the Presidency.<\/span><\/span><\/td>\n<\/tr>\n
Automatically Processing Data<\/span><\/span><\/strong><\/td>\nComputer, phone, watch, etc. <\/span>It is a processing activity that takes place automatically, without human intervention, within the scope of pre-prepared algorithms through software or hardware features, carried out by devices with processors.<\/span><\/span><\/td>\n<\/tr>\n
Special Personal Data<\/span><\/span><\/strong><\/td>\nData regarding race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special quality data.<\/span><\/span><\/td>\n<\/tr>\n
Record<\/span><\/span><\/strong><\/td>\nIt is the Data Controllers Registry.<\/span><\/span><\/td>\n<\/tr>\n
DAISY CLINIC<\/span><\/span><\/strong><\/td>\nIt is a PRIVATE DAISY POLYCLINIC.<\/span><\/span><\/td>\n<\/tr>\n
Data Processor<\/span><\/span><\/strong><\/td>\nIt is a natural or legal person who processes Personal Data on behalf of the data controller, based on the authority given by the data controller.<\/span><\/span><\/td>\n<\/tr>\n
Data Recording System<\/span><\/span><\/strong><\/td>\nIt refers to the recording system in which Personal Data is structured and processed according to certain criteria.<\/span><\/span><\/td>\n<\/tr>\n
Data Category<\/span><\/span><\/strong><\/td>\nIt is a class of personal data belonging to a group or groups of data subjects in which personal data is grouped according to their common characteristics.<\/span><\/span><\/td>\n<\/tr>\n
Data Subject Person Group<\/span><\/span><\/strong><\/td>\nIt is the relevant person group whose personal data the data controller processes.<\/span><\/span><\/td>\n<\/tr>\n
Data Controller<\/span><\/span><\/strong><\/td>\nIt is the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for establishing and managing the data recording system.<\/span><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

1.4 ENFORCEMENT OF THE POLICY<\/span><\/span><\/strong><\/p>\n

The Policy principles, which were issued by DA\u0130SY KLIN\u0130K and entered into force on 01.07.2021, are published on the corporate websites of DA\u0130SY KLIN\u0130K and made available to Data Owners.<\/span><\/span><\/p>\n

2. PROTECTION OF PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

2.1 SECURITY OF PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K takes all necessary administrative and technical measures to ensure the appropriate level of security in order to store personal data safely in accordance with KVKK and GDPR and to prevent unlawful processing and access of personal data. <\/span>Administrative and technical measures taken regarding the security of personal data are regulated in detail in DA\u0130SY KLIN\u0130K’s Personal Data Storage and Destruction Policy.<\/span><\/span><\/p>\n

2.2 AUDIT<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K carries out the necessary inspections and has them carried out in order to establish the data security described above and to ensure the regularity and continuity of the measures taken. <\/span>The technical measures taken by DA\u0130SY KLIN\u0130K are audited by authorized persons in six-month periods a year, and the administrative measures are audited by persons authorized by DA\u0130SY KLIN\u0130K.<\/span><\/span><\/p>\n

2.3 PRIVACY<\/span><\/span><\/strong><\/p>\n

All necessary administrative and technical measures are taken by DA\u0130SY KLIN\u0130K to ensure that the Data Processor does not disclose the personal data he\/she has learned within the scope of his\/her duty to anyone else, contrary to the provisions of KVKK, GDPR and Policy, and does not use it for purposes other than processing. <\/span>In this context, information and training activities are carried out for Clinic employees about KVKK, GDPR and Policy, and relevant employees are made to sign confidentiality agreements as part of the recruitment process. <\/span>Policies are also communicated to Suppliers and Data Processors who provide outsourced services and Privacy Commitments are taken.<\/span><\/span><\/p>\n

2.4 UNAUTHORIZED DISCLOSURE OF PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

If the personal data processed by DA\u0130SY KLIN\u0130K is obtained by others through illegal means, DA\u0130SY KLIN\u0130K carries out the necessary procedures to notify the Data Owner and the KVK Board about this situation within the periods determined by the KVK Board. <\/span>If deemed necessary by the KVK Board, this situation is announced on the KVK Board’s website or by another method deemed appropriate by the KVK Board.<\/span><\/span><\/p>\n

2.5 RESPECT OF THE LEGAL RIGHTS OF RELATED PERSONS<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K observes all legal rights of the relevant persons regarding the implementation of the Policy and the Law and takes all necessary measures to protect these rights.<\/span><\/span><\/p>\n

2.6 PROTECTION OF SPECIAL PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

Data regarding individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data of special quality is personal data. <\/span>DA\u0130SY KLIN\u0130K is aware that Special Personal Data is data that may cause the Data Owner to be victimized or discriminated against if learned by others, and therefore, it carefully takes adequate measures determined by the Board to protect such personal data processed in accordance with the law. <\/span>In this context; <\/span>It has a separate policy (Security of Special Personal Data Policy) that is systematic, has clear rules, is manageable and sustainable.<\/span><\/span><\/p>\n

3. PROCESSING AND TRANSFER OF PERSONAL DATA<\/span><\/span><\/strong><\/a><\/p>\n

3.1 GENERAL PRINCIPLES IN THE PROCESSING AND TRANSFER OF PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

Personal Data is processed by DA\u0130SY KLIN\u0130K in accordance with the procedures and principles stipulated in KVKK, GDPR and this Policy. <\/span>DA\u0130SY KLIN\u0130K complies with the following principles when processing personal data.<\/span><\/span><\/p>\n

a) Compliance with the Law, the Rules of Honesty and the Principle of Transparency<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K processes personal data in accordance with the relevant legislation and the requirements of the code of honesty and uses it within these limits. <\/span>In accordance with the principle of compliance with the rule of honesty, DA\u0130SY KLIN\u0130K takes into account the interests and reasonable expectations of the relevant persons while trying to achieve its goals in data processing. <\/span>It acts to prevent the emergence of consequences that the Data Owner does not expect and does not need to expect. <\/span>In accordance with the principle, it also ensures that such data processing activity is transparent to the data subject; <\/span>Acts in accordance with its lighting and warning obligations.<\/span><\/span><\/p>\n

b) Being Accurate and Up to Date When Necessary<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K ensures that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights and legitimate interests of the Data Owners. <\/span>In this context, it carefully takes into account issues such as determining the sources from which the data is obtained, confirming its accuracy, and evaluating whether it needs to be updated. <\/span>DA\u0130SY KLIN\u0130K always keeps the channels open to ensure that the personal data owner’s information is accurate and up-to-date. <\/span>Keeping personal data accurate and up-to-date is necessary to protect the interests of DA\u0130SY KLIN\u0130K as well as to protect the fundamental rights and freedoms of the Data Owner.<\/span><\/span><\/p>\n

c) Processing for Specific, Clear and Legitimate Purposes<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K clearly and precisely determines the purpose of data processing and ensures that this purpose complies with the law. <\/span>The legality of the purpose means that the personal data processed by DA\u0130SY KLIN\u0130K is related to and necessary for the healthcare service in which it operates. <\/span>DA\u0130SY KLIN\u0130K does not process data for purposes other than these stated purposes. <\/span>In this respect, it shows sensitivity in complying with the principle of certainty and clarity in legal transactions and texts in which the purposes of personal data processing are explained.<\/span><\/span><\/p>\n

d) Being Related to the Purpose for which they are Processed, Limited, Proportionate and Necessary<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K pays attention to ensure that the personal data processed are suitable for the achievement of the specified purposes and avoids the processing of data that is not relevant or needed to achieve the purpose, and does not collect or process personal data for purposes that do not exist and are expected to be realized later. <\/span>It also limits the data processed to only what is necessary to achieve the purpose. <\/span>Within the scope of the principle of proportionality, it establishes a reasonable balance between data processing and the purpose it is intended to achieve.<\/span><\/span><\/p>\n

e) Preservation for the period stipulated in the relevant legislation or required for the purpose for which they are processed.<\/span><\/span><\/strong><\/p>\n

If there is a period stipulated in the relevant legislation for the storage of data, DA\u0130SY KLIN\u0130K complies with these periods; <\/span>Otherwise, it retains personal data only for the period necessary for the purpose for which they are processed. <\/span>If there is no valid reason for further storage of personal data by DA\u0130SY KLIN\u0130K, the data in question is deleted, destroyed or anonymized. <\/span>Procedures regarding the storage and destruction of personal data are regulated in detail in DA\u0130SY KLIN\u0130K’s Personal Data Storage and Destruction Policy.<\/span><\/span><\/p>\n

f) Compliance with Integrity and Confidentiality Principles<\/span><\/span><\/strong><\/p>\n

Personal data is processed by DA\u0130SY KLIN\u0130K by taking the necessary technical and administrative measures in order to ensure appropriate security against loss, destruction, damage or protection of personal data.<\/span><\/span><\/p>\n

g) Compliance with the Accountability Principle<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K has fulfilled its obligation in accordance with the rules of protection of personal data in its processing activities, and in case of any complaint or ex officio review, it will be able to submit documents proving to the audit institutions that these measures have been taken.<\/span><\/span><\/p>\n

3.2 CONDITIONS FOR PROCESSING PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K does not process personal data without the explicit consent of the Data Owner. <\/span>Personal data can only be processed without the explicit consent of the Data Owner if one of the following conditions is met.<\/span><\/span><\/a><\/a>may be:<\/span><\/span><\/p>\n

a) Clearly Provided in Laws<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K may process personal data without seeking the explicit consent of the Data Owner, in cases clearly stipulated by law.<\/span><\/span><\/p>\n

b) It is Necessary for the Protection of the Life or Physical Integrity of the Person Who Is Unable to Express His Consent Due to Actual Impossibility or whose Consent Is Not Recognized as Legally Valid.<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K may process personal data without seeking explicit consent to protect the life or physical integrity of individuals in cases where consent cannot be disclosed or is not valid.<\/span><\/span><\/p>\n

c) It is Necessary to Process Personal Data of the Parties to the Contract, Provided That It is Directly Related to the Establishment or Performance of a Contract<\/span><\/span><\/strong><\/p>\n

In case it is necessary to process personal data of the parties to the contract directly related to the establishment or execution of a contract, DA\u0130SY KLIN\u0130K may process the personal data of the Data Owner without seeking explicit consent, limited to this purpose, as a matter of ordinary course of life.<\/span><\/span><\/p>\n

d) It is mandatory for DA\u0130SY KL\u0130N\u0130K to fulfill its legal obligations<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K, as the Data Controller, may process the Data Owner’s personal data without seeking explicit consent when necessary in order to fulfill its legal obligations.<\/span><\/span><\/p>\n

e) It has been made public by the Relevant Person Himself<\/span><\/span><\/strong><\/p>\n

DAISY CLINIC; <\/span>The personal data of the Data Owner, which has been made public by the Data Owner, in other words, has been disclosed to the public in any way, may be processed on a limited basis for the purpose of publicization, as it is accepted that the legal interest to be protected in the processing of such data, which has been made public by the Data Owner and thus become known to everyone, is eliminated.<\/span><\/span><\/p>\n

f) Data Processing is Necessary for the Establishment, Exercise or Protection of a Right<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K may process the personal data of the Data Owner without seeking explicit consent, in cases where data processing is mandatory for the exercise or protection of a legally legitimate right.<\/span><\/span><\/p>\n

g) It is mandatory for our clinic to process data for its legitimate interests, provided that it does not harm the fundamental rights and freedoms of the relevant persons.<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K may process the Data Owner’s personal data in cases where processing of personal data is necessary to ensure the legitimate interests of the Data Owner, provided that it does not harm the Data Owner’s fundamental rights and freedoms protected under KVKK, GDPR and the Policy. <\/span>DA\u0130SY KLIN\u0130K shows the necessary sensitivity to comply with the basic principles regarding the protection of personal data and to observe the balance of interests of DA\u0130SY KLIN\u0130K and personal data owners. <\/span>What is meant by legitimate interest; <\/span>Legitimate is an effective, specific and existing interest that competes with the fundamental rights and freedoms of the Data Owner. <\/span>DA\u0130SY KLIN\u0130K takes additional protective measures to prevent harm to the rights of the Data Owner. <\/span>A reasonable balance is maintained between the interests of our clinic and the fundamental rights and freedoms of the person concerned.<\/span><\/span><\/p>\n

3.3 CONDITIONS FOR PROCESSING SPECIAL PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K does not process sensitive personal data without the explicit consent of the Data Owner. <\/span>Special categories of personal data can only be processed without the express consent of the relevant person if one of the following conditions is met:<\/span><\/span><\/p>\n

\u00b7 Clearly Provided in Laws<\/span><\/span><\/strong><\/p>\n

Special personal data of the Data Owner, other than his health and sexual life, may be processed without the express consent of the Data Owner in cases clearly provided for by law.<\/span><\/span><\/p>\n

\u00b7 For the Purpose of Protection of Public Health, Preventive Medicine, Execution of Medical Diagnosis, Treatment and Care Services, Planning and Management of Health Services and Financing<\/span><\/span><\/strong><\/p>\n

Data Owner’s personal data of special nature regarding his health and sexual life, for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, persons or authorized institutions and organizations who are under the obligation of confidentiality. can be processed by.<\/span><\/span><\/p>\n

3.4 CONDITIONS FOR TRANSFER OF PERSONAL DATA<\/span><\/span><\/strong><\/p>\n

DA\u0130SY KLIN\u0130K can transfer personal data to third parties on a limited basis and based on one or more of the following personal data processing conditions, in accordance with Articles 8 and 9 of the KVKK and Articles 45 and 49 of the GDPR, by taking the necessary security measures:<\/span><\/span><\/p>\n