Clarification Text Regarding the Processing of Personal Data
CCN INVESTMENTS HOLDING INC.
REGARDING THE PROCESSING OF PERSONAL DATA
CLARIFICATION TEXT
1. What is personal data and who processes it?
Pursuant to Article 3 of the Law No. 6698 on the Protection of Personal Data, personal data refers to any information relating to an identified or identifiable natural person. CCN Hastane Hizmetleri Ve İşletme Anonim Şirketi ("Company") will record, store, update, process, disclose and transfer your personal data to third parties in accordance with the law as "data controller" in accordance with the Law on the Protection of Personal Data No. 6698.
2. For what purpose can your personal data be processed?
From your personal data collected, which we have specified one by one below;
Identity Information Data;
- Explicitly stipulated in the laws (Art. 5/2.a)
- It is mandatory for the data controller to fulfill its legal obligation (art.5/2.ç)
- Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract (art.5/2.c)
Contact Information Data;
- Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process the personal data of the parties to the contract (art.5/2.c)
- It is explicitly stipulated in the laws (art.5/2.a)
- It is mandatory for the data controller to fulfill its legal obligation (art.5/2.ç)
Data on Financial Information;
- Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract (Art.5/2.c)
- It is explicitly stipulated in the laws (art.5/2.a)
- It is mandatory for the data controller to fulfill its legal obligation (art.5/2.ç)
Data on Physical Location Security Information;
- Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract (art.5/2.c)
- It is explicitly stipulated in the laws (art.5/2.a)
- It is mandatory for the data controller to fulfill its legal obligation (art.5/2.ç)
- Data processing is mandatory for the establishment, exercise or protection of a right (Art. 5/2.d)
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5/f)
Data on Legal Transaction Information;
- It is mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)
Sensitive Personal Data;
v Explicit consent of the data subject (Art.5/1) within the personal data processing conditions;
- Electronically, automatically or non-automatically through our website www.ccnholding.com and other websites that may be established in the future,
- Automatically or non-automatically electronically through cookies ("Cookies") that communicate with your devices on the Website (cookies often collect anonymous data),
- Electronically by automatic or non-automatic means through accounts operated on behalf of the Company on various social media channels ("Social Media"),
- Verbally and electronically by automatic or non-automatic means through our call centers ("Call Center") managed by the Company,
- Electronically by automatic or non-automatic means via e-mail through the entire sales and marketing network established and managed by the Company,
- Verbally, electronically and in writing by automated or non-automated means through contracts, mailing and user devices,
- Verbally or in writing by receiving business cards from company visitors,
- Verbally, in writing or electronically by automatic or non-automatic means within the scope of sales and marketing through our employees operating on behalf of the Company and working in the sales and marketing network,
- Electronically, automatically or non-automatically by our Company or real or legal persons who process data on behalf of our Company, based on different legal reasons, through the website, electronic mail, mobile communication routes, mobile applications,
- Through the ad management channel, physically in a panel environment,
- Correspondence carried out through our e-mail addresses, other communication methods, including text messages or multimedia messages sent for other purposes for Company activities, and through all kinds of communication tools,
- Verbally, in writing or electronically by automatic or non-automatic means within the scope of sales, marketing and after-sales services through the entire service sales and marketing network that belongs to the Company or is not within the Company but established or operated by third parties,
- Verbally, in writing or electronically by automatic or non-automatic means through our network of all other after-sales services established or operated by the Company or by third parties not within the Company,
- Through third parties such as group companies, business partners, manufacturers or companies that the Company provides services or receives services, online sales platforms, dealers, solution partner institutions and organizations,
- Verbally or electronically by automatic or non-automatic means through your website, social media or other channels where you make your Personal Data public,
- Electronically through the keeping of log records on the system from the devices used by guests who connect to the company Wi-Fi system,
- Visitors to the company or dealers are electronically recorded electronically through cameras from the IP Camera system for security reasons.
- Electronically by automatic or non-automatic means for the purpose of receiving and evaluating requests and complaints,
- Electronically by automatic or non-automatic means for the purpose of following and conducting legal affairs,
- Electronically by automated or non-automated means for the fulfillment of official requests,
- Electronically by automatic or non-automatic means for the purpose of carrying out information security processes,
- Electronically, by automated or non-automated means, for the purpose of carrying out audit and ethics activities,
- Electronically by automated or non-automated means for the purpose of planning and execution of internal processes,
- Verbally, in writing or electronically by automatic or non-automatic means through our network of all other after-sales services established or operated by the Company or by third parties not within the Company,
- Through third parties such as group companies, business partners, manufacturers or companies that the Company provides services or receives services, online sales platforms, dealers, solution partner institutions and organizations,
- Through the information you provide to our employees or suppliers verbally, in writing, electronically or through paper forms to obtain information about our infrastructure and other services,
- Business cards, resumes (cv), proposals given in a physical or virtual environment, face-to-face or at a distance, verbally or in writing or electronically for purposes such as establishing a commercial relationship with our organization, applying for a job, making an offer,
- Verbally or electronically by automatic or non-automatic means through your website, social media or other channels where you make your Personal Data public,
The data collected verbally, in writing or electronically by automatic or non-automatic means through the above-mentioned and other channels that may be added to them in the future may be processed in accordance with the reasons and purposes stated below.
Your Personal Data collected through the channels and methods mentioned in this Clarification Text are processed by the Company for the following purposes:
v Within the scope of Article 5.2 and Article 6.3 of LPPD;
As a rule, we process your Personal Data based on your explicit consent. However, in exceptional cases permitted under the LPPD, your Personal Data may be processed without your explicit consent. In this context (i) in order to fulfill our legal obligations (such as obligations arising from tax legislation, consumer protection legislation, law of obligations, commercial law and other legislation), (ii) if you are unable to disclose your consent due to actual impossibility (iii) for the establishment or performance of a contract, (iv) in order to fulfill our legal obligations such as receiving your questions and complaints about the service, responding to you and using them in a possible dispute when necessary, (v) in order to establish or protect a right through transactions carried out within the scope of keeping records as evidence within the scope of after-service services and any other transactions that can be attributed within the scope of the relevant regulation, (vi) in order to protect our legitimate interests such as cost reduction, efficient use of resources, observation of call center service quality, ensuring your security and measuring the quality of the service provided to you, evaluating and resolving your requests in this context, provided that it does not harm your fundamental rights and freedoms; We process your Personal Data. In addition, the processing of the personal data you make public with the limits specified in the LPPD does not require your explicit consent. The processing of your Personal Data that you have publicized on Social Media channels, your website and other channels and any other processing that can be attributed within the scope of the relevant regulation can be given as an example to this situation. Apart from this, your explicit consent will also be obtained in case of a processing that requires your explicit consent.
v Your Personal Data collected through the above-mentioned channels and the above-mentioned methods may also be processed for the following purposes, provided that your explicit consent is obtained within the scope of Article 5.1 and Article 6.2 of the LPPD:
(i) For the purpose of conducting communication, advertising and marketing, product/service offer, all kinds of information, promotion and sales activities,
(ii) For the purposes of communication, ad targeting and marketing archive creation and to establish contacts for possible cooperation at future dates,
(iii) For the purpose of contract management,
(iv) To be able to provide better service to our users and improve our services on our website for the purpose of creating exhibitors' information, area entry permissions, event agreements at fairs and events,
(v) Ensuring the legal and commercial security of the Company, its Subsidiary Companies and persons who have established or are in a business relationship with the Company,
(vi) Carrying out the necessary work by our business units in order to benefit you depending on the product, service or commercial activity offered by the Company;
(vii) The purposes of determining and implementing the commercial and business strategies of the Company,
(viii) For the purpose of keeping visitor records to ensure the security of the Company,
(ix) For the purposes of sales, telesales, online sales and marketing activities, in particular for the purpose of providing you with customized advertisements, campaigns, advantages and other benefits and carrying out other marketing and Customer Relationship Management activities,
(x) To ensure the continuity of communication and marketing activities,
(xi) to provide personalized content during your visit to the Websites,
(xii) To create new product and service models,
(xiii) For the purpose of sending electronic commercial messages (such as newsletters, campaigns, newsletter, customer satisfaction surveys, product and service advertisements),
(xiv) For the purpose of sending gifts, newsletters and promotions and other magazines/periodicals,
(xv) For the purpose of organizing and informing about corporate communication and other events and invitations in this context, making the application, entry and all related procedures for meeting participation and completing other necessary meeting notification procedures, carrying out the procedures for participation in Congresses / Symposiums, scientific and educational meetings,
(xvi) If you are unable to disclose your consent due to actual impossibility of your Special Categories of Personal Data, your data is processed for the establishment or performance of a contract, to fulfill our legal obligations, to establish, exercise or protect a right, to protect our legitimate interests without harming your fundamental rights and freedoms.
3.To whom and for what purpose can your processed personal data be transferred?
Your personal data collected, in accordance with Articles 8 and 9 of the LPPD;
- Fulfillment of legal obligations by our Company,
- Carrying out the necessary operational activities by our business units,
- Optimal planning and implementation of our human resources policies, proper planning and execution of our business partnerships and strategies,
- Ensuring the legal, commercial and physical security of our company and our business partners,
- Ensuring the corporate functioning of our company,
- Fulfillment of official institution requests,
- Follow-up and execution of legal affairs,
- Carrying out activities to ensure that you benefit from the products and services offered by our Company in the best way possible; customizing the products and services offered by our Company according to your demands, needs and requests and recommending them to you, ensuring data security at the highest level, creating databases,
- Taking the necessary steps to make, implement and realize commercial decisions by the Company for the purposes of improving the services offered on our Company's website, communicating with those who submit their requests and complaints to our Company, and eliminating errors on our Company's website,
- For the purposes of planning and executing our Company's human resources policies and processes;
a) To our business partners,
b) Our suppliers,
c) Company officials,
d) Legally authorized public institutions and private persons,
4.For what legal reason and by which method do we collect your personal data?
Personal data are collected in all kinds of verbal, written, electronic media; by technical and other methods, through various means such as our Company's website, in order to fulfill the responsibilities arising from the law within the framework of legislation, contract, request and request-based legal reasons in order to fulfill the purposes set out in the Policy, and are processed by our Company or data processors assigned by our Company. They can be collected, processed and transferred based on your consent to the processing of your personal data or the legal reasons specified in Articles 5 and 6 of the Law and other legislation.
5.Conditions for Transmission of Personal Data
Our Company may transfer personal data and special categories of personal data to third parties in accordance with the Law by establishing the necessary confidentiality conditions and taking security measures in line with the purposes of processing personal data. Our Company acts in accordance with the regulations stipulated in the Law during the transfer of personal data. In this context, our Company may transfer personal data to third parties based on and limited to one or more of the personal data processing conditions specified in Article 5 of the Law, listed below, in line with legitimate and lawful personal data processing purposes;
- If the person concerned has given explicit consent,
- If there is a clear regulation in the laws regarding the transfer of personal data,
- If it is mandatory for the protection of the life or physical integrity of the person concerned or another person and the person concerned is unable to disclose his/her consent due to actual impossibility or his/her consent is not legally valid,
- If it is necessary to transfer personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
- If personal data transfer is mandatory for our company to fulfill its legal obligation,
- If the personal data has been made public by the data subject,
- If personal data transfer is mandatory for the establishment, exercise or protection of a right,
- Provided that it does not harm the fundamental rights and freedoms of the data subject, if personal data transfer is mandatory for the legitimate interests of our Company, it may transfer.
Conditions for Domestic Transmission of Special Categories of Personal Data
Our Company may transmit the special categories of personal data of the data subjects to third parties in accordance with the principles adopted in the processing of personal data.
In the transmission of special categories of personal data to third parties, sensitivity is shown to obtaining the consent of the data subject and special categories of personal data are transmitted domestically by taking adequate technical and administrative measures. However, in the event of the following circumstances, it may be possible to transmit sensitive personal data without the explicit consent of the data subject by taking adequate technical and administrative measures;
v Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership to associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data, in cases stipulated by law,
v Personal data relating to health and sexual life can only be transmitted for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or authorized institutions and organizations under the obligation of confidentiality.
Conditions for Transmission of Personal Data Abroad:
Our Company may transmit the personal data and special categories of personal data of the data subjects to third parties abroad by taking the necessary security measures in line with the purposes of personal data processing. Personal data may be transmitted by our Company to foreign countries declared to have adequate protection by the Board in the light of Article 9 of the Law or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and the relevant foreign country undertake adequate protection in writing and where the Board has permission.
Conditions for Transmission of Special Categories of Personal Data Abroad
Our Company may transmit the personal data of the data subjects abroad in accordance with the principles adopted in the processing of personal data.
Provided that there is adequate protection in the country where the data will be transmitted or that the data controller to whom the personal data will be transmitted undertakes adequate protection in writing and the Personal Data Protection Board has the permission of the Personal Data Protection Board, it is possible to transmit personal data abroad without the need for the explicit consent of the data subject in the presence of one of the following conditions:
-Race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership to associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data, in cases stipulated by law,
- Personal data relating to health and sexual life can only be collected by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
6.What are your personal data processed regarding communication?
For the reasons stated in Article 2 of this Clarification Text, the contents of the corporate e-mail addresses of our Company, your contact information recorded on the website and the IP information of the communication tools you access the site you use, the correspondence and communication records made by the Company and / or the person(s) authorized by the Company and / or its authorized person(s) with the Company officials, employees, call center and customer relations employees can be backed up, reported and subjected to detailed examinations when necessary.
7.For how long is your Personal Data processed?
The Personal Data you have shared with the Company through the channels mentioned in this Clarification Text will be processed in accordance with the legislation on the protection of Personal Data, especially the LPPD, and the periods required by other legislation, in any case, as long as the above-mentioned legitimate purposes do not disappear.
8.What are your rights under Law No. 6698 on the Protection of Personal Data?
Pursuant to Article 11 of the Law No. 6698 on the Protection of Personal Data;
- To learn whether your personal data is being processed or not,
- Request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
- To know the third parties to whom personal data are transferred domestically or abroad,
- To request correction of personal data in case of incomplete or incorrect processing, and to request notification of the correction process to third parties to whom personal data is transferred,
- To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the Law, except for legal limits, and to request notification of the deletion and destruction to third parties to whom personal data is transferred,
- Object to the occurrence of a result to your detriment by analyzing your processed data exclusively through automated systems,
- You have the right to demand compensation for damages in case you suffer damage due to unlawful processing of your personal data.
9. How will you contact the data controller?
You can submit your rights listed above to our company in writing with wet signature or by using the registered electronic mail (REM) address, secure electronic signature, mobile signature or the electronic mail address previously notified to our company by the person concerned and registered in our company's system.
The application address for written applications is "Üniversiteler Mah. 1604 Cad. Ana Hastane Binası Apt. No:9/1/177 Çankaya Ankara". In order for a person other than the personal data owner to make a request, there must be a special power of attorney issued by the personal data owner on behalf of the person who will make the application.
Duly submitted requests will be finalized free of charge within thirty days at the latest. If the response is more than ten pages, a transaction fee of one (1) Turkish Lira may be charged for each page over ten pages. If the response to the application is given in a recording medium such as CD, flash memory, the cost of the data recording medium may be requested.