Privacy Notice

1. What is personal data and who processes it?

In accordance with Article 3 of Law No. 6698 on the Protection of Personal Data, personal data is defined as any information relating to an identified or identifiable natural person.

In accordance with Law No. 6698 on the Protection of Personal Data, CCN Hastane Hizmetleri ve İşletme Anonim Şirketi (the “Company”), acting as the data controller, shall lawfully collect, record, store, update, and process your personal data, and may disclose or transfer it to third parties.

 
2. For what purposes may your personal data be processed?

Of your collected personal data separately specified below:

Identity Data may be processed for the following purposes:

• Explicitly provided for under applicable laws (Art. 5/2.a);
• Required for the data controller to fulfill its legal obligations (Art. 5/2.ç);
• Processing of the personal data of the contractual parties is required, provided that such processing is directly related to the establishment or performance of a contract (Art. 5/2.c);

Contact Data may be processed for the following purposes:

• Processing of the personal data of the contractual parties is required, provided that such processing is directly related to the establishment or performance of a contract (Art. 5/2.c);
• Explicitly provided for under applicable laws (Art. 5/2.a);
• Required for the data controller to fulfill its legal obligations (Art. 5/2.ç);

Financial Data may be processed for the following purposes:

• Processing of the personal data of the contractual parties is required, provided that such processing is directly related to the establishment or performance of a contract (Art. 5/2.c);
• Explicitly provided for under applicable laws (Art. 5/2.a);
• Required for the data controller to fulfill its legal obligations (Art. 5/2.ç);

Physical Space Security Data may be processed for the following purposes:

• Processing of the personal data of the contractual parties is required, provided that such processing is directly related to the establishment or performance of a contract (Art. 5/2.c);
• Explicitly provided for under applicable laws (Art. 5/2.a);
• Required for the data controller to fulfill its legal obligations (Art. 5/2.ç);
• Processing of personal data is required for the establishment, exercise, or protection of a right (Art. 5/2.d);
• Processing of personal data is required for the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject (Art. 5/2.f);

Legal Transaction Data may be processed for the following purposes:

• Required for the data controller to fulfill its legal obligations (Art. 5/2.ç);

Special Categories of Personal Data

Provided that the explicit consent of the data subject is obtained (Art. 5/1) and in line with the personal data processing requirements, personal data may be collected and processed through the following channels and methods:

• electronically, by automated or non-automated means, through our website www.ccnholding.com and any other websites we may launch in the future;
• electronically, by automated or non-automated means, through cookies (“Cookies”) on the Website that communicate with your devices (cookies generally collect anonymous data);
• electronically, by automated or non-automated means, through accounts operated on behalf of the Company via various social media channels (“Social Media”);
• verbally or electronically, by automated or non-automated means, through our call centers (“Call Center”) operated by the Company;
• electronically, by automated or non-automated means, via email through all sales and marketing networks established and managed by the Company;
• verbally, electronically, or in writing, by automated or non-automated means, through contracts, email correspondence, or via user devices;
• verbally from Company visitors, or in writing by receiving business cards in person;
• verbally, in writing, or electronically, by automated or non-automated means, through sales and marketing activities and through our employees operating on behalf of the Company and/or working within the sales and marketing network;
• electronically, by automated or non-automated means, through the website, electronic mail, mobile communication methods, or mobile applications, by the Company or by natural or legal persons processing data on behalf of the Company based on various legal grounds;
• physically, in a panel environment, through the advertisement management channel;
• through any means of communication by other communication methods, including correspondence via our email addresses and SMS or multimedia messages sent for other purposes related to the Company’s activities;
• verbally, in writing, or electronically, by automated or non-automated means, through all service sales and marketing networks owned by the Company or operated by third parties, within the scope of sales, marketing, and after-sales services;
• verbally, in writing, or electronically, by automated or non-automated means, through all other after-sales service networks established or operated by the Company or by third parties;
• through third parties such as Group companies to which the Company provides or from which it receives services, business partners, manufacturers, firms from which it procures goods/services, online sales platforms, dealers, and solution partners;
• verbally or electronically, by automated or non-automated means, through websites, social media, or other channels on which you have made your Personal Data publicly available;
• electronically, through the retention of log records on the system from devices used by guests connected to the Company’s Wi-Fi network;
• electronically, through cameras of the IP Camera system for security purposes for visitors arriving at the Company or dealers;
• electronically, by automated or non-automated means, for the purpose of receiving and evaluating requests and complaints;
• electronically, by automated or non-automated means, for the purpose of tracking and conducting legal processes;
• electronically, by automated or non-automated means, for the purpose of fulfilling requests from official authorities;
• electronically, by automated or non-automated means, for the purpose of carrying out information security processes;
• electronically, by automated or non-automated means, for the purpose of conducting audit and ethical compliance activities;
• electronically, by automated or non-automated means, for the purpose of planning and executing internal processes;
• verbally, in writing, or electronically, by automated or non-automated means, through all other after-sales service networks established or operated by the Company or by third parties;
• through third parties such as Group companies to which the Company provides or from which it receives services, business partners, manufacturers, firms from which it procures goods/services, online sales platforms, dealers, and solution partners;
• verbally, in writing, electronically, or through paper-based forms, via the information you provide to our employees or suppliers to obtain information about our infrastructure and other services;
• physically or virtually, whether in person or remotely, verbally, in writing, or electronically, through business cards, résumés (CVs), or proposals provided for purposes such as establishing a commercial relationship with our Institution, applying for a job, or submitting an offer;
• verbally or electronically, by automated or non-automated means, through websites, social media, or other channels on which you have made your Personal Data publicly available.

Through the channels listed above or any other channels that may be added in the future, the data collected verbally, in writing, or electronically, by automated or non-automated means, may be processed in line with the legal grounds and purposes set out below.

 
Purposes of processing

Your Personal Data, collected through the channels and by the methods specified in this Privacy Notice, is processed by the Company for the following purposes, under Articles 5.2 and 6.3 of the Law on the Protection of Personal Data (KVKK):

As a rule, we process your Personal Data based on your explicit consent. However, your Personal Data may be processed without your explicit consent in exceptional cases permitted under the Law. Within this scope, we process your Personal Data for the purpose of protecting our legitimate interests, such as:

(i) fulfilling our legal obligations (obligations arising from tax legislation, consumer protection legislation, the code of obligations, the commercial code, and other applicable legislation);
(ii) where you are unable to express your consent due to actual impossibility;
(iii) establishing or performing a contract;
(iv) fulfilling our legal obligations such as receiving your inquiries and complaints regarding services, responding to you, and using such information in the event of a potential dispute, when deemed necessary;
(v) establishing or protecting a right through transactions carried out within the scope of retaining records as evidence in after-sales services, as well as any other related processing that may be attributed under the applicable regulations;
(vi) reducing costs, ensuring efficient use of resources, monitoring call-center service quality, ensuring your security, measuring the quality of the service provided to you, and evaluating and resolving your requests within this scope, provided that your fundamental rights and freedoms are not harmed.

Additionally, the processing of personal data you have made public does not require your explicit consent within the limits set forth under the Law. Our processing of your Personal Data that you have made public through Social Media channels, your website, or other platforms, as well as any other related processing that may be attributed under the applicable regulations, may be given as an example of this situation.

Apart from this, your explicit consent shall be separately obtained for any processing that requires your explicit consent.

Your Personal Data collected through the aforementioned channels and by the aforementioned methods may also be processed for the following purposes, provided that your explicit consent is obtained under Article 5.1 and Article 6.2 of the Law:

(i) Carrying out communication, advertisement and marketing activities, product/service offers, information, promotion, and sales activities;
(ii) Creating communication, advertisement-targeting, and marketing archives, and enabling future contact for potential partnerships or collaborations;
(iii) Ensuring contract management;
(iv) Creating participant information, venue entry permits, and event contracts for exhibitions and events; providing better services to our Website users and improving our services;
(v) Ensuring the legal and commercial security of the Company, its Subsidiaries, and the natural and legal persons who have established or are currently in a business relationship with the Company;
(vi) Performance of the necessary activities by our business units to make available to you any products, services, or commercial activities offered by the Company, as applicable;
(vii) For the purposes of determining and implementing the Company’s commercial and business strategies;
(viii) Keeping visitor logs to ensure the security of the Company;
(ix) Offering advertisements, campaigns, advantages, and other benefits—particularly those tailored for you—for sales, telesales, online sales, and marketing activities; and carrying out other marketing and Customer Relations Management activities;
(x) Ensuring the continuity of communication and marketing activities;
(xi) Providing personalized content during your visit to the Websites;
(xii) Creating new product and service models;
(xiii) Sending electronic commercial communications (e.g., bulletins, campaigns, newsletters, customer satisfaction surveys, product and service advertisements, etc.);
(xiv) Sending gifts, bulletins, promotions, and other magazines/periodicals;
(xv) Corporate communication and the organization of other events and invitations, and providing information thereof; carrying out meeting participation applications, entry, and all other relevant processes; completing other necessary meeting notification procedures; and conducting the processing required for participation in congresses/symposiums and scientific or educational meetings;
(xvi) Your Special Categories of Personal Data are processed in cases where you are unable to express your consent due to actual impossibility; for the purposes of establishing or performing a contract; fulfilling our legal obligations; establishing, exercising, or protecting a right; and protecting our legitimate interests without harming your fundamental rights and freedoms.

 
3. To whom and for what purposes may your processed Personal Data be transferred?

Your collected Personal Data may be transferred for the purposes of:

• Fulfillment of the Company’s legal obligations;
• Carrying out the necessary operational activities by our business units;
• Optimal planning and implementation of our human resources policies, and accurate planning and execution of our business partnerships and strategies;
• Ensuring the legal, commercial, and physical security of our Company and our business partners;
• Ensuring the corporate operation of our Company;
• Fulfillment of requests from official authorities;
• Tracking and conducting legal processes;
• Ensuring that you benefit from the products and services offered by our Company in the best possible manner; customizing and recommending such products and services according to your demands, needs, and preferences; ensuring the highest level of data security; and creating databases;
• Improving the services offered on our Company’s website; contacting those who submit requests and complaints to our Company; resolving errors that occur on our Company’s website; and taking the necessary steps for making, implementing, and carrying out commercial decisions by the Company;
• Planning and executing our Company’s human resources policies and processes.

Personal Data may be transferred to:

a) Our business partners;
b) Suppliers;
c) Company officials; and
d) Legally authorized public institutions and private persons,

pursuant to Articles 8 and 9 of the Law on the Protection of Personal Data.

 
4. What are the legal basis and methods used to collect your Personal Data?

Personal data are collected in any verbal, written, or electronic environment, by technical and other methods, through various channels such as the Company’s website, for the purposes set out in this Policy and for the full and accurate fulfillment of the responsibilities arising from applicable laws, within the framework of legal grounds based on legislation, contracts, requests, or demands.

Your Personal Data may be collected, processed, and transferred based on your explicit consent for the processing of your Personal Data, or on the legal grounds specified under Articles 5 and 6 of the Law, as well as other legal grounds set forth in applicable legislation.

 
5. Conditions for the Transfer of Personal Data

The Company may transfer personal data and Special Categories of Personal Data to third parties in accordance with the Law by establishing the necessary confidentiality conditions and taking the required security measures in line with its purposes for processing personal data.

The Company complies with the regulations set forth in the Law during the transfer of personal data. Within this scope, the Company may transfer personal data to third parties, based on one or more of the personal data processing conditions set out in Article 5 of the Law, limited to and in line with its legitimate and lawful personal data processing purposes:

• If the explicit consent of the data subject is obtained;
• If there is an explicit provision in the laws regarding the transfer of personal data;
• If it is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to express their consent due to actual impossibility or their consent is not deemed legally valid;
• If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract;
• If the transfer of personal data is necessary for the Company to fulfill its legal obligations;
• If the personal data have been made public by the data subject;
• If the transfer of personal data is required for the establishment, exercise, or protection of a right;
• If the transfer of personal data is required for the legitimate interests of the Company, provided that such transfer does not harm the fundamental rights and freedoms of the data subject.

Conditions for the Domestic Transfer of Special Categories of Personal Data

The Company may transfer special categories of personal data of data subjects to third parties in line with the principles adopted for the processing of personal data.

For the transfer of special categories of personal data to third parties, due care is exercised to obtain the explicit consent of the data subject, and such data is transferred domestically with adequate technical and organizational measures in place.

However, in the presence of the circumstances set out below, special categories of personal data may also be transferred without the explicit consent of the data subject, provided that adequate technical and organizational measures are taken:

• Data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, attire, association, foundation or trade union membership, criminal convictions and security measures, as well as biometric and genetic data, may be transferred in cases prescribed by law;
• Personal data concerning health and sexual life may be transferred only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, or the planning and management of healthcare services and their financing, and only to/by persons under a duty of confidentiality or by authorized institutions and organizations.

Conditions for the Transfer of Personal Data Abroad

The Company may transfer personal data and special categories of personal data of data subjects to third parties abroad by taking the necessary security measures in line with its personal data processing purposes.

Personal data may be transferred by the Company to foreign countries that are declared by the Board, in accordance with Article 9 of the Law, to provide adequate protection, or—where adequate protection is lacking—to foreign countries where the data controllers in Türkiye and the relevant foreign country provide a written undertaking of adequate protection and obtain the Board’s authorization thereof.

Conditions for the Transfer of Special Categories of Personal Data Abroad

The Company may transfer the personal data of data subjects abroad in line with the principles adopted for the processing of personal data.

Where the country to which the personal data will be transferred provides adequate protection, or where the data controller receiving the data provides a written undertaking of sufficient protection and authorization is obtained from the Personal Data Protection Board, personal data may be transferred abroad without the explicit consent of the data subject, provided that one of the following conditions is met:

• Data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, attire, association, foundation or trade union membership, criminal convictions and security measures, as well as biometric and genetic data, may be transferred in cases prescribed by law;
• Personal data concerning health and sexual life may be transferred only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, or the planning and management of healthcare services and their financing, and only to/by persons under a duty of confidentiality or by authorized institutions and organizations.

 
6. What personal data concerning your contact information is processed?

For the reasons specified in Article 2 of this Privacy Notice, the contents of the Company’s corporate email accounts, your contact information recorded via the website, and the IP details of the communication devices you use to access the website are processed by the Company and/or persons authorized by the Company.

Records of correspondence and communication with Company representatives, employees, call center, and customer relations staff may be backed up, reported, and subjected to detailed examination when necessary.

 
7. For how long is your personal data processed?

The Personal Data you have shared with the Company through the channels referred to in this Privacy Notice will be processed in accordance with the Law on the Protection of Personal Data (“KVKK” or the “Law”) and other applicable legislation on the protection of personal data, for the periods mandated therein, and in any case, as long as the legitimate purposes set out above remain valid.

 
8. What are your rights under Law No. 6698 on the Protection of Personal Data?

Pursuant to Article 11 of Law No. 6698 on the Protection of Personal Data, you are entitled to:

• learn whether your personal data is being processed;
• request information if your personal data has been processed;
• learn the purpose for which your personal data is processed and whether it is used in accordance with that purpose;
• know the third parties to whom your personal data is transferred, whether domestically or abroad;
• request the rectification of your personal data if it is incomplete or inaccurately processed, and to request that such rectification be notified to the third parties to whom the data has been transferred;
• request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the Law, except where statutory limitations apply, and to request that such deletion or destruction be notified to the third parties to whom the data has been transferred;
• object to any outcome to your detriment arising from the analysis of your processed data exclusively through automated systems; and
• request compensation for damages in the event you suffer harm due to the unlawful processing of your personal data.

 
9. How can you apply to the data controller?

You may submit your requests regarding the rights listed above to the Company:

• in writing with an original signature (signed by hand); or
• through registered electronic mail (KEP) address, secure electronic signature, mobile signature; or
• via the email address previously provided to the Company and registered in our systems.

The address for written applications:
“Üniversiteler Mah. 1604 Cad. Ana Hastane Binası Apt. No:9/1/177 Çankaya/Ankara.”

If a request is to be submitted by someone other than the data subject, a special power of attorney issued by the data subject in favor of the person who will submit the application is required.

Duly submitted requests delivered to the Company will be finalized free of charge within thirty (30) days at the latest. If the response exceeds ten pages, a processing fee of TRY 1 (one Turkish Lira) may be charged for each page beyond the first ten pages.

If the response to the application is provided on a recording medium such as a CD or flash drive, the cost of the recording medium may be charged.