Privacy Notice

The legally binding version of this text is the Turkish version. Türkçe metin →

Turkuaz Sağlık Hizmetleri Medikal Temizlik Kimyasal Ürünler San. ve Tic. A.Ş. PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This Privacy Notice has been prepared by Turkuaz Sağlık Hizmetleri Medikal Temizlik Kimyasal Ürünler San. ve Tic. A.Ş. (the “Company”) to inform the Company’s customers about the processing of their personal data by the Company under the Personal Data Protection Law No. 6698 (the “Law”).

Detailed information on the processing of your personal data under this Privacy Notice can be found in the Turkuaz Sağlık Hizmetleri Medikal Temizlik Kimyasal Ürünler San. ve Tic. A.Ş. Personal Data Protection and Processing Policy available at [www.turkuazsaglik.com].

a) Methods and Legal Grounds for Collecting Personal Data

Your personal data is collected electronically or physically. Your personal data collected on the legal grounds set out in this Privacy Notice may be processed and shared within the framework of the personal data processing conditions set out in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Within the framework of the personal data processing conditions set out in Articles 5 and 6 of the Law, your personal data is processed for the following purposes: planning and carrying out the activities needed to tailor, recommend and promote the Company’s products and services according to the preferences, usage habits and needs of the persons concerned; carrying out, through the business units, the work needed for the persons concerned to benefit from the Company’s products and services, and running the related business processes; carrying out, through the relevant business units, the work needed to perform the Company’s commercial activities, and running the related business processes; planning and implementing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial/business security of the Company and of the persons in a business relationship with the Company.

c) Parties with whom Personal Data may be Shared and Purposes of Sharing

Within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the Law, and for the purposes listed in section (b) above, your personal data may be shared with the Company’s business partners and suppliers, with legally authorised public institutions and organisations, and with legally authorised private legal entities.

d) Rights of Data Subjects and Exercising these Rights

If, as a data subject, you submit requests concerning the rights listed below to the Company using the methods described under “Exercise of Rights by Data Subjects”, your requests will be evaluated and concluded by our Company as soon as possible and in any event within 30 (thirty) days.

Under Article 11 of the Law, as a data subject you have the right to:

• learn whether your personal data is being processed,
• request information about the processing if your personal data has been processed,
• learn the purpose of the processing of your personal data and whether it is used for its intended purpose,
• know the third parties in Türkiye or abroad to whom your personal data has been transferred,
• request the rectification of your personal data if it has been processed incompletely or incorrectly, and request that this be notified to the third parties to whom your personal data has been transferred,
• request the erasure or destruction of your personal data if the reasons for its processing no longer exist, even though it has been processed in accordance with the Law and other relevant legislation, and request that this be notified to the third parties to whom your personal data has been transferred,
• object to a result against you arising from the analysis of your processed data exclusively by automated systems,
• claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which data subjects have no right to make requests. Accordingly, the above rights cannot be exercised where:

• the processing of personal data is necessary for the prevention of a crime or for a criminal investigation,
• personal data made public by the data subject is processed,
• the processing of personal data is necessary for the performance of supervisory or regulatory duties or for disciplinary investigations or prosecutions by authorised public institutions and organisations and professional bodies with public institution status, on the basis of the powers granted by law,
• the processing of personal data is necessary to protect the economic and financial interests of the State in relation to budgetary, tax and financial matters.

Under paragraph 1 of Article 28 of the Law, the data in the following cases falls outside the scope of the Law, and data subjects’ requests will therefore not be processed in respect of such data:

• Processing of personal data by natural persons within the scope of activities relating exclusively to themselves or to family members living in the same household, provided that the data is not disclosed to third parties and data security obligations are complied with.
• Processing of personal data for purposes such as research, planning and statistics by anonymising it through official statistics.
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that this does not violate national defence, national security, public security, public order, economic security, privacy or personal rights, or constitute a crime.
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised by law to ensure national defence, national security, public security, public order or economic security.
• Processing of personal data by judicial authorities or enforcement offices in connection with investigation, prosecution, trial or enforcement proceedings.

Exercise of Rights by Data Subjects

To exercise the rights mentioned above, data subjects may use the “Application Form for Applications by the Data Subject to the Data Controller” available at [www.turkuazsaglik.com].

Applications must be made together with documents identifying the data subject, using one of the following methods:

• delivering a completed copy of the form with a wet signature by hand, through a notary or by registered letter with return receipt to [Akçaburgaz Mahallesi Muhsin Yazıcıoğlu Caddesi No:45/5 34522 Esenyurt, Istanbul – Türkiye],
• signing the form with a secure electronic signature under Electronic Signature Law No. 5070 and sending it by registered e-mail to info@turkuazsaglik.com.tr,
• following a method prescribed by the Personal Data Protection Board.

Within the limits set out in the Law, the Company responds to data subjects wishing to exercise these rights within a maximum of thirty (30) days, as provided in the Law. For a third party to apply on behalf of a data subject, a special power of attorney issued through a notary by the data subject in the name of the applicant is required.

Data subject applications are, as a rule, processed free of charge; however, fees may be charged according to the fee schedule[1] set by the Personal Data Protection Board.

To determine whether the applicant is the data subject, the Company may request information from the applicant and may ask the data subject questions about the application in order to clarify the matters stated in it.

[1] Under the “Communiqué on the Procedures and Principles of Application to the Data Controller” published in the Official Gazette No. 30356 of 10.03.2018, no fee is charged for written responses of up to ten pages. A processing fee of 1 Turkish lira may be charged for each page above ten pages. If the response is provided on a recording medium such as a CD or flash drive, the fee that may be requested cannot exceed the cost of the recording medium.