Personal Data Processing and Protection Policy

1. GENERAL PROVISIONS

As DENT FORUM ORAL AND DENTAL HEALTH SERVICES TRADE LIMITED COMPANY, we attach great importance to the protection, processing, deletion, destruction, or anonymization of the personal data of all natural persons with whom we come into contact in any manner while carrying out our commercial activities, and to fully complying with the requirements set forth under the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”), the Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28.10.2017 and effective as of 01.01.2018, the Regulation on the Data Controllers Registry published in the Official Gazette dated 30.12.2017 and effective as of 01.01.2018, and other applicable legislation.

This policy, prepared within the scope of Personal Data Protection, has been established for use throughout the website specified below.

Our Website:

https://dentforumizmir.com/

Hereinafter, our entire website shall be referred to as the “Company.”

The Personal Data Protection Law constitutes one of the most important regulatory frameworks applicable to our Company and all websites operated within our organization. One of the fundamental elements of this framework is the Personal Data Protection and Processing Policy (“Policy”).

This Policy sets forth the principles governing the processing, deletion, destruction, and anonymization of personal data belonging to data subjects by the Company. These provisions apply to Company employees, our subcontractors and their employees, our existing and potential customers, suppliers, visitors, and other natural persons who have a relationship with the Company.

2. PURPOSE AND SCOPE OF THE POLICY

The primary purpose of this Policy is to ensure transparency by providing information regarding the lawful processing and protection of personal data obtained by the Company, as well as the security measures and precautions implemented to protect such personal data.

This Policy also applies to all personal data belonging to our patients, patients’ relatives (parents/guardians/representatives), employees, employee candidates, supplier representatives and employees, employees of institutions with which we cooperate, and third parties, where such data is processed automatically or by non-automatic means provided that it forms part of a data recording system.

The scope of application of this Policy to the categories of personal data subjects specified above may cover the entire Policy or only certain provisions thereof.

3. IMPLEMENTATION OF THE POLICY AND APPLICABLE LEGISLATION

Applicable legal regulations currently in force regarding the processing and protection of personal data shall take precedence. In the event of any conflict between the applicable legislation and this Policy, the Company acknowledges and declares that the applicable legislation shall prevail.

4. EFFECTIVE DATE OF THE POLICY

This Policy enters into force on the date of its publication. In the event that the entire Policy or any specific part thereof is amended or renewed, the effective date of the Policy shall be updated accordingly.

5. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

5.1. Definitions

The definitions of the terms and abbreviations used in this Policy are as follows:

  • Explicit Consent: Consent relating to a specific matter, based on information and expressed freely by the data subject.
  • Data Recording Medium: Any environment in which personal data processed wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system, is stored.
  • Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.
  • Deletion of Personal Data: The process of rendering personal data inaccessible and unusable in any way by Relevant Users.
  • Destruction of Personal Data: The process of rendering personal data inaccessible, irretrievable, and unusable by anyone under any circumstances.
  • Disposal: The deletion, destruction, or anonymization of personal data.
  • Law: Turkish Personal Data Protection Law No. 6698.
  • Personal Data: Any information relating to an identified or identifiable natural person.
  • Processing of Personal Data: Any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that it forms part of a data recording system, including the collection, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, acquisition, making available, classification, or prevention of use of such data.
  • Board: The Turkish Personal Data Protection Board.
  • Special Categories of Personal Data: Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
  • Periodic Disposal: The deletion, destruction, or anonymization process carried out automatically at recurring intervals specified in the Personal Data Retention and Disposal Policy when all conditions requiring the processing of personal data under the Law cease to exist.
  • Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
  • Data Subject / Relevant Person: The natural person whose personal data is processed.
  • Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
  • Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28.10.2017 and the Regulation on the Data Controllers Registry published in the Official Gazette dated 30.12.2017.

5.2. Ensuring the Security of Personal Data

Pursuant to Article 12 of the Turkish Personal Data Protection Law No. 6698, the Company takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of and unauthorized access to personal data and to ensure the secure retention of personal data. The Company also carries out or commissions the necessary audits to ensure compliance with the provisions of the Law.

The Personal Data Security Guide (Technical and Administrative Measures) published by the Personal Data Protection Board includes the following measures:

Technical Measures

  • Authorization Matrix
  • Authorization Control
  • Access Logs
  • User Account Management
  • Network Security
  • Application Security
  • Encryption
  • Penetration Testing
  • Intrusion Detection and Prevention Systems
  • Log Records
  • Data Masking
  • Data Loss Prevention Software
  • Backup and Firewall Systems
  • Up-to-Date Antivirus Systems
  • Deletion, Destruction, or Anonymization
  • Key Management

Administrative Measures

  • Preparation of a Personal Data Processing Inventory
  • Corporate Policies (Access, Information Security, Use, Retention and Disposal, etc.)
  • Agreements between Data Controllers and between Data Controllers and Data Processors
  • Confidentiality Agreements
  • Periodic and/or Random Internal Audits and Risk Analyses
  • Employment Agreements and Disciplinary Regulations incorporating provisions compliant with the Law
  • Corporate Communication procedures, including crisis management, notification processes for the Board and data subjects, and reputation management
  • Training and Awareness Activities regarding Information Security and the Law
  • Notification to the Data Controllers Registry Information System (VERBİS)

Within the scope of the Personal Data Security Guide published by the Board, the technical and administrative measures implemented by our Company include the following:

  • The Company ensures network and application security.
  • The security of personal data stored in cloud environments is ensured.
  • Employees receive periodic training and awareness programs regarding data security.
  • Authorization matrices are established for employees.
  • Corporate policies regarding access, information security, use, retention, and disposal have been prepared and implemented.
  • Confidentiality agreements are executed.
  • Authorization rights of employees who change positions or leave the Company are revoked.
  • Up-to-date antivirus systems are used.
  • Firewalls are used.
  • Executed agreements contain provisions regarding data security.
  • Personal data security policies and procedures have been established.
  • Personal data security is continuously monitored.
  • Necessary security measures are implemented regarding entry to and exit from physical environments containing personal data.
  • Physical environments containing personal data are protected against external risks such as fire and flooding.
  • The security of environments containing personal data is ensured.
  • The amount of personal data processed is minimized wherever possible.
  • Personal data is backed up, and the security of backed-up personal data is also ensured.
  • User account management and authorization control systems are implemented and monitored.
  • Existing risks and corresponding measures have been identified.

5.3. Protection of Special Categories of Personal Data

The definition of “Special Categories of Personal Data” is provided in the Definitions section of this Policy.

Within this scope, our Company exercises particular care during the processing, storage, and disposal of special categories of personal data and implements various technical and administrative measures, including the following:

  • Adequate security measures are implemented according to the nature of the environment in which special categories of personal data are stored, including measures against electrical faults, fire, flooding, theft, and similar risks. Physical security is maintained and unauthorized access is prevented.
  • Personal data is backed up to ensure the secure storage of special categories of personal data, and the physical security of all backups is maintained.
  • Special categories of personal data are destroyed in a manner that prevents recovery and does not leave an audit trail.
  • All policies and procedures relating to the processing, confidentiality, security, and disposal of special categories of personal data, as well as the duties, authorities, and responsibilities of personnel involved in these processes, are documented in writing and made accessible to all relevant personnel.
  • Personnel receive regular training regarding the Law, related regulations, and the security of special categories of personal data.
  • Policies and procedures are kept up to date, and employees are provided with the necessary training and information regarding any amendments.
  • As part of the recruitment process, provisions concerning the protection and confidentiality of special categories of personal data are incorporated into agreements executed between employees and the Company and are signed by the employees.
  • The Company periodically determines whether processed personal data is still required and whether it is being stored in the appropriate environment. Personal data retained for archival purposes is stored in more secure environments, while special categories of personal data that are no longer required are deleted, destroyed, or anonymized in accordance with this Policy.
  • Confidentiality agreements regarding the protection and security of special categories of personal data are executed with persons and data processors with whom such data is shared, or appropriate data security provisions are incorporated into existing agreements.
  • Access to systems containing special categories of personal data is provided in accordance with access policies and user and role management procedures. The scope and duration of authorization granted to users who have access to such data are clearly defined.
  • If processed special categories of personal data are unlawfully obtained by third parties, the relevant data subject and the Personal Data Protection Board shall be notified as soon as possible.

6. MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

6.1. Processing of Personal Data

The Company processes, stores, and disposes of personal data in accordance with the procedures and principles stipulated under the KVKK and other applicable legislation. Accordingly, the Company fully complies with the following principles set forth under the KVKK when processing, storing, and disposing of personal data:

  • Lawfulness and fairness: The Company's personal data processing activities are carried out within the limits required by all applicable legislation, particularly the Constitution and the KVKK, and in accordance with the principles of good faith.
  • Accuracy and being up to date where necessary: Necessary measures are taken to ensure that personal data processed by the Company is accurate and up to date. Data subjects are provided with the necessary opportunities to ensure that processed data reflects the current and actual circumstances.
  • Processing for specified, explicit, and legitimate purposes: The Company processes personal data only for clearly defined and legitimate purposes and does not engage in processing activities outside such purposes. Accordingly, personal data is processed only where it is connected with and necessary for the relationship established with the relevant data subjects.
  • Being relevant, limited, and proportionate to the purposes for which data is processed: Personal data is processed in accordance with the KVKK and other applicable legislation, to the extent necessary and proportionate to achieve the purposes determined for each category of data. The processing of unnecessary personal data is avoided.
  • Retention for the period stipulated under applicable legislation or necessary for the purpose of processing: Personal data processed by the Company is retained only for the period stipulated under applicable legislation or for the period necessary for the purposes for which it is processed. Where applicable legislation specifies a retention period, the Company complies with such period. Where no specific period is prescribed, personal data is retained only for as long as necessary for the purpose for which it was processed. Upon expiry of the legally prescribed period or when the reasons requiring the processing of personal data cease to exist, the personal data is deleted, destroyed, or anonymized by the Company. Personal data may only be retained for potential future use where legitimate interests exist.
Call Book Appointment