Special Categories of Personal Data Storage and Disposal Policy

1. PURPOSE OF THE POLICY

The purpose of this Policy is to determine the rules, roles, and responsibilities to be implemented throughout our Company in order to fulfill the obligations regarding the processing, retention, and disposal of special categories of personal data pursuant to Articles 5 and 6 of the Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette No. 30224 dated 28.10.2017 based on the Turkish Personal Data Protection Law No. 6698 (“Law”), and the Personal Data Protection Board’s Decision dated 31.01.2018 and numbered 2018/10.

2. SCOPE OF THE POLICY

This Policy covers natural persons whose special categories of personal data, as defined under the Law, are processed, as well as all departments, employees, and third parties involved in any process involving the processing of personal data within the Company.

This Policy defines the procedures to be followed by the Company in processing special categories of personal data, as well as the rules governing the retention and disposal of such data, and covers all activities required for the management of these processes.

3. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

3.1. Definitions

The definitions of the terms and abbreviations used in this Policy are as follows:

• Explicit Consent: Consent relating to a specific matter, based on information and expressed freely by the data subject.
• Data Recording Medium: Any environment in which personal data processed wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system, is stored.
• Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.
• Deletion of Personal Data: Rendering personal data inaccessible and unusable in any way by Relevant Users.
• Destruction of Personal Data: Rendering personal data inaccessible, irretrievable, and unusable by anyone under any circumstances.
• Disposal: The deletion, destruction, or anonymization of personal data.
• Law: Turkish Personal Data Protection Law No. 6698.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing of Personal Data: Any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that it forms part of a data recording system, including collection, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, acquisition, making available, classification, or prevention of use.
• Board: The Turkish Personal Data Protection Board.
• Special Categories of Personal Data: Data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Periodic Disposal: The deletion, destruction, or anonymization process carried out automatically at recurring intervals specified in the Personal Data Retention and Disposal Policy when all conditions requiring the processing of personal data under the Law cease to exist.
• Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
• Data Subject / Relevant Person: The natural person whose personal data is processed.
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28.10.2017 and the Regulation on the Data Controllers Registry published in the Official Gazette dated 30.12.2017.

3.2. Protection of Special Categories of Personal Data

The definition of “Special Categories of Personal Data” is provided under Section 3.1, Definitions, of this Policy.

Within this scope, our Company exercises particular care in the processing, retention, and disposal of special categories of personal data and has implemented various technical and administrative measures, including:

• Adequate security measures are implemented according to the nature of the environment in which special categories of personal data are stored, including measures against electrical faults, fire, flooding, theft, and similar risks. Physical security is maintained and unauthorized access is prevented.
• Personal data is backed up to ensure the secure storage of special categories of personal data, and the physical security of all backups is maintained.
• Special categories of personal data are destroyed in a manner that prevents recovery and does not leave an audit trail.
• All policies and procedures regarding the processing, confidentiality, security, and disposal of special categories of personal data, together with the duties, authorities, and responsibilities of personnel involved in such processes, are documented in writing and made accessible to relevant personnel.
• Personnel are provided with regular training regarding the Law, related regulations, and the security of special categories of personal data.
• Policies and procedures are kept up to date, and employees are provided with the necessary training and information regarding amendments.
• As part of the recruitment process, provisions concerning the protection and confidentiality of special categories of personal data are incorporated into agreements executed between employees and the Company and signed by employees.
• The Company determines whether processed personal data is still required and whether it is stored in the appropriate environment. Personal data retained for archival purposes is stored in more secure environments, while special categories of personal data that are no longer required are deleted, destroyed, or anonymized in accordance with this Policy.
• Confidentiality agreements regarding the protection and security of special categories of personal data are executed with persons and data processors with whom such data is shared, or appropriate data security provisions are incorporated into existing agreements.
• Access to systems containing special categories of personal data is provided in accordance with access policies and user and role management procedures. The scope and duration of authorization granted to users with access to such data are clearly defined.
• If processed special categories of personal data are unlawfully obtained by third parties, the relevant data subject and the Board shall be notified as soon as possible.

4. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

4.1. Conditions for Processing Special Categories of Personal Data

The Company exercises particular care when processing special categories of personal data, as such data requires a higher level of protection for data subjects. Within this scope, provided that adequate measures determined by the Board are implemented, such data is not processed without the explicit consent of the data subject.

However, special categories of personal data may also be processed without the explicit consent of the data subject in circumstances prescribed by law. In addition, data concerning health and sexual life may be processed without explicit consent, provided that adequate safeguards are implemented and one of the following purposes applies or such processing is otherwise permitted by law:

• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Provision of treatment and care services,
• Planning and management of healthcare services and their financing,
• Marketing operations.

The categories listed above are provided for informational purposes. Additional categories may be introduced in the future in connection with the Company’s commercial and operational activities. In such cases, the relevant texts will be updated accordingly in order to ensure that appropriate information continues to be provided.

5. INFORMING AND NOTIFYING THE DATA SUBJECT

Section 4.1 of this Policy provides detailed information regarding the conditions for processing special categories of personal data. In addition to satisfying these conditions under the KVKK, Article 10 requires personal data subjects to be informed before their personal data is obtained or, at the latest, at the time it is obtained.

The information to be provided to data subjects within the scope of this obligation includes:

• The identity of the data controller and, where applicable, its representative,
• The purposes for which personal data will be processed,
• To whom and for what purposes processed personal data may be transferred,
• The method and legal basis for collecting personal data,
• Other rights of the data subject set forth under Article 11 of the KVKK.

In order to fulfill its obligation to inform, the Company has prepared privacy notices to be presented to data subjects in accordance with the provisions of the KVKK specified above, taking into account the relevant processes and categories of persons whose data is processed.

Following the presentation of these privacy notices, explicit consent declarations have also been prepared for processing activities and categories of personal data for which the data subject’s explicit consent is required in order for the Company to conduct its commercial activities.

In line with European Union regulations underlying the KVKK, the explicit consent declarations prepared for data subjects provide individuals with the opportunity to choose whether their personal data may be processed by the Company and inform them of the potential consequences where explicit consent is not provided.

Under Article 28(1) of the KVKK, the data controller is not subject to the obligation to inform in the following circumstances:

• Processing of personal data by natural persons exclusively within the scope of activities relating to themselves or family members living in the same household, provided that the data is not disclosed to third parties and data security obligations are complied with,
• Processing of personal data for purposes such as research, planning, and statistics by anonymizing such data through official statistics,
• Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, privacy, or personal rights and does not constitute a criminal offense,
• Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, judicial proceedings, or execution proceedings.

Furthermore, pursuant to Article 28(2) of the KVKK, the data controller’s obligation to inform shall not apply in the following circumstances:

• Where processing of personal data is necessary for the prevention of crime or a criminal investigation,
• Processing of personal data that has been made public by the data subject,
• Where processing is necessary for supervisory or regulatory duties or disciplinary investigations or proceedings conducted by authorized public institutions and organizations and professional organizations having the status of public institutions pursuant to authority granted by law,
• Where processing is necessary for the protection of the State’s economic and financial interests regarding budgetary, tax, and financial matters.

6. RIGHTS OF THE PERSONAL DATA SUBJECT

The Company has implemented the necessary measures to enable data subjects to exercise the rights granted under Article 11 of the KVKK regarding personal data processed in accordance with the principles set forth in this Policy.

These rights include:

1. To learn whether personal data is being processed,
2. To request information if personal data has been processed,
3. To learn the purpose of processing personal data and whether such data is being used in accordance with that purpose,
4. To know the third parties to whom personal data has been transferred within Türkiye or abroad,
5. To request correction of personal data if it has been processed incompletely or inaccurately,
6. To request deletion or destruction of personal data within the framework of the conditions stipulated under Article 7 of the Law,
7. To request notification of the actions taken pursuant to the correction, deletion, or destruction of personal data to third parties to whom the personal data has been transferred,
8. To object to any adverse result arising against the data subject as a result of the analysis of processed personal data exclusively through automated systems,
9. To request compensation for damages suffered as a result of the unlawful processing of personal data.

Data subjects may exercise the rights listed above by submitting a wet-signed copy of the Data Subject Application Form included as Annex 1 to this Policy to the Company’s contact addresses by post, email, or registered mail with return receipt requested. Detailed information regarding completion and submission of the Form is provided in Annex 1.

The Company shall deliver its response to the relevant data subject either physically or electronically.

Depending on the nature of the request, the Company shall conclude the request free of charge as soon as possible and no later than thirty (30) days. However, if processing the request incurs an additional cost, the fee determined in the tariff issued by the Board may be charged to the applicant.

During the process of handling requests from data subjects, the Company may also request additional information or documents from applicants in order to ensure data security and verify whether the applicant is the relevant personal data subject.

7. TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA

By exercising due care and implementing the necessary security measures and adequate safeguards published by the Board, the Company may transfer special categories of personal data belonging to a data subject to third parties for legitimate and lawful personal data processing purposes in the following circumstances:

• Where the data subject has provided explicit consent; or
• Where the data subject has not provided explicit consent:
  1. For special categories of personal data other than health and sexual life data, where permitted by law;
  2. For special categories of personal data concerning health and sexual life, for the purposes of:
     • Protection of public health,
     • Preventive medicine,
     • Medical diagnosis,
     • Provision of treatment and care services,
     • Planning and management of healthcare services and their financing,
     • Responding to requests received from public, semi-private, or private institutions and organizations in accordance with applicable legislation.

The conditions applicable to the processing of special categories of personal data are also observed when such data is transferred.

8. TRANSFER OF PERSONAL DATA ABROAD

In accordance with Article 9 of the KVKK, the explicit consent of the data subject is required for the transfer of personal data abroad.

However, where the conditions permitting the processing of personal data, including special categories of personal data, without the explicit consent of the data subject are satisfied, the Company may transfer personal data abroad without explicit consent, provided that an adequate level of protection exists in the foreign country to which the personal data will be transferred.

If the country to which the data will be transferred has not been designated by the Board as a country providing an adequate level of protection, the Company and the relevant data controller/data processor in the foreign country shall undertake in writing to provide adequate protection.

9. DATA COLLECTION AND EXPLICIT CONSENT PROCESS

Explicit consent shall be obtained from the relevant person whose special categories of personal data will be processed before such personal data is collected.

Explicit consent may be obtained with a wet signature or electronically. For explicit consent obtained from employees and employee candidates, a written undertaking shall be signed and retained in the relevant personnel file.

10. ACTIONS TO BE TAKEN WHEN THE CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA CEASE TO EXIST

10.1.

The Company is responsible for ensuring that the conditions for processing special categories of personal data remain current and shares this responsibility with all employees.

10.2.

Employees may not continue processing data when the conditions permitting such processing cease to exist. Upon the request of the relevant business units or an authorized Company representative, the Company is responsible for eliminating the circumstances in which such processing conditions no longer exist in accordance with this Policy.

10.3.

The Company considers that the conditions for processing special categories of personal data have ceased to exist in circumstances including, but not limited to, those specified in the Regulation on the Deletion, Destruction or Anonymization of Personal Data:

• The purpose requiring the processing of personal data ceases to exist,
• The processing of personal data becomes contrary to law and the principle of good faith,
• Where personal data is processed solely on the basis of explicit consent, the data subject withdraws such consent.

The data controller is responsible for implementing all necessary administrative and technical measures regarding the deletion, destruction, and anonymization of personal data.

10.4.

Within this scope, the measures, implementation principles and procedures, and actions defined in the Company’s Personal Data Retention and Disposal Policy shall apply.

11. IMPLEMENTATION OF THE POLICY, VIOLATIONS AND SANCTIONS

11.1.

This Policy shall enter into force upon being communicated to all employees and, as of its effective date, shall be binding on all business units, consultants, external service providers, and all other persons processing personal data on behalf of or within the Company.

11.2.

The supervisors of the relevant employees shall be responsible for monitoring whether Company employees comply with the requirements of this Policy. If conduct contrary to the Policy is identified, the matter shall immediately be reported by the relevant employee’s supervisor to the next-level supervisor. Where the violation is significant, the Company shall be informed without delay.

11.3.

Following an assessment by Human Resources, necessary administrative action shall be taken against employees who act contrary to this Policy.

11.4.

The Company implements all necessary security measures to ensure compliance with the requirements of this Policy.

12. PERSONS INVOLVED IN PERSONAL DATA RETENTION AND DISPOSAL PROCESSES AND THEIR RESPONSIBILITIES

All employees and all other persons who retain or process personal data within the Company are responsible for fulfilling the requirements concerning data disposal set forth under the Law, the Regulation, and this Policy.

Each business unit is responsible for retaining and protecting the data generated through its own business processes. However, where generated data is stored solely within information systems outside the control and authority of the relevant business unit, such data shall be retained by the units responsible for the relevant information systems.

Periodic disposal operations that may affect business processes or result in loss of data integrity, data loss, or outcomes contrary to applicable legislation shall be carried out by the relevant information systems departments, taking into account the type of personal data concerned, the systems in which it is stored, and the business unit responsible for the data.

The persons involved in the retention and disposal of special categories of personal data and their responsibilities are as follows:

13. DELETION, DESTRUCTION OR ANONYMIZATION OF SPECIAL CATEGORIES OF PERSONAL DATA

Although personal data may have been processed in accordance with the Law and other applicable legislation, where the reasons requiring its processing cease to exist, such personal data shall be deleted, destroyed, or anonymized by the data controller either ex officio or upon the request of the relevant data subject.

The deletion, destruction, or anonymization of personal data shall be carried out in accordance with the general principles set forth under Article 4 of the Law, the technical and administrative measures required under Article 11, applicable legislation, decisions of the Board, and the Personal Data Retention and Disposal Policy.

14. PERSONAL DATA RETENTION AND DISPOSAL PERIODS

The retention and disposal periods applicable to special categories of personal data are specified in the Personal Data Processing Inventory. These retention and disposal periods shall be taken into consideration for periodic disposal operations and disposal operations carried out upon request.

Where applicable legislation specifies a mandatory retention period for processed personal data, such data must be retained for the period prescribed by law. Disposal of such data may only be carried out after the applicable statutory retention period has expired.

The retention and disposal periods applicable to special categories of personal data are as follows:

15. PERIODIC DISPOSAL PERIODS

The periodic disposal period for special categories of personal data shall be determined by the relevant business units responsible for the data; however, under no circumstances may this period exceed 6 (six) months. Accordingly, periodic disposal shall be carried out by the Company in June and December of each year.

16. EFFECTIVE DATE

This Policy shall enter into force as of its publication date.

DENT FORUM ORAL AND DENTAL HEALTH SERVICES TRADE LIMITED COMPANY

DATA SUBJECT APPLICATION FORM

1. GENERAL

This Application Form has been prepared by Dent Forum Oral and Dental Health Services Trade Limited Company, acting as the data controller, in order to promptly, effectively, and comprehensively evaluate and resolve applications submitted by data subjects pursuant to Articles 11 and 13 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

2. APPLICATION METHOD

Pursuant to Articles 11 and 13 of the KVKK, data subjects may submit requests concerning the implementation of the KVKK to our Company, acting as the data controller, in writing by completing this Form or through other methods to be determined by the Board.

• By personally submitting a wet-signed copy of this Data Subject Application Form to: Narlı Mahallesi Mithatpaşa Caddesi No: 262/1B, Narlıdere / İzmir, Türkiye
• By sending a wet-signed copy of this Data Subject Application Form by registered mail with return receipt requested to: Narlı Mahallesi Mithatpaşa Caddesi No: 262/1B, Narlıdere / İzmir, Türkiye
• By sending an electronically signed copy of this Data Subject Application Form to: dentforumizmir@gmail.com

3. INFORMATION REGARDING THE DATA SUBJECT

In order for us to identify you and carry out the necessary investigation, assessment, and resolution regarding your application submitted pursuant to the relevant provisions of the KVKK, please complete the requested information in full.

ANNEX–1: Data Subject Application Form