Personal Data Retention and Destruction Policy

1. INTRODUCTION

   1. Purpose

Personal Data Storage and Destruction Policy (“Policy”),

Title of data controller : Healco Health, Education, Informatics and Consultancy Trade Limited Company

Address of the data controller : Çeliktepe Mah. İsmet İnönü Cad. Yıldırımlar Business Centre No:11 Interior Door No: 501 Kağıthane/İstanbul

Data controller telephone                                : (0538) 6841918

 Data controller e-mail          : [email protected]

 Data controller website    : https://onurseyrek.com

It has been prepared in order to determine the procedures and principles regarding the works and procedures regarding the personal data storage and destruction activities carried out by the data controller.

Our business; In line with the mission, vision and basic principles in accordance with the law, it has determined the processing of personal data that we process in accordance with the Constitution of the Republic of Turkey, international conventions, the Law No. 6698 on the Protection of Personal Data (“Law”) and other relevant legislation and ensuring that the relevant persons effectively use their rights as a priority.

Businesses and transactions regarding the storage and destruction of personal data are carried out in accordance with the Policy prepared in this direction.

Personal data of patients, companions, personnel, personnel candidates and service providers are within the scope of this Policy and this Policy is applied in all recording environments where personal data managed by our enterprise are processed and in activities for personal data processing.

Legal and technical terms used in this Policy;

İfade eder. 

Personal data processed by our business is stored in accordance with the Law and destroyed at the end of the storage period.

Article 3 of the Law defines the concept of processing personal data, Article 4 states that the personal data processed must be related, limited and proportionate to the purpose for which they are processed and must be kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed, and Articles 5 and 6 list the conditions for processing personal data.

Accordingly, personal data are stored for the period stipulated in the relevant legislation or in accordance with our processing purposes.

Processed personal data are processed and stored in the presence of at least one of the following legal reasons.

• Explicitly stipulated in the law
• Processing of the parties’ data is necessary for the performance of the contract
• It is mandatory for the data controller to fulfil its legal obligation
• Data processing is mandatory for the establishment, exercise or protection of a right
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• Carrying out preventive medicine, medical diagnosis, treatment and care services
• Open Consent
  

  1. Processing Purposes Requiring Retention

Personal data are processed and stored for the purposes set out below.

• Carrying out the application processes of employee candidates
• Fulfillment of employment contractual and legislative obligations for employees
• Execution of fringe benefits and benefits processes for employees
• Conducting training activities
• Execution of access authorizations
• Execution of activities in accordance with the legislation
• Conducting finance and accounting affairs
• Ensuring physical space security
• Execution of assignment processes
• Follow-up and execution of legal affairs
• Conducting communication activities
• Planning of human resources processes
• Conducting occupational health and safety activities
• Receiving and evaluating suggestions for improving business processes
• Conducting performance evaluation processes
• Carrying out storage and archive activities
• Execution of contract processes
• Follow-up of requests and complaints
• Ensuring the security of movable property and resources
• Ensuring the security of data controller operations
• Informing authorized persons, institutions and organizations
• Conducting promotional activities

Personal datas;

• Amendment or abolition of the relevant legislation provisions that constitute the basis for processing,

• The purpose requiring processing or storage disappears,
• In cases where the processing of personal data is carried out only on the basis of explicit consent, the data subject may withdraw his/her explicit consent,
• Pursuant to Article 11 of the Law, the application made by the person concerned regarding the deletion and destruction of his personal data within the framework of his rights is accepted by our business,
• In cases where our Company rejects the application made by the person concerned with the request for deletion, destruction or anonymization of his/her personal data, finds the answer insufficient or does not respond within the period stipulated in the Law; to file a complaint to the Board and this request is approved by the Board,
• The maximum period for which the personal data is required to be retained has expired and there are no circumstances that would justify retaining the personal data for a longer period of time,

In such cases, it shall be deleted, destroyed or ex officio deleted, destroyed or anonymized by our enterprise upon the request of the person concerned.

Technical and administrative measures shall be taken within the framework of adequate measures determined and announced by the Board for special categories of personal data in accordance with Article 12 of the Law and Article 6, paragraph four of the Law for the safe storage of personal data, prevention of unlawful processing and access and destruction of personal data in accordance with the law.

The technical measures taken in relation to the processed personal data are listed below:

• Network security and application security are ensured.
• Security measures are taken within the scope of procurement, development and maintenance of information technology systems.
• Employees who are reassigned or leave their jobs are no longer authorized in this area.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• Employees with access to sensitive personal data are periodically subject to authorization checks.
• Security updates for the environments where the data are stored are constantly monitored, necessary security tests are regularly performed or commissioned and test results are recorded.
• Security tests of software that accesses sensitive personal data are regularly conducted and test results are recorded.
• For personal data stored in digital media, deletion, destruction or anonymization operations are performed periodically.
  

  1. Administrative Measures

The administrative measures taken regarding the processed personal data are listed below:

• There are disciplinary regulations for employees that include data security provisions.
• Training and awareness raising activities on data security are carried out at regular intervals for employees.
• Corporate policies on access, information security, use, storage and disposal have been prepared and implemented.
• Confidentiality commitments are made.
• The signed contracts contain data security provisions.
• Extra security measures are taken for personal data transferred via paper and the relevant document is sent in the format of a confidential document.
• Personal data security policies and procedures have been determined.
• Personal data security issues are reported quickly.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• Physical environments containing personal data are secured against external risks (fire, flood, etc.).
• Security of environments containing personal data is ensured.
• Personal data is minimized as much as possible.
• Internal periodic and/or random audits are conducted and commissioned.
• Protocols and procedures for the security of sensitive personal data have been determined and implemented.
• If sensitive personal data is to be sent via electronic mail, it is sent encrypted and using a KEP or corporate mail account.
• The scope and duration of authorization of users authorized to access sensitive personal data are clearly defined.
• Inventory allocated to employees who change their positions or leave their jobs is returned.
• A personal data inventory was prepared.
• Periodic deletion, destruction or anonymization operations are performed.

1. STORAGE AND DESTRUCTION PERIODS

Regarding the personal data processed by our business within the scope of its activities; retention periods are included in the Personal Data Retention and Destruction Policy.

These retention periods shall be updated if necessary.

For personal data whose retention periods have expired, the process of ex officio deletion, destruction or anonymization is carried out in the first periodic destruction period following the end of the retention period.

Our business deletes, destroys or anonymizes personal data ex officio in accordance with the principles and procedures set out in this Policy in the first periodic destruction process following the date on which the obligation to delete, destroy or anonymize personal data arises under the provisions of the Law and Regulation.

Veri sorumlusu, Kanunun 13. maddesinde belirtilen kişisel verilerin silinmesini talep etme hakkını kullanarak tarafımıza usulüne uygun şekilde başvurması durumunda; 

• If all the conditions for processing personal data have disappeared; Personal data subject to the request shall be deleted, destroyed or anonymized by appropriate destruction method within 30 (thirty) days from the day the request is received.
• If all the conditions for processing personal data have not disappeared, the request may be rejected by explaining the reason in accordance with the third paragraph of Article 13 of the Law and the rejection response shall be notified to the data subject in writing or electronically within 30 (thirty) days at the latest.

1. PERIODIC DESTRUCTION PERIODS

Pursuant to Article 11 of the Regulation, the periodic destruction period is set as 6 months. Accordingly, periodic destruction is carried out on February 1 and July 1 each year.

DESTRUCTION METHODS

At the end of the period stipulated in the relevant legislation or at the end of the retention period required for the purpose for which they are processed, personal data are destroyed ex officio or upon the application of the person concerned, in accordance with the provisions of the relevant legislation, by the following techniques.

Personal data is deleted by the methods given below.

Personal data is destroyed by the methods given below.

Anonymization of personal data means making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even if the personal data is matched with other data.

In order for personal data to be anonymized; personal data must be rendered unassociated with an identified or identifiable natural person, even through the use of appropriate techniques in terms of the recording medium and the relevant field of activity, such as the return of personal data by the data controller or third parties and/or matching the data with other data.

When anonymizing personal data, our business performs anonymization in accordance with the above-mentioned standards. After the anonymization of personal data, personal data cannot be associated with an identified or identifiable natural person under any circumstances.

Destruction operations carried out ex officio upon request and in periodic destruction processes are carried out in accordance with the Law, Regulation and this Policy. The technical and administrative measures taken within this scope are shown separately below.

• The authorization of employees working in information technology units to access personal data is kept under control.
• Destruction of personal data is ensured in such a way that the data cannot be recycled and leaves no audit trail.
  

  1. Administrative Measures

• Personnel are trained on personal data protection legislation, data security and destruction.
• Destruction processes are audited at regular intervals. Necessary measures are taken to eliminate the security gaps detected.

1. RECORDING MEDIA

Personal data are stored in accordance with the provisions of laws, regulations and other relevant legislation. The recording media of personal data stored in this context are shown in the table below.

Technical and administrative measures shall be taken within the framework of adequate measures determined and announced by the Board for special categories of personal data in accordance with Article 12 of the Law and Article 6, paragraph four of the Law for the safe storage of personal data, prevention of unlawful processing and access and destruction of personal data in accordance with the law.

The technical measures taken in relation to the processed personal data are listed below:

• Network security and application security are ensured.
• Security measures are taken within the scope of procurement, development and maintenance of information technology systems.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• Deletion, destruction or anonymization is performed
• Data loss prevention software is used.
  

  1. Administrative Measures

The administrative measures taken regarding the processed personal data are listed below:

• There are disciplinary regulations for employees that include data security provisions.
• Training and awareness raising activities on data security are carried out at regular intervals for employees.
• Corporate policies on access, information security, use, storage and disposal have been prepared and implemented.
• Employees who are reassigned or leave their jobs are no longer authorized in this area.
• Personal data security policies and procedures have been determined.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• Physical environments containing personal data are secured against external risks (fire, flood, etc.).
• Security of environments containing personal data is ensured.
• Personal data is minimized as much as possible.
• Internal periodic and/or random audits are conducted and commissioned.

1. STAFF TITLE, UNIT AND TASK DISTRIBUTION

All units and employees actively support the responsible units in taking technical and administrative measures to ensure data security in all environments where personal data is processed in order to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to ensure that personal data is stored in accordance with the law, by properly implementing the technical and administrative measures taken by the responsible units within the scope of the Policy, training and raising awareness of unit employees, monitoring and continuous auditing.

The distribution of the titles and job descriptions of those involved in the storage and destruction of personal data is given in the table below.

This Personal Data Storage and Destruction Policy may be amended due to changes in the legislation, in accordance with the decisions of the Board or in line with the developments in the sector or in the field of informatics. Changes made within this scope are immediately incorporated into the text and explanations regarding the changes are added to the updates table below.

Updates Table

This Personal Data Storage and Destruction Policy is prepared by the data controller;

• at appropriate locations within the enterprise
• on our website

https://onurseyrek.com and announced to the relevant persons.