Data Destruction Policy

Personal Data Destruction Policy

The data controller, Özel Cinik Polikliniği (ERC Estetik Turizm Sağlık Hizmetleri Tic. Ltd. Şti.), stores and destroys your personal data in accordance with the general principles and regulations set forth in this Personal Data Retention and Destruction Policy, which has been prepared primarily in compliance with the Constitution, the Personal Data Protection Law No. 6698, the Regulation on the Deletion, Destruction or Anonymization of Personal Data, and other relevant legislation.

This Policy aims to establish the general principles and guidelines regarding the retention and destruction of the personal data of natural persons subject to the Company's personal data processing activities within the scope of the Personal Data Protection Law and to fulfill the obligations prescribed by legislation.

Explicit Consent: Consent relating to a specific matter, based on being informed and expressed through free will,

Recipient Group: The category of natural or legal persons to whom personal data is transferred by the data controller,

Anonymization: Rendering personal data incapable of being associated, under any circumstances, with an identified or identifiable natural person, even when matched with other data.

Relevant User: Persons who process personal data within the organization of the data controller or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data,

Destruction: The deletion, destruction or anonymization of personal data,

Personal Data: Any information relating to an identified or identifiable natural person (e.g., first and last name, Turkish ID number, e-mail address, date of birth, credit card number, bank account number

Data Subject: The natural person whose personal data is processed,

Processing of Personal Data: Any operation performed on data, such as obtaining, recording, storing, retaining, changing, reorganizing, disclosing, transferring, acquiring, making available, classifying or preventing its use, by fully or partially automated means or by non-automated means provided that it is part of any data recording system,

Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data,

Periodic Destruction: The deletion, destruction or anonymization of personal data carried out ex officio at recurring intervals specified in this Policy when all of the conditions for processing personal data set forth in the Personal Data Protection Law have ceased to exist,

Data Storage Environments Governed by the Policy

This Policy covers all personal data subject to data processing activities within the scope of the Personal Data Protection Law. In addition, the documents referenced by the Policy include both physical and digital copies.

All personal data subject to data processing activities within the scope of the Personal Data Protection Law is stored in the environments specified below, where personal data processed by fully or partially automated means or by non-automated means, provided that it is part of any data recording system, is located:

Company computers, e-mail accounts, desktop computers, employees' devices (e.g., mobile phones), backup areas, paper files, folders, visitor logbooks, CDs, DVDs, USB drives, hard disks, printers, photocopiers, etc.

Reasons Requiring the Retention and Destruction of Personal Data

The following principles are observed in personal data processing activities:

Complying with the law and the principle of good faith,
Ensuring that personal data is accurate and, where necessary, up to date,
Processing for specific, explicit, and legitimate purposes,
Being connected with, limited to, and proportionate to the purposes for which personal data is processed,
Retaining personal data for the period stipulated in the relevant legislation or necessary for the purposes for which it is processed.

Our Company retains and uses personal data for the purposes of personal data processing and in accordance with the conditions for processing personal data set forth in Articles 5 and 6 of the KVKK listed below. If all of these conditions cease to exist, the personal data is destroyed ex officio or upon the request of the personal data owner:

Explicit Consent of the Personal Data Owner: The first condition for processing personal data is the explicit consent of its owner.

Explicitly Stipulated in Laws: The personal data of the data owner may be processed lawfully without obtaining explicit consent if this is explicitly stipulated by law.

Inability to Obtain the Explicit Consent of the Personal Data Owner Due to Actual Impossibility: If processing the personal data of a person who is unable to express consent due to actual impossibility or whose consent cannot be legally recognized is necessary to protect the life or physical integrity of that person or another person, the data owner's personal data may be processed.

Directly Related to the Establishment or Performance of a Contract: Personal data may be processed if processing the personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

Legal Obligation: If data processing is mandatory for our Company to fulfill its legal obligations, the personal data owner's data may be processed.

Making the Personal Data Publicly Available by the Personal Data Owner: If the data owner has made their personal data publicly available, the relevant personal data may be processed to the extent limited to the purpose of making it public.

Processing Data Is Necessary for the Establishment or Protection of a Right: If data processing is necessary for the establishment, exercise, or protection of a right, the data owner's personal data may be processed.

Processing Data Is Necessary for Our Company's Legitimate Interests: If data processing is necessary for our Company's legitimate interests, provided that this does not harm the fundamental rights and freedoms of the personal data owner, the data owner's personal data may be processed.

Deletion, Destruction, or Anonymization of Personal Data

Personal data is deleted or destroyed by the Company upon the request of the relevant person, or deleted, destroyed, or anonymized ex officio, in cases where the provisions of the relevant legislation forming the basis for its processing are amended or repealed; the purpose requiring its processing or retention ceases to exist; the relevant person withdraws their explicit consent where personal data is processed solely on the basis of explicit consent; the maximum period requiring the retention of personal data has expired; and there is no condition justifying the retention of personal data for a longer period.

Unless the Personal Data Protection Board decides otherwise, our Company selects the appropriate method among the methods of ex officio deletion, destruction, or anonymization of personal data, taking into account technological capabilities and implementation costs. Upon the request of the personal data owner, the rationale for the appropriate method is explained. The necessary technical and administrative measures are taken for each of these procedures.

Technical and Administrative Measures Taken

Our Company takes the necessary technical and administrative measures in accordance with Article 12 of the KVKK and the provisions of the Regulation, the general principles specified above, this Policy, and the decisions of the Personal Data Protection Board, taking into account the technological capabilities available and the costs of implementation, in relation to the matters set out below:

The necessary software and hardware have been identified. Strong passwords are used on computers and email accounts.
Our personnel have been informed through training about the measures required to protect customer information, and their responsibilities have been formalized in employment contracts. (Confidentiality Agreements) This obligation continues even after the relevant individuals leave their positions.
The necessary infrastructure has been established for backing up all data.
Employees who can access data on computers have been identified.
Customer files and information are provided only to the individuals concerned, their relatives for whom they have given written consent, the relevant public institutions and organizations within the framework of applicable legislation, and the authorized judicial authorities in judicial matters.
Before personal data processing begins, the Company fulfills its obligation to inform the relevant individuals.
A personal data processing inventory has been prepared.

Retention and Destruction Periods

Our Company retains and destroys personal data only for the period specified in the legislation to which it is subject or for the period necessary for the purpose for which the data is processed.

If the owner of the personal data applies to our Company and requests the destruction of their personal data:

If all conditions for processing personal data have ceased to exist: The Company concludes the personal data owner's request within thirty days at the latest and informs the personal data owner. If the personal data subject to the request has been transferred to third parties, it notifies the third party of this situation and ensures that the necessary procedures are carried out before the third party.

If all conditions for processing personal data have not ceased to exist: The Company may reject the personal data owner's request by explaining the grounds for rejection pursuant to the third paragraph of Article 13 of the KVKK and notifies the personal data owner of the rejection in writing or digitally within thirty days at the latest.

Periodic Destruction Periods

Personal data is destroyed during the first periodic destruction process following the date on which the obligation to destroy personal data arises. Accordingly, when the obligation to destroy personal data arises, the data is subject to destruction at six-month intervals.

PROCESS	RETENTION PERIOD	DESTRUCTION PERIOD
Preparation of Contracts	10 years from the end of the contract	During the first periodic destruction period following the end of the retention period
Conducting Human Resources Processes	10 years from the end of the activity	During the first periodic destruction period following the end of the retention period
Conducting Hardware and Software Access Processes	5 years	During the first periodic destruction period following the end of the retention period
Registration of Visitors and Meeting Participants	5 years	During the first periodic destruction period following the end of the retention period
Records of Personal Health Data	For the period specified in the applicable legislation	During the first periodic destruction period following the end of the retention period
Identity Data	For the period specified in the applicable legislation	During the first periodic destruction period following the end of the retention period
Camera Footage	Retained for at least 2 months in accordance with the Regulation on Private Hospitals.	During the first periodic destruction period following the end of the retention period

This Policy shall be deemed to have entered into force upon its publication on the website.

DATA DESTRUCTION POLICY