RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ.
CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA
As RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ. (RED & MORE), protecting privacy relating to private life, primarily the protection of fundamental rights and freedoms, ensuring and protecting information security, and respecting ethical values are among our top priorities. We hereby inform you that we process your personal data within the framework of the Personal Data Protection Law No. 6698 ("KVKK") and relevant legislation.
1. Identity of the Data Controller
This clarification text has been prepared by (RED & MORE) acting in the capacity of the data controller.
2. Processed Personal Data and Purposes of Processing
Within the scope of our services, the following personal data is processed:
* Identity Information: Name, surname, passport number, or identity information
* Contact Information: Telephone number, e-mail address
* Health Data: (Sensitive) data specifically regarding the health service you requested, solely based on your explicit consent
* Transportation and Accommodation Information: Flight information, hotel reservation data
These data are processed for the following purposes:
* Providing health tourism services
* Directing to health institutions in Turkey
* Organizing transportation and accommodation
* Notifying official authorities as required by legislation
* Promotion, advertisement, and marketing
* Creating your customer registration
* Creating your personal customer profile
* Generating customer statistics
* Executing customer cancellations
* Receiving your requests and complaints and carrying out the necessary procedures and transactions in this context
* Carrying out our company activities
* Informing you about promotions based on your consent due to being our customer
* Notifications of periodic campaign studies
* Content regarding our company and its subsidiaries, affiliates, sponsors, cooperation, and project partners
* Informing you about opportunities and innovations
* Carrying out "classification" studies of our customers to prevent the transmission of unsolicited e-mails
* Offering our customers financial benefits and privileges to be obtained from cooperation or project partners, or public or private institutions and organizations we work with
* Fulfilling our legal obligations within the framework of our contracts concluded with our customers
* Executing finance and accounting transactions
* Procuring information and documents containing your personal data categories to ensure the privacy and security of our visitors' and customers' information.
Your personal data is shared with parties from whom we receive services, such as companies we work with for online SMS/E-mail sending, our solution partners, companies carrying out banking activities, and companies from which we receive information technology support, to the extent necessary for the realization of the purposes stated above and limited to the described purposes.
3. Method and Legal Reason for Collecting Personal Data
Your personal data is processed;
* Through contact forms on our website, e-mail, telephone, or your direct contact with us,
* Based on the service contract and your explicit consent, in accordance with Articles 5 and 6 of the KVKK.
4. Transfer of Personal Data
Your personal data may be transferred, only to the extent required by the service and in line with your explicit consent, to:
* Contracted hospitals and health institutions in Turkey,
* Companies providing accommodation and transportation services,
* Official authorities,
* Domestic and international solution partners and companies with marketing functions, in accordance with the legislation.
5. Your Rights Under KVKK
Pursuant to Article 11 of the KVKK, you have the right to:
* Learn whether your personal data is being processed,
* Request information if it has been processed,
* Learn the purpose of processing,
* Request correction if it has been processed incorrectly or incompletely,
* Request deletion or destruction in accordance with the destruction policy.
To exercise these rights, you can contact us at iletisim@redandmore.org.
6. Method and Legal Reason for Collecting Personal Data
Personal data is collected, used, recorded, stored, and processed by Galatasaray Spor Kulübü by informing personal data owners clearly and understandably, verbally and in writing, in connection with and limited to the legitimate purpose expressly stated above, within the framework of the proportionality principle, through virtual or physical means.
Your personal data is processed under the following legal reasons listed in KVKK Art. 5/1, Art. 5/2, and Art. 6:
* The existence of your explicit consent
* Expressly provided for by the laws
* Necessity to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.
* Necessity for the data controller to fulfill its legal obligation.
* Necessity of data processing for the establishment, exercise, or protection of any right.
* Necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
We apply for your explicit consent when necessary under KVKK to process your personal data.
You are reminded that you always have the right to withdraw your explicit consent regarding our personal data processing activities carried out based on your explicit consent.
You can always contact us at redandmore.org to withdraw your explicit consent.
7. Your Rights Under Article 11 of KVKK and Our Contact Information
Pursuant to Article 11 of the KVKK, you have the right to obtain information about your personal data by applying to our company.
RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ.
PERSONAL DATA RETENTION AND DESTRUCTION POLICY
ARTICLE 1- PURPOSE
The personal data retention and destruction policy has been prepared to determine the procedures and principles regarding the activities and transactions for the retention and destruction of personal data processed by RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ. (RED & MORE).
ARTICLE 2- SCOPE
Personal data belonging to company employees, employee candidates, interns, current customers or potential customers, partners, visitors, suppliers, and other third parties are within the scope of this policy.
This policy is applied to all recording media owned or managed by the company where personal data is processed and to activities involving personal data processing.
ARTICLE 3- DEFINITIONS
Recipient group: The category of natural or legal persons to whom personal data is transferred by the data controller.
Explicit consent: Consent relating to a specific subject, based on information and expressed with free will.
Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person, even by matching them with other data.
Employee: Company personnel.
Electronic medium: Environments where personal data can be created, read, changed, and written with electronic devices.
Non-electronic medium: All other written, printed, visual, etc., environments outside of electronic media.
Service provider: Natural or legal person providing services to the company within the framework of a specific contract.
Relevant person: The natural person whose personal data is processed.
Relevant user: Persons who process personal data within the data controller organization or in line with the authorization and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection, and backup of the data.
Destruction: Deletion, destruction, or anonymization of personal data.
Law: Personal Data Protection Law No. 6698.
Recording medium: Any medium containing personal data that is processed wholly or partly by automated means, or by non-automated means provided that they form part of a data filing system.
Personal data: Any information relating to an identified or identifiable natural person.
Personal data processing inventory: The inventory created by data controllers by associating their personal data processing activities dependent on business processes with personal data processing purposes and legal grounds, data categories, transferred recipient groups, and data subject groups, detailing the maximum retention period necessary for the purposes for which the personal data are processed, personal data foreseen to be transferred to foreign countries, and the measures taken regarding data security.
Processing of personal data: Any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system.
Board: Personal Data Protection Board.
Sensitive personal data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dressing, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometrics and genetics.
Periodic destruction: The process of deletion, destruction, or anonymization to be carried out ex officio at repetitive intervals specified in the personal data retention and destruction policy in the event that all the conditions for processing personal data in the Law disappear.
Policy: Personal Data Retention and Destruction Policy.
Company: RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ.
Data processor: Natural or legal person who processes personal data on behalf of the data controller upon its authorization.
Data filing system: Any system where personal data are structured and processed according to specific criteria.
Data controller: Natural or legal person determining the purposes and means of processing personal data and responsible for the establishment and management of the data filing system.
Data controllers registry information system (VERBİS): The informatics system accessible over the internet, created and managed by the Presidency, to be used by data controllers for application to the Registry and other related transactions.
VERBİS: Data Controllers Registry Information System.
Regulation: Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated October 28, 2017.
ARTICLE 4- RESPONSIBILITY AND DUTIES
All employees and units of the company provide full and active support to the responsible units in the legal acquisition, processing, and retention of personal data and sensitive personal data. All employees and units support the responsible units in implementing the administrative and technical measures taken within the scope of the Policy, training unit employees, ensuring, increasing, and monitoring employee awareness, preventing unlawful access to personal data, and maintaining personal data legally.
The titles, units, and job descriptions of those involved in the personal data retention and destruction processes are shown in APPENDIX TABLE: 1.
ARTICLE 5- RECORDING MEDIA
Personal data is securely maintained by the company in a legally compliant manner in the media listed in APPENDIX TABLE: 2.
ARTICLE 6- LEGAL REASONS REQUIRING RETENTION
Personal data processed within the framework of activities in the company is retained for the period foreseen in the relevant legislation and within the scope of the law and relevant legislation. Reasons requiring retention in this context are:
1. Retention of personal and sensitive personal data as they are directly related to the establishment and performance of contracts,
2. Retention of personal data for the purpose of establishing, exercising, or protecting a right,
3. Mandatory retention of personal data for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of individuals,
4. Retention of personal data for the company to fulfill any legal obligation,
5. Explicit provision in the legislation for the retention of personal data,
6. Existence of explicit consent of the data subjects in terms of retention activities requiring the explicit consent of data subjects.
ARTICLE 7- PROCESSING PURPOSES REQUIRING RETENTION
The company may process the personal data of the relevant person or third parties specified by the relevant person for various purposes, including but not limited to the following:
1. Executing human resources processes
2. Ensuring corporate communication
3. Ensuring company security
4. Conducting statistical studies
5. Performing works and transactions as a result of signed contracts and protocols
6. Ensuring the fulfillment of legal obligations as required or mandated by legal regulations
7. Providing contact with real/legal persons in business relations with the company
8. Making legal reporting
9. Managing call center processes
10. Fulfilling the burden of proof as evidence in future legal disputes
11. Executing/following up on company legal affairs
12. Determining customer satisfaction and marketing strategies
13. Providing health tourism services
14. Directing to health institutions in Turkey
15. Organizing transportation and accommodation
16. Executing customer cancellations,
* Receiving your requests and complaints and carrying out the necessary procedures and transactions in this context.
ARTICLE 8- LEGAL REASONS REQUIRING DESTRUCTION
Personal data is deleted or destroyed upon the request of the data subject or ex officio by the company in the presence of the following situations:
1. Amendment or repeal of the relevant legislative provisions constituting the basis for the processing of personal data
2. Disappearance of the purpose requiring the processing or retention of personal data
3. In cases where the processing of personal data is carried out only based on explicit consent, the relevant person withdraws their explicit consent
4. Acceptance by the data controller of the application made by the relevant person for the deletion and destruction of their personal data within the framework of their rights under Article 11 of the Law
5. Expiration of the maximum period requiring the retention of personal data and the absence of any LEGAL BASIS to justify storing personal data for a longer period.
ARTICLE 9- TECHNICAL MEASURES
The technical measures taken by the company regarding the personal data it processes are as follows:
1. Performs the necessary internal controls within the scope of installed systems
2. Carries out information technology risk assessment and business impact analysis processes within the scope of installed systems
3. Ensures the provision of technical infrastructure to prevent or observe data leakage outside the company and creates related matrices
4. Ensures the control of system vulnerabilities by obtaining penetration testing services regularly and when necessary
5. Ensures that the access authorizations of employees in information technology units to personal data are kept under control
6. Ensures that the destruction of personal data is irreversible and leaves no audit trail
7. Pursuant to Article 12 of the Law, any digital environment where personal data is stored is protected by encrypted or cryptographic methods to meet information security requirements.
ARTICLE 10- ADMINISTRATIVE MEASURES
The administrative measures taken by the company regarding the personal data it processes are as follows:
1. Limits internal access to stored personal data to personnel who need to access it due to their job descriptions. Whether the data is of a sensitive nature and its degree of importance are also considered in limiting access.
2. In case processed personal data is obtained by others through unlawful means, it notifies the relevant person and the Board as soon as possible.
3. Regarding the sharing of personal data, it signs a framework agreement on the protection of personal data and data security with the persons with whom personal data is shared or ensures data security with provisions added to its existing agreement.
4. Employs knowledgeable and experienced personnel regarding the processing of personal data and provides necessary training to its personnel on personal data protection legislation and data security.
5. Carries out and has others carry out the necessary audits to ensure the application of the provisions of the Law within its own legal entity. Eliminates the privacy and security vulnerabilities that emerge as a result of the audits.
ARTICLE 11- METHODS OF DELETING PERSONAL DATA
Personal data is deleted by the methods specified in APPENDIX TABLE: 3.
ARTICLE 12- METHODS OF DESTROYING PERSONAL DATA
Personal data is destroyed by the methods specified in APPENDIX TABLE: 4.
ARTICLE 13- RETENTION AND DESTRUCTION PERIODS
While determining the retention period of personal data by the company; primarily, if a period is stipulated in the legal legislation regarding the retention of the said personal data, this period is complied with. Otherwise, the retention and destruction period table in APPENDIX TABLE: 5 is taken as a basis.
ARTICLE 14- PERIODIC DESTRUCTION PERIOD
The company carries out periodic destruction in June and December every year.
ARTICLE 15- PUBLICATION, RETENTION, AND UPDATING OF THE POLICY
The Policy is published in two different media, wet-signed (printed paper) and electronic, and announced to the public on the website. The printed paper copy is kept within the company. The policy is reviewed as needed, and the necessary sections are updated.
ARTICLE 16- ENFORCEMENT
The Policy is deemed to have entered into force after its publication on the company's website. If it is decided to be repealed, old wet-signed copies of the policy are signed by canceling (stamping "canceled" or writing "canceled") and stored by the company for at least 5 years.
**APPENDIX TABLE: 1 Distribution of Duties for Retention and Destruction Processes**
* **Company Manager (Company Unit):** Responsible for ensuring employees comply with the policy.
* **Website Development Manager (Company Unit):** Responsible for the preparation, development, execution, publication in relevant media, and updating of the policy.
* **IT Manager (Company Unit):** Responsible for providing technical solutions needed in the implementation of the policy.
* **Employees (All Other Units):** Responsible for executing the Policy in accordance with their duties.
**APPENDIX TABLE: 2 Personal Data Retention Media**
* **Electronic Media:** Personal computers, Mobile Devices, Optical discs, Servers, Software, Information security devices, Removable and portable memories.
* **Non-Electronic Media:** Printers, scanners, photocopiers, Papers, Written and printed media, Visual records, Manual data recording systems.
**APPENDIX TABLE: 3 Methods of Deleting Personal Data**
* **Servers:** For personal data on servers whose retention period has expired, the deletion process is performed by the system administrator by removing the access authorization of the relevant users.
* **Electronic Medium:** Personal data in electronic media whose retention period has expired is made completely inaccessible and un-reusable for all employees (relevant users) except the database administrator.
* **Physical Medium:** For personal data kept in physical media whose retention period has expired, it is made completely inaccessible and un-reusable for all employees except the unit manager responsible for the document archive. In addition, an obscuring process is applied by scratching/painting/erasing unreadably.
* **Portable Media:** Personal data kept in flash-based storage media whose retention period has expired is encrypted by the system administrator, and access authorization is given only to the system administrator, and stored in secure environments with encryption keys.
**APPENDIX TABLE: 4 Methods of Destroying Personal Data**
* **Physical Medium:** Personal data on paper whose retention period has expired is irreversibly destroyed in document shredding machines.
* **Optical or Magnetic Media:** Physical destruction processes such as melting, burning, or pulverizing are applied to personal data in optical and magnetic media whose retention period has expired. In addition, the data on the magnetic media is rendered unreadable by passing it through a special device and exposing it to a high magnetic field.
**APPENDIX TABLE: 5 Retention and Destruction Period Table**
* **Occupational health and safety practices:** Retention period: 10 years following the end of the employment relationship. Destruction period: 180 days following the end of the retention period.
* **Payroll:** Retention period: 10 years following the end of the employment relationship. Destruction period: 180 days following the end of the retention period.
* **Answering personnel court/courthouse requests:** Retention period: 10 years following the end of the employment relationship. Destruction period: 180 days following the end of the retention period.
* **Filing of training records:** Retention period: 10 years after the training is organized. Destruction period: 180 days following the end of the retention period.
* **Emergency preparations:** Retention period: 10 years after preparation. Destruction period: 180 days following the end of the retention period.
* **Log record tracking systems:** Retention period: 10 years from its creation. Destruction period: 180 days following the end of the retention period.
* **Camera recordings:** Retention period: 1 year from recording. Destruction period: 180 days following the end of the retention period.
According to this destruction policy, you will always be able to request the destruction of your personal information in accordance with the destruction policy.
The text above is information regarding the data retention and destruction policy announced by RED & MORE EVENTS TURİZM İNŞAAT TEKSTİL GIDA VE TİCARET LTD. ŞTİ.