TURASSIST HEALTH SUPPORT SERVICES INC. PERSONAL DATA PROTECTION AND PRIVACY POLICY
1. PURPOSE
The Company processes the personal data of its suppliers, employees, customers, visitors, and other individuals who establish a relationship through job applications or any other purpose or channel in a lawful manner, in order to conduct the management of affiliated institutions on behalf of insurance companies, policy, and claims activities.
The purpose of this policy is to inform relevant individuals about the Company's processing activities regarding personal data and related systems by explaining, within the scope of the Company's operations, and thus providing transparency regarding personal data.
In this context, the Company has explained the processing of personal data under the Personal Data Protection Law (KVKK), detailing it in this Policy, including the use of cookies and similar technologies.
2. PERSONAL DATA
2.1 General Principles Regarding Processing of Personal Data
The Company processes personal data in compliance with the following principles, as indicated in Article 4, paragraph 2 of the Law on the Protection of Personal Data (KVKK) and exemplified in the section 'Purposes of Processing Personal Data' in this Policy:
- Compliance with laws and principles of honesty
- Accuracy and currency when necessary
- Processing for specific, clear, and legitimate purposes
- Being relevant, limited, and proportionate to the purpose of processing
- Preservation for the period stipulated by the relevant legislation or required for the purpose of processing
2.2 Personal Data Processed by the Company
Personal data is processed within the Company based on activities that can be carried out without explicit consent under Articles 5 and 6 of the KVKK or obtained through the express consent of data owners. These data are processed only within the scope of purposes exemplified in the section 'Purposes of Processing Personal Data' in this Policy. Depending on the type and nature of the relationship between the Company and the data owner, the communication channels used, and the mentioned purpose information, these types of personal data, processed in accordance with the principles in this Policy, include but are not limited to:
- Identifying information of the data subject, such as name, surname, profession, title, employment information, education status, gender, health information, marital status, spouse/children information, citizenship status, military service information, criminal record information, tax liability status, etc.
- Data present in identity documents such as date of birth, place of birth, ID number, blood type, religion, and photograph found in identity documents such as photocopy of ID card, ID card copy, passport, and driver's license.
- Contact information such as address, email, telephone, and fax number, along with communication records from phone calls and email correspondence, including other voice data.
- Information about real persons in legal entity documents such as tax certificates, trade gazettes, authorization documents, qualification certificates, signature circulars, and operation certificates.
- Detailed financial data related to pricing, reconciliation, collection, and payment activities.
2.3 Purposes of Processing Personal Data
Personal data may be processed by the Company for the following purposes and may be retained for the periods prescribed by these purposes and relevant laws:
- Conducting necessary work by business units to benefit customers from products and services offered by the Company
- Planning and executing corporate sustainability activities
- Supporting the implementation of corporate law transactions of group companies
- Ensuring the legal and commercial security of the Company and individuals in a business relationship with the Company
- Conducting commercial activities for the purposes of determining and implementing Company's commercial and business strategies
2.4 Transfer of Personal Data
The Company conducts domestic and international data transfers in line with the purposes exemplified in the section 'Purposes of Processing Personal Data' in this Policy and in accordance with Articles 8 and 9 of the KVKK. Personal data may be processed and stored in servers and electronic environments used for these purposes. The nature of these transfers and the parties with whom the data is shared vary depending on the type and nature of the relationship between the data owner and the Company, the purpose of the transfer, and the relevant legal basis. These parties generally include but are not limited to:
- Domestic and foreign third parties from which services are obtained
- Direct and indirect shareholders, subsidiaries, affiliates
- Individuals and institutions from whom services and/or consultancy are obtained
- Business partners with whom contracts are signed
2.5 Collection of Personal Data
The Company may obtain personal data directly from employees and customers, suppliers, business partners, group companies, call centers, official institutions, and other physical environments based on the conditions envisaged in Articles 5 and 6 of the KVKK to meet the purposes exemplified in the section 'Purposes of Processing Personal Data' in this Policy. Additionally, personal data may be collected through websites, mobile applications, social media, and other public platforms, or through organized training sessions, events, and similar activities.
2.6 Storage Period of Personal Data
Personal data is kept within the Company for the duration of the relevant legal retention periods and is stored for the necessary period to realize the activities related to these data and the purposes specified in this Policy. Personal data for which the purpose of use has ended and the legal retention period has expired is deleted, destroyed, or anonymized by the Company in accordance with Article 7 of the KVKK.
2.7 Data Subject Rights within the Framework of KVKK
The rights of individuals whose personal data is processed are regulated under Article 11 of the KVKK. Accordingly, data subjects have the following rights against the Company:
- Learning whether personal data is processed
- Requesting information if personal data has been processed
- Learning the purpose of processing personal data and whether they are used in line with their purpose
- Knowing the third parties to whom personal data are transferred domestically or abroad
- Requesting correction if personal data is incomplete or incorrect
- Requesting the deletion or destruction of personal data if the reasons requiring their processing cease to exist
- Requesting notification of correction and deletion processes to third parties to whom personal data have been transferred
- Objecting to the emergence of a result against oneself by exclusively analyzing processed data through automated systems
- Demanding compensation in case of damage due to the unlawful processing of personal data
Requests related to the exercise of the above rights from data subjects will be responded to by the Company within a maximum of 30 days. These requests can be submitted in person by delivering identity documents to TURASSIST Health Support Services Inc., Maslak Mah. Büyükdere Cad. Nurol Plaza No:255 Inner Door No:103 Sarıyer/Istanbul, sent to the same address through a notary, or sent electronically with a secure electronic signature to [email protected]. If these requests entail any cost, the Company may request a fee within the limits set by the relevant legislation.
2.8 Data Transfer Abroad
Personal data may be transferred abroad in compliance with the legislation for processing, storage, management, or other purposes specified in this Policy's section 'Purposes of Processing Personal Data.' Necessary measures are taken to protect personal data during these transfers.
2.9 Security of Personal Data
The Company prioritizes protecting the confidentiality and security of personal data. Accordingly, necessary technical and administrative security measures are taken to protect personal data against unauthorized access, damage, loss, or disclosure. These measures include system access controls, data access controls, secure transfer controls, business continuity controls, and other necessary corporate controls.
3. COOKIES AND SIMILAR TECHNOLOGIES
3.1. General
Small data files sent by the internet server to users' devices through the internet browser are referred to as cookies, and websites identify users through these cookies. The lifespan of cookies varies depending on browser settings.
These cookies are managed through systems operated by the Company. Also, certain service providers authorized by the Company may place similar technologies on users' devices to obtain IP addresses, unique identifiers, and device identification information. Additionally, third-party links within the Company's systems, while subject to the privacy policies of those third parties, do not impose responsibility on the Company for privacy practices. Therefore, it is recommended to read the privacy policy of the respective site when visiting a site within the scope of the related link.
3.2. Types of Cookies
Cookies, primarily intended to facilitate user convenience, are primarily categorized into four groups:
- i. Session Cookies: Enable various features such as transferring information between web pages and systemically remembering information entered by users. These cookies are necessary for the proper functioning of functions on the Company's website.
- ii. Performance Cookies: Collect information on page visit frequencies, potential error messages, total time users spend on the respective page, and usage patterns of the site to enhance the performance of the Company's website.
- iii. Functional Cookies: Remind users of pre-selected options for the purpose of providing convenience and aiming to offer users enhanced internet features within the scope of the Company's website.
- iv. Advertising and Third-Party Cookies: Cookies belonging to third-party suppliers facilitate the use of certain functions on the Company's website and enable tracking of advertisements.
3.3. Purposes of Using Cookies
The purposes of using cookies by the Company are as follows:
- i. Operational Purposes: The Company can use cookies that enable the administration and security of its systems, facilitating the utilization of functions on this site or detecting irregular behavior.
- ii. Functionality-oriented Uses: Cookies that remember user information and past selections to facilitate the use of the Company's systems and provide usage features specific to users.
- iii. Performance-oriented Uses: Cookies used by the Company to enhance and measure system performance by evaluating and analyzing interaction with sent messages and user behaviors.
- iv. Advertising Purposes: The Company utilizes cookies that measure the effectiveness of advertisements or analyze click-through rates to convey advertisements and similar content based on user interests through its systems or third-party systems.
3.4. Disabling Cookies
Cookie usage is pre-selected in many browsers, and users can change this selection through browser settings, thereby deleting existing cookies and rejecting future cookie usage. Disabling cookie usage might result in the inability to benefit from certain features on the Company's systems.
The method to change cookie usage preferences varies depending on the browser type and can be learned from the relevant service provider upon request.
4. EFFECTIVENESS AND UPDATES
This Policy will come into effect on the date it is approved by the Company's Board of Directors. Changes to the Policy will take effect after approval by the Company's General Manager. The Policy is reviewed and updated annually as a routine measure. However, the Company reserves the right to review, change, or delete this Policy and create a new policy as necessary, based on legislative changes, changes in referenced technical standards, procedures or decisions of the Personal Data Protection Board, and/or court decisions. The authority to decide on the withdrawal of the Policy belongs to the Company's Board of Directors.