Altınçatı Clarification Text

CLARIFICATION TEXT WITHIN THE SCOPE OF THE PERSONAL DATA PROTECTION LAW NO. 6698

Your privacy is respected and your data security is valued by Altın Hayat Social Services Education Food Construction Cleaning Tourism and Trade Ltd. Co. (Company). In this context, this clarification text has been prepared to inform and enlighten you within the scope of the Personal Data Protection Law No. 6698 (“Law”, “PDPL”) and other relevant legislation.

Information

The Personal Data Protection Law No. 6698 was accepted on March 24, 2016, and entered into force by being published in the Official Gazette on April 7, 2016. However, according to Article 32 of the Law titled Enforcement, Articles 8, 9, 11, 13, 14, 15, 16, 17, and 18 of this Law entered into force as of October 7, 2016.

The Law was adopted in order to protect the fundamental rights and freedoms of individuals, particularly the privacy of private life, in the processing of personal data, and to regulate the obligations and the procedures and principles to be complied with by natural and legal persons who process personal data. With this text, relevant persons are informed and enlightened by Altın Hayat Social Services Education Food Construction Cleaning Tourism and Trade Ltd. Co.

In accordance with the Personal Data Protection Law No. 6698, Altın Hayat Social Services Education Food Construction Cleaning Tourism and Trade Ltd. Co., in its capacity as “data controller,” will be able to record, store, update, process, and disclose and transfer your personal data to third parties in accordance with the law.

DEFINITIONS

Our Reasons for Processing Your Data

Your personal data are processed in accordance with Articles 5 and 6 of the Law for purposes such as carrying out the necessary activities within the company to ensure that the products and services provided by our company can be offered to you, carrying out the necessary work with the relevant business unit and business partners to provide products and services suitable for your needs to our customers, ensuring the rights of natural persons by providing human resources management by our Company, taking the necessary steps regarding the making, implementation, and realization of commercial decisions by our Company, ensuring the legal safety of the natural persons with whom we have a business relationship and our Company arising from these relationships, and for similar purposes, not limited to these.

As a rule, we process your Personal Data based on your explicit consent. However, your Personal Data may be processed by Altın Hayat Social Services Education Food Construction Cleaning Tourism and Trade Ltd. Co. in its capacity as Data Controller without seeking your further explicit consent in the following cases:

1. a) Being explicitly stipulated in the laws;
2. b) Being mandatory for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
3. c) Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

ç) Being mandatory for us to fulfill our legal obligations as a data controller;

1. d) Being made public by the data subject himself/herself.
2. e) Data processing is mandatory for the establishment, exercise, or protection of any right.
3. f) Processing of data is mandatory for the legitimate interests of the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject, relying on any of these conditions, it may be used for the purposes we will state below.

Your personal data may be processed for the following purposes;

• To communicate with you and others as part of the business.
• To send you important information about changes to our terms of service, changes to our electronic services, and other administrative information.
• To provide quality, training, and security and the best quality care services (for example, recording your routine health data to provide the best quality care service).
• To resolve complaints and process data access or correction requests.
• To prevent, detect, and investigate possible crimes and analyze and manage other commercial risks.
• To comply with applicable laws and regulatory obligations (including those outside your country of residence); to comply with legal processes and respond to requests from official authorities and government authorities (including those outside your country of residence).
• To manage our operations and comply with internal policies and procedures, including those related to auditing, finance, and accounting; billing and collections; IT systems; data and website hosting; business continuity and records, document and print management.
• To establish and defend legal rights; to protect our operations, our rights, our privacy, our safety or our property, and/or these aforementioned assets of yours or others, and to apply available remedies or limit our damages.
• To follow up on current and possible situations, including satisfaction surveys.
• To facilitate the social media sharing function.
• To personalize your experience with electronic services by presenting you with tailored information and advertisements.

However, from your collected personal data specified individually below;

Identity Information Data;
• Being explicitly stipulated in the laws (Art. 5/2.a)
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)
• Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract (Art. 5/2.c)

Contact Information Data;
• Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract (Art. 5/2.c)
• Being explicitly stipulated in the laws (Art. 5/2.a)
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)

Financial Information Data;

* Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract (Art. 5/2.c)
* Being explicitly stipulated in the laws (Art. 5/2.a)
* Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)

Physical Space Security Information Data;
• Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract (Art. 5/2.c)
• Being explicitly stipulated in the laws (Art. 5/2.a)
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)
• Data processing is mandatory for the establishment, exercise, or protection of any right (Art. 5/2.d)
• Processing of data is mandatory for the legitimate interests of the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject (Art. 5/f)

Legal Action Information Data;
• Being mandatory for the data controller to fulfill its legal obligation (Art. 5/2.ç)

Special Categories of Personal Data;
– Explicit consent of the data subject (Art. 5/1) within the personal data processing conditions

* In case it is explicitly stipulated in the laws (Art. 5/2.a)

Are being processed.

To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your collected personal data;
• Fulfillment of legal obligations by our Company,
• Execution of necessary operational activities by our business units,
• Optimal planning and implementation of our human resources policies, accurate planning and execution of our commercial activities and strategies,
• Ensuring the legal, commercial, and physical security of our Company,
• Ensuring the corporate functioning of our Company,
• Fulfillment of the requests of official institutions,
• Follow-up and execution of legal affairs,
• Carrying out works to ensure you benefit from the products and services offered by our Company in the best way; recommending the products and services offered by our Company by customizing them according to your demands, needs, and wishes, providing data security at the highest level, creating databases,

• Protection and improvement of the bodily and physical health of the elderly to whom we provide care services
  • Taking necessary steps regarding the making, implementation, and realization of commercial decisions by the Company for the purposes of developing the services offered on our Company’s website, communicating with those who submit their requests and complaints to our Company, and fixing the errors occurring on our Company’s website,
  • For the purposes of planning and executing our Company’s human resources policies and processes;
  a) To the relatives/legal representatives of those receiving care services
  b) To our suppliers,
  c) To company officials,
  d) To legally authorized public institutions and private persons,

May be transferred in accordance with Articles 8 and 9 of the PDPL.

Transfer Conditions

Our Company may transfer the personal data and special categories of personal data of the data subjects to third parties in accordance with the Law by creating the necessary confidentiality conditions and taking security measures in line with its personal data processing purposes. Our Company acts in accordance with the regulations stipulated in the Law during the transfer of personal data. In this context, our Company transfers personal data to third parties for legitimate and lawful personal data processing purposes, based on and limited to one or more of the personal data processing conditions specified in Article 5 of the Law, listed below;

• If there is explicit consent of the data subject,
  • If there is an explicit regulation in the laws that the personal data will be transferred,
  • If it is necessary for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving consent or whose consent is not deemed legally valid,
  • If it is necessary to transfer the personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract,
  • If personal data transfer is mandatory for our Company to fulfill its legal obligation,
  • If the personal data have been made public by the data subject,
  • If the transfer of personal data is mandatory for the establishment, exercise, or protection of a right,
  • If data transfer is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject,

may transfer.

Conditions for Domestic Transfer of Special Categories of Personal Data

Since care center services and health services are provided within our Company, special categories of personal data are kept within the scope of providing and maintaining services in this context. The special categories of personal data of the data subjects can be transferred to third parties in accordance with the principles adopted in the processing of personal data.

Sensitivity is shown to obtain the consent of the data subject in transferring special categories of personal data to third parties, and special categories of personal data are transferred domestically by taking adequate technical and administrative measures. However, in the presence of the situations specified below, special categories of personal data can be transferred without the explicit consent of the data subject by taking sufficient technical and administrative measures;

* Data relating to the philosophical beliefs, religion, sect or other beliefs, and genetic data of individuals, in cases provided for by law,

– Personal data relating to health and sexual life, only for purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment, and care services (treatment and care services are carried out in our company), planning and management of health services and financing, by persons under the obligation of secrecy or competent institutions and organizations.

Method and Legal Reason for Collecting Personal Data

• Electronically through our website at [www..com](https://www.google.com/search?q=https://www..com).tr (COMPANY’S WEBSITE ADDRESS TO BE WRITTEN) and other websites that may be established in the future, by automatic or non-automatic means,
  • Electronically through cookies (“Cookie”) that communicate with your devices on the Website, by automatic or non-automatic means (mostly anonymous data is collected with cookies),
  • Electronically through accounts operated on behalf of the Company on various social media channels (“Social Media”), by automatic or non-automatic means,
  • Verbally and electronically through our call centers managed by the Company (“Call Center”), by automatic or non-automatic means,
  • Electronically via e-mail through networks established and managed by the Company, by automatic or non-automatic means,
  • Verbally, electronically, and in writing through contracts, e-mailing, and user devices, by automatic or non-automatic means,
  • Verbally and in writing from Company visitors/customers,
  • Verbally, in writing, or electronically through our employees acting on behalf of the Company, by automatic or non-automatic means,
  • Electronically through the website, e-mail, mobile communication channels, and mobile applications, relying on different legal reasons, by our Company or real or legal persons processing data on behalf of our Company, by automatic or non-automatic means,
  • Physically in the panel environment, through the advertisement management channel,
  • Through all kinds of communication tools, with correspondences carried out over our e-mail addresses, short messages or other communication methods including multimedia messages sent for other purposes regarding Company activities,
  • Verbally, in writing, or electronically within the scope of sales, marketing, and after-sales services, through all service sales and marketing networks belonging to the Company or established or operating by third parties not within the Company, by automatic or non-automatic means,
  • Verbally, in writing, or electronically through our entire other after-sales services network established or operating by the Company or by third parties not within the Company, by automatic or non-automatic means,
  • Through third parties such as group companies, business partners, manufacturing companies, or companies from which it procures services/products, online sales platforms, dealers, solution partner institutions and organizations that the Company serves or receives services from,
  • Verbally or electronically through your website, social media, or other channels where you make your Personal Data public, by automatic or non-automatic means,
  • Electronically through keeping log records on the system from the devices used by guests connecting to the Company Wi-Fi system,
  • Electronically via cameras from the IP Camera system for security reasons from visitors coming to the Company or care centers, and verbally/in writing by filling out visitor registration forms.
  • Electronically by automatic or non-automatic means for the purpose of receiving and evaluating requests and complaints,
  • Electronically by automatic or non-automatic means for the purpose of following up and executing legal affairs,
  • Electronically by automatic or non-automatic means for the purpose of fulfilling official institution requests,
  • Electronically by automatic or non-automatic means for the purpose of executing information security processes,
  • Electronically by automatic or non-automatic means for the purpose of carrying out audit and ethical activities,
  • Electronically by automatic or non-automatic means for the purpose of planning and executing internal processes,
• Electronically/verbally/in writing by automatic or non-automatic means for the purpose of planning and executing elderly care services.
  • Verbally, in writing, or electronically by automatic or non-automatic means through our entire other after-sales services network established or operating by the Company or by third parties not within the Company,
  • Through third parties such as group companies, business partners, manufacturing companies, or companies from which it procures services/products, online sales platforms, dealers, solution partner institutions and organizations that the Company serves or receives services from,
  • Through the information you provide verbally, in writing, electronically, or via forms on paper to our employees or suppliers in order to get information about our infrastructure and other services,
  • Through a business card, resume (CV), or proposal given verbally, in writing, or electronically, face-to-face or at a distance, in a physical or virtual environment, for purposes such as establishing a commercial relationship with our Institution, making a job application, or submitting a proposal,
  • Verbally or electronically through your website, social media, or other channels where you make your Personal Data public, by automatic or non-automatic means,

and data collected verbally, in writing, or electronically, by automatic or non-automatic means, through the above-mentioned channels and other channels that may be added to them in the future, may be processed in accordance with the reasons and purposes specified below.

Your Personal Data collected through the channels mentioned in this Clarification Text, with the methods mentioned, are processed by the Company within the following legal reasons:

Within the scope of PDPL Article 5.2 and Article 6.3 (Our company provides care services);

As a rule, we process your Personal Data based on your explicit consent. However, your Personal Data may also be processed without your explicit consent in exceptional cases allowed within the scope of PDPL. In this context,

(i) in order to fulfill our legal obligations (such as obligations arising from the REGULATION ON NURSING HOMES AND NURSING HOME ELDERLY CARE AND REHABILITATION CENTERS, tax legislation, consumer protection legislation, code of obligations, commercial code, and other legislation),

(ii) In case you are unable to express your consent due to actual impossibility,

(iii) For the purpose of establishing or performing a contract,

(iv) In order to fulfill our legal obligations such as receiving your questions and complaints regarding the service, responding to you, and using them in a possible dispute when necessary,

(v) For the purpose of establishing or protecting a right through transactions carried out within the scope of keeping records as evidence within the scope of after-sales services and all kinds of other processing that can be attributed within the scope of the relevant regulation,

(vi) In order to protect our legitimate interests such as cost reduction, efficient use of resources, observing call center service quality, ensuring your security, and measuring the quality of the service provided to you, evaluating and resolving your requests conveyed in this context, provided that it does not harm your fundamental rights and freedoms; we process your Personal Data. In addition, processing your personal data that you have made public within the limits set in the PDPL does not require your explicit consent. The processing of your Personal Data that you have made public on Social Media channels, your website, and other media by us and all kinds of other processing that can be attributed within the scope of the relevant regulation can be shown as an example of this situation. Apart from this, in case of a processing that requires your explicit consent, your explicit consent will also be obtained.

Your Personal Data collected from the above channels with the methods expressed above can also be processed for the following purposes provided that your explicit consent is obtained within the scope of PDPL Article 5.1 and Article 6.2:

(i) For the purpose of communication, advertising and marketing, product/service offer, any kind of information, promotion, and sales activities,
(ii) For the purpose of communication, creating an advertising targeting and marketing archive, and establishing contact for possible collaborations in future dates,
(iii) For the purpose of providing contract management,
(iv) For the purpose of creating participant information, area access permissions, event contracts in fairs and events, to provide better service to our users on our website and to improve our services,
(v) Ensuring the legal and commercial security of the Company, Affiliate Companies, and persons who have established/will establish a business relationship with the Company or are in a business relationship,
(vi) Carrying out the necessary works by our business units to benefit you depending on the product, service, or commercial activity offered by the Company;
(vii) Purposes of determining and implementing the commercial and business strategies of the Company,
(viii) For the purpose of keeping visitor records to ensure the security of the Company,
(ix) For the purpose of carrying out the management works of relations with the service recipients and their relatives/legal representatives,
(x) For the purpose of ensuring the continuity of communication and marketing activities,
(xi) For the purpose of providing personalized content during your visit to the Websites,
(xii) For the purpose of creating new product and service models,
(xiii) For the purpose of sending electronic commercial messages (such as bulletins, campaigns, newsletters, customer satisfaction surveys, product and service advertisements),
(xiv) For the purpose of sending gifts, bulletins, and promotions and other magazines/periodicals,
(xv) For the purpose of corporate communication and organizing other events and invitations within this scope and informing about them, completing meeting participation application, entry, and all related transactions, and completing other necessary meeting notification transactions, executing transactions for participation in Congress/Symposium, scientific and educational meetings,
(xvi) Your data are processed for the purposes of your Special Categories of Personal Data in case you are unable to express your consent due to physical impossibility, establishment or performance of a contract, fulfilling our legal obligations, establishment, exercise, or protection of a right, protecting our legitimate interests without harming your fundamental rights and freedoms.

The Company does not engage in any personal data processing activity that does not fall within the scope of personal data processing conditions. Namely, the personal data processing conditions included in the PDPL are as follows;

• Presence of the data subject’s explicit consent,
• Being explicitly stipulated in the laws,
• Being mandatory for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid,
• Processing of personal data belonging to the parties of the contract is necessary, provided that it is directly related to the establishment or performance of a contract,
• Being mandatory for the data controller to fulfill its legal obligation,
• Being made public by the data owner himself/herself,
• Data processing is mandatory for the establishment, exercise, or protection of any right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner.

For special categories of personal data, the basic processing condition is explicit consent, and the Company basically does not aim to process special categories of personal data. However, your special categories of personal data that we have to process due to our activity or that you have approved with your explicit consent are also processed proportionally within the legislation.

Regarding special categories of personal data, the conditions listed in the PDPL for the processing of special categories of personal data are as follows;

• Presence of the explicit consent of the data subject,
• Being explicitly stipulated in the laws for special categories of personal data other than health and sexual life,

Personal data relating to health and sexual life, however,

• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Execution of treatment and care services,
• Planning and management of health services and financing,
• May be processed by persons under the obligation of secrecy or competent institutions and organizations without seeking the explicit consent of the data subject.

One or more personal data processing conditions that make a personal data processing activity lawful may be present at the same time.

In order to realize our aforementioned purposes, it becomes necessary to process your data specified above. While identity information is transferred to our Company, data that is not actually within our processing purposes may also be transferred to us. Within the scope of administrative and technical measures, we delete or anonymize such data at the end of the periods stipulated in the legislation, but it is not possible to ensure this situation in all circumstances. In this case, it is necessary to refer to your explicit consent for the processing of the said data.

For how long are your Personal Data processed?

Personal Data you have shared with the Company through the channels mentioned in this Clarification Text will be processed in any case as long as the legitimate purposes above do not disappear, in accordance with the periods mandated by the legislation regarding the protection of Personal Data, especially the PDPL, and other legislation.

Rights of the Data Subject Enumerated in Article 11 of the PDPL

As personal data owners, in the event that you submit your requests regarding your rights to our Company using the methods set out below in this Clarification Text, our Company will conclude the request free of charge as soon as possible and at the latest within thirty days, depending on the nature of the request. However, if a fee is foreseen by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. In this context, personal data owners have the right to;

• Learn whether personal data is processed or not,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used appropriately for their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data in case of incomplete or incorrect processing and request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• Request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, despite the fact that it has been processed in accordance with the provisions of the PDPL and other relevant laws, and request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
• Demand the compensation of the damage in case of incurring damage due to unlawful processing of personal data.

How Can You Exercise Your Rights?

You can submit the said form to us by filling out the contact form on our contact page in line with your request, by using the communication channels specified in the form.

In the event that you submit your request to us using one of the methods written on the form, in accordance with Article 13/2 of the PDPL, your request will be evaluated within 30 days at the latest and you will be informed about the subject. If your request is accepted, the necessary actions will be taken immediately by the data controller COMPANY.

Requests are met free of charge as a rule, however, if fulfilling the requirement of the request requires a cost, a fee may be requested by the COMPANY in accordance with the provision stipulated in Article 7 of the “Communiqué on Procedures and Principles of Application to the Data Controller”; “If the application of the data subject is to be responded to in writing, no fee is charged up to 10 pages. A transaction fee of 1 TL may be charged for each page over 10 pages. If the response to the application is given on a recording medium such as a CD or flash memory, the fee that may be requested by the data controller cannot exceed the cost of the recording medium.” 

AMENDMENT

1. Amendment 1 : No changes have been made to the document yet.

            Amendment Details        :