DIYETISYENPRO
MERSIS NUMBER: 0631112028700001
Teknopark Ankara İvedik OSB Mh.
2224 Cad. No:1/203 C Bl. K:8 D:814-815-816
Yenimahalle / ANKARA
Phone: 0(312) 284 85 90
Website: diyetisyenpro.com
Email Address: bilgi@niltekyazilim.com.tr
1. INTRODUCTION
DiyetisyenPRO places great importance on the security of your personal data. In accordance with its mission, vision and core principles, it prioritizes ensuring that all personal data belonging to persons associated with our Company—including customers using our products and services, business contacts, employees, job applicants, service providers, visitors and other third parties—are processed in compliance with the Constitution of the Republic of Türkiye, international conventions, Personal Data Protection Law No. 6698 (the “Law”) and other applicable legislation, and that data subjects can effectively exercise their rights.
This “Personal Data Protection and Processing Policy” (the “Policy”) sets out the fundamental principles adopted by DiyetisyenPRO for the protection, retention and disposal of personal data, establishing them as a sustainable Company policy.
2. PURPOSE AND SCOPE
The purpose of this Policy is to inform our employees and the public about the principles and activities adopted by DiyetisyenPRO to protect personal data collected, processed and transferred within its operations.
This Policy applies to personal data processed under the Law concerning our employees, company executives, visitors, job applicants, employees of companies with which we have commercial relationships, customers, consumers and third parties.
3. DEFINITIONS
The definitions used in the implementation of this Policy are set out below:
Explicit Consent: Consent relating to a specific matter, based on information and expressed freely.
Recipient Group: A category of natural or legal persons to whom personal data is transferred by the data controller.
Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching it with other data.
Employee(s): Workers who have an employment relationship with DiyetisyenPRO under the Labor Law.
Relevant User: Persons who process personal data within the DiyetisyenPRO organization or under the authority and instructions received from DiyetisyenPRO, excluding the persons or units responsible for the technical storage, protection and backup of data.
Disposal: Irreversibly deleting, destroying or anonymizing personal data.
Recording Medium: Any medium containing personal data processed wholly or partly by automated means or by non-automated means as part of a data recording system.
Registered Electronic Mail (KEP) Address: A qualified form of electronic mail that provides legal evidence regarding the use of electronic messages, including their dispatch and delivery.
Personal Data: Any information relating to an identified or identifiable natural person.
Data Subject: The natural person whose personal data is processed.
Processing of Personal Data: Any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, receiving, making available, classifying or preventing its use, wholly or partly by automated means or by non-automated means as part of a data recording system.
Personal Data Inventory: An inventory prepared by data controllers by linking their personal data processing activities to business processes, purposes of processing, data categories, recipient groups and categories of data subjects, and detailing the maximum retention periods, personal data envisaged to be transferred abroad and data security measures taken.
Personal Data Protection Committee: A committee comprising representatives of different DiyetisyenPRO departments, responsible for coordination within DiyetisyenPRO and authorized to make decisions and present them to senior management to establish, maintain, manage and improve compliance with personal data protection legislation.
Board: Personal Data Protection Board.
Authority: Personal Data Protection Authority.
KVKK / Law: Personal Data Protection Law No. 6698.
Special Categories of Personal Data: Data concerning a person's race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Periodic Disposal: Deletion, destruction or anonymization performed automatically at recurring intervals specified in the personal data processing, retention and disposal policy when all conditions for processing personal data under the Law cease to exist.
Policy: This DiyetisyenPRO Personal Data Protection and Processing Policy, setting out the principles adopted by DiyetisyenPRO for processing, retaining and disposing of personal data.
Deletion: Rendering personal data completely inaccessible and unusable for relevant users.
VERBIS: Data Controllers Registry Information System.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by that controller.
Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Recording System: A system in which personal data is structured and processed according to specific criteria.
Data Controllers Registry: The publicly accessible registry of data controllers maintained by the Presidency of the Personal Data Protection Authority.
Destruction: Rendering personal data completely inaccessible, irretrievable and unusable by anyone.
Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette on October 28, 2017.
For definitions not included in this Policy, the definitions in the KVKK apply.
4. GENERAL PRINCIPLES
Pursuant to Article 3(1)(e) of the KVKK, “processing of data” means any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, receiving, making available, classifying or preventing its use, wholly or partly by automated means or by non-automated means as part of a data recording system.
Personal data processed by DiyetisyenPRO may be processed in accordance with the following principles under Article 4 of the Law:
i. Data must be processed lawfully and fairly.
ii. Processed data must be accurate and, where necessary, kept up to date.
iii. Processing must be carried out for specific, explicit and legitimate purposes only.
iv. Data must be processed in a manner relevant, limited and proportionate to the purposes for which it is processed.
v. Personal data must be retained for the period prescribed by applicable legislation or necessary for the purpose of processing.
5. CONDITIONS FOR PROCESSING PERSONAL DATA
The conditions set out in Articles 5 and 6 of the Law must be observed when processing personal data. As a general rule, personal data may not be processed without the explicit consent of the data subject. However, Article 5 permits processing without explicit consent in certain circumstances. These circumstances are as follows:
a) Where expressly provided for by law.
b) Where necessary to protect the life or physical integrity of a person who cannot express consent due to actual impossibility, or whose consent is not legally valid, or of another person.
c) Where processing personal data belonging to the parties to a contract is necessary, provided it is directly related to establishing or performing the contract.
ç) Where necessary for the data controller to fulfill its legal obligations.
d) Where the data has been made public by the data subject.
e) Where processing is necessary for the establishment, exercise or protection of a right.
f) Where processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
Processing of Special Categories of Personal Data in Accordance with Processing Conditions
Special categories of personal data may be processed only with the explicit consent of the data subject. However, special categories of personal data other than data concerning sexual life and personal health may be processed without explicit consent in circumstances prescribed by law. Data concerning health and sexual life may be processed without explicit consent only for purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care, and planning and managing healthcare services and their financing.
DiyetisyenPRO takes the measures determined by the Board for processing and protecting special categories of personal data. DiyetisyenPRO exercises the utmost care in protecting and securing such data, diligently implements technical and administrative measures, and carries out the necessary internal audits.
Processing in Accordance with the Conditions for Transferring Personal Data
DiyetisyenPRO may transfer personal data and special categories of personal data to third parties for its processing purposes, subject to explicit consent where available or otherwise the applicable legal grounds, and with necessary security measures in place. In doing so, DiyetisyenPRO complies with the conditions for transferring personal data prescribed in Articles 8 and 9 of the Law.
Domestic Transfer of Personal Data
DiyetisyenPRO carries out domestic data transfers in accordance with the processing conditions under Article 8 of the Law.
International Transfer of Personal Data
DiyetisyenPRO carries out international data transfers in accordance with the processing conditions under Article 9 of the Law. Where personal data is transferred without explicit consent under the KVKK, one of the following conditions must also be met in relation to the destination country:
i. The destination country must be recognized by the Board as a country providing an adequate level of protection.
ii. If adequate protection is unavailable, data controllers in Türkiye and the relevant foreign country must provide a written undertaking of adequate protection and obtain the Board's authorization.
Recipient Groups to Whom Personal Data Is Transferred
In accordance with Articles 8 and 9 of the Law, DiyetisyenPRO may transfer data subjects' personal data to business partners providing services to DiyetisyenPRO, suppliers, banks and financial institutions, consultancy and audit firms providing legal, tax and similar support, Company officials, shareholders, legally authorized public institutions and private persons, and service providers in Türkiye and/or abroad that process data on the Company's behalf and provide storage, archiving or IT support (servers, hosting, software, cloud computing, etc.), for the purpose of continuing its commercial activities and business processes. The classification of recipient groups is included in Section 3 of this Policy.
When transferring personal data, DiyetisyenPRO ensures that the third parties receiving it also comply with this Policy. Necessary protective provisions are included in agreements with third parties and technical safeguards are implemented.
Personal data collected within our Company is generally processed to fulfill legal and contractual obligations. The types of personal data generally processed by DiyetisyenPRO are described in detail below.
6. CATEGORIES OF PERSONAL DATA PROCESSED BY DIYETISYENPRO
Identity Data: Information identifying a person, such as their first and last name, Turkish Republic identity number, marital status, gender, nationality, parents' names, place and date of birth and other identity information; documents containing such information, including driver's licenses, identity cards, passports and birth certificates; and tax numbers, Social Security Institution (SGK) numbers and similar information.
Contact Data: Contact information such as phone numbers, addresses, email addresses and fax numbers, as well as documents containing that information, such as proof of residence.
Personal Data of Family Members/Relatives: Personal data concerning a data subject's family members or relatives processed within our Company's activities or to protect the legal and other interests of the Company or data subject. Examples include family members' contact and identity details.
Financial Data: Personal data in information, documents and records showing financial consequences arising from the legal relationship between our Company and the relevant data subject. Examples include credit card details, income information and IBAN numbers.
Personnel Data: Personal data processed to obtain information forming the basis of employment rights and entitlements of individuals who have an employment relationship with our Company.
Communication and Complaint Management Data: Personal data obtained while receiving and evaluating requests or complaints addressed to our Company.
Special Categories of Personal Data: Personal data exhaustively defined by the Law which may expose data subjects to discrimination if processed. Examples include health information such as blood type, biometric data, examinations, images and files of any format voluntarily uploaded, and association membership information.
Transaction Security Data: Personal data processed to ensure the technical, administrative, legal and commercial security of both data subjects and our Company.
Payment Data: Agency and customer billing and payment information (name, surname, billing address, Turkish identity number, tax identification number), invoices sent to members, copies of receipts for payments received from members, payment numbers, invoice numbers, invoice amounts, invoice dates and similar information.
Categories of Data Subjects
The categories of our customers, platform users, employees, job applicants, business contacts and third parties covered by this Policy are defined and explained below.
Data Subject Categories and Descriptions
Customers: Natural persons who currently use or have previously used the products and services offered by our Company.
Platform Users: Natural persons who visit or have visited and/or use or have used our Company's digital platforms for any purpose.
Employees: Natural persons who have an employment relationship with our Company.
Job Applicants: Natural persons who have applied for a job with our Company by any means and submitted their résumé and/or job application form for our review.
Company Officials: Natural persons serving in DiyetisyenPRO's senior management and/or authorized to represent DiyetisyenPRO, as well as natural-person representatives of legal entities, including members of the board of directors.
Other Third Parties: Natural persons who do not fall into any other data subject category.
Classification of Personal Data Processed by DIYETISYENPRO by Data Subject
The following table provides a detailed mapping of the data subject categories identified above to the categories of personal data covered by processing activities:
Identity Data
Customers, Platform Users, Employees, Job Applicants, Other Third Parties
Contact Data
Customers, Platform Users, Employees, Job Applicants, Other Third Parties
Personal Data of Family Members / Relatives
Employees
Financial Data
Customers, Employees, Other Third Parties
Personnel Data
Employees, Job Applicants
Communication and Complaint Management Data
Customers, Platform Users, Other Third Parties
Special Categories of Personal Data
Customers, Employees, Other Third Parties
Transaction Data
Customers, Platform Users
Marketing Data
Customers, Platform Users
Transaction Security Data
Customers, Platform Users, Employees, Company Officials, Other Third Parties
7. PURPOSES OF PROCESSING PERSONAL DATA
DiyetisyenPRO processes personal data for the following purposes. These purposes have been defined clearly and in detail for each business unit and process by linking business processes with personal data categories, and have been recorded in the DiyetisyenPRO Personal Data Inventory:
· Carrying out the planning, assessments and activities necessary for DiyetisyenPRO's business units to enable customers to benefit from the services provided by DiyetisyenPRO;
· Conducting advertising and marketing activities for DiyetisyenPRO's services; providing information about promotions, campaigns, offers, events and similar matters; carrying out corporate communication activities; and customizing products and services according to data subjects' preferences, usage habits and needs;
· Organizing corporate communications, related events, campaigns and invitations, providing information about these activities, and conducting market research;
· Ensuring organizational security;
· Conducting statistical studies;
· Improving the digital platforms available to DiyetisyenPRO customers; producing statistics on user numbers, types, visit frequency and behavior to provide platform users with an efficient and personalized experience; and presenting personalized content, campaigns and advertisements based on their interests and needs;
· Monitoring and evaluating requests, suggestions and complaints from data subjects, managing customer satisfaction and carrying out related planning, statistical and satisfaction-assessment activities;
· Ensuring the legal and commercial security of DiyetisyenPRO and persons with whom it has business relationships (including planning administrative operations relating to DiyetisyenPRO services, customer and customer representative or employee assessment and audit processes, and legal compliance);
· Exercising legal rights and using transaction history as evidence in disputes after the legal relationship ends;
· Determining and implementing DiyetisyenPRO's commercial, legal and business strategies;
· Implementing DiyetisyenPRO's financial affairs policies;
· Implementing DiyetisyenPRO's human resources policies and recruitment processes, supervising and monitoring employees, administering employee rights and fulfilling legal obligations arising from employment relationships;
· Planning, auditing and implementing information security processes and managing information technology infrastructure;
· Carrying out planning, reporting, visitor/customer statistical analyses and similar assessments within DiyetisyenPRO's activities;
· Ensuring compliance with applicable domestic legislation, supplying information requested by public institutions and organizations, and fulfilling reporting obligations.
8. METHODS AND GROUNDS FOR COLLECTING PERSONAL DATA
DiyetisyenPRO collects personal data belonging to data subjects through the following channels:
· DiyetisyenPRO websites and platforms, various social media channels, email, short message services (“SMS”) and multimedia messaging services (“MMS”) used in DiyetisyenPRO sales and marketing activities;
· Other communication methods, including printed and electronic forms;
· Contracts and policies executed, commercial offers submitted, printed and electronic forms, documents and correspondence as part of DiyetisyenPRO's business activities;
· Business cards and other documents obtained during business meetings;
· Third parties such as DiyetisyenPRO group companies, business contacts and companies from which DiyetisyenPRO procures services or products. Such collection may occur verbally, in writing or electronically, wholly or partly by automated means, or by non-automated means as part of a data recording system.
Personal data collected through these methods is retained in accordance with the processing conditions in Section 5 of this Policy and the processing purposes listed above, for the periods required by the KVKK and other legislation, and with all necessary administrative and technical safeguards in place.
9. RECIPIENT GROUPS TO WHOM PERSONAL DATA IS TRANSFERRED
In accordance with the KVKK, DiyetisyenPRO may transfer personal data covered by this Policy to the recipient groups listed below for the stated purposes. Recipient groups and transfer purposes have been identified clearly and in detail by reference to the personal data categories and recorded in the DiyetisyenPRO Personal Data Inventory.
RECIPIENT GROUP
PURPOSE OF TRANSFER
Business Partners
Solely to ensure the provision of services procured by our Company that are necessary for carrying out its activities.
Legally Authorized Public Institutions and Organizations
Solely for purposes requested within the legal authority of the relevant public institutions and organizations.
Legally Authorized Private-Law Entities
Solely for purposes requested within the legal authority of the relevant private-law entities.
Personal data transfers carried out by DiyetisyenPRO comply with the provisions set out in Section 5 of this Policy.
10. TECHNICAL AND ADMINISTRATIVE MEASURES
In accordance with Article 12 of the KVKK, DiyetisyenPRO takes the technical and administrative measures necessary, within its capabilities and according to the nature of the data requiring protection, to provide an appropriate level of security, prevent unlawful processing of or access to personal data, and ensure data retention; it also carries out or commissions the necessary audits.
10.1 Technical Measures
The principal technical measures taken to prevent unlawful processing of or access to personal data and to ensure its security are listed below:
· DiyetisyenPRO adopts technical safeguards for personal data protection to the extent permitted by technology, updates those safeguards and audits their implementation regularly.
· Software and systems are installed and used to ensure data security. Data recording environments are protected by various systems, particularly antivirus programs and firewalls, to prevent unlawful interference with personal data from inside or outside the Company.
· Access to personal data is restricted in line with defined processing purposes, and authorizations are reviewed regularly.
· Technical security systems are established for storage areas; security tests and investigations are conducted to identify vulnerabilities in IT systems; and identified existing or potential risks are remedied.
· Systems and backup programs suited to technological developments are used lawfully to ensure secure retention of personal data.
· Special categories of personal data transferred from portable memory devices, CDs or DVDs are encrypted during transfer.
10.2 Administrative Measures
The principal administrative measures taken to prevent unlawful processing of or access to personal data and to ensure its security are listed below:
· A “Personal Data Protection Committee” has been established and put into operation within DiyetisyenPRO to ensure and maintain compliance with the Law.
· DiyetisyenPRO employees are regularly informed and trained regarding personal data protection and lawful processing.
· All DiyetisyenPRO activities have been analyzed in detail across business units, and personal data processing activities arising from each unit's commercial operations have been identified and entered into the Personal Data Inventory, which DiyetisyenPRO updates regularly.
· The requirements necessary to ensure compliance with personal data processing conditions have been defined for each DiyetisyenPRO business unit and its individual activities.
· Awareness is raised and implementation rules are established within the relevant business units to meet compliance requirements; internal Company policies and audits are implemented to ensure continued compliance.
10.3 Measures Taken to Protect Special Categories of Personal Data
Special categories of personal data require the consent of the data subject in every case. They must therefore be processed on the basis of a separate information and consent notice. The data subject is also specifically and separately informed. In addition to the technical and administrative measures described above, DiyetisyenPRO implements the following:
· Specific data security training and awareness activities are provided to employees who process special categories of personal data.
· Where special categories of personal data are transferred by digital means such as email or physical devices such as portable memory, CDs or DVDs, the file storing the data is encrypted. When paper-based transfer is necessary, maximum care is taken against theft, loss or viewing by unauthorized persons, and physical storage locations are accessible only to authorized personnel.
10.4 Auditing Personal Data Protection Measures
DiyetisyenPRO conducts or commissions the necessary internal audits under the KVKK. The findings are reported to the Personal Data Protection Committee, senior management and relevant departments; action plans are developed, and follow-up actions to improve existing measures are monitored and carried out by the relevant process owners and the Committee.
10.5 Measures in the Event of Unlawful Disclosure of Personal Data
If personal data is unlawfully obtained or disclosed by others, DiyetisyenPRO shall notify the relevant data subject and the Board as soon as possible.
10.6 Protection of Special Categories of Personal Data
The Law affords special protection to certain types of personal data because their unlawful processing may cause harm and/or discrimination. These include data on race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. DiyetisyenPRO exercises the utmost care in protecting special categories of personal data defined by the Law and processed lawfully.
DiyetisyenPRO pays the greatest attention to the security of special categories of personal data and conducts the necessary internal audits.
10.7 Protection of Data Subjects' Legal Rights
DiyetisyenPRO respects all the legal rights of data subjects under this Policy and the Law and takes the necessary measures to protect them. Detailed information about these rights is provided in Section 12 of this Policy.
11. RETENTION AND DISPOSAL OF PERSONAL DATA
11.1 Recording Media Where Personal Data Is Stored and Disposed Of
Personal data processed by DiyetisyenPRO may be recorded in different media depending on the nature of the data, the purposes of processing and frequency of use. Such personal data is securely retained by DiyetisyenPRO in the environments listed below in accordance with applicable legislation, particularly the KVKK.
a) Electronic media:
I. Servers: Central server, data center servers
II. Software: Third-party software within cloud infrastructure, various applications depending on processing purposes, etc.
III. Databases
IV. Electronic Devices: Network devices, computers, laptops, portable media devices (flash drives, hard drives, etc.), printers and mobile phones
b) Physical media:
I. Departmental cabinets
II. DiyetisyenPRO's physical archive
DiyetisyenPRO retains personal data for the period prescribed by applicable legislation or necessary for its processing purposes. Where a statutory retention period is specified, DiyetisyenPRO complies with it; otherwise, data is retained for the period necessary to provide the services for which it is processed. Upon expiration of the period, at the data subject's request or when the processing purpose ceases to exist, DiyetisyenPRO deletes, destroys or anonymizes the personal data.
11.2 Legal, Technical and Administrative Grounds Requiring Retention of Personal Data
Even when the purpose of processing ends, the data subject submits a request and/or statutory or Company retention periods expire, personal data may be retained, subject to statutory limits and periods, to fulfill legal responsibilities, such as serving as evidence in potential disputes, asserting rights relating to personal data or establishing a defense. Retention periods in such circumstances are determined based on the limitation periods applicable to asserting the relevant rights. Retained data is not accessed for any other purpose and is accessed only where its use in the relevant legal dispute is required.
Data intended for disposal by deletion, destruction or anonymization may be retained until the next scheduled periodic disposal date at the latest.
After the periods mentioned above expire, personal data is deleted, destroyed or anonymized.
Legal Grounds Requiring Retention
Personal data processed as part of DiyetisyenPRO's activities is retained for the periods prescribed by applicable legislation, including:
· Personal Data Protection Law No. 6698,
· Turkish Code of Obligations No. 6098,
· Regulation on the Provision of Remote Healthcare Services,
· Social Insurance and General Health Insurance Law No. 5510,
· Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications,
· Occupational Health and Safety Law No. 6361,
· Right to Information Law No. 4982,
· Law No. 3071 on the Exercise of the Right of Petition,
· Labor Law No. 4857,
· Social Services Law No. 2828,
· Regulation on Health and Safety Measures to Be Taken in Workplace Buildings and Annexes
Regulation,
· Regulation on Archival Services.
Personal data is retained for the periods prescribed under these laws and regulations and any secondary legislation in force pursuant to them.
Processing Purposes Requiring Retention
DiyetisyenPRO retains the personal data it processes as part of its activities for the following purposes:
• Carrying out human resources processes.
• Ensuring system security.
• Conducting statistical studies.
• Performing tasks and transactions arising from signed agreements and protocols.
• Identifying the preferences and needs of employees, data controllers, contact persons, data controller representatives and data processors within the scope of VERBIS, and tailoring and updating services accordingly where necessary.
• Ensuring the fulfillment of legal obligations as required or mandated by law.
• Maintaining contact with natural and legal persons that have business relationships with DiyetisyenPRO.
• Preparing statutory reports.
• Managing call center processes.
• Meeting obligations to provide evidence in legal disputes that may arise in the future.
11.3 Legal, Technical and Administrative Grounds Requiring Disposal of Personal Data
DiyetisyenPRO deletes, destroys or anonymizes the personal data it retains in the following circumstances:
· All purposes requiring the processing and reasons requiring the retention of personal data cease to exist;
· The data subject withdraws their consent where processing is based solely on explicit consent;
· The data subject requests disposal by exercising their rights under the KVKK and DiyetisyenPRO accepts the request, or the Board upholds the request following a complaint against DiyetisyenPRO's refusal;
· The maximum period requiring retention has expired and no grounds justify longer retention. In such cases, DiyetisyenPRO deletes or destroys the data at the data subject's request or deletes, destroys or anonymizes it on its own initiative.
11.5 Techniques for Disposal of Personal Data
At the end of the retention period prescribed by applicable legislation or necessary for the processing purpose, DiyetisyenPRO disposes of personal data using the techniques below, either on its own initiative or upon application by the data subject, in accordance with applicable law.
11.5.1 Deletion of Personal Data
Secure Deletion from Software: When deleting data processed wholly or partly by automated means and retained in digital environments, methods are used to remove data from the relevant software so that it is completely inaccessible and unusable to Relevant Users.
This may include issuing a deletion command in cloud systems, removing access rights to files or directories on a central server, deleting relevant database rows using database commands, or erasing data on portable media such as flash drives using appropriate software.
However, if deleting personal data would make other data in the system inaccessible or unusable, the personal data may also be considered deleted when archived in a form that cannot be associated with the data subject, provided that the following conditions are met:
• It must be inaccessible to any other institution, organization or person;
• All necessary technical and administrative measures must be taken to ensure that only authorized persons can access the personal data.
Secure Deletion by a Specialist: In some cases, a specialist may be engaged to delete personal data on DiyetisyenPRO's behalf. The specialist securely deletes the personal data so that it becomes completely inaccessible and unusable to Relevant Users.
Redaction of Personal Data on Paper: To prevent use of personal data outside its intended purpose or remove data requested to be deleted, the data is physically cut out of the document or irreversibly obscured with permanent ink so that it cannot be read using technological means.
11.5.2 Destruction of Personal Data
Degaussing: A method of rendering data on magnetic media unreadable by passing the media through specialized equipment that exposes it to strong magnetic fields. If this method does not successfully destroy the data, destruction can only be completed by physically destroying the media.
Physical Destruction: Personal data may also be processed by non-automated means as part of a data recording system. When destroying such data, it is physically destroyed in a way that prevents subsequent use. Data on paper and microfiche must also be destroyed in this manner where no other means of destruction is possible.
Overwriting: A method of destroying data on magnetic media and rewritable optical media using specialized software to write random sequences of zeros and ones at least seven times, making the original data impossible to read or recover.
When implementing the measures listed above, DiyetisyenPRO fully complies with the KVKK, the Regulation and other applicable legislation to ensure data security and takes all necessary administrative and technical measures.
11.5.3 Anonymization of Personal Data
Anonymization means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even when matched with other data.
For personal data to be considered anonymized, it must be impossible to associate it with any identified or identifiable natural person, even through reversal by the data controller or third parties or by matching it with other data using techniques suitable for the recording medium and relevant activity. DiyetisyenPRO may use one or more of the following methods to anonymize personal data:
Variable Removal: An anonymization method in which one or more variables are completely removed from a table.
Record Removal: A method of strengthening anonymity by removing a unique row from a personal data set.
Generalization: The process of converting personal data from a specific value into a more general value.
Local Suppression: A method of reducing the risk of identification by replacing an exceptional value with “unknown” where a rare combination of values in a record creates a high likelihood of distinguishing the person within the relevant population.
Top and Bottom Coding: A method of defining a category for a variable in a personal data set and combining values that fall within the grouping created by that category.
Global Recoding: An anonymization method that creates a common new group for selected values and replaces all relevant records in the data set with the new definition.
Sampling: A method of disclosing or sharing a subset drawn from a data set instead of the entire data set.
Microaggregation: A method of dividing all records in a data set into a specified number of subsets, calculating the average value of a selected variable within each subset and replacing the variable's values with that average.
Data Swapping: A method of modifying records by swapping the values of a variable belonging to a subset between selected pairs of records.
Noise Addition: Adding or subtracting values to create a defined level of distortion in a selected variable within a data set.
Other statistical methods that strengthen anonymization (K-Anonymity, L-Diversity, T-Closeness, etc.).
11.6 Unit Responsible for Personal Data Retention and Disposal Processes
A “Personal Data Protection Committee” has been established within DiyetisyenPRO to conduct personal data retention and disposal processes and take the actions required under this Policy. The Committee's members are responsible for fully fulfilling all obligations regarding personal data retention and disposal set out in this Policy.
11.7 Retention and Disposal Periods
Where legislation specifies a retention period, that period is observed in all cases. At its expiration, the data is deleted, destroyed or anonymized. Where no period is specified by legislation, an appropriate period is determined with regard to the processing purposes, legal grounds and DiyetisyenPRO's interests. If these periods need revision over time, the protection and disposal policy is updated.
Personal data whose retention period has expired is anonymized or disposed of every 6 (six) months in accordance with the disposal periods and procedures set out in this Policy. All operations involving the deletion, destruction or anonymization of personal data are recorded, and such records are retained for at least 3 (three) years, without prejudice to other legal obligations.
12. RIGHTS OF DATA SUBJECTS AND EXERCISE OF THOSE RIGHTS
12.1 Rights of Data Subjects Under the KVKK
Under Article 11 of the KVKK, a data subject has the following rights by applying to DiyetisyenPRO in relation to their own personal data:
a) To learn whether their personal data is processed;
b) To request information if their personal data has been processed;
c) To learn the purposes of processing and whether their personal data is used in accordance with those purposes;
d) To know the third parties to whom their personal data has been transferred in Türkiye or abroad;
e) To request correction of incomplete or inaccurate personal data and notification of the correction to third parties to whom the data has been transferred;
f) To request deletion or destruction of personal data when the grounds for processing no longer exist, even where it was processed in compliance with the Law and other relevant legislation, and notification of such action to third parties to whom the data has been transferred;
g) To object to any outcome against them resulting from the analysis of processed personal data exclusively through automated systems;
h) To request compensation for damages caused by unlawful processing of personal data.
12.2 Circumstances in Which Data Subjects Cannot Exercise Their Rights
Under Article 28 of the KVKK, data subjects cannot assert the rights listed in Section 12.1 in the following circumstances, which are outside the scope of the Law:
a) Processing of personal data by natural persons solely for activities relating to themselves or family members living in the same residence, provided that the data is not disclosed to third parties and data security obligations are observed;
b) Processing personal data for research, planning and statistical purposes by anonymizing it through official statistics;
c) Processing personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided it does not violate national defense, national security, public security, public order, economic security, privacy or personal rights and does not constitute a criminal offense;
d) Processing personal data as part of preventive, protective and intelligence activities conducted by public institutions and organizations vested with duties and powers by law to ensure national defense, national security, public security, public order or economic security;
e) Processing personal data by judicial or enforcement authorities in connection with investigation, prosecution, judicial proceedings or enforcement of sentences.
Furthermore, under Article 28(2) of the KVKK, a data subject cannot exercise the rights listed in Section 12.1, except the right to seek compensation for damages, in the following cases:
a) Where processing is necessary to prevent crime or for a criminal investigation.
b) Where personal data has been made public by the data subject.
c) Where processing is necessary for the performance of supervisory or regulatory duties or for disciplinary investigations or proceedings by public institutions and organizations or professional organizations with public-institution status, acting under powers granted by law.
d) Where processing is necessary to protect the State's economic and financial interests in relation to budgetary, tax and financial matters.
12.3 Exercising the Rights of the Data Subject
Data subjects may exercise their rights under Section 12.1 by completing the application form available at the “diyetisyenpro” address and submitting a wet-ink signed copy, or by sending it through a registered electronic mail address, secure electronic signature, mobile signature or an email address previously notified to DiyetisyenPRO and registered in its systems. The “Application Form Under the Personal Data Protection Law” available at the address indicated above explains the application procedure in detail.
If a data subject wishes to exercise these rights through a representative, documents verifying identity issued or approved by the competent authorities and any supporting documents must be submitted to DiyetisyenPRO with the application form.
12.4 DiyetisyenPRO's Response to Applications
DiyetisyenPRO shall resolve requests free of charge as soon as possible, and in any case within thirty days, depending on their nature. If fulfilling a request incurs a cost, fees prescribed by the Board's tariff may be charged.
DiyetisyenPRO may accept a request or reject it with reasons, and shall notify the data subject of its response in writing or electronically. If a request is accepted, DiyetisyenPRO shall take the necessary action.
12.5 Data Subject's Right to Complain to the Board
If an application is rejected, the response is considered insufficient or no response is provided in time, the data subject may file a complaint with the Board within thirty days of learning DiyetisyenPRO's response and, in any event, within sixty days of the application date.
13. GOVERNANCE STRUCTURE FOR PERSONAL DATA PROCESSING, RETENTION AND DISPOSAL
13.1 Unit Responsible for Processing, Retaining and Disposing of Personal Data
DiyetisyenPRO has established a “Personal Data Protection Committee” consisting of representatives of different departments, authorized to make decisions and submit them to senior management, and responsible for coordinating activities within DiyetisyenPRO to establish, maintain, manage and improve compliance with personal data protection legislation.
The duties of this Committee are as follows:
a) To coordinate and manage all personal data processing, retention, protection and disposal activities within DiyetisyenPRO across business units;
b) To prepare fundamental policies for processing, retaining, protecting and disposing of personal data and submit them for approval by senior management before implementation;
c) To ensure implementation of policies on processing, retaining, protecting and disposing of personal data, manage compliance with legislation and Company policies, and report to senior management;
d) To coordinate communications with data subjects in connection with DiyetisyenPRO's activities as a data controller and make the necessary organizational arrangements;
e) To carry out the necessary activities and arrangements within the Company and organize processes concerning the Board's requests, complaints and notifications;
f) To carry out the necessary activities and arrangements within the Company and organize processes concerning requests, complaints and notifications from data subjects;
g) To update the Personal Data Inventory, monitor, report and record processing activities, and make the necessary updates to VERBIS (Data Controllers Registry Information System) when changes occur;
h) To organize employee awareness training, ensure continuity and assess effectiveness;
i) To raise awareness and provide information about the processing, retention, protection and disposal of personal data within DiyetisyenPRO and among organizations cooperating with DiyetisyenPRO;
j) To determine how audits of personal data processing activities will be conducted and ensure the necessary coordination;
k) To identify or ensure identification of technical and administrative measures taken by third-party data processors to ensure data security, and conduct or commission audits;
l) To identify risks arising from personal data processing and ensure appropriate safeguards, submit action plans and improvement recommendations for senior management's approval, and coordinate their implementation;
m) To arrange internal audits of KVKK compliance, make necessary arrangements for external audits where applicable, and ensure that measures to address identified risks are determined and evaluated;
n) To cooperate with consultants specializing in personal data protection, participate in assessments and submit reports;
o) To monitor Board announcements and legislative developments, ensure their implementation where relevant and submit required notifications;
p) To manage processes for data confidentiality breaches, assign responsible persons or teams and their duties, and oversee reporting and corrective actions.
14. UPDATES, COMPLIANCE AND AMENDMENTS
DiyetisyenPRO reserves the right to amend this Policy and other policies connected with or related to it in response to changes in the Law, decisions of the Board, or developments in the industry or information technology.
Amendments to this Policy are incorporated into the text immediately, and explanations of the changes are provided at the end of the Policy.
14. AMENDMENTS TO THE POLICY
DiyetisyenPRO may amend this Policy from time to time. The current version of the Policy prepared by our Company is available on our Company's website, where any amendments may also be followed.
ANNEX 1 – TABLE OF PERSONAL DATA RETENTION AND DISPOSAL PERIODS
PROCESS / RETENTION PERIOD / DISPOSAL PERIOD [1]
1. Responding to court/enforcement information requests concerning employees, customers and third parties / 10 years after termination of the employment relationship / Within 180 days
2. Employee finance processes / 10 years after termination of the employment relationship / Within 180 days
3. Contracts signed with third parties / 10 years after termination of the contract / Within 180 days
4. Recruitment and payroll / 10 years after termination of the employment relationship / Within 180 days
5. Occupational health and safety practices / 10 years after termination of the employment relationship / Within 180 days
6. Payment transactions / 10 years after termination of the employment relationship / Within 180 days
7. Administration of contractual processes,
8. Creation and maintenance of employee personnel files / 10 years after termination of the employment relationship / Within 180 days
9. Software system accounts created for employees and establishment of transaction security information / 1 year after termination of the employment contract / Within 180 days
10. Managing customer complaints / 2 years after the complaint is entered into the records / Within 180 days
11. Managing customer compensation claims and assessing damage / 10 years after the damage occurs / Within 180 days
[1] Refers to the period within which personal data retained by DiyetisyenPRO will be disposed of after its retention period expires.