Employee Information Notice on Personal Data Processing

Şerifali Mah. Miras Sok. Çankaya Plaza 20/1 Ümraniye/ISTANBUL (Dentgen) acts as the data controller. In this context, in accordance with the principles set forth in the Personal Data Protection Law No. 6698 and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform published in the Official Gazette No. 30356, this Information Notice has been prepared to inform you about the methods of collecting personal data, principles and procedures of processing, purposes, retention, and transfer of personal data, and the legal bases of the processing activity.

What is Special Category Personal Data?

Special category personal data includes information about an individual’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, dress and clothing, membership to associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Special category personal data requires higher protection compared to other data categories; thus, additional information must be provided when processing such data.

Personal Data Processed Including Special Category Data

1. Name-Surname
2. Signature, Initials
3. National Identity Number
4. Place and Date of Birth
5. Phone Number
6. Profession
7. Past Work Information
8. Photograph
9. Age
10. Education Level
11. Marital Status
12. Home Address
13. Treatment Information
14. Disability Information
15. Gender
16. Employment Health Report
17. Blood Type Information
18. Chronic Disease Information
19. Tetanus/Hepatitis Information
20. Immunization Disease Information
21. Vaccination Information
22. Illness Complaint Information
23. Medical History Information
24. Medical Complaint Information
25. Disease Information
26. Surgery Information
27. Occupational Disease Information
28. Test/Examination Information
29. Smoking or Alcohol Use Information
30. Medication Information
31. Health Report
32. CCTV Footage

Purpose of Processing Your Personal Data

Your personal data listed in items 1-15 are collected and processed by Dentgen due to obligations arising from the Labor Law and within its rights.

Your health-related special category personal data listed in items 16-31 are processed for the purposes of conducting occupational health/safety activities, conducting audit/ethical activities, ensuring activities are conducted in compliance with the legislation, conducting internal audit-investigation-intelligence activities, providing information to authorized persons, institutions, and organizations, conducting management activities, fulfilling obligations arising from employment contracts and legislation for employees, exercising the employer’s right to audit, and fulfilling obligations arising from the Labor Law and contracts, based on the legal ground specified in Article 6 of the Personal Data Protection Law, which states that personal data related to health and sexual life may be processed without explicit consent of the individual concerned by persons or authorized institutions and organizations who are under confidentiality obligations, for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment, and care services, planning and managing health services and their financing, and limited to these purposes only.

The CCTV footage listed in item 32 is processed for the purposes of monitoring operational processes, ensuring and monitoring occupational health and safety, and ensuring the security of the workplace, materials, and the dental health center. Audio recordings are not made. Areas where CCTV is recorded are listed below. Recordings are not made in private areas such as restrooms or changing rooms. These recordings are retained for 20 days unless required by legal obligations, after which they are overwritten and destroyed. If needed for workplace inspections or legal obligations, these recordings may be provided to authorized authorities but are not shared with third parties outside of necessity.

Methods of Collecting Your Personal Data

CCTV footage is collected via cameras located in various areas of the dental health center. Areas where CCTV is recorded are listed below. Your health-related personal data is collected through correspondences, printed and electronic forms, contracts, and reports prepared as a result of examinations by the workplace physician.

Principles and Legal Bases of Processing and Transferring Your Personal Data

Your personal data is processed and transferred in accordance with the principles listed below:

• Compliance with the law and honesty rules
• Accuracy and up-to-dateness when necessary
• Processing for specific, explicit, and legitimate purposes
• Being relevant, limited, and proportionate to the purposes for which they are processed
• Being retained for the period required by relevant legislation or for the purposes for which they are processed

The reasons for processing your personal data are simply explained above. However, general information on the processing of personal data is provided in this section. The reasons for processing personal data may include one or more of the following:

• The explicit consent of the data subject
• Explicit stipulation by laws
• The necessity for the protection of life or physical integrity of the data subject or another person who is unable to disclose consent due to actual impossibility or whose consent is not legally valid
• The necessity of processing the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract
• The necessity for the data controller to fulfill its legal obligation
• The data subject having made the data public
• The necessity of data processing for the establishment, exercise, or protection of a right
• The necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

In this context, the employer may process your personal data for reasons not explicitly stated above, in accordance with the circumstances and conditions of the situation. However, this processing activity will be limited to the necessity arising within the framework of laws and legitimate purposes, and when the need for processing the personal data ceases, your data will be destroyed.

Recipients of Personal Data

Your personal data is transferred to:

• Ministries, the Social Security Institution, and the Workplace Physician for the purpose of ensuring activities are conducted in compliance with the legislation and providing information to authorized persons, institutions, and organizations
• The law firm retained for the purpose of following and conducting legal affairs
• Relevant domestic and foreign patients, suppliers, and insurance companies, if required by your job role, provided that necessary measures are taken
• The security company, if necessary

Retention Period of Personal Data

Your personal data is retained for 5 years from the date of termination of your employment unless otherwise required by law.

Rights of the Data Subject

Under the Personal Data Protection Law and relevant legislation, you have the right to:

• Learn whether your personal data is processed
• Request information if your personal data has been processed
• Learn the purpose of processing your personal data and whether they are used in accordance with the purpose
• Know the third parties to whom your personal data is transferred, both domestically and abroad
• Request correction of your personal data if it is incomplete or incorrectly processed
• Request the deletion or destruction of your personal data under the conditions stipulated in the relevant legislation
• Request notification of the correction, deletion, or destruction to third parties to whom your personal data has been transferred
• Object to the processing of your personal data if it results in a negative outcome for you
• Request compensation for damages if you suffer damage due to unlawful processing of your personal data

Application Procedures

You can send your application and requests regarding your personal data by sending a signed petition by mail or electronically. The petition must include your name, surname, signature (if written), national identity number, address for notification, if available, your e-mail address, telephone, and fax number, and the subject of the request. Documents related to the subject must be attached to the petition. The request must be related to the applicant’s own personal data; if acting on behalf of someone else, the applicant must have special authorization (special power of attorney) and document this authority. The application must include identity and address information and documents proving identity. Requests made by unauthorized third parties on behalf of others will not be considered.

The date of application is the date when written applications are notified to the data controller. For applications made by other methods, the date of application is the date when the application reaches the data controller.

You can send your written application to Şerifali Mah. Miras Sok. Çankaya Plaza 20/1 Ümraniye/ISTANBUL address or visit this address in person to apply.

You can sign your application electronically using a mobile signature or secure electronic signature and send it to info@dentgen.clinic or send it via registered electronic mail (KEP) to sttadsm@hs01.kep.tr using a secure electronic signature or mobile signature.

Response Time and Fees for Applications

Requests related to your personal data will be evaluated and answered within 30 days from the date we receive them. If your application is negatively evaluated, the reasons for the refusal will be sent to the address you provided in the application via electronic mail, mail, or other means of communication.

If the response to your application is provided in writing, there will be no charge for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page over ten pages. If the response is provided on a CD, flash drive, or other recording medium, the data controller may charge a fee not exceeding the cost of the recording medium.

Areas Where CCTV Recording is Conducted

1. Building entrance
2. Patient waiting lounge
3. Patient registration area
4. Corridors
5. Dining hall