Special Personal Data

Policy on the Processing, Storage, and Destruction of Special Categories of Personal Data

AloTech, with this Policy on the Processing, Storage, and Destruction of Special Categories of Personal Data (“Policy”) published at https://alotech.com.tr/ozel-nitelikli-kisisel-veri-politikasi, declares that it is responsible as a data controller under the Law on the Protection of Personal Data No. 6698. AloTech places great importance on the processing and preservation of your special categories of personal data in accordance with the law and other relevant legislation under the Law on the Protection of Personal Data No. 6698. With this awareness, AloTech processes and preserves personal data in compliance with the legislation to fulfill its legal obligations and carry out activities consistent with its field of business.

Definitions and Abbreviations

1. PURPOSE AND SCOPE

The purpose of this Policy is to explain the principles adopted by AloTech for the processing and protection of special categories of personal data in accordance with the Law, and its storage and destruction in accordance with the Regulation, and the methods to be followed in this context.

This Policy is an integral part of the Policy on the Processing, Storage, and Destruction of Personal Data. For all matters not included in this Policy, we recommend you review the Policy on the Processing, Storage, and Destruction of Personal Data, which can be accessed at https://alotech.com.tr/kisisel-verilerin-islenmesi-politikasi.

This Policy applies to all activities managed by AloTech regarding the processing, protection, storage, and destruction of all personal data processed by AloTech through fully or partially automated means or non-automated means provided that they are part of a data recording system. This includes, but is not limited to, personal data belonging to officials, employees, former employees, employee candidates, interns, visitors of AloTech and its affiliated group(s), other companies, direct and indirect subsidiaries and affiliates, as well as officials and employees of collaborating institutions and organizations, and third parties from whom services are procured or to whom services are provided in relation to its field of business, both domestically and internationally.

2. PRINCIPLES REGARDING THE PROCESSING AND TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA

2.1. PRINCIPLES UNDERLYING THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

AloTech processes special categories of personal data within the scope of this Policy in accordance with the following general principles, pursuant to Article 4 of the Law.

• Compliance with the law and principles of fairness
• Being accurate and up-to-date when necessary
• Processing for specific, explicit, and legitimate purposes
• Being relevant, limited, and proportionate to the purposes for which they are processed
• Being retained for the period stipulated by relevant legislation or required for the purpose for which they are processed

2.2. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

AloTech does not process special categories of personal data without the explicit consent of the data subject. However, it is possible to process the data subject’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, criminal convictions and security measures, as well as biometric and genetic data without the explicit consent of the data subject in cases prescribed by law.

2.3. TRANSFER OF PERSONAL DATA

2.3.1. Domestic Transfer of Special Categories of Data

AloTech may transfer special categories of personal data to third parties within the country, provided there is explicit consent from the data subject, in line with data processing purposes, and by taking the necessary technical and administrative measures as required by legislation. As a rule, special categories of personal data cannot be transferred to third parties within the country without the explicit consent of the Data Subject.

However, personal data other than health and sexual life data may be transferred without seeking the explicit consent of the Data Subject if it is explicitly stipulated in the laws, in other words, if there is a clear provision in the law governing the relevant activity regarding the processing/transfer of special categories of personal data. Personal data related to health and sexual life may be transferred without seeking the explicit consent of the Data Subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, provided that adequate and necessary measures are taken.

During the transfer of special categories of personal data, AloTech takes all necessary measures to ensure an appropriate level of security in accordance with the legislation to prevent the unlawful use of data and to ensure its preservation.

2.3.2. International Transfer of Special Categories of Personal Data

AloTech may transfer special categories of personal data abroad for legitimate and lawful personal data processing purposes by showing due diligence, taking the administrative and technical measures stipulated by the legislation, and the precautions deemed necessary by the Board. As a rule, special categories of personal data cannot be transferred abroad without the explicit consent of the Data Subject.

However, personal data other than health and sexual life data may be transferred abroad without seeking the explicit consent of the Data Subject if it is explicitly stipulated in the laws, in other words, if there is a clear provision in the law governing the relevant activity regarding the international transfer of special categories of personal data. Personal data related to health and sexual life may also be transferred abroad without seeking the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, provided that adequate and necessary measures are taken.

3. MEASURES TAKEN FOR THE STORAGE OF SPECIAL CATEGORIES OF PERSONAL DATA

In the processing of special categories of personal data, AloTech, as the data controller, takes the following measures in accordance with Article 6 of the Law and the Board’s decision dated 31.01.2018 and numbered 2018/10:

Measures for employees involved in the processing of special categories of personal data;

• Employees are provided with training on relevant legislation and data security topics such as the processing, security, protection, and storage of special categories of personal data.
• Confidentiality agreements are signed with employees, and disciplinary procedures are applied.
• The scope and duration of authorization for employees who have access to special categories of personal data are defined.
• Authority checks are conducted periodically.
• The authorizations of employees who change roles or leave their jobs are immediately revoked. In this context, any inventory assigned to the employee is reclaimed.

Measures for electronic environments where special categories of personal data are processed, stored, and/or accessed;

• Data is stored using cryptographic methods.
• Cryptographic keys are kept in secure and separate environments.
• Transaction records of all movements performed on the data are securely logged.
• Security updates for the environments where data is located are continuously monitored, security tests are regularly conducted/commissioned, and test results are recorded.
• If data is accessed through software, user authorizations for this software are made, security tests for these applications are regularly conducted/commissioned, and test results are recorded.
• If remote access to data is required, at least a two-factor authentication system is implemented.

Measures for physical environments where special categories of personal data are processed, stored, and/or accessed;

• Physical environments (cabinets, archives, etc.) containing special categories of personal data are locked.
• Adequate security measures (against electrical leakage, fire, flood, theft, etc.) are taken according to the nature of the environment where special categories of personal data are located.
• The physical security of these environments is ensured, and unauthorized entry and exit are prevented.

Measures regarding the transfer of special categories of personal data;

• If special categories of personal data need to be transferred via e-mail, this data is transferred in an encrypted format using a corporate e-mail address or a Registered Electronic Mail (KEP) account. The password for the file is not included in the body of the e-mail.
• If special categories of personal data need to be transferred via portable media such as flash drives, CDs, or DVDs, this data is encrypted using cryptographic methods, and the cryptographic key is kept in a separate medium.
• If the transfer of special categories of personal data is carried out between servers in different physical environments, the data transfer is performed by establishing a VPN between the servers or by using the SFTP method.
• If special categories of personal data need to be transferred in paper format, necessary precautions are taken against risks such as the document being stolen, lost, or seen by unauthorized persons, and the document is sent in a “classified documents” format.

In addition to the measures mentioned above, the technical and administrative measures aimed at ensuring the appropriate level of security specified in the Policy on the Processing, Storage, and Destruction of Personal Data, which can be accessed at https://alotech.com.tr/kisisel-verilerin-islenmesi-politikasi, should also be taken into consideration.

4. IMPLEMENTATION OF THE POLICY AND PROCESS MONITORING

The individuals assigned by AloTech to carry out the necessary actions and manage the processes for the processing, storage, and destruction of data subjects’ data in accordance with the Law and the Regulation under this Policy are as follows.

5. RIGHTS OF THE DATA SUBJECT

In accordance with Article 11 of the Law, the data subject has the right to apply to AloTech to;

• a. Learn whether their personal data is being processed,
• b. Request information if their personal data has been processed,
• c. Learn the purpose of the processing of their personal data and whether they are used in line with this purpose,
• d. Know the third parties to whom their personal data is transferred, both domestically and abroad,
• e. Request the correction of their personal data if it is incomplete or incorrectly processed,
• f. Request the deletion or destruction of their personal data in the event that the reasons requiring its processing cease to exist, to be evaluated within the principles of purpose, duration, and legitimacy,
• g. Request notification of the operations carried out upon their request for correction, deletion, or destruction of their personal data to third parties to whom the personal data has been transferred,
• h. Object to the emergence of a result against them by analyzing the processed data exclusively through automated systems,
• i. Request compensation for damages in case of suffering damages due to the unlawful processing of their personal data.

For updating, correcting personal data held by AloTech, and for any other questions, requests, and opinions regarding personal data, AloTech can always be reached through the methods set out in the AloTech Data Subject Application Form available at https://alotech.com.tr/basvuru-formu. Applications are evaluated and concluded as soon as possible and within 30 (thirty) days at the latest after being communicated to AloTech. However, if the transaction requires an additional cost, AloTech reserves the right to charge a fee based on the tariff determined by the Board.