Personal Data Protection Policy
TDS DİAGNOSTİK TIBBİ CİHAZLAR LTD. ŞTİ. PERSONAL DATA PROCESSING, PROTECTION, AND DESTRUCTION POLICY
This document outlines the procedures and commitments of TDS Diagnostik Tıbbi Cihazlar Ltd. Şti. regarding the protection and processing of personal data.
1. Purpose and Scope of the Policy
TDS Diagnostik Tıbbi Cihazlar Ltd. Şti. (hereinafter referred to as “TDS Diagnostik” or “the Company”) is committed to upholding the fundamental rights and privacy principles guaranteed by the Constitution of the Republic of Turkey and the Personal Data Protection Law No. 6698 (“KVKK”) at the highest level. The primary purpose of this document is to ensure transparency in the data processing activities carried out by our company, standardize protection and destruction procedures, and inform data subjects about their rights.
This policy covers the processing of data belonging to job applicants, customers, visitors, suppliers, business partners, and all other third-party natural persons who establish a relationship with our company.
2. Fundamental Principles of Personal Data Processing Activities
TDS Diagnostik strictly adheres to the following legal principles at every stage of the data processing cycle:
- All operations conducted must comply with the constitution, laws, and universal principles of honesty.
- Processed information must be complete, accurate, and, when necessary, kept in its most up-to-date form.
- Data collection processes must serve legitimate, clearly defined, and specific purposes.
- Collected data must be used only to the extent that is relevant, limited, and proportionate to the stated purpose.
- Information must be retained only for the period mandated by relevant legislation or as required by the legitimate processing purpose.
3. Ensuring Data Security
TDS Diagnostik implements comprehensive security measures to prevent unauthorized access, data breaches, and unlawful use of personal data.
Measure Category | Implementation Details
|
|---|---|
Technical Measures | Regular penetration tests and authorization controls are performed on system infrastructures; data is hosted in up-to-date and secure technological environments. |
Administrative Measures | Company personnel receive periodic data security training, data protection agreements are signed with third parties, and regular internal audits are conducted. |
4. Data Storage, Deletion, Destruction, and Anonymization
If the legitimate reasons requiring data processing cease to exist or legal retention periods expire, data is subjected to destruction procedures by TDS Diagnostik ex officio or upon the request of the data subject.
- Destruction of Physical Documents: Printed documents are physically shredded using document shredders in a manner that makes them impossible to reconstruct or read.
- Deletion of Digital Data: Data located in computer systems, servers, or cloud-based environments is permanently removed through secure deletion software and digital commands.
- Anonymization: This is the process of converting data into statistical data that cannot be linked to any real person, using techniques such as masking, generalization, or aggregation.
5. Transfer of Personal Data
TDS Diagnostik may share data in strict compliance with KVKK rules to ensure the uninterrupted progress of its services and to fulfill legal obligations.
- As a rule, data cannot be transferred to third parties without the explicit and free consent of the data owner.
- Sharing with official institutions and organizations authorized to request information by legal regulations is done only within the scope of the requested purpose.
- For transfers abroad, the recipient country must either be on the list of “countries with adequate protection” announced by the Board or the parties must guarantee adequate protection through written undertakings.
6. Legal Rights of Data Subjects
Pursuant to Article 11 of the KVKK, every individual whose personal data is processed may apply to TDS Diagnostik to assert the following rights:
- To inquire whether their data is being processed and to learn the parties to whom it has been transferred.
- To request the correction of incomplete or inaccurately processed information.
- To request the deletion or complete destruction of their data under the conditions stipulated by law.
- To demand compensation for damages that may arise from unlawful practices.
TDS Diagnostik evaluates and resolves requests submitted by data subjects in due form as soon as possible, and within a maximum of 30 days, depending on their nature.
