As Haliç Occupational Hygiene Laboratory, we are fully aware of the importance of personal data. With this ‘Disclosure Statement and Privacy Notice’ prepared by us, what personal data is collected, in what manner it is collected, recorded, retained, and used, the legal grounds for processing, the purposes for which it is processed, the parties to whom it is transferred, and the purposes of transfer are explained in a simple and clear manner.
Our privacy procedure encompasses all personnel of Haliç Occupational Hygiene Laboratory, employee candidates, interns, visitors, employees of collaborating companies, and customers.
Principles to be Followed Regarding the Processing of Personal Data
In the processing of personal data, compliance with the following principles is mandatory:
- a) Compliance with the law and rules of good faith.
- b) Being accurate and, where necessary, kept up to date.
- c) Being processed for specific, explicit, and legitimate purposes.
- d) Being relevant, limited, and proportionate to the purposes for which they are processed.
- e) Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
Purposes of Processing Personal Data
Personal data and special categories of personal data are processed strictly limited to the purposes and conditions within the personal data processing terms. These purposes and conditions are as follows:
- Being relevant and necessary for the establishment or performance of a contract / work order,
- Being mandatory for the fulfillment of a legal obligation,
- Being requested by customers / business partners,
- Execution and tracking of reporting and risk management processes,
- Ensuring the continuation of communication activities,
- Request and complaint management,
- Carrying out activities aimed at protecting institutional reputation,
- Being required during the training registration phase,
- Creation and tracking of visitor / customer records.
Personal data cannot be processed without the explicit consent of the data subject.
In the presence of one of the following conditions, it is possible to process personal
data without seeking the explicit consent of the data subject:
- a) Being clearly provided for in the laws.
- b) Being mandatory for the protection of life or physical integrity of the person or of another person where the data subject is physically incapable of expressing consent or whose consent is not granted legal validity due to actual impossibility.
- c) Processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract.
- d) Being mandatory for the controller to fulfill its legal obligation.
- e) Having been made public by the data subject themselves.
- f) Data processing being mandatory for the establishment, exercise, or protection of a right.
- g) Data processing being mandatory for the legitimate interests pursued by the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data. Special categories of personal data cannot be processed without the explicit consent of the data subject.
Personal data other than health and sexual life may be processed without seeking the explicit consent of the data subject in cases stipulated by law. Personal data relating to health and sexual life, however, may only be processed without seeking explicit consent by persons under an obligation of confidentiality or authorized public institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of healthcare services and financing.
Special categories of personal data regarding personnel will be kept confidential between the personnel and the laboratory, outside the circumstances specified above.
Transfer of Personal Data
Within the scope of the duties of the Quality Manager / Quality Supervisor, data subjects are informed during the collection of personal data about the purpose for which personal data will be processed, to whom and for what purpose processed personal data may be transferred, the method and legal ground of personal data collection, and their legal rights; furthermore, a Personnel Data Sharing Permission Statement is obtained from personnel at the end of their orientation period.
Personal data is defined in accordance with the purpose of sharing, and a written commitment ensuring the protection of confidentiality of personal data (Commitment on the Processing and Protection of Personal Data) is obtained from the institutions with which data is shared in order to prevent imprudent or unauthorized disclosure, access, transfer, or any other unlawful access, after which the requested data (excluding special categories of personal data) is shared. Employees are informed that they cannot disclose the personal data they have learned to anyone in violation of statutory provisions or use it outside the processing purpose, and that this obligation will continue after their departure from duty; necessary commitments are obtained from them accordingly.
Retention of Personal Data
At Haliç Occupational Hygiene Laboratory, personnel records are not recorded in any automated database. Personnel information is maintained only in electronic formats (as scans) and as hardcopy documents in physical file folders.
Archived files are retained by the archive supervisor (Quality Manager / Quality Officer) with necessary precautions taken by laboratory management.
Files are retained taking into account the retention periods specified in the Laboratory Records List determined in accordance with relevant regulations.
The preservation of personal data compiled into files and archived is ensured by taking necessary precautions by Laboratory Management.
Note: Records in hardcopy format cannot be left randomly on desks.
In the event it is determined that the confidentiality of personal data has not been complied with in the laboratory, the action to be taken is determined according to the decision to be made by senior management.
Individuals other than those authorized by the laboratory cannot directly access folders containing personnel personal data. The relevant data sharing is carried out by the Quality Manager / Quality Supervisor.
Laboratory personnel notify the Laboratory Quality Manager / Quality Officer of any matters they consider to be deficient in terms of security and safety regarding the protection of personal data and ensure that measures are taken.
Right of the Data Subject to Access, Rectify, or Erase Personal Data: Data subjects have the right to access their personal data.
At the same time, they may request the rights itemized below:
– To learn whether their personal data is processed,
– To request information if their personal data has been processed,
– To learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,
– To know the third parties to whom personal data is transferred,
– To request rectification of personal data in case of incomplete or inaccurate processing,
– To request the erasure or destruction of personal data in the event that the reasons requiring its processing cease to exist.