Information Notice for Visitors/Guests

Dear Recipients,

As Pineapple Health Tourism Agency, we place great importance on data security. We have shared our Information Security Policy with our employees, business partners, suppliers, visitors, and the public through this communication.

Notification Regarding the Personal Data Protection Law No. 6698

As Pineapple Health Tourism Agency, we would like to inform you about the Personal Data Protection Law No. 6698 (KVKK), which regulates the protection of the fundamental rights and freedoms of individuals, especially the privacy of personal life, and the obligations of natural and legal persons processing personal data. Personal data may be processed by Pineapple Health Tourism Agency in the scope explained below.

When and for What Purposes Can Your Personal Data Be Processed?

According to Article 5 of the Personal Data Protection Law No. 6698, as a rule, personal data cannot be processed without the explicit consent of the data subject. However, in the presence of one of the following conditions, personal data can be processed without the explicit consent of the data subject:

Explicitly stipulated by the laws.
When it is necessary to protect the life or physical integrity of the person or another person, and the person is incapable of giving consent due to physical impossibility, or their consent is not legally valid.
When it is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.
When it is necessary for the data controller to fulfill a legal obligation.
When it has been made public by the data subject.
When it is necessary for the establishment, use, or protection of a right.
When it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Processing of Sensitive Personal Data

According to Article 6 of the Personal Data Protection Law, processing sensitive personal data without the explicit consent of the data subject is prohibited. Sensitive personal data includes information related to a person’s race, ethnicity, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data.

However, sensitive personal data, excluding health and sexual life data, can be processed without the explicit consent of the data subject in cases stipulated by laws. Personal data related to health and sexual life can be processed without the explicit consent of the data subject only by persons or authorized institutions who are bound by confidentiality obligations, for purposes such as protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and financing.

Personal Data Processed by Our Institution Regarding Employees

Personal data related to experts, specialists, and other individuals processed by our institution may be processed in accordance with the purposes and processing conditions stated in this text. The personal data to be processed includes:

Identity Data: Name, surname, T.C. ID number
Visual and Auditory Data: Photos and video recordings of visitors.

Your personal data may be processed by our institution for the following purposes according to the conditions outlined above:

Organizing visits to Pineapple Health Tourism Agency
Managing your requests, suggestions, complaints, and operations regarding Pineapple Health Tourism Agency
Recording transaction and cookie information when you visit the Pineapple Health Tourism Agency website
Performing visual and auditory operations in accordance with physical space security and Occupational Health and Safety (OHS) when you physically visit Pineapple Health Tourism Agency
Monitoring Emergency Management Processes
Managing Information Security Processes
Conducting Audits / Ethical Activities
Providing information to authorized persons, institutions, and organizations
Performing storage and archiving activities
Performing management activities
Ensuring compliance with the law in our activities
Ensuring the security of the data controller’s operations
Providing information to authorized persons, institutions, and organizations.

Who Can Your Personal Data Be Transferred To and for What Purpose?

According to Article 8 of the Personal Data Protection Law No. 6698, personal data cannot be transferred without the explicit consent of the data subject. However, personal data may be transferred to third parties without the explicit consent of the data subject in cases where personal data can be processed without the data subject’s explicit consent. Similarly, sensitive personal data, excluding health and sexual life data, may be transferred without the explicit consent of the data subject in cases specified by law, provided that sufficient measures are taken. Personal data related to health and sexual life may only be transferred without the data subject’s explicit consent to persons or authorized institutions who are under an obligation to maintain confidentiality for purposes such as protecting public health, providing preventive medicine, medical diagnosis, treatment, and care services, and planning and managing health services and financing.

Transfer of Personal Data Abroad

According to Article 9 of the Personal Data Protection Law, personal data cannot be transferred abroad without the explicit consent of the data subject. However, personal data can be transferred abroad without the explicit consent of the data subject in cases where personal data can be processed without the data subject’s explicit consent, as well as in the cases specified by law. Similarly, sensitive personal data, excluding health and sexual life data, can be transferred abroad without the explicit consent of the data subject in cases stipulated by law, provided that adequate precautions are taken.

If adequate protection is not available, the data controllers in Turkey and the foreign country must guarantee adequate protection in writing, and the transfer will be made with the permission of the Board. The Board will announce the countries where adequate protection exists.

Collection Methods and Legal Grounds for Processing Personal Data

Your personal data is collected through personal applications, printed materials, electronic platforms, software, CDs, DVDs, USBs, photocopies, printers, videos, cameras, telephones, tablets, websites, and similar media, either manually or automatically. Additionally, when you visit our institution physically, some of your personal data will be processed.

These personal data are processed in accordance with the relevant laws such as the 4857 Labor Law, Occupational Health and Safety legislation, and health regulations for the purposes specified in the law, for the performance of contracts, or for the legal obligations of the data controller.

Personal Data Transfer and Legal Compliance

Personal data may be transferred to the authorities, courts, public institutions, consultants, lawyers, firms processing data, and other relevant institutions as required by law.

Our Institution’s Obligation to Ensure Personal Data Security

We are obligated to take necessary technical and administrative measures to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the safe storage of personal data. The data controller is also jointly responsible for taking these measures with third parties who process data on its behalf. The data controller is required to conduct necessary audits or ensure that audits are carried out to ensure compliance with these provisions.

Rights of Personal Data Owners (Data Subjects) Under Article 11 of the KVKK

Learn whether personal data is being processed
Request information about personal data processed
Learn the purpose of processing personal data and whether they are used in accordance with that purpose
Learn the third parties to whom personal data is transferred, domestically or abroad
Request correction of personal data if it is incomplete or incorrect and request that this correction be communicated to third parties to whom the data has been transferred
Request deletion or destruction of personal data if the reasons for processing cease to exist and request that this action be communicated to third parties
Object to a result arising from the analysis of personal data solely through automated systems and request compensation for damages caused by unlawful processing of personal data

Communication with the Data Controller Regarding Personal Data

Requests related to the exercise of the rights mentioned above can be sent by personal data owners, the relevant persons, using the methods specified in the Personal Data Protection Law page at https://pineapplehealthtourism.com/. The institution will evaluate the requests and respond as quickly as possible, and no later than 30 days. When applying, please include your name, surname, and ID number. Clearly express your complaint and indicate your connection with the institution. You can submit your application using the contact details below.

We reserve the right to verify your identity before responding to your request.

Data Controller Contact Information

Data Controller: Pineapple Health Tourism Agency
Address: Levent Mahallesi, Karanfil Aralığı Street No:18/1 Beşiktaş / Istanbul
Email: info@pineapplehealthtourism.com
Contact link: https://pineapplehealthtourism.com/