I. INTRODUCTION
A. Purpose and Scope
The principles of Hair Skill Clinic for the protection and handling of personal records are defined in this policy.
Within the scope of this Policy, making explanations about the personal records processing activity and the systems adopted by Hair Skill Clinic for the protection of personal information, in this context, the persons who buy products or services, our employee and employee candidates, potential customers, shareholders, visitors, participants, suppliers and third parties ensuring transparency by informing the Relevant Person, establishing and realizing standards in the management of personal records; setting and supporting organizational goals and obligations; it is aimed to establish control mechanisms in line with the acceptable risk level, to comply with the principles and rules introduced by international agreements on the protection of personal details, the constitution, laws, regulations, contracts and other legislation, and to protect the fundamental rights and freedoms of the Relevant Person in the best way. In addition, this Policy covers all physical and electronic record systems and media used for automatic or non-automatic processing of personal and private details, provided that they are part of any registry system.
B. Definitions
| Definition | Description |
|---|---|
| Open Consent | Consent on a particular subject, based on information and expressed with free will. |
| Constitution | Constitution of the Islamic Republic of Pakistan. |
| Worker | Employees and managers at Hair Skill Clinic. |
| Employee Candidate | Individuals who have applied to Hair Skill Clinic by any means or have opened their CV and related records to Hair Skill Clinic for review. |
| Shareholder/Partner | The shareholders and partners of Hair Skill Clinic are real persons. |
| Related person | Natural person whose personal records are processed. |
| Destruction | Deletion or destruction of personal details. |
| Personal Information | Any information relating to an identified or identifiable natural person. |
| Processing Inventory | Information handling activities carried out by controllers depending on their business processes; Processing inventory, which is created by associating records with the purposes of handling, information category, transferred recipient group and subject group, by explaining the maximum time required for the purposes for which personal details are processed, the personal records planned to be transferred to foreign countries and the measures taken regarding security. |
| Anonymization | Anonymizing personal records, making it impossible to associate personal details with an identified or identifiable natural person in any way, even if it is matched with other files. |
| Disposal of Information | The process of deletion, anonymization or destruction of personal records. |
| Deletion of Records | The process of making personal information inaccessible and non-reusable for Relevant Users in any way. |
| Destruction of Details | The process of destroying personal records, making information inaccessible, unrecoverable and unusable by anyone in any way. |
| Committee | Hair Skill Clinic Personal Information Protection Committee. |
| Commission / Board | National Commission for Personal Information Protection and privacy authority of the relevant member country. |
| PDPB | Personal Information Protection Bill / Law of Pakistan. |
| GDPR | European General Information Protection Regulation. |
| Special Qualified Details | Information as well as records on peoples race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures. |
| Periodic Destruction | In the event that all of the personal information processing conditions in the PDPB and GDPR are eliminated, the deletion, destruction or anonymization of personal records, which will be carried out ex officio at repetitive intervals and specified in the storage and destruction policy. |
| Policy | Hair Skill Clinic Personal Information Processing and Protection Policy. |
| Hair Skill Clinic | Hair Skill Clinic (Pvt) Ltd. |
| Supplier Employee | Real persons working in institutions (such as but not limited to business partners, suppliers) with which Hair Skill Clinic has any business relationship. |
| Supplier Representative | Real persons with whom Hair Skill Clinic has business relations. |
| Product or Service User | Regardless of whether they have any contractual relationship with Hair Skill Clinic, natural persons (who receive products or services), or Legal Entity Authorities who use or have used them, using or using the products and services offered by Hair Skill Clinic. |
| Information Processor | The natural or legal person who handles personal records on behalf of the controller based on the authority given by him. |
| Record System | The registry system where personal details are processed and structured according to certain criteria. |
| Privacy Controller | The natural or legal person who determines the purposes and means of processing personal records and is responsible for the establishment and management of the registry system. |
| Visitor | Real persons who have entered the physical facilities owned by Hair Skill Clinic for various purposes or visited our websites. |
II. GENERAL PRINCIPLES AND CONDITIONS REGARDING THE PROCESSING OF RECORDS
Hair Skill Clinic, in accordance with the Constitution of Pakistan, the PDPB, and Article 5 of the GDPR, regarding the handling of personal details; in accordance with the law and the rules of honesty, accurate and up-to-date when necessary; for specific, clear and legitimate purposes; engages in personal records processing activities in a connected, limited and measured manner for this purpose. In this context, in accordance with the PDPB for the residents of Pakistan, personal information is processed based on one or more of the conditions regarding the processing of personal details, and the personal information is retained for as long as required by the laws and/or the personal handling purpose is doing. In addition, it also acts in accordance with the regulations envisaged in terms of the handling of sensitive personal details in accordance with the PDPB, and in accordance with the regulations stipulated in the law and set forth by the Commission on the transfer of personal records. It informs the Relevant Person and provides the necessary information in case the Relevant Person requests it. In addition, all the above-mentioned activities are carried out for European residents in accordance with the relevant provisions of the GDPR.
A. Principles Regarding the Handling of Personal Information
Hair Skill Clinic processes your personal records in accordance with the personal details handling principles in the PDPB and Article 5 of the GDPR. It is mandatory to comply with these principles for each personal handling activity:
Processing personal information in accordance with the law and honesty rules:
In the handling of your personal details, we act in accordance with the laws, secondary regulations and general principles of law; It is important to process personal records limited to the purpose of handling and to take into account the reasonable expectations of the Relevant Person.
Accurate and up-to-date personal details:
Care is taken to ensure that your processed personal information is up-to-date and to check it. In this context, the Relevant Person is entitled to request the correction or deletion of their correct and outdated records.
Processing of personal information for specific, explicit and legitimate purposes:
Before each personal details handling activity, the purposes of record handling are determined and compliance with the law is complied with.
Being connected, limited and proportional to the purpose for which personal information is processed:
The personal details required to fulfill the purpose of collecting handling activities are limited and necessary technical and administrative measures are taken to prevent the handling of personal information not related to this purpose.
Retention of personal information for as long as required by the legislation or handling purposes:
Personal records are deleted, destroyed or anonymized after the purpose of processing personal details disappears or when the period stipulated in the legislation expires.
B. Conditions Regarding the Processing of Personal Information
Your personal details are processed by at least one of the personal information handling conditions in the PDPB and Article 6 of the GDPR and its continuation. Explanations on these conditions are given below:
Having the Explicit Consent of the Relevant Person:
The personal details of the Relevant Person can be handled with his free will, provided that he has sufficient information about the personal records handling activity, and gives his consent limited to that transaction, leaving no room for hesitation.
Explicitly stipulated in laws:
Personal details can be handled within the framework of the relevant legal regulation without the Explicit Consent of the Related Person, if it is expressly stipulated in the laws.
If the Explicit Consent of the Related Person cannot be obtained due to the actual impossibility and personal handling is mandatory:
Personal records belonging to the Relevant Person, who is unable to express his consent or whose consent cannot be validated, may be handled without seeking explicit consent, if personal handling is necessary in order to protect the life or physical integrity of the Relevant Person or a third party.
If the personal details handling activity is directly related to the establishment or performance of a contract:
If it is necessary to process the personal information of the parties to the contract established or already signed between the Company, personal handling can be carried out without seeking explicit consent.
In order for the Privacy Controller to fulfill his legal obligation:
In order to fulfill the legal obligations stipulated in the current legislation, personal details can be handled without seeking explicit consent.
Relevant Person has made his personal information public:
Personal records, which have been disclosed to the public in any way by the Relevant Person and have become accessible to everyone as a result of this publicization, may be handled without the Relevant Persons Express Consent, limited to the purpose of making it public.
Personal records handling is mandatory for the establishment, exercise or protection of a right:
If information handling is necessary for the establishment, exercise or protection of a right, the personal details of the Relevant Person may be processed.
Record handling is mandatory for the legitimate interests of the privacy controller:
Provided that the balance of interests of the Relevant Person is observed, personal information can be processed. In this context, the legitimate interest of Hair Skill Clinic as a result of the handling activity is determined primarily. If the possible impact on the rights and freedoms of the Relevant Person is evaluated and it is concluded that the balance is not disturbed, the processing can be carried out without seeking explicit consent.
C. Conditions Regarding the Processing of Special Categories of Personal Information
Special categories of personal records are specified in a limited number. These; information about race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, costume and clothing, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic records.
Hair Skill Clinic can handle sensitive personal details in the following cases by taking additional measures determined by the Commission:
Processing of special categories of personal records other than health and sexual life:
It can be processed without the Relevant Persons Explicit Consent, if the person concerned gives explicit consent or if it is expressly stipulated in the law.
Personal records on health and sexual life:
In case the Relevant Person gives Explicit Consent, or for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing, by persons or authorized institutions and organizations under the obligation of confidentiality. It can be handled without seeking his explicit consent.
Regardless of the reason for the handling, general information handling principles are always taken into account in the processing processes and compliance with these principles is ensured. Regarding the protection of sensitive records, Private Personal Information Protection Policy has been put into effect in our company, and our business units act in accordance with the provisions of this policy and necessary measures are taken.
However, the handling of special categories of personal records is only possible if at least one of the following conditions listed in Article 9 of the GDPR are present. In the presence of these situations, sensitive personal details may be handled by providing the appropriate level of security stipulated in accordance with the PDPB. These issues are also clearly stated in the Privacy Policy prepared by us:
- In case of explicit consent of the person concerned
- For the privacy controller to fulfill its obligations under the Labor Law and Social Security Law
- If the person concerned is physically or legally unable to give consent
- In case the information is disclosed to the public by the person concerned
- In case legal claims are made and record handling is required within the framework of the relevant jurisdiction
- Processing records for the public benefit, provided that necessary technical and administrative measures are provided.
- For the purposes of preventive medicine or occupational medicine,
- For the purposes of conducting archive, research activities in the public interest based on applicable Law.
III. HAIR SKILL CLINIC CATEGORIES OF PERSONAL RECORDS PROCESSED
Hair Skill Clinic in accordance with the PDPB and GDPR and other relevant legislation provisions, within the framework of the purposes and conditions specified in this Policy.
Credentials
Clearly belonging to an identified or identifiable natural person; Information contained in documents such as Drivers License, Identity Card, Residence, Passport, Marriage Certificate.
Communication Information
Clearly belonging to an identified or identifiable natural person; information such as phone number, address, e-mail.
Personal Information
All kinds of personal details handled for the purpose of obtaining the information that will form the basis of the personal rights of our employees or real persons who have a working relationship with Hair Skill Clinic.
Legal Transaction Information
Your personal records processed within the scope of determination, follow-up and performance of our legal receivables and rights, and compliance with our legal obligations.
Customer Transaction Information
Records for the use of our products and services, and the customers instructions and requests necessary for the use of products and services.
Physical Space Security Information
Personal details regarding the records and documents taken at the entrance to the physical space, during the stay in the physical space.
Transaction Security Information
Personal details handled to ensure technical, administrative, legal and commercial security while carrying out activities.
Finance
Personal records processed for information, documents and registry showing all kinds of financial results created according to the type of legal relationship.
Professional Experience
Personal information handled for measuring performance of employees, and planning career development within Hair Skill Clinics human resources policy.
Marketing Information
Personal records handled for customizing and marketing our products and services in line with usage habits, tastes and needs.
Audio and Audio Recordings
Records contained in photographs and camera recordings, audio recordings and documents that are copies of files containing personal details.
Special Qualified Personal Records
Details on health and sexual life, records on criminal convictions and security measures.
IV. TRANSFERRING PERSONAL RECORDS
To ensure the fulfillment of the objectives of Hair Skill Clinics activities and establishments; the services that are outsourced from the supplier and necessary to carry out commercial activities are provided to our Company. Transfer is carried out for the purposes of ensuring that the necessary information is provided to authorized public institutions.
By Hair Skill Clinic, without prejudice to the cases where it is necessary to transfer personal records to administrative and judicial institutions in accordance with PDPB, GDPR or relevant legislation, personal details of the persons concerned are not transferred to other persons without the express consent of the persons concerned. However in cases where there is a reason for compliance with the law, it can transfer records to real persons and private law legal entities, shareholders, suppliers, and public institutions by taking the necessary security measures, without seeking explicit consent. Accordingly, the regulations stipulated in the PDPB and GDPR are complied with.
A. Transfer of Personal Details
Within the scope of PDPB, even if the person does not have explicit consent, if one or more of the following conditions are present, Hair Skill Clinic personal records may be transferred to third parties, taking all necessary security measures:
- The relevant activities regarding the transfer of personal information are clearly stipulated in the laws.
- It is compulsory for the person or someone else, who is unable to express his consent due to actual impossibility, to protect his or her life or physical integrity.
- The transfer of personal records is directly related to and necessary for the establishment or performance of a contract.
- The transfer of personal details is mandatory in order to fulfill a legal obligation.
- Limited transfer of personal records for the purpose of making it public, provided that it has been made public by the Relevant Person.
- Transfer of personal details is mandatory for the establishment, use or protection of the rights of Hair Skill Clinic or the relevant person or third parties.
- It is mandatory to carry out personal records transfer activities for the legitimate interests of Hair Skill Clinic, provided that it does not harm the fundamental rights and freedoms of the Relevant Person.
In addition to the above, personal details may be transferred to foreign countries declared to have adequate protection by the Commission. In the absence of sufficient protection, it can be transferred to foreign countries where the privacy controllers in Pakistan and the relevant foreign country undertake an adequate protection in writing and where the permission of the Commission is available.
B. Transfer of Private Personal Information
Special categories of personal records Hair Skill Clinic by taking all necessary technical and administrative measures, including the methods to be determined by the Commission, in accordance with the principles set forth in this Policy. Special categories of personal details other than health and sexual life may be processed without the explicit consent of the Relevant Person, provided that it is expressly stipulated in the law. Otherwise, the Explicit Consent of the Related Person will be taken.
Special quality personal information regarding health and sexual life, for the purpose of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the express consent of persons under the obligation of keeping confidentiality or authorized institutions and organizations. Otherwise, the Explicit Consent of the Related Person will be taken.
V. MATTERS REGARDING THE PROTECTION OF PERSONAL RECORDS
Hair Skill Clinic takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of the personal information it handles, illegal access to the files, and to ensure the preservation of the records, in accordance with the relevant security provisions of the PDPB and the 32nd article of the GDPR.
Systems suitable for technological developments are used to protect personal records in secure environments. Technical security systems for hiding areas are established, the technical measures taken are periodically audited by the control mechanism determined by Hair Skill Clinic, the risky issues are re-evaluated and the necessary technological solution is produced.
Contracts concluded by Hair Skill Clinic with relevant companies on the storage of personal details; It is stated that the persons to whom personal records are transferred will take the necessary security measures for the protection of personal information and that these measures will be complied with in their own establishments.
Hair Skill Clinic includes:
- Providing individuals with clear information about who and how their personal records are used.
- For these purposes, to process personal details at the minimum level necessary and not to process more than necessary records.
- Respecting the rights of the Relevant Person regarding their personal information, including the right of access.
- Keeping an inventory of the handled personal records categories.
- Keeping personal details accurate and up-to-date when necessary.
- Handling personal records fairly and in accordance with the law.
- Processing personal information only if it is clearly necessary for legitimate corporate purposes.
- Personal details are only required by legal regulations, legal obligations or legitimate corporate interests of Hair Skill Clinic and to be stored within specified periods.
- Transfer of personal records abroad within the framework of the principles determined by PDPB and GDPR.
- Determining a Committee with special powers and responsibilities regarding the personal privacy system.
- Implementation of the exceptions allowed in accordance with the legislation.
- Preparation of this Policy.
- Taking the necessary technical and administrative measures determined by the PDPB, GDPR and secondary legislation, as well as the Commission.
- Handling only relevant and appropriate personal records.
A. Educational Activities
Hair Skill Clinic provides employees with necessary training on the protection of Personal Records within the scope of the Policies and PDPB & GDPR Regulations and Procedures. In the trainings, applications for the definition and protection of Sensitive Personal Details are especially included. Hair Skill Clinic provides its employees with training and making necessary notifications in order to increase awareness about the illegal handling of personal information.
B. Audit Activities
Hair Skill Clinic has the right to regular and ex officio inspection, without any prior notification, that all employees, departments and suppliers of the Company act in accordance with this Policy and PDPB & GDPR Regulations. The results of these audits are evaluated within the scope of the internal operation of the Company and necessary activities are carried out to improve the measures taken.
VI. STORAGE AND DISPOSAL OF PERSONAL RECORDS
Hair Skill Clinic preserves personal details for the period required for the purpose for which they are handled and in accordance with the minimum periods stipulated in the legislation to which the relevant activity is subject. If a period of time is not available in the legislation, personal information is stored for the period necessary for the purpose for which they are processed. At the end of the personal records storage periods, Hair Skill Clinic destroys it in accordance with the periodic destruction periods specified in the Personal Storage and Disposal Policy.
VII. INFORMING THE RELATED PERSON
Hair Skill Clinic enlightens the Relevant Person in accordance with PDPB, GDPR and secondary regulations. In this context, if the personal information is obtained from the Relevant Person himself, during the acquisition; If it is not obtained from the Relevant Person, within a reasonable time from the acquisition of the personal details. The disclosure includes:
- Identity of Hair Skill Clinic.
- For what purpose personal records will be handled.
- To whom and for what purposes it can be transferred.
- The method of personal details collection.
- The legal reason for collecting personal information.
- Other rights of the Related Person listed in the PDPB or GDPR.
VIII. THE RIGHTS OF THE RELATED PERSON
The legal rights that the Relevant Person can use regarding personal records are listed below:
- Learning whether personal details are processed or not.
- If personal information has been handled, requesting details about it.
- Learning the purpose of processing personal records and whether they are used in accordance with the purpose.
- Learning the third parties whose personal information is transferred in the country or abroad.
- Requesting correction of your personal details if it is incomplete or incorrectly processed.
- Requesting the deletion, destruction or anonymization of personal records.
- Objecting to the emergence of a negative result by analyzing the handled records exclusively through automated systems.
- To request the compensation of the damage in case of loss due to unlawful handling of personal details.
- Transfer of personal information to a different privacy controller requested by the person concerned (right to portability).
If the Relevant Person is a resident of Pakistan, on the condition that they make their requests regarding their rights in accordance with the relevant procedures under the PDPB, if they are a European resident, on the condition that they make their requests in English, it can be submitted to Hair Skill Clinic by filling out the Application Form in written form or by using the Registered Electronic Mail address or the e-mail address that it has previously notified and registered in our system.
IX. HAIR SKILL CLINICS ANSWER TO APPLICATIONS
Hair Skill Clinic takes all kinds of technical and administrative measures to conclude the applications to be made by the Relevant Person effectively, in accordance with the law and honesty. Applications of the Relevant Person may be accepted or rejected by explaining the reason. Response may be notified in writing or electronically. The relevant request will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest.
X. EFFECTIVENESS OF THE POLICY AND UPDATE PERIOD
The Committee carries out the implementation, updating and announcement of this Policy. This Policy is published by Hair Skill Clinic on the website.