Homepage/About/Data Protection Policy

Personal Data Protection Policy

I. INTRODUCTION

A. Purpose and Scope

The principles of Hair Skill Clinic for the protection and processing of personal data are defined in this policy.

Within the scope of this Policy, making explanations about the personal data processing activity and the systems adopted by Hair Skill Clinic for the protection of personal data, in this context, the persons who buy products or services, our employee and employee candidates, potential customers, shareholders, visitors, participants, suppliers and third parties ensuring transparency by informing the Relevant Person, establishing and realizing standards in the management of personal data; setting and supporting organizational goals and obligations; it is aimed to establish control mechanisms in line with the acceptable risk level, to comply with the principles and rules introduced by international agreements on the protection of personal data, the constitution, laws, regulations, contracts and other legislation, and to protect the fundamental rights and freedoms of the Relevant Person in the best way. In addition, this Policy covers all physical and electronic data recording systems and media used for automatic or non-automatic processing of personal and private data, provided that they are part of any data recording system.

B. Definitions

Definition	Description
Open Consent	Consent on a particular subject, based on information and expressed with free will.
Constitution	Constitution of the Islamic Republic of Pakistan.
Worker	Employees and managers at Hair Skill Clinic.
Employee Candidate	Individuals who have applied to Hair Skill Clinic by any means or have opened their CV and related information to Hair Skill Clinic for review.
Shareholder/Partner	The shareholders and partners of Hair Skill Clinic are real persons.
Related person	Natural person whose personal data is processed.
Destruction	Deletion or destruction of personal data.
Personal Data	Any information relating to an identified or identifiable natural person.
Personal Data Processing Inventory	Personal data processing activities carried out by data controllers depending on their business processes; Personal data processing inventory, which is created by associating personal data with the purposes of processing, data category, transferred recipient group and data subject group, by explaining the maximum time required for the purposes for which personal data is processed, the personal data planned to be transferred to foreign countries and the measures taken regarding data security.
Anonymization of Personal Data	Anonymizing personal data, making it impossible to associate personal data with an identified or identifiable natural person in any way, even if it is matched with other data.
Disposal of Personal Data	The process of deletion, anonymization or destruction of personal data.
Deletion of Personal Data	The process of making personal data inaccessible and non-reusable for Relevant Users in any way.
Destruction of Personal Data	The process of destroying personal data, making personal data inaccessible, unrecoverable and unusable by anyone in any way.
Committee	Hair Skill Clinic Personal Data Protection Committee.
Commission / Board	National Commission for Personal Data Protection and data protection authority of the relevant member country.
PDPB	Personal Data Protection Bill / Law of Pakistan.
GDPR	European General Data Protection Regulation.
Special Qualified Personal Data	Data as well as data on peoples race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures.
Periodic Destruction	In the event that all of the personal data processing conditions in the PDPB and GDPR are eliminated, the deletion, destruction or anonymization of personal data, which will be carried out ex officio at repetitive intervals and specified in the storage and destruction policy.
Policy	Hair Skill Clinic Personal Data Processing and Protection Policy.
Hair Skill Clinic	Hair Skill Clinic (Pvt) Ltd.
Supplier Employee	Real persons working in institutions (such as but not limited to business partners, suppliers) with which Hair Skill Clinic has any business relationship.
Supplier Representative	Real persons with whom Hair Skill Clinic has business relations.
Product or Service User / Authority	Regardless of whether they have any contractual relationship with Hair Skill Clinic, natural persons (who receive products or services), or Legal Entity Authorities who use or have used them, using or using the products and services offered by Hair Skill Clinic.
Data Processor	The natural or legal person who processes personal data on behalf of the data controller based on the authority given by him.
Data Recording System	The registry system where personal data is processed and structured according to certain criteria.
Data Controller	The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Visitor	Real persons who have entered the physical facilities owned by Hair Skill Clinic for various purposes or visited our websites.

II. GENERAL PRINCIPLES AND CONDITIONS REGARDING THE PROCESSING OF PERSONAL DATA

Hair Skill Clinic, in accordance with the Constitution of Pakistan, the PDPB, and Article 5 of the GDPR, regarding the processing of personal data; in accordance with the law and the rules of honesty, accurate and up-to-date when necessary; for specific, clear and legitimate purposes; engages in personal data processing activities in a connected, limited and measured manner for this purpose. In this context, in accordance with the PDPB for the residents of Pakistan, personal data is processed based on one or more of the conditions regarding the processing of personal data, and the personal data is retained for as long as required by the laws and/or the personal data processing purpose is doing. In addition, it also acts in accordance with the regulations envisaged in terms of the processing of sensitive personal data in accordance with the PDPB, and in accordance with the regulations stipulated in the law and set forth by the Commission on the transfer of personal data. It informs the Relevant Person and provides the necessary information in case the Relevant Person requests information. In addition, all the above-mentioned activities are carried out for European residents in accordance with the relevant provisions of the GDPR.

A. Principles Regarding the Processing of Personal Data

Hair Skill Clinic processes your personal data in accordance with the personal data processing principles in the PDPB and Article 5 of the GDPR. It is mandatory to comply with these principles for each personal data processing activity:

Processing personal data in accordance with the law and honesty rules:

In the processing of your personal data, we act in accordance with the laws, secondary regulations and general principles of law; It is important to process personal data limited to the purpose of processing and to take into account the reasonable expectations of the Relevant Person.

Accurate and up-to-date personal data:

Care is taken to ensure that your processed personal data is up-to-date and to check it. In this context, the Relevant Person is entitled to request the correction or deletion of their correct and outdated data.

Processing of personal data for specific, explicit and legitimate purposes:

Before each personal data processing activity, the purposes of data processing are determined and compliance with the law is complied with.

Being connected, limited and proportional to the purpose for which personal data is processed:

The personal data required to fulfill the purpose of collecting data processing activities are limited and necessary technical and administrative measures are taken to prevent the processing of personal data not related to this purpose.

Retention of personal data for as long as required by the legislation or processing purposes:

Personal data is deleted, destroyed or anonymized after the purpose of processing personal data disappears or when the period stipulated in the legislation expires.

B. Conditions Regarding the Processing of Personal Data

Your personal data is processed by at least one of the personal data processing conditions in the PDPB and Article 6 of the GDPR and its continuation. Explanations on these conditions are given below:

Having the Explicit Consent of the Relevant Person:

The personal data of the Relevant Person can be processed with his/her free will, provided that he/she has sufficient information about the personal data processing activity, and gives his/her consent limited to that transaction, leaving no room for hesitation.

Explicitly stipulated in laws:

Personal data can be processed within the framework of the relevant legal regulation without the Explicit Consent of the Related Person, if it is expressly stipulated in the laws.

If the Explicit Consent of the Related Person cannot be obtained due to the actual impossibility and personal data processing is mandatory:

Personal data belonging to the Relevant Person, who is unable to express his consent or whose consent cannot be validated, may be processed without seeking explicit consent, if personal data processing is necessary in order to protect the life or physical integrity of the Relevant Person or a third party.

If the personal data processing activity is directly related to the establishment or performance of a contract:

If it is necessary to process the personal data of the parties to the contract established or already signed between the Company, personal data processing can be carried out without seeking explicit consent.

In order for the Data Controller to fulfill his legal obligation:

In order to fulfill the legal obligations stipulated in the current legislation, personal data can be processed without seeking explicit consent.

Relevant Person has made his personal data public:

Personal data, which has been disclosed to the public in any way by the Relevant Person and has become accessible to everyone as a result of this publicization, may be processed without the Relevant Persons Express Consent, limited to the purpose of making it public.

Personal data processing is mandatory for the establishment, exercise or protection of a right:

If data processing is necessary for the establishment, exercise or protection of a right, the personal data of the Relevant Person may be processed.

Data processing is mandatory for the legitimate interests of the data controller:

Provided that the balance of interests of the Relevant Person is observed, personal data can be processed. In this context, the legitimate interest of Hair Skill Clinic as a result of the processing activity is determined primarily. If the possible impact on the rights and freedoms of the Relevant Person is evaluated and it is concluded that the balance is not disturbed, the processing can be carried out without seeking explicit consent.

C. Conditions Regarding the Processing of Special Categories of Personal Data

Special categories of personal data are specified in a limited number. These; data about race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, costume and clothing, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Hair Skill Clinic can process sensitive personal data in the following cases by taking additional measures determined by the Commission:

Processing of special categories of personal data other than health and sexual life:

It can be processed without the Relevant Persons Explicit Consent, if the person concerned gives explicit consent or if it is expressly stipulated in the law.

Personal data on health and sexual life:

In case the Relevant Person gives Explicit Consent, or for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing, by persons or authorized institutions and organizations under the obligation of confidentiality. It can be processed without seeking his explicit consent.

Regardless of the reason for the processing, general data processing principles are always taken into account in the processing processes and compliance with these principles is ensured. Regarding the protection of sensitive data, Private Personal Data Protection Policy has been put into effect in our company, and our business units act in accordance with the provisions of this policy and necessary measures are taken.

However, the processing of special categories of personal data is only possible if at least one of the following conditions listed in Article 9 of the GDPR are present. In the presence of these situations, sensitive personal data may be processed by providing the appropriate level of security stipulated in accordance with the PDPB. These issues are also clearly stated in the Privacy Policy prepared by us:

In case of explicit consent of the person concerned
For the data controller to fulfill its obligations under the Labor Law and Social Security Law
If the person concerned is physically or legally unable to give consent
In case the data is disclosed to the public by the person concerned
In case legal claims are made and data processing is required within the framework of the relevant jurisdiction
Processing data for the public benefit, provided that necessary technical and administrative measures are provided.
For the purposes of preventive medicine or occupational medicine,
For the purposes of conducting archive, research activities in the public interest based on applicable Law.

III. HAIR SKILL CLINIC CATEGORIES OF PERSONAL DATA PROCESSED

Hair Skill Clinic in accordance with the PDPB and GDPR and other relevant legislation provisions, within the framework of the purposes and conditions specified in this Policy.

Credentials

Clearly belonging to an identified or identifiable natural person; Information contained in documents such as Drivers License, Identity Card, Residence, Passport, Marriage Certificate.

Communication Information

Clearly belonging to an identified or identifiable natural person; information such as phone number, address, e-mail.

Personal Information

All kinds of personal data processed for the purpose of obtaining the information that will form the basis of the personal rights of our employees or real persons who have a working relationship with Hair Skill Clinic.

Legal Transaction Information

Your personal data processed within the scope of determination, follow-up and performance of our legal receivables and rights, and compliance with our legal obligations.

Customer Transaction Information

Records for the use of our products and services, and the customers instructions and requests necessary for the use of products and services.

Physical Space Security Information

Personal data regarding the records and documents taken at the entrance to the physical space, during the stay in the physical space.

Transaction Security Information

Personal data processed to ensure technical, administrative, legal and commercial security while carrying out activities.

Finance

Personal data processed for information, documents and records showing all kinds of financial results created according to the type of legal relationship.

Professional Experience

Personal data processed for measuring performance of employees, and planning career development within Hair Skill Clinics human resources policy.

Marketing Information

Personal data processed for customizing and marketing our products and services in line with usage habits, tastes and needs.

Audio and Audio Recordings

Data contained in photographs and camera recordings, audio recordings and documents that are copies of documents containing personal data.

Special Qualified Personal Data

Data on health and sexual life, data on criminal convictions and security measures.

IV. TRANSFERRING PERSONAL DATA

To ensure the fulfillment of the objectives of Hair Skill Clinics activities and establishments; the services that are outsourced from the supplier and necessary to carry out commercial activities are provided to our Company. Data transfer is carried out for the purposes of ensuring that the necessary information is provided to authorized public institutions.

By Hair Skill Clinic, without prejudice to the cases where it is necessary to transfer personal data to administrative and judicial institutions in accordance with PDPB, GDPR or relevant legislation, personal data of the persons concerned are not transferred to other persons without the express consent of the persons concerned. However in cases where there is a reason for compliance with the law, it can transfer data to real persons and private law legal entities, shareholders, suppliers, and public institutions by taking the necessary security measures, without seeking explicit consent. Accordingly, the regulations stipulated in the PDPB and GDPR are complied with.

A. Transfer of Personal Data

Within the scope of PDPB, even if the person does not have explicit consent, if one or more of the following conditions are present, Hair Skill Clinic personal data may be transferred to third parties, taking all necessary security measures:

The relevant activities regarding the transfer of personal data are clearly stipulated in the laws.
It is compulsory for the person or someone else, who is unable to express his consent due to actual impossibility, to protect his or her life or physical integrity.
The transfer of personal data is directly related to and necessary for the establishment or performance of a contract.
The transfer of personal data is mandatory in order to fulfill a legal obligation.
Limited transfer of personal data for the purpose of making it public, provided that it has been made public by the Relevant Person.
Transfer of personal data is mandatory for the establishment, use or protection of the rights of Hair Skill Clinic or the relevant person or third parties.
It is mandatory to carry out personal data transfer activities for the legitimate interests of Hair Skill Clinic, provided that it does not harm the fundamental rights and freedoms of the Relevant Person.

In addition to the above, personal data may be transferred to foreign countries declared to have adequate protection by the Commission. In the absence of sufficient protection, it can be transferred to foreign countries where the data controllers in Pakistan and the relevant foreign country undertake an adequate protection in writing and where the permission of the Commission is available.

B. Transfer of Private Personal Data

Special categories of personal data Hair Skill Clinic by taking all necessary technical and administrative measures, including the methods to be determined by the Commission, in accordance with the principles set forth in this Policy. Special categories of personal data other than health and sexual life may be processed without the explicit consent of the Relevant Person, provided that it is expressly stipulated in the law. Otherwise, the Explicit Consent of the Related Person will be taken.

Special quality personal data regarding health and sexual life, for the purpose of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the express consent of persons under the obligation of keeping confidentiality or authorized institutions and organizations. Otherwise, the Explicit Consent of the Related Person will be taken.

V. MATTERS REGARDING THE PROTECTION OF PERSONAL DATA

Hair Skill Clinic takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of the personal data it processes, illegal access to the data, and to ensure the preservation of the data, in accordance with the relevant security provisions of the PDPB and the 32nd article of the GDPR.

Systems suitable for technological developments are used to protect personal data in secure environments. Technical security systems for hiding areas are established, the technical measures taken are periodically audited by the control mechanism determined by Hair Skill Clinic, the risky issues are re-evaluated and the necessary technological solution is produced.

Contracts concluded by Hair Skill Clinic with relevant companies on the storage of personal data; It is stated that the persons to whom personal data are transferred will take the necessary security measures for the protection of personal data and that these measures will be complied with in their own establishments.

Hair Skill Clinic includes:

Providing individuals with clear information about who and how their personal data is used.
For these purposes, to process personal data at the minimum level necessary and not to process more than necessary data.
Respecting the rights of the Relevant Person regarding their personal data, including the right of access.
Keeping an inventory of the processed personal data categories.
Keeping personal data accurate and up-to-date when necessary.
Processing personal data fairly and in accordance with the law.
Processing personal data only if it is clearly necessary for legitimate corporate purposes.
Personal data is only required by legal regulations, legal obligations or legitimate corporate interests of Hair Skill Clinic and to be stored within specified periods.
Transfer of personal data abroad within the framework of the principles determined by PDPB and GDPR.
Determining a Committee with special powers and responsibilities regarding the personal data protection system.
Implementation of the exceptions allowed in accordance with the legislation.
Preparation of this Policy.
Taking the necessary technical and administrative measures determined by the PDPB, GDPR and secondary legislation, as well as the Commission.
Processing only relevant and appropriate personal data.

A. Educational Activities

Hair Skill Clinic provides employees with necessary training on the protection of Personal Data within the scope of the Policies and PDPB & GDPR Regulations and Procedures. In the trainings, applications for the definition and protection of Sensitive Personal Data are especially included. Hair Skill Clinic provides its employees with training and making necessary notifications in order to increase awareness about the illegal processing of personal data.

B. Audit Activities

Hair Skill Clinic has the right to regular and ex officio inspection, without any prior notification, that all employees, departments and suppliers of the Company act in accordance with this Policy and PDPB & GDPR Regulations. The results of these audits are evaluated within the scope of the internal operation of the Company and necessary activities are carried out to improve the measures taken.

VI. STORAGE AND DISPOSAL OF PERSONAL DATA

Hair Skill Clinic preserves personal data for the period required for the purpose for which they are processed and in accordance with the minimum periods stipulated in the legislation to which the relevant activity is subject. If a period of time is not available in the legislation, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the personal data storage periods, Hair Skill Clinic destroys it in accordance with the periodic destruction periods specified in the Personal Data Storage and Disposal Policy.

VII. INFORMING THE RELATED PERSON

Hair Skill Clinic enlightens the Relevant Person in accordance with PDPB, GDPR and secondary regulations. In this context, if the personal data is obtained from the Relevant Person himself, during the acquisition; If it is not obtained from the Relevant Person, within a reasonable time from the acquisition of the personal data. The disclosure includes:

Identity of Hair Skill Clinic.
For what purpose personal data will be processed.
To whom and for what purposes it can be transferred.
The method of personal data collection.
The legal reason for collecting personal data.
Other rights of the Related Person listed in the PDPB or GDPR.

VIII. THE RIGHTS OF THE RELATED PERSON

The legal rights that the Relevant Person can use regarding personal data are listed below:

Learning whether personal data is processed or not.
If personal data has been processed, requesting information about it.
Learning the purpose of processing personal data and whether they are used in accordance with the purpose.
Learning the third parties whose personal data is transferred in the country or abroad.
Requesting correction of your personal data if it is incomplete or incorrectly processed.
Requesting the deletion, destruction or anonymization of personal data.
Objecting to the emergence of a negative result by analyzing the processed data exclusively through automated systems.
To request the compensation of the damage in case of loss due to unlawful processing of personal data.
Transfer of personal data to a different data controller requested by the person concerned (right to data portability).

If the Relevant Person is a resident of Pakistan, on the condition that they make their requests regarding their rights in accordance with the relevant procedures under the PDPB, if they are a European resident, on the condition that they make their requests in English, it can be submitted to Hair Skill Clinic by filling out the Application Form in written form or by using the Registered Electronic Mail address or the e-mail address that it has previously notified and registered in our system.

IX. HAIR SKILL CLINICS ANSWER TO APPLICATIONS

Hair Skill Clinic takes all kinds of technical and administrative measures to conclude the applications to be made by the Relevant Person effectively, in accordance with the law and honesty. Applications of the Relevant Person may be accepted or rejected by explaining the reason. Response may be notified in writing or electronically. The relevant request will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest.

X. EFFECTIVENESS OF THE POLICY AND UPDATE PERIOD

The Committee carries out the implementation, updating and announcement of this Policy. This Policy is published by Hair Skill Clinic on the website.