QBA Medi Tours
General Privacy Policy

Pursuant to Article 13 of the General Data Protection Regulation (GDPR) of the European Union and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK), we would like to inform data subjects about our personal data processing activities.

Under GDPR and KVKK, your personal data may be processed, recorded, stored, categorized, updated, and—where allowed by law or limited to the purpose of processing—disclosed or transferred to third parties by QBA Medi Turizm Sağlık ve Dış Ticaret Anonim Şirketi (“QBA Medi Tours”) as the data controller, for the purposes described below, in accordance with legal principles and good faith.

1. Purpose of Personal Data Processing

QBA Medi Tours processes personal data of employees, customers, potential customers, customer relatives, companions, and suppliers.

The categories of data processed are as follows:

• Employees: Identity, contact, criminal record, salary and IBAN, photograph, personnel, health, and professional information

• Customers: Identity, contact, credit card, invoice, health, request/complaint, flight and accommodation information

• Customer relatives: Identity, contact, request/complaint, and contract amount information

• Potential customers: Identity, contact, personnel, health, credit card, and cookie data

• Companions: Identity, contact, invoice, request/complaint, flight, and accommodation information

• Suppliers: Identity, contact, IBAN, and invoice details

QBA Medi Tours processes this data for purposes such as:

• Evaluating requests and complaints regarding the services we provide

• Assessing the suitability of the healthcare services requested by customers and potential customers

• Translating necessary information to be submitted to the Cuban Ministry of Health for treatment eligibility

• Handling payments through credit card via secure systems

• Analyzing visitor behavior on our website through cookies

• Preparing and maintaining patient files for monitoring and audit purposes by Cuban and Turkish public health authorities

• Handling visa processes, flights, accommodation, translation, and transfer logistics for patients and companions

• Fulfilling taxation and billing obligations per Turkish law

• Concluding contracts with customers or their relatives and suppliers

• Managing HR operations including payroll, insurance, and legal employment processes

• Ensuring institutional security by obtaining background checks from employees

• Responding to legal inquiries from authorities and managing legal processes

2. Deletion of Personal Data

Requests for the deletion of personal data can be submitted by using the Personal Data Application Form provided by QBA Medi Tours. In the absence of a request, data will be deleted or anonymized after the following retention periods:

• Employee data: Stored for 10 years following termination of employment

• Customer, potential customer, and companion data: Stored for 10 years after the service ends

• Supplier data: Stored for 10 years after contract termination

3. Data Sharing

Within Turkey:

• Legal or contractual disputes may result in sharing data with legal advisors or government agencies

• Data required for visa processes is shared with consulates via authorized agencies

• Credit card data is shared with banks via secure virtual POS systems

• Invoices containing personal data are shared with contracted financial consultants

• Data is shared with airlines via travel agencies for ticketing

• Translators receive identity and health data during pre-application to the Cuban Ministry of Health

• Employee salary data is shared with banks

• Employment-related data is shared with financial advisors for tax and insurance processes

• Data is shared with the Turkish Ministry of Health for supervision and legal compliance

Outside Turkey:

• Data is shared with the Cuban Ministry of Health to assess eligibility for treatment

• Accommodation details are shared post-approval

• Contact, flight, and hotel details are shared with Cuban service providers for guidance and coordination

Data is processed based on:

• Your explicit consent

• Legal obligations of QBA Medi Tours

• The necessity for the establishment, exercise, or defense of a legal right

• The legitimate interest of the data controller provided it does not harm your fundamental rights and freedoms

If the legal conditions outlined in Articles 5, 6, and 9 of the KVKK are not met, your explicit consent will be required for data processing and sharing.

4. Methods and Legal Basis for Collecting Personal Data

Your data is collected via:

• In-person submission

• Email

• Pre-application forms

• Virtual POS systems

• Written and verbal declarations

And processed securely based on the following legal grounds:

• Your explicit consent

• Necessity for the performance of a contract

• Legal obligation of the data controller

• Legitimate interest of the data controller

5. Ensuring Data Security

Your data is stored securely and can only be accessed by authorized individuals or service providers bound by confidentiality agreements. QBA Medi Tours has implemented administrative and technical measures, such as:

• Antivirus software and hardware protection

• Role-based access control (RBAC)

• Secure physical storage areas

• Encrypted backups accessible only by authorized personnel

• SSL certificate on the website for secure data transmission

• Strong password policies

• Regular maintenance of security systems and data protection tools

• Internal policies and procedures on data management and security

• Designation of a Data Controller Representative to oversee data security

• Staff confidentiality training and disciplinary procedures

• Confidentiality clauses in third-party contracts regarding data protection

6. Data Subject Rights

You may exercise your rights by submitting a request to QBA Medi Tours, including:

• Learning whether your data is being processed

• Requesting information if data has been processed

• Understanding the purpose and compliance of processing

• Learning third-party recipients of your data

• Requesting correction of incomplete or inaccurate data

• Requesting deletion or anonymization when data is no longer needed

• Requesting notification of updates or deletions to third parties

• Objecting to outcomes based solely on automated processing

• Requesting compensation for damages due to unlawful processing

Requests will be processed within 30 (thirty) days. A fee may be charged if deemed necessary by the Turkish Personal Data Protection Authority.

7. Contact Methods

You may submit your applications regarding your personal data using the methods below:

Data Controller:
QBA Medi Turizm Sağlık ve Dış Ticaret Anonim Şirketi

For legal compliance, applications submitted by postal mail must be notarized and sent via registered mail with return receipt. Your request will be processed after identity verification, and a written or electronic response will be provided within the legal timeframe.