Turkish Anti-Doping Commission (“TADC”) as the data controller, presents herein the clarification text (“Clarification Text”), which is prepared in accordance with Article 10 of the Law on Protection of Personal Data (“Law”) numbered 6698 and Communique on Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform. As a signatory of the World Anti-Doping Code, TADC is responsible for carrying out anti-doping activities in Turkey as the National Anti-Doping Organization. Clarification Text has been prepared to inform personal data owners (“Data Owner”) regarding the ways TADC processes personal information while ensuring fulfilment of its responsibilities.
What information does TADC collect and process?
TADC, collects and processes personal data related to Athletes or Athlete Support Personnel (as defined in the World Anti-Doping Code). For example, you will need to provide the information on the form that must be filled out in case of a doping control sample, or if you need a therapeutic use exemption, you will need to provide information about your medical history to TADC. In case you are alleged to have committed an anti-doping rule violation, you may be required to provide evidence in your defense to TADC. Even if you are not an athlete, it may still be necessary to collect training data and other personal information about you. The data collected by TADC, stored and/or processed for certain periods and/or shared with relevant institutions and organizations include but is not limited to the following:
- Identity information such as but not limited to name-surname, identification number, date of birth, gender, nationality and sport branch,
- Contact information such as but not limited to address, telephone number, e-mail address, fax number,
- Information regarding the anti-doping trainings attended, including but not limited to the courses you have completed, participation dates and the score you have achieved,
- Whereabouts information collected, processed and/or shared with relevant institutions and organizations, in order to locate you for doping control purposes, such as location and address information regarding other activities you regularly do such as overnight accommodation and/or training,
- In the event of a sample collection, all data related to doping control, including sensitive personal data, including but not limited to the sample type, sample kit number and all the information you have provided in the doping control form,
- Other information regarding the use of drugs, medicine and/or similar, nutritional support, dietary supplements, cases of blood transfusion or similar medical intervention, and/or any other personal comments declared by the athlete on the doping control form,
- Athlete’s biological passport data, such as blood and steroid biomarker values and ratios, and expert assessments on them,
- Medical data collected through the Therapeutic Use Exemption application, such as medical history, treatments received and test results,
- Information obtained from open sources, witnesses or confidential sources within the scope of intelligence and investigations activities,
- Information regarding the results management process, such as the allegation of anti-doping rule violation, the evidence presented for the allegation, and the sanction decisions.
Purposes of Processing Personal Data
The mission of TADC as the national anti-doping organization; is to prevent the use of prohibited substances in sports, raise awareness for the concerned individuals, protect the health of the athletes and the principles of clean sports in accordance with the World Anti-Doping Code, International Standards and the Turkish Anti-Doping Regulation. Personal data provided to TADC will be recorded, stored, preserved, rearranged, classified, shared with relevant people and institutions, transferred abroad when deemed necessary and processed verbally, in writing or digitally in accordance with the relevant laws and regulations, within the framework of and/or in connection with the purposes listed below:
- Planning, conducting and coordinating doping controls
- Taking samples, having samples analyzed, reviewing laboratory analysis results
- Creating biological passport (ABP) for athletes and managing passport data
- Examining and evaluating the information and evidence submitted for the grant of a Therapeutic Use Exemption
- Identifying anti-doping rule violations, conducting results management process and determining legal consequences if necessary, in order to implement Turkish Anti-Doping Regulation
- Collecting information and conducting investigations in order to organize target testing, uncover anti-doping rule violations and cooperate with law enforcement agencies
- Keeping the records of doping control activities in order to follow up and develop new ones
- Sharing information with other anti-doping organizations to ensure harmonization
- Disclosing finalized sanctions to the public in accordance with the Turkish Anti-Doping Regulation
- Organizing anti-doping education activities
- Contacting you when necessary for the implementation of the Turkish Anti-Doping Regulation
- Reporting TADC’s anti-doping activities to the World Anti-Doping Agency (WADA) in order to demonstrate compliance with the World Anti-Doping Code
Personal data can only be processed for the purposes of conducting anti-doping activities, in a limited and proportionate manner, by keeping the information accurate and up-to-date and if necessary, by obtaining data owner’s explicit consent in accordance with Law, World Anti-Doping Code and International Standard for the Protection of Privacy and Personal Information.
Transfer of Personal Data
If deemed necessary, some personal data may be shared with following individuals and organizations and transferred abroad within the scope of the anti-doping activities:
- People you have consented to receive or share your personal data with, such as representatives, coaches, physicians or parents
- Signatories of the World Anti-Doping Code, such as the National Anti-Doping Organizations, International Federations or Major Event Organizers, who have authority for conducting doping controls, sample collection or results management
- The World Anti-Doping Agency (WADA), which ensures that all signatories comply with the World Anti-Doping Code and manages the ADAMS system where your personal data is stored
- Laboratories and Athlete Biological Passport Management Units that analyze doping control samples which has limited access to personal data that only consists of codes such as the sample kit number
- Service providers or authorized third parties designated to carry out part of TADC’s anti-doping activities, which are subject to strict contractual clauses on protection of personal data
- Public institutions and organizations responsible and authorized for the enforcement of sport and anti-doping laws and the investigation of doping-related crimes in sport
In addition, information related to Athletes and Athlete Support Personnel who are found to have violated an anti-doping rule and sanctioned as a result, such as; name and surname, sport branch, violated anti-doping rule, the name and class of the substance in case the violation is based on a prohibited substance, duration of the period of ineligibility and all other legal consequences are publicly disclosed.
Technical and Organizational Measures for Data Security
Necessary organizational, technical and physical measures are taken to protect personal data from risks such as theft, loss, tampering or unauthorized access. In addition, TADC makes agreements regarding data security with the service providers it works with. Access to personal data is restricted only to employees, authorized third parties and service providers who need the data to perform their duties. Retention periods for different types of personal data are determined in accordance with the specifications in International Standard for the Protection of Privacy and Personal Data. When the obtained data no longer serves the above-mentioned purposes, they are erased, destructed or permanently anonymized.
Rights of a Personal Data Owner
Each personal data owner has the following rights under Law:
- To learn whether their personal data is processed or not
- To request information if their personal data is processed
- To find out the purpose of personal data processing, and whether such data are used for the intended purpose
- To find out the third parties in and out of the country to whom the personal data is transferred
- To request correction of any missing or inaccurate personal data, and request that such processing be notified to the third parties to whom the personal data is transferred
- To request deletion or destruction of personal data if grounds for data processing do not exist anymore even though such data was processed in compliance with the provisions of Law and other relevant laws, and request that such transaction be notified to the third parties, to whom the personal data is transferred
- To object to any negative consequence arising against himself/herself due to analysis of the processed personal data exclusively via automatic systems
- To seek restitution of any incurred damages due to illegal processing of personal data
Anti-doping activities are mandatory for sports. Therefore, despite your objection, TADC may need to continue to process your personal information in order to fulfill its obligations. Pursuant to the World Anti-Doping Code and Turkish Anti-Doping Regulation, failure to provide information that you are required to may constitute an Anti-Doping Rule Violation. Not providing the necessary information during doping control and/or withdrawal of consent to the processing of Doping Control related data will be construed as a refusal to participate in anti-doping procedures mandated by the World Anti-Doping Code and could cause exclusion from further participation in organized sporting events and may result in disciplinary or other sanctions being imposed, such as disqualification from competitions that are scheduled or the disqualification of results arising from prior competitions.
Contacting the Data Controller
You can send your requests regarding the exercise of the aforementioned rights to email@example.com via e-mail. All applications must include; applicant’s name-surname, identity number for Turkish citizens, nationality and passport or identity number for others, residence or workplace address, telephone number and the subject of the request. Any related information or documents should also be attached to the application. It is not possible for third parties to make requests on behalf of a personal data owner. Applications will be responded to within 30 (thirty) days. All applications are free of charge. However, in case the demanded process requires additional cost, a fee may be applied according to the rates determined by Turkish Personal Data Protection Authority. In order to ensure the security of your personal data and confirm that you are the data owner, TADC may contact you after your application is received and request additional information and documents that are not included in the application. For your application to be evaluated properly, you are expected to fulfill these requests of TADC fully.
(Last Update: November 9th, 2022)