As MY Ticaret ve Medikal A.Ş. (“MY Medikal”), we show utmost sensitivity to the security of your personal data. With this awareness, we attach great importance to the processing and preservation of all kinds of personal data belonging to all real persons associated with the Company, including those who benefit from our products and services, in accordance with the Personal Data Protection Law No. 6698 (“KVK Law”) and related legislation. With full awareness of this responsibility, we process personal data within the scope and limits prescribed by the legislation, as explained below, in our capacity as the “data controller” defined in the KVK Law.

a) Data Controller and Representative

In accordance with the KVK Law, your personal data may be processed by MY Medikal as the data controller within the scope explained below.

b) Purposes of Processing Personal Data, To Whom and For What Purposes Personal Data Can Be Transferred

Your collected personal data may be processed in accordance with the law and the purposes of the KVK Law, for the correct planning, execution, and management of our Company's commercial collaborations, management and communication activities, and strategies, for the necessary work to be carried out by our business units to make the best use of the products and services by personal data owners, for customizing them according to their demands, needs, and requests, for ensuring the highest level of data security, for improving the services offered on our website and fixing errors on the site, for communicating with personal data owners who convey their requests and complaints and managing request and complaint processes, for event management, for providing information to authorized institutions as required by legislation, for creating and tracking visitor records, for ensuring the legal and commercial security of our Company, our group companies, and individuals who have a business relationship with our Company (administrative operations for communication carried out by our Company, ensuring and auditing the physical security of locations belonging to the Company, business partner/customer/supplier/authorized/employee evaluation processes, reputation research processes, legal compliance process, audit, financial affairs, etc.), for determining and implementing our Company's commercial and business strategies, and for ensuring the execution of our Company's human resources policies, within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVK Law, and may be transferred to our business partners, suppliers, group companies, Company officials, shareholders, legally authorized public institutions, and private individuals within the framework of the personal data transfer conditions specified in Articles 8 and 9 of the KVK Law. If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated in the Law, your explicit consent is obtained by the Company regarding the relevant processing activity.

c) Method and Legal Reason for Collecting Personal Data

Your personal data is collected by our Company through different channels such as the website, mobile applications, call center, and physical channels, based on legal reasons arising from and executed in accordance with the relevant legislation, contract, request, commercial custom, and honesty rules, for the purpose of providing our commercial services to you and conducting our commercial activities within this framework, for fulfilling our Company's legal obligations, for fulfilling the requirements of the business relationship we have established with you, and for establishing, using, and protecting the mutual rights we have in this direction, and for protecting our Company's legitimate interests by observing the fundamental rights and freedoms of the personal data owners we are in contact with.

d) Rights of the Personal Data Owner

As personal data owners, if you submit your requests regarding your rights to us, our Company will conclude the request as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee determined in the tariff set by the Personal Data Protection Board will be charged by our Company. In this context, personal data owners have the right to;

• Learn whether personal data is processed or not,

• Request information if personal data has been processed,

• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

• Know the third parties to whom personal data is transferred domestically or abroad,

• Request the correction of personal data if it is incomplete or incorrectly processed and request the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,

• Request the deletion or destruction of personal data in case the reasons requiring its processing cease to exist, although it has been processed in accordance with the KVK Law and other relevant legal provisions, and request the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,

• Object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

• Request the compensation of the damage in case of damage due to the unlawful processing of personal data.

To exercise your above-mentioned rights, you need to submit your request to our Company in writing, along with the necessary information to identify your identity and your explanations regarding the right you wish to use, by filling out and signing the application form that can be accessed from the link below, in accordance with the KVK Law and the Communiqué on the Principles and Procedures for the Request to the Data Controller;

• By applying in person,

• Through a notary,

• By sending it to our Company's registered electronic mail address kvkk@mymedikal.com.tr with a secure electronic signature defined in the Electronic Signature Law No. 5070 by the applicant.