TRPharm Pharmaceutical Industry Trade Joint Stock Company
Personal Data Protection and Processing Policy

Son Güncelleme: Şubat 2023

1. INTRODUCTION
1.1. Purpose and Scope

Law No. 6698 on the Protection of Personal Data (“Law”) entered into force on 7 April 2016; This TRPharm İlaç Sanayi Ticaret Anonim Şirketi Personal Data Processing and Protection Policy (“KVK Policy”) is intended to ensure compliance of TRPharm İlaç Sanayi Ticaret Anonim Şirketi (“Company” or “TRPharm”) with the Law and to protect and process personal data by TRPharm. It has been prepared and put into effect with the aim of determining the principles to be followed in the fulfillment of the related obligations.

This KVK Policy determines the processing conditions of personal data and sets out the main principles adopted by TRPharm in the processing of personal data. In this context, the KVK Policy covers all personal data processing activities within the scope of the Law carried out by the Company for persons other than TRPharm employees and

It covers the owners of all personal data whose personal data are processed by TRPharm. Issues regarding the processing of personal data of TRPharm employees are regulated separately in the Policy on the Processing and Protection of Personal Data of Employees of TRPharm İlaç Sanayi Ticaret Anonim Şirketi.

1.2. Enforcement and Change

This KVK Policy is valid from the date it was approved and entered into force by TRPharm. The company reserves the right to make changes in the KVK Policy in line with the legal regulations.

In case of conflict with the legislation in force, especially the Law, and the regulations included in this KVK Policy, the provisions of the current legislation shall apply.

2. DATA OWNERS, DATA PROCESSING PURPOSE AND DATA CATEGORIES FOR PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT BY OUR COMPANY
2.1. Data Owners
Data owners within the scope of KVK Policy are all natural persons other than TRPharm employees whose personal data are being processed by TRPharm. In this context, the categories of data subjects are as follows:

2.2. Personal Data Processing Purposes
Your personal data and sensitive personal data may be processed by TRPharm for the following purposes in accordance with the personal data processing conditions in the Law and relevant legislation:

2.3. Personal Data Categories
Your personal data categorized below by TRPharm are processed in accordance with the personal data processing conditions in the Law and relevant legislation:

3. PRINCIPLES AND CONDITIONS REGARDING THE PROCESSING OF PERSONAL DATA
3.1. Principles Regarding the Processing of Personal Data
Personal data is processed by TRPharm in accordance with the personal data processing principles set forth in Article 4 of the Law. It is mandatory to comply with these principles for each personal data processing activity:

Processing personal data in accordance with the law and honesty rules; TRPharm acts in accordance with the relevant laws, secondary regulations and general principles of law in the processing of personal data; attaches importance to processing personal data limited to the purpose of processing and taking into account the reasonable expectations of data owners.

• Personal data are accurate and up-to-date; Care is taken to ensure that the personal data processed by TRPharm is up-to-date and controls are made in this regard. In this context, data owners are given the right to request correction or deletion of their correct and outdated data.
• Processing personal data for specific, explicit and legitimate purposes; TRPharm determines the purposes of data processing in accordance with the law before each personal data processing activity.
• To be connected, limited and proportionate to the purpose for which personal data is processed; Data processing by TRPharm is limited to the personal data necessary to achieve the purpose of collection and necessary steps are taken to prevent the processing of personal data unrelated to this purpose.
• Keeping personal data for as long as required by the legislation or processing purposes; In cases where a longer retention period is not determined by TRPharm in accordance with the law, taking into account the sector practices regarding the storage of personal data, the processed personal data is deleted, destroyed or destroyed by the Company after the purpose of processing the personal data disappears or when the period stipulated in the legislation expires. is anonymized.

3.2. Conditions Regarding the Processing of Personal Data
Your personal data is processed by the Company in the presence of at least one of the personal data processing conditions in Article 5 of the Law. Explanations on these conditions are given below:

In cases where the personal data owner has express consent and other data processing conditions do not exist, 3.1. In accordance with the general principles set forth under the heading, TRPharm may process the personal data of the data subject, with the free will of the data subject, with sufficient information about the personal data processing activity, without leaving any room for hesitation, and only if he gives his consent limited to that transaction.

• Personal data may be processed by TRPharm without the explicit consent of the data owner, if the personal data processing activity is expressly stipulated in the law. In this case, the Company will process personal data within the framework of the relevant legal regulation.
• In case the explicit consent of the data owner cannot be obtained due to the actual impossibility and personal data processing is mandatory, the personal data belonging to the data owner, whose consent cannot be declared by TRPharm or whose consent cannot be validated, may be required for the purpose of protecting the life or physical integrity of the data owner or a third person. if any, it will be processed.
• In the event that the personal data processing activity is directly related to the establishment or performance of a contract, personal data processing will be carried out if it is necessary to process the personal data of the parties of a written or oral contract between the data owner and TRPharm.
• If it is necessary to carry out personal data processing activities in order to fulfill the legal obligation of the data controller, TRPharm will process personal data in order to fulfill its legal obligations under the applicable legislation.
• The personal data that has been made public by the data owner in any way, and that has been made available to everyone as a result of making it public, may be processed by TRPharm without the explicit consent of the data owners, limited to the purpose of making it public.
• In the event that personal data processing is mandatory for the establishment, exercise or protection of a right, TRPharm will be able to process the personal data of the data subject without the explicit consent of the data subjects within the scope of the obligation.
• Provided that it does not harm the fundamental rights and freedoms of the data owner, if data processing is necessary for the legitimate interests of the data controller, personal data may be processed by TRPharm, provided that the balance of interests of the TRPharm and the data owner is observed. In this context, in the processing of data based on legitimate interest, the Company first determines the legitimate interest to be obtained as a result of the processing activity. It evaluates the possible impact of the processing of personal data on the rights and freedoms of the data owner, and if it considers that the balance is not disturbed, it performs the processing.

3.3. Conditions Regarding the Processing of Special Categories of Personal Data
In Article 6 of the Law, special categories of personal data are specified in a limited number. These; data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, costume and clothing, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

TRPharm processes sensitive personal data in accordance with the relevant legal regulations and by ensuring that additional measures determined by the Personal Data Protection Board (“KVK Board”) are taken in the following cases:

• The processing of sensitive personal data other than health and sexual life may be processed without the explicit consent of the data owner, provided that it is expressly stipulated in the law, in other words, there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained in order to process the said special categories of personal data.
• Personal data related to health and sexual life may be processed without explicit consent by persons or authorized institutions and organizations under the obligation of secrecy for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing. Otherwise, the explicit consent of the data owner will be obtained in order to process the said special categories of personal data.

4. TRANSFER OF PERSONAL DATA
TRPharm, in accordance with the additional regulations listed in Articles 8 and 9 of the Law and determined by the KVK Board; In case of conditions for the transfer of personal data, it can transfer personal data to third parties in the country or abroad.

Transfer of personal data to third parties in the country, in the presence of at least one of the data processing conditions explained in Articles 5 and 6 of the Law and explained under Title 3 of this KVK Policy, and on the condition of complying with the basic principles of data processing conditions. It can be transferred to third parties domestically by TRPharm.

• Transfer of personal data to third parties abroad:

If the country to which the transfer will be made is from a safe country with adequate protection declared by the KVK Board; Your personal data may be transferred by TRPharm to third parties abroad, provided that at least one of the data processing conditions included in the 5th and 6th articles of the Law and explained under the 3rd Title of this KVK Policy are present and that the basic principles regarding the data processing conditions are complied with.

If the country to which the transfer will be made is not a safe country with adequate protection declared by the KVK Board; Personal data can be transferred to third parties abroad in the following cases, in the presence of at least one of the data processing conditions explained under the 3rd Title of this KVK Policy and in accordance with the basic principles specified in Article 4 of the Law:
o Existence of explicit consent of the person concerned
o The company and the data recipient in the relevant country undertake in writing to adequate protection and obtain the permission of the KVK Board for the relevant transfer
In accordance with the general principles of the Law and the data processing conditions in Articles 8 and 9, TRPharm can transfer data to the parties categorized in the table below:

5. DISCLOSURE OF DATA OWNERS AND RIGHTS OF DATA OWNERS
According to Article 10 of the Law, before the processing of personal data or at the latest at the time of processing, data owners must be informed about the processing of their personal data. In accordance with the relevant article, the necessary internal structure has been established by TRPharm as the data controller to ensure that the data owners are informed in every situation where personal data processing activities are carried out. In this context;

For the purpose of processing personal data, please see paragraph 2.2 of the KVK Policy. Check out the section.
For the parties to whom personal data is transferred and the purpose of the transfer, please review Section 4 of the KVK Policy.
In order to examine the conditions regarding the processing of personal data that can be collected through different channels in physical or electronic environments, please see paragraphs 3.2 and 3.3 of the KVK Policy. see section.
As a data owner, the rights of data owners in accordance with Article 11 of the Law are listed below:

• Learning whether personal data is processed or not,
• Requesting information on personal data if it has been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with the purpose,
• To know the third parties to whom your personal data is transferred, in the country or abroad,
• Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
• Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing have disappeared, although it has been processed in accordance with the Law and other relevant law provisions, and requesting the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
• Objecting to a result against you by analyzing the processed data exclusively through automated systems,
• Requesting the compensation of the damage in case you suffer damage due to the unlawful processing of personal data.
• Applications for the data owner rights listed above can be submitted to TRPharm by filling out the Data Owner Application Form at the address https://www.trpharm.com/verisahibibasvuruformu. Depending on the nature of the request, the application will be concluded free of charge as soon as possible and within thirty days at the latest; however, if the transaction requires an additional cost, a fee may be charged to the data owner according to the tariff to be determined by the KVK Board.

During the evaluation of the applications, TRPharm first determines whether the person making the request is the real beneficiary. However, when deemed necessary, the Company may request detailed and additional information in order to better understand the request.
Responses to data subject applications are notified by the company in writing or electronically. If the application is rejected, the reasons for the rejection will be explained to the data owner with justification.

In case the personal data is not obtained directly from the data owner; By the company (1) within a reasonable period of time after the personal data is obtained, (2) during the first communication in case the personal data will be used for communication with the data owner, (3) in the case of the personal data to be transferred, at the latest, the personal data will be used for the first time. At the time of transfer, activities regarding the disclosure of data owners are carried out.

6. DELETING, DESTROYING, MAKING PERSONAL DATA ANONYMOUS
In cases where a longer retention period is not legally determined by TRPharm, taking into account the sector practices regarding the storage of personal data, personal data may be ex officio or in the case of data processing, although it has been legally processed in accordance with Article 7 of the Law. upon the request of the owner, it is deleted, destroyed or anonymized by TRPharm in accordance with the guidelines published by the Personal Data Protection Authority, periodic destruction periods and the data owner application.

Personal data processed by the company are handled on a categorical basis, and maximum data retention periods are determined for each personal data category in line with the data processing process it is related to. Detailed information on how the storage and destruction process will be carried out, including the aforementioned maximum periods, is set forth in the Personal Data Retention and Destruction Policy issued by the Company.