TRPharm Pharmaceutical Industry Trade Joint Stock Company
Processing and Security of Private Personal Data Policy

Last Update: Feburary 2023

TRPharm Pharmaceutical Industry Trade Joint Stock Company
Processing and Security of Private Personal Data Policy

1. INTRODUCTION
1.1. Purpose of the Policy
As TRPharm İlaç Sanayi Ticaret Anonim Şirketi (hereinafter referred to as “TRPharm” or “Company”), we process sensitive personal data and ensure the security of this data in accordance with the Law on Protection of Personal Data No. 6698 and the relevant legislation.
The Decision of the Personal Data Protection Board dated 31/01/2018 and numbered 2018/10 regarding this Policy on Processing and Security of Special Quality Personal Data (“Policy”), “Adequate Precautions to be Taken by Data Controllers in Processing of Special Quality Personal Data” (“Policy”) Board Decision"), as the data controller, to determine the measures we take for the processing of sensitive personal data.
This Policy and TRPharm's Personal Data Security Policy (“Security Policy”) are complementary to each other, and the Security Policy should be reviewed for matters not mentioned in this Policy.
TRPharm, as the data controller, will act in accordance with this Policy when processing sensitive personal data under its responsibility, sharing it with third parties and storing it in data recording environments.

1.2. Scope of the Policy
This Policy covers our activities to ensure the appropriate level of security for the personal data of special nature that we have or may obtain from the following persons:

• Our company's employees, employee candidates, former employees and interns,
• Representatives, proxies and shareholders of our company and group companies,
• Employees, representatives and attorneys of our business partners,
• Healthcare professionals with whom we cooperate,
• Employees, representatives and attorneys of our suppliers,
• Our customers and potential customers,
• Employees of public / private institutions and organizations,
• Members and managers of the associations we cooperate with,
• Other real persons.

1.3. Policy Changes and Updates
TRPharm, art. It will take the necessary administrative and technical measures in order to process the sensitive personal data of the persons mentioned in Article 2 in accordance with the personal data protection legislation and to ensure the security of this data. In line with the changes in the law or related legislation or the activities of TRPharm, this Policy can be changed and updated at any time by the relevant units.

2. PROCESSING OF SPECIAL QUALITY PERSONAL DATA
2.1. General Principles Regarding the Processing of Private Personal Data
TRPharm is obliged to comply with the general principles set forth in the KVK Law regarding the processing of personal data. In this context, TRPharm will act in accordance with the following principles when processing sensitive personal data:

• Processing personal data in accordance with the law and honesty,
• Ensuring that personal data is accurate and up-to-date when necessary,
• Processing personal data for specific, explicit and legitimate purposes,
• Processing personal data in connection with the purpose for which they are processed, limited and measured,
• Storage for the period required by the relevant legislation or for the purpose for which they are processed.

2.2. Conditions for Processing Special Quality Personal Data
TRPharm is obliged to process sensitive personal data in accordance with the above-mentioned general principles and the conditions specified in Article 6 of the KVK Law. In this context, TRPharm will be able to process sensitive personal data based on one of the following conditions:

• Obtaining the express consent of the person concerned for the processing of sensitive personal data, or
• Except for personal data related to health and sexual life, the processing of sensitive personal data is stipulated in the law.
• Personal data related to health and sexual life, on the other hand, are individuals or authorized institutions and organizations that are under the obligation to keep confidential, without seeking explicit consent, only for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. can be processed by

2.3. Transfer of Private Personal Data
TRPharm may share sensitive personal data with third parties in accordance with the data processing conditions specified in Articles 8 and 9 of the KVK Law. During the transfer of sensitive personal data to third parties, TRPharm will take the security measures specified in the Board Decision.

2.4. Retention of Private Personal Data
TRPharm preserves sensitive personal data in accordance with the general principles and processing conditions detailed above. Regarding the environments where sensitive personal data is stored and/or accessed, TRPharm will take the security measures specified in the Board Decision. In this context, TRPharm,

• preserves sensitive personal data using cryptographic methods and keeps cryptographic keys in secure and different environments,
• All transactions made on sensitive personal data are securely logged,
• regularly monitors the security updates of the environments where sensitive personal data is stored, regularly performs the necessary security tests and records the test results,
• In cases where sensitive personal data is accessed through a software, user authorizations for this software are made,
• If remote access to sensitive personal data is required, an authentication system is provided.
• environments where sensitive personal data is processed, stored and/or accessed, and physical environment, electricity leakage, fire, flood, theft, etc. taking precautions against situations. By ensuring the physical security of these environments, unauthorized entries and exits are prevented.

3. PROCESSING OF PERSONAL DATA OF SPECIAL QUALIFICATIONS OF EMPLOYEES
TRPharm takes the following measures specified in the Board Decision for its employees who process sensitive personal data:

• Necessary training and awareness activities are carried out for the personnel to ensure the security of personal data, not to disclose or share it unlawfully.
• A confidentiality agreement is signed with the employees.
• Personnel are authorized to access servers containing personal data, depending on their department and job role. The scope and duration of these authorizations are clearly defined.
• Periodic authorization checks are carried out.
• In the event that the employees change their duties or leave the job, their access to data is removed and the inventory given to them is taken back.

4. PERSONAL DATA SECURITY POLICY
TRPharm has created the Personal Data Security Policy in accordance with the technical and administrative measures specified in the Personal Data Security Guide published on the Institution's website in order to ensure the security of all personal data it processes, including sensitive personal data. This Special Quality Personal Data Security Policy includes the technical and administrative measures taken by the Company to ensure the compliance of the processed personal data with the law, to prevent unlawful access and to ensure the appropriate level of security in order to ensure its preservation.