This Clarification Text has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”) for the purpose of informing data subjects regarding the procedures and principles of the processing of personal data and special categories of personal data obtained from data subjects by İLKO İLAÇ SAN. ve TİC. A.Ş. (“Company”), operating at the address Veysel Karani Mah. Çolakoğlu Sok. No: 10, Rings Rezidans, Floors: 7-8-9, 34885, Sancaktepe/Istanbul (Tel: 0216 564 80 00, MERSIS no: 0473002635900010 and trade registry number 151205), in its capacity as the data controller.

DEFINITIONS

1) About the Data Controller

Your personal data and your data falling within the scope of special categories of personal data shared with us during the membership application may be processed by the Company within the scope and purposes specified below under the Law. Under the Law, the Company (İLKO İLAÇ SAN. ve TİC. A.Ş.) is considered the data controller.

2) General Principles in the Processing of Personal Data

Within the framework of KVKK Art. 3/I(e), any operation that can be performed on personal data constitutes "data processing."

İLKO İLAÇ SAN. ve TİC. A.Ş. processes personal data in accordance with the following principles:

• Compliance with the law and rules of honesty,

• Being accurate and, where necessary, up-to-date,

• Processing for specific, explicit, and legitimate purposes,

• Being relevant, limited, and proportionate to the purposes for which they are processed,

   

   

• Retention for the period prescribed in the relevant legislation or required for the purpose for which they are processed.

   

   

3) Data Processed by İLKO İLAÇ SAN. ve TİC. A.Ş.

The Company may process general and special categories of personal data with the explicit consent of the data subject or without explicit consent in cases provided for in Articles 5 and 6 of the KVKK.

Personal Data: Name, Surname, Date of Birth, Place of Birth, TR ID Number, ID Card (in case of recruitment), Family/social life info, Address, Driver's License info, Military status, Education info, Employment info (Resume, References), Financial info, Goods/services info (in case of recruitment), Business activity info, Professional licenses/permits, Telecommunication records, Location records via company vehicle/tablet (in case of recruitment), E-mail/IS usage records, Entry records, SGK registration info, Exit interview info.

Special Categories of Personal Data: Nationality, Marital Status, Vaccination Card, liver X-ray and similar health data, Biometric data, Criminal record, and ongoing lawsuit information.

4) Purposes of Processing Personal Data

Data is collected and processed limited to the following purposes:

• Execution of commercial activities and business processes,

• Management of relations with business partners/suppliers,

• Sales, marketing, and after-sales process planning,

• Information regarding product/service content,

• Sending commercial electronic messages (with separate consent),

• Ensuring legal/commercial security of relations,

• Administrative operations, logistics planning, and reputation research,

• Contract management, legal claims follow-up, and R&D activities,

• Information security management and financial/accounting audits,

• Resolution of legal disputes and responding to requests,

• Protection of the legitimate interests of the Company and its employees,

• Execution of human resources processes (recruitment, performance, payroll, career development, assignment, promotion, and termination),

• Occupational health and safety planning,

• Fulfilling legal obligations and informing authorized institutions,

• Protecting public health (COVID-19 and similar pandemics).

5) Transfer of Your Personal Data Within Its Purposes

Your data may be transferred to the Company's group companies, affiliates, shareholders, business partners, banks, and consulates (if necessary) in accordance with Articles 8 and 9 of the Law, limited to the realization of the purposes stated above.

6) Method of Personal Data Collection

Personal data is collected verbally, in writing, and/or electronically through clear and understandable information provided to data subjects, and where necessary, by obtaining explicit consent, in accordance with the principles of lawfulness, honesty, and proportionality.

7) Retention Period of Personal Data

The Data Controller complies with the periods prescribed in the legislation for the storage of the relevant data and shall only keep the data for the period necessary for the purpose for which they are processed. If there is no valid reason for further storage, the data shall be deleted or anonymized.

8) Security of Your Data

Our management implements technical and administrative measures under the Information Security Management System (ISO 27001 and 27018) and the Personal Data Security Guide published by the KVKK Board to prevent unauthorized access, loss, or damage.

9) Rights of the Data Subject (Article 11)

In accordance with Article 11, everyone has the right to:

• Learn whether personal data is processed, request information if so,

• Learn the purpose of processing and whether used accordingly,

• Know third parties at home or abroad to whom data is transferred,

• Request rectification of incomplete/inaccurate data,

• Request erasure or destruction under Article 7 conditions,

• Object to analysis exclusively via automated systems,

• Claim compensation for damages due to unlawful processing.

Application Methods:

In accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller," applications must include Name, Surname, ID/Passport number, Address, E-mail/Phone, Subject, and supporting documents.

1. In Person: Delivery to the Company address with the note "Information Request per KVKK" on a sealed envelope.

2. Via Notary: Notification to the Company address.

3. Via KEP: Application to kvkk@selcukluholding.com.tr using a Secure Electronic Signature.

10) Erasure, Destruction, or Anonymization of Personal Data

The Company uses the following methods:

• Deletion: Command-based deletion from the database.

• Destruction: Physical destruction of paper-based data.

• Anonymization: Masking or removing identifiers (Name, TR ID, etc.) so the data subject cannot be identified.

  The Company may agree with an expert for destruction, ensuring data cannot be recovered or accessed.