Protection of Personal Data

Processing of Personal Data

1. General Description

Under the law, personal data includes any information relating to an identified or identifiable natural person. Sensitive Personal Data, which is a special category of personal data, refers to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership of associations, foundations or trade-unions, information relating to health, sexual life, convictions and security measures, and the biometric and genetic data.

Processing of personal data refers to the series of operations that are carried out on personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or through non-automatic means only for the process which is a part of any data registry system.

2. Purpose and Identity of the Data Controller

This “Clarification Text on the Protection and Processing of General Personal Data” was issued by the data controller whose identity is given below, DESTEK PATENT ANONİM ŞİRKETİ (“DESTEK PATENT” or “Company ”), in order to fulfill the obligation to inform regarding the processing of your personal data in accordance with Article 10 of the “Personal Data Protection Law No. 6698 (“Law”) and the “Communique On Principles And Procedures To Be Followed In Fulfillment Of The Obligation To Inform”.

Your personal data Sanatkarlar Sok. within the framework of the purposes listed below and in a limited and measured manner in relation to these purposes, maintaining the accuracy and up-to-datedness of the personal data as it reaches us, within the scope described below by DESTEK PATENT ANONİM ŞİRKETİ (“DESTEK PATENT” or “Company”), residing in “Maslak Mah. Sanatkarlar Sok. No: 2D/20 Sarıyer/İSTANBUL”, taxpayer registered to Maslak Tax Office with the number 2930172251, in accordance with the Personal Data Protection Law No. 6698 (“Law”), as the data controller.

3. Purposes of Processing Your Personal Data

Your collected personal data may be processed by DESTEK PATENT for the purpose of ensuring the legal, technical, commercial and occupational safety of the Company and the persons who are in business relations with the Company and carrying out activities during data management processes; in accordance with the basic principles stipulated in the Law and within the conditions for processing personal data specified in Articles 5 and 6 of the Law.

4. Collection and Processing of Personal Data

The company can obtain personal data directly from the data owners themselves, as well as indirectly from third parties and from the data that the owner has made public. Within this scope, data is collected verbally, physically or from electronic media and these personal data are processed. You can examine what your personal data are, how they are collected and what personal data may be processed by us by looking at the table below.

Of Employees and Trainee Candidates

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, date of birth, marital status

1. Provided by the person herself/himself.

2. Obtained from recruitment platforms such as Kariyer.net etc.

Contact Information:

Telephone number, residence address, e-mail address

1. Provided by the person herself/himself.

2. Obtained from recruitment platforms such as Kariyer.net etc.

Sensitive Personal Data:

Health information, * (on the grounds that there is no disease / disability preventing employment), information relating to convictions / security measures that may prevent recruitment into the job applied

1. Provided by the person herself/himself.

2. Created or acquired by the company.

Professional Experience:

Degrees held, courses attended, vocational training information, certificates

1. Provided by the person herself/himself.

2.Obtained from recruitment platforms such as Kariyer.net etc.

Legal Acts:

Current lawsuit information * (on the grounds of whether there is a reemployment lawsuit)

Provided by the person herself/himself.

Visual and Audio Data:

Closed circuit security camera footage, personal photo

1. Security camera footage is obtained through closed-circuit security cameras.

2. The photo is obtained from recruitment platforms such as Kariyer.net etc.

Candidate Information:

Educational status, schools graduated from and year of graduation, education and skills, seminars and trainings, computer knowledge, foreign language knowledge, reference information, club memberships and interests, work experience, employment status and title, job description, company / institution names, periods worked

1. Provided by the person herself/himself.

2. Obtained from recruitment platforms such as Kariyer.net etc.

Other:

Military service status, vehicle driving competence and driver's license information, salary expectation

1. Provided by the person herself/himself.

2.Obtained from recruitment platforms such as Kariyer.net etc.

Of Employees and Interns

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, T.R. Identification Number, marital status, date of birth, signature

1. Provided by the person herself/himself

2. Obtained from recruitment platforms such as Kariyer.net etc.

Contact Information:

Telephone number, residence address, e-mail address

1. Provided by the person herself/himself.

2. Obtained from recruitment platforms such as Kariyer.net etc.

Location:

Location information collected during the use of company vehicles, GPS data

GPS data is obtained automatically

Financial Information

Financial and salary details, premium list, bank information

1. Bank information is provided by the employee.

2. Financial and salary details, premium lists are created or acquired by the company.

Legal Acts:

File and debt information regarding enforcement proceedings, current case information

1. Information on enforcement proceedings is obtained through legal notices.

2. Current lawsuit information is provided by the Company with reference to reemployment lawsuits.

Sensitive Personal Data:

Pre-recruitment medical examination form, blood type, Lung radiograph, Eye Examination, criminal record (the criminal conviction that may prevent the recruitment / information about the subjected security measure)

1. Health reports, health tests, blood type, criminal record data are provided by the employee.

2. The pre-employment medical examination form is provided by the workplace doctor.

Personnel affairs:

Payroll information, résumé, certificate of employment

1. Provided by the person herself/himself.

2. Provided by the company.

Professional Experience:

Degrees held, courses attended, vocational training information, certificates, educational status, certificate and diploma photocopies, trainings and skills fotokopileri, eğitim ve beceriler

1. Provided by the person herself/himself.

2. Obtained from recruitment platforms such as Kariyer.net etc.

Visual and Audio Data:

Photographs, closed circuit security camera footage

1. The photo is provided by the employee.

2. Audio recordings and security camera footage are obtained from related devices.

Physical Environment Security:

Entry-exit recording information, camera records

Obtained from closed circuit security cameras

Transaction Security:

IP addresses and web browsing activities of business computers used by employees

IP addresses, web browsing activities are obtained through computers and software.

Physical Environment Security:

Entry-exit recording information, camera records

Obtained from closed circuit security cameras

Risk Management:

Information processed to manage commercial, technical and administrative risks

Provided by the company.

Employee Information:

Military service status, discharge certificate, employee department, position information, driver's license, ownership information, overtime hours, number of deserved leave days, starting date information, leave request information, SGK information, salary information, title information, exit interview information

1. Provided by the person herself/himself.

2. Provided by the company.

Employee Performance and Career Development Information:

Training participation forms, training hours and durations, (if any) exam results, internal promotion evaluation processes (English, general aptitude tests, personality inventory), ethical non-compliance reports, personnel promotion transfer movements file, HR outbound search team scoring and performance reports, meeting records, scorecard information, start date, weekly working hours (login-logout records)

1. Provided by the person herself/himself.

2. Data related to education are obtained from the people who provide education services. Other information is related to performance management and is created by the Company.

Family, Relative Information:

Family enrollment forms, certificate of identity register copy

Provided by the person herself/himself.

Vehicle Information:

License plate

Provided by the company.

Of Customers

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, Turkish ID number

Provided by the customer herself/himself/

Contact Information:

Telephone number, residence address, e-mail address

Provided by the person herself/himself.

Customer Transaction:

Invoice, Order information, Demand information, etc

1. Provided by the person herself/himself.

2. Can be arranged and processed by the company.

Financial Information:

Bank account information, IBAN etc

Provided by the person herself/himself.

Marketing:

Shopping history information, cookies, etc

Provided by the company.

Transaction Security:

IP address information, website login and exit information, password information

1. Provided by the customer herself/himself.

2. Collected and processed by the company.

Intellectual Property Information

1. Provided by the person herself/himself.

2.Can be arranged and processed by the company.

Of Perspective Customers

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, Turkish ID number

Provided by the customer herself/himself

Contact Information:

Telephone number, residence address, e-mail address

Provided by the person herself/himself.

Customer Transaction:

Order information etc.

1. Provided by the person herself/himself.

2. Can be arranged and processed by the company.

Transaction Security:

IP address information, website login and exit information, password information

1. Provided by the customer herself/himself.

2. Collected and processed by the company.

Marketing

Cookies etc.

Collected and processed by the company.

Of Visitors

Data Category

Where Data Are Collected From

Identity Information:

Name, surname

Provided by the customer herself/himself

Visual Data:

Closed circuit security camera footage

Obtained from closed circuit security cameras.

Physical Environment Security:

Employee and visitor entrance and exit information, Camera footage, Building / Office Entry-Exit Records

Obtained from closed circuit security cameras.

Transaction Security:

Internet Access Registration Logs (for visitors accessing the Internet through the company network), IP address information, Website visit and exit information, System and Application User Account Information (Visitor's user names, e-mail accounts, last login dates, IP information, etc.)

1. Provided by the visitor herself/himself.

2. Provided by MS PHARMA over network systems.

Of Business Partner and Supplier Candidates

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, T.R. Identification Number, signature

1. Provided by the person himself/herself, or by his/her representatives.

2. N/A

Contact Information:

Address information, e-mail addresses, telephone number

1. Provided by the person himself/herself, or by his/her representatives.

2. N/A

Visual Data:

Closed circuit security camera footage

1. N/A

2. Obtained from closed circuit security cameras.

Of Business Partner and Supplier Candidates

Data Category

Where Data Are Collected From

Identity Information:

Name, surname, T.R. Identification Number, signature

Provided by the person himself/herself, or by his/her representatives.

Contact Information:

Address information, e-mail addresses, telephone number

Provided by the person himself/herself, or by his/her representatives.

Financial Information:

Bank account information, IBAN etc.

Provided by the person himself/herself, or by his/her representatives.

Visual Data:

Closed circuit security camera footage

Obtained from closed circuit security cameras.

Related Persons by Closed Circuit Security Cameras

Data Category

Where Data Are Collected From

Physical Environment Security:

Employee and visitor entrance and exit information, Camera footage, Building / Office Entry-Exit Records

Obtained from closed circuit security cameras.

Visual and Audio Records:

Closed circuit security camera footage

Obtained from closed circuit security cameras.

5. Parties to Which Your Personal Data is Transferred and Purposes for Transfer

Your collected personal data is legally provided to our shareholders, business partners, suppliers, and to authorized public and private institutions and organizations, within the scope of the above-mentioned “Purposes”, under the provisions of the personal data transfer conditions specified in Articles 8 and 9 of the Law, in accordance with the provisions in all relevant legislation and the basic principles stipulated in Law No.6698.

6. Collection Method of Your Personal Data and Legal Reasoning

Your personal data can be collected electronically by DESTEK PATENT via e-mail, mobile application, website, open internet resources, social media, telephone, SMS and call center channels, and physically by hand delivery or through the mail. In addition, your personal data will be collected based on legal reasons for the establishment and / or performance of the contract specified in Articles 5 and 6 of the Law, establishment, use and / or protection of a right, fulfillment of a legal obligation and legitimate interest, and by your explicit consent if you provide it.

Per the KVK Law article 7/1, your personal data will be deleted, destroyed, or anonymized when the purpose of processing your personal data no longer exists, and/or the time-out/retention periods required by the legislation for us to process your data expire.

7. Cases Where Personal Data Can Be Processed Without Explicit Consent under the KVK Law

In accordance with Article 5 of the Personal Data Protection Law No. 6698, your personal data may be processed without your explicit consent in the following cases. Such as;

• In cases clearly stipulated in the laws,
• If you are unable to disclose your consent as a data owner due to the physical disability, or in cases where your consent is not legally valid, it is necessary to process your personal data in order to protect yourself or someone else’s life or body integrity,
• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data belonging to the parties to the contract,
• It is compulsory to process data for a legal obligation to be fulfilled,
• In cases where your personal data are made public by you,
• If it is necessary to process the data for the establishment, use, or protection of a right,
• Data processing is mandatory for the legitimate interests of the Company, provided that it does not harm your fundamental rights and freedoms.
• Personal health data may be processed without the express consent of the person concerned, by persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing.

8. Your Rights As the Owner of Personal Data Listed under Article 11 of the Law

In accordance with Article 11 of the Law, we state that you have the following rights as data owners:

• To learn whether your personal data are being processed or not,
• To request information if your personal data have been processed,
• To learn the purpose of the processing of your personal data and whether these personal data are used in compliance with the purpose,
• To know the domestic or foreign third parties to whom your personal data were transferred,
• To request correction of your personal data in the case of incomplete or incorrect processing, and to request notification of the third parties to whom your personal data has been transferred about the action carried within this scope,
• To request the deletion or destruction of personal data if the reasons for processing no longer exist, even when the data have been processed in accordance with the Law and other relevant provisions of the law, and to request notification of the third parties to whom your personal data has been transferred about the action carried within this scope,
• To object to any outcome against you resulting from the analysis of the processed data solely through automated systems,
• To claim compensation for the losses you suffer in the case of unlawful processing of your personal data.

For requests regarding your rights listed above, you can use the DESTEK PATENT APPLICATION FORM ON THE PROTECTION OF PERSONAL DATA, or deliver a petition, which should include the minimum conditions included in the Communique On The Principles And Procedures For The Request To Data Controller, in writing and with a wet signature, to our headquarters located at “Maslak Mah. Sanatkarlar Sok. No: 2D/20 Sarıyer/İSTANBUL” in person, through a notary, send it with an electronic signature to KEP address of our company at destekpatent@hs02.kep.tr, or if your e-mail address is registered in our company’s systems, you can send it to us via kvk@destekpatent.com. Depending on the nature of your request, your applications will be concluded, free of charge, as soon as possible and within 30 (thirty) days at the latest. However, if the process incurs an additional cost, you may be charged at a rate determined by the Personal Data Protection Board. If the responses to the applications exceed 10 (ten) pages, a transaction fee of 1.00 (one) TL for each page will be charged. If the response is requested in a recording medium such as CD, flash memory, a fee will be charged according to the cost of the desired recording medium.