Ankara Beşer Ecza Deposu ve İlaç Pazarlama A.Ş.

ANKARA BEŞER ECZA DEPOSU VE İLAÇ PAZARLAMA ANONİM ŞİRKETİ

CLARIFICATION TEXT ON PROTECTION OF PERSONAL DATA

Purpose

This Clarification Text has been prepared in accordance with the Article 10 of the Law No. 6698 on the Protection of Personal Data and the Communiqué on Procedures and Principles in Fulfilling the Notice Requirement in order to inform you as a supplier, buyer of goods and/or service, employee candidate, employee, manager, visitor and/or other relevant person regarding the data processing activities carried out by Ankara Beşer Ecza Deposu ve İlaç Pazarlama Anonim Şirketi (Hereinafter referred to as the “Company”.) as the data controller.

Definitions

Explicit Consent: Consent regarding a specific subject, based on information and expressed with free will

Data Subject: Real person whose personal data is processed

Personal Data: Any information regarding an identified or identifiable real person

Processing of Personal Data: All kinds of activity performed on data such as obtaining, registering, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system

The Law: Law No. 6698 on the Protection of Personal Data

Sensitive Personal Data: Data regarding people’s race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data

Data Processor: Real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system

Data Controller

As Ankara Beşer Ecza Deposu ve İlaç Pazarlama Anonim Şirketi; we hereby inform you that as the data controller, we process the personal data that you have disclosed/will disclose to our Company as supplier, buyer of goods and/or service, employee candidate, employee, manager, visitor and/or other relevant person, within the scope of the Law and other relevant legislation.

Purposes of Processing Personal Data and Categories of Personal Data to be Processed

Purposes of Processing Personal Data

Your personal data is processed for the purpose of carrying out the Company’s activities in accordance with the limits set forth in the Law and other relevant legislation. In this context, your personal data is processed for these purposes below;

Carrying out and auditing business activities
Carrying out business activities through software systems used within the Company
Obtaining the necessary contact information so that you or the legal entity you represent can supply goods or services to our Company and sell goods or services to you or the legal entity/administration you represent
Contacting you within the scope of purchasing goods or services and selling goods or services
Carrying out contract processes within the scope of purchasing goods or services and selling goods or services
Fulfilling and keeping track of mutual contractual and legal obligations
Fulfilling obligations arising from employment contracts and legislation, and carrying out side rights and benefits processes for employees, in accordance with the legislation regulating business life, especially the Labor Law No. 4857, the Occupational Health and Safety Law No. 6331 and the Social Insurance and General Health Insurance Law No. 5510
Carrying out training activities
Carrying out Occupational Health and Safety Activities
Fulfilling and keeping track of obligations arising from legal legislation
Following and carrying out legal affairs
Carrying out financial and accounting affairs
Conducting Human Resources processes
Providing information and documents to authorized public institutions and organizations and judicial authorities in cases specified by law
Carrying out storage and archive activities
Creating and tracking visitor records
Ensuring the security of the Company building, employees and visitors

Categories of Personal Data to be Processed

Although the categories of personal data that will be and/or are being processed by our Company may differ depending on the data subject group, your personal data below will be processed within the scope of the purposes and legal reasons specified in this Clarification Text in accordance with the Law and other relevant legislation:

Identity Information: Name-Surname, T.R. Identity Number, mother’s name, father’s name, place and date of birth, signature, etc.

Contact Information: Residential address, work address, fixed phone number, mobile number, e-mail, REM address, fax number, etc.

Customer Transaction Data: Order and request information

Legal Transaction Data: Information in correspondence with judicial authorities, information in case files, etc.

Physical Space Security Data: Image recordings of security cameras installed in our Company building and entry-exit records information

Financial Information: Financial records and payment information for services received by the Company or provided to the Company

Request and Complaint Information: Request and complaint information submitted within the scope of the survey studies conducted by our Company and information regarding the satisfaction with our Company’s services

Sensitive Personal Data: Health data regarding customers, if necessary

Data regarding employees: In addition to the data categories mentioned above regarding employee candidates and our employees, personnel data, professional experience information, process security data, vehicle data, family and relative data, reference information, visual records, health data, information regarding criminal convictions and security measures may also be processed.

Method and Legal Reason for Collecting Personal Data

In order to fulfill the purposes specified in paragraph (d) of this text, your personal data shall be obtained verbally, in writing or electronically by the following automatic or non-automatic methods:

Verbal transmission of personal data to our Company by the data subject or his/her representative,
Physical delivery of written documents to our Company,
Sending mail to our Company's corporate e-mail addresses and/or our REM address,
Filling out the form in writing or electronically and submitting it to our Company,
Sending documents to our fax address,
Obtaining personal data through security camera recordings.

In order to fulfill the purposes specified in paragraph (d) of this text, your personal data will be processed within the legal grounds of “a) It is clearly provided for in the law”, “c) Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract", "ç) It is mandatory for the data controller to fulfill its legal obligation”, "e) Data processing is mandatory for the establishment, exercise or protection of a right" and “f) Provided that it does not harm the fundamental rights and freedoms of the data subject, data processing is mandatory for the legitimate interests of the data controller” as stated in Article 5 (2) of the Law.

In the processes where special categories of personal data are processed within the scope of our company's activities and if necessary; your special categories of personal data may be processed within the legal reason of "obtaining your explicit consent" specified in Article 6 (2) of the Law.

To Whom and For What Purpose the Processed Personal Data will be Transferred

Your personal data will be transferred for the purposes stated below, without seeking the explicit consent of the data subject, in accordance with Article 8 (2) (a) of the Law:

It may be shared with our suppliers, in order to carry out the sales processes of goods or services within the scope of realizing the sale of goods or services to you or the legal person / administration you represent.
It may be shared with the license holder company officials as necessary within the framework of confidentiality and confidentiality obligations, in order to carry out the maintenance / repair and installation activities of the software programs used within our Company for the purpose of carrying out business activities and planning contractual processes.
It may be shared with courier companies, notaries, enforcement offices, courts and/or authorized public institutions and organizations, if necessary, in order to carry out contractual processes and to fulfill mutual contractual and legal obligations.
It may be shared with the banks and financial advisors we work with, if necessary, in order to carry out financial and accounting affairs.
It may be shared with the company that receives independent audit services, in order to fulfill our obligations under the relevant legislation.
It may be shared with authorized public institutions and organizations, in order to fulfill our obligations arising from legal legislation and to provide information to authorized persons, institutions and organizations.
Your personal data that you have submitted through our Company's website may be shared with the officials of the data processing company that we have contracted with, in order to carry out the maintenance and repair activities of our Company's website so as to carry out business activities within the framework of confidentiality and confidentiality obligations.

In the processes where special categories of personal data are transferred within the scope of our Company's activities and if necessary; your special categories of personal data may be transferred within the legal reason of "obtaining your explicit consent" specified in Article 6 (2) of the Law.

Your Rights as the Data Subject

Pursuant to Article 11 of the Law, provided that you prove your identity to our Company in person,

You can find out whether your personal data is being processed, and if it is or has been processed, you can request information about it.
You can learn the purpose of processing your personal data and whether they are used for their intended purpose.
You can find out whether your personal data is transferred domestically or abroad and to whom it is transferred.
You may request the correction of your incomplete or incorrectly processed personal data and request that the actions to be taken within this scope be notified to third parties to whom your personal data has been transferred.
You may request the annihilation (deletion or destruction) of your personal data within the framework of the conditions stipulated in Article 7 of the Law and you may request that the actions to be taken in this context be notified to third parties to whom your personal data has been transferred. However, our Company will evaluate your annihilation request and evaluate which of the annihilation methods (deletion, destruction and anonymization) is appropriate according to the circumstances of the concrete event. In this context, you can request information about the reason why that annihilation method was chosen by our Company.
You may object to the occurrence of a result against you by analyzing your processed personal data exclusively through automatic systems.
If you suffer damage due to unlawful processing of your personal data, you may request compensation for the damage.

Your requests in your application will be finalized free of charge within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Company, the fare in the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged.

For matters related to the processing of your personal data, you can submit your application by filling in all the information specified in the Data Subject Application Form on our website or in accordance with Article 11 and paragraph 1 of Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller,

By coming to our Company located at Altınevler District Aslanağzı Street. No: 3A Interior Door No: - Mamak/Ankara in person,
Via our registered electronic mail (REM) address - ankarabeserecza@hs01.kep.tr,
In writing through a notary or by registered letter with return receipt, in order to be able to identify you and not to provide information to the wrong people,
By sending an e-mail to kvkk@beserecza.com by using a secure electronic signature, mobile signature or (if any) the e-mail address previously notified by you to our Company and registered in our systems

or by other methods to be determined by the Board in the future.

ANKARA BEŞER ECZA DEPOSU VE İLAÇ PAZARLAMA ANONİM ŞİRKETİ

CLARIFICATION TEXT FOR SUPPLIERS

Data Controller

Since you are a natural person supplier/service provider of our Company or the representative of our legal person supplier/service provider, as ANKARA BEŞER ECZA DEPOSU VE İLAÇ PAZARLAMA ANONİM ŞİRKETİ (“Company”), we process the personal data that you have disclosed/will disclose to our Company as Data Controller, within the scope of the Law No. 6698 on the Protection of Personal Data (the “Law”) and other relevant legislation.

İşlenen Kişisel Veri Kategorileri

Pursuant to the Law and other relevant legislation, within the scope of the purposes and legal reasons specified in this Clarification Text For Suppliers;

Identity information; Name, Surname, T.R. Identity Number, signature, etc.

Contact information; E-mail, office telephone number, mobile number, address information, etc.

Physical space security data; if our Company is visited physically, security camera recordings and entry-exit records

Financial information; if you are a real person supplier/service provider, financial records regarding the services you have provided to our Company and payment information made to you

Your current and past transaction information; If you are a real person supplier/service provider, current and past transaction information regarding the services received from you

Professional experience information; if you are a natural person supplier/service provider, your professional experience information regarding the service to be provided by you

shall be processed.

Purpose of Processing Personal Data

Your personal data will be processed within the legal reasons specified in paragraph (d) of this text and for the following purposes:

Obtaining the necessary contact information to make an offer and/or purchase of goods/services,
Contacting you for the supply of goods or services,
Fulfilling and keeping track of mutual contractual and legal obligations,
Fulfilling our obligations arising from legal legislation,
Carrying out financial and accounting affairs,
Following and carrying out legal affairs,
Creating records on the computer software systems used within our Company.

Method and Legal Reason for Collecting Personal Data

Your personal data is obtained by the real person supplier/service provider or the representative of legal person supplier/service provider by verbal, written or electronic transmission to our Company with automatic or non-automatic method, in order to fulfill the purposes specified in paragraph (c) of this text.

In order to fulfill the purposes specified in paragraph (c) of this text, your personal data will be processed within the legal grounds of “c) Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract", "ç) It is mandatory for the data controller to fulfill its legal obligation” and "e) Data processing is mandatory for the establishment, exercise or protection of a right" as stated in Article 5 (2) of the Law.

To Whom and For What Purpose the Processed Personal Data will be Transferred

Your personal data will be transferred for the purposes stated below, without seeking the explicit consent of the data subject, in accordance with Article 8 (2) (a) of the Law:

It may be shared with notaries, enforcement offices, courts and/or authorized public institutions and organizations, if necessary, in order to fulfill mutual contractual and legal obligations within the scope of realizing the collection of goods or services.
It may be shared with our lawyers as much as necessary within the framework of the confidentiality obligation, in order to follow the legal processes.
It may be shared with the financial advisor and our contracted bank, in order to carry out financial and accounting affairs.
It may be shared with our contracted courier companies, if necessary, in order to carry out contract and sales processes.
It will be shared with the companies from which independent audit services are received and relevant institutions and organizations, in order to fulfill our legal obligations within the scope of the relevant legislation.
It may be shared with the license holder company officials as necessary within the framework of confidentiality and confidentiality obligations, in order to carry out the maintenance/repair and installation activities of the software programs used within our Company for the purpose of carrying out business activities.

Your Rights as the Data Subject

Pursuant to Article 11 of the Law, provided that you prove your identity to our Company in person,

You can find out whether your personal data is being processed, and if it is or has been processed, you can request information about it.
You can learn the purpose of processing your personal data and whether they are used for their intended purpose.
You can find out whether your personal data is transferred domestically or abroad and to whom it is transferred.
You may request the correction of your incomplete or incorrectly processed personal data and request that the actions to be taken within this scope be notified to third parties to whom your personal data has been transferred.
You may request the annihilation (deletion or destruction) of your personal data within the framework of the conditions stipulated in Article 7 of the Law and you may request that the actions to be taken in this context be notified to third parties to whom your personal data has been transferred. However, our Company will evaluate your annihilation request and evaluate which of the annihilation methods (deletion, destruction and anonymization is appropriate by evaluating your request for annihilation, which of the annihilation methods (deletion, destruction and anonymization) is appropriate according to the circumstances of the concrete event. In this context, you can request information about the reason why that annihilation method was chosen by our Company.
You may object to the occurrence of a result against you by analyzing your processed personal data exclusively through automatic systems.
If you suffer damage due to unlawful processing of your personal data, you may request compensation for the damage.

Your requests in your application will be finalized free of charge within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Company, the fare in the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged.

For matters related to the processing of your personal data, you can submit your application by filling in all the information specified in the Data Subject Application Form on our website or in accordance with Article 11 and paragraph 1 of Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller,

By coming to our Company located at Altınevler District Aslanağzı Street. No: 3A Interior Door No: - Mamak/Ankara in person,
Via our registered electronic mail (REM) address - ankarabeserecza@hs01.kep.tr,
In writing through a notary or by registered letter with return receipt, in order to be able to identify you and not to provide information to the wrong people,
By sending an e-mail to kvkk@beserecza.com by using a secure electronic signature, mobile signature or (if any) the e-mail address previously notified by you to our Company and registered in our systems

or by other methods to be determined by the Board in the future.

As part of Law No. 6698 on the Protection of Personal Data (the "Law"), I have read and understood the information provided above.

Name / Surname of the Data Subject : ........................................

Signature : ........................................

Date : ........................................

ANKARA BEŞER ECZA DEPOSU VE İLAÇ PAZARLAMA ANONİM ŞİRKETİ

CLARIFICATION TEXT FOR BUYERS OF GOODS AND SERVICES

Data Controller

Since you are the representative of the buyers of our Company’s goods and/or services, as ANKARA BEŞER ECZA DEPOSU VE İLAÇ PAZARLAMA ANONİM ŞİRKETİ (“Company”), we process the personal data that you have disclosed/will disclose to our Company as Data Controller, within the scope of the Law No. 6698 on the Protection of Personal Data (the “Law”) and other relevant legislation.

Categories of Personal Data to be Processed

Pursuant to the Law and other relevant legislation, within the scope of the purposes and legal reasons specified in this Clarification Text For Buyers of Goods and Services;

Identity information; Name, Surname, T.R. Identity Number, signature, etc.

Contact information; E-mail, office telephone number, mobile number, address information, etc.

Physical space security data; if our Company is visited physically, security camera recordings and entry-exit records

Request and complaint information; Your request and complaint information you submit within the scope of the survey studies conducted by our Company and information regarding your satisfaction with our Company’s services

shall be processed.

Purpose of Processing Personal Data

Your personal data will be processed within the legal reasons specified in paragraph (d) of this text and for the following purposes:

Obtaining the necessary contact information to submit an offer and/or supply goods and/or services to the legal entity/administration you represent,
Conducting the sales and contract processes, including tender processes,
Ensuring the delivery of goods subject to sales contracts concluded with the legal entity/administration you represent,
Ensuring customer satisfaction and conducting survey studies within this scope,
Fulfilling and keeping track of mutual contractual and legal obligations,
Fulfilling and keeping track of our obligations arising from legal legislation,
Carrying out financial and accounting affairs,
Following and carrying out legal affairs,
Creating records on the computer software systems used within our Company.

Method and Legal Reason for Collecting Personal Data

Your personal data is obtained by the representative of the buyers of goods and/or services by verbal, written or electronic transmission to our Company with automatic or non-automatic method, in order to fulfill the purposes specified in paragraph (c) of this text.

In order to fulfill the purposes specified in paragraph (c) of this text, your personal data shall be processed within the legal grounds of “c) Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract", "ç) It is mandatory for the data controller to fulfill its legal obligation” and "e) Data processing is mandatory for the establishment, exercise or protection of a right" as stated in Article 5 (2) of the Law.

To Whom and For What Purpose the Processed Personal Data will be Transferred

Your personal data will be transferred for the purposes stated below, without seeking the explicit consent of the data subject, in accordance with Article 8 (2) (a) of the Law:

It may be shared with notaries, enforcement offices, courts and/or authorized public institutions and organizations, if necessary, in order to fulfill mutual contractual and legal obligations within the scope of realizing the collection of goods and/or services.
It may be shared with our lawyers as much as necessary within the framework of the confidentiality obligation, in order to follow the legal processes.
It may be shared with the financial advisor and our contracted bank, in order to carry out financial and accounting affairs.
It may be shared with our contracted courier companies, in order to carry out contract and sales processes.
It will be shared with the companies from which independent audit services are received and relevant institutions and organizations, in order to fulfill our legal obligations within the scope of the relevant legislation.
It may be shared with the license holder company officials as necessary within the framework of confidentiality and confidentiality obligations, in order to carry out the maintenance/repair and installation activities of the software programs used within our Company for the purpose of carrying out business activities.
It may be shared with our supplier companies in order to carry out goods or service sales processes within the scope of providing product sales services to the legal entity / administration you represent.

Transferring Abroad

Some of the supplier companies we work with have their headquarters abroad. For the aforementioned reason, your personal data may be transferred to our foreign-based suppliers “with your explicit consent” in order to carry out goods or service sales processes within the scope of providing products sales services to the legal entity/ administration you represent.

The infrastructure and databases of the e-mail software used within our Company as part of carrying out our business operations are located abroad. For the aforementioned reason, your personal data will be transferred abroad “with your explicit consent” since the infrastructure and databases of the e-mail software used to carry out communication activities are located abroad.

Your Rights as the Data Subject

Pursuant to Article 11 of the Law, provided that you prove your identity to our Company in person,

You can find out whether your personal data is being processed, and if it is or has been processed, you can request information about it.
You can learn the purpose of processing your personal data and whether they are used for their intended purpose.
You can find out whether your personal data is transferred domestically or abroad and to whom it is transferred.
You may request the correction of your incomplete or incorrectly processed personal data and request that the actions to be taken within this scope be notified to third parties to whom your personal data has been transferred.
You may request the annihilation (deletion or destruction) of your personal data within the framework of the conditions stipulated in Article 7 of the Law and you may request that the actions to be taken in this context be notified to third parties to whom your personal data has been transferred. However, our Company will evaluate your annihilation request and evaluate which of the annihilation methods (deletion, destruction and anonymization is appropriate by evaluating your request for annihilation, which of the annihilation methods (deletion, destruction and anonymization) is appropriate according to the circumstances of the concrete event. In this context, you can request information about the reason why that annihilation method was chosen by our Company.
You may object to the occurrence of a result against you by analyzing your processed personal data exclusively through automatic systems.
If you suffer damage due to unlawful processing of your personal data, you may request compensation for the damage.

Your requests in your application will be finalized free of charge within thirty (30) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Company, the fare in the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged.

For matters related to the processing of your personal data, you can submit your application by filling in all the information specified in the Data Subject Application Form on our website or in accordance with Article 11 and paragraph 1 of Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller,

- By coming to our Company located at Altınevler District Aslanağzı Street. No: 3A Interior Door No: - Mamak/Ankara in person,

- Via our registered electronic mail (REM) address - ankarabeserecza@hs01.kep.tr,

- In writing through a notary or by registered letter with return receipt, in order to be able to identify you and not to provide information to the wrong people,

- By sending an e-mail to kvkk@beserecza.com by using a secure electronic signature, mobile signature or (if any) the e-mail address previously notified by you to our Company and registered in our systems

or by other methods to be determined by the Board in the future.

As part of Law No. 6698 on the Protection of Personal Data (the "Law"), I have read and understood the information provided above.

Name / Surname of the Data Subject : ........................................

Signature : ........................................

Date : ........................................