Search

A. SCOPE

This Policy, titled Personal Data Protection and Privacy Policy (“Policy”), has been prepared to provide necessary information by explaining the set of rules for processing personal data and entered into force on 29.06.2021 upon approval by the management of Santa Farma İlaç Sanayii A.Ş. (“Santa Farma”).

B. DEFINITIONS

C. REFERENCES

D. CHANGES

Changes to this Policy resulting from the entry into force of additional legislation within the scope of the Law or at various times can be followed on the Santa Farma corporate website, and the current version of this Policy can also be accessed from this corporate site.

1. PURPOSE

Santa Farma processes the personal data of its guarantors, suppliers, employees, customers, visitors, and other natural persons who establish a relationship through job applications or any other purpose or channel in accordance with the law to carry out its activities. The purpose of this policy is to provide transparency regarding personal data by explaining these processing activities and systems containing personal data and thus informing the relevant persons. In this context, Santa Farma has detailed and explained the processing of personal data within the scope of KVKK, the data subjects of this processing, and the rights of these persons, along with the use of cookies and similar technologies in this Policy.

2. PERSONAL DATA

2.1. General Principles Regarding Personal Data Processing

Santa Farma processes personal data in accordance with the following principles within the scope of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy and pursuant to Article 4, Paragraph 2 of the KVKK:

• Compliance with the law and honesty.
• Being accurate and, where necessary, up-to-date.
• Processing for specific, explicit, and legitimate purposes.
• Being relevant, limited, and proportionate to the purposes for which they are processed.
• Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

2.2. Data Processed by Santa Farma

Personal data is processed within Santa Farma through explicit consent obtained from data subjects or in light of activities that can be carried out without explicit consent pursuant to Articles 5 and 6 of the KVKK, and this data is processed only within the framework of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy. These types of personal data, which vary and differentiate depending on the type and nature of the relationship between Santa Farma and the data subject, the communication channels used, and the aforementioned purpose information, and are processed in accordance with the principles in this Policy, are as follows:

• Information identifying the data subject such as name, surname, profession, title, work information, education status, gender, marital status, spouse/child information, citizenship status, military service information, criminal record information, tax liability status,
• Data such as date of birth, place of birth, ID number, blood type, religion, and photograph found in identity identification documents such as a copy of the ID card, copy of the birth certificate, passport, and driver's license,
• Contact information such as address, e-mail, telephone, and fax numbers, as well as communication records and other audio data within the scope of telephone calls and e-mail correspondence,
• Natural person information in documents for legal entities such as tax plates, trade gazettes, authorization certificates, qualification certificates, signature circulars, and activity certificates,
• Detailed financial data regarding pricing, reconciliation, collection, and payment activities.

2.3. Purposes of Processing Personal Data

Personal data may be processed by Santa Farma for the following purposes and may be stored for as long as these purposes and relevant legal periods require:

• Carrying out the necessary work by business units to enable customers to benefit from the products and services offered by Santa Farma,
• Planning and execution of corporate sustainability activities,
• Providing support regarding the performance of company and partnership law transactions of group companies,
• Ensuring the legal and commercial security of Santa Farma and the persons who are in a business or contractual relationship with Santa Farma,
• Carrying out commercial activities for the purposes of determining and implementing Santa Farma's contractual relationships, commercial and business strategies.

2.4. Transfer of Personal Data

Santa Farma carries out domestic and international data transfers within the framework of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy and pursuant to Articles 8 and 9 of the KVKK, and personal data can be processed and stored in servers and electronic environments used in this context. The nature of these transfers and the parties with whom they are shared vary depending on the type and nature of the relationship between the data subject and Santa Farma, the purpose of the transfer, and the relevant legal basis, and these parties are generally as follows:

• Domestic and international third parties from whom services/products are received,
• Direct and indirect shareholders, affiliates, subsidiaries,
• Persons and institutions from whom services/products and/or consultancy are received,
• Business partners with a contractual relationship.

2.5. Collection of Personal Data

To fulfill the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy, Santa Farma may obtain personal data directly from employees and customers, suppliers, business partners, group companies, the call center, official institutions, and other physical environments within the framework of the conditions stipulated in Articles 5 and 6 of the KVKK, or it may collect personal data through websites, mobile applications, social media, and other public channels or organized training, organizations, and similar events.

2.6. Retention Period of Personal Data

Personal data is kept within Santa Farma during the relevant legal retention periods and is stored for the period necessary to carry out the activities associated with this data and the purposes also specified in this Policy. Personal data whose purpose of use has ended and whose legal retention period has expired is deleted, destroyed, or anonymized by Santa Farma pursuant to Article 7 of the KVKK.

2.7. Rights of the Data Subject under KVKK

The rights of natural persons whose personal data is processed are regulated within the scope of Article 11 of the KVKK, and according to this article, data subjects have the following rights over Santa Farma:

• Learning whether personal data is processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom personal data is transferred domestically or abroad,
• Requesting correction of personal data if it is incomplete or incorrectly processed,
• Requesting the deletion or destruction of personal data in case the reasons requiring its processing disappear,
• Requesting notification of correction and deletion operations to third parties to whom personal data has been transferred,
• Objecting to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• Requesting compensation for damages in case of loss due to unlawful processing of personal data.

Requests from data subjects for the purpose of exercising one of the above rights will be met by Santa Farma within 30 days at the latest. These requests can be delivered in person with identity identifying documents to the address H. Edip Adıvar, Boru Çiçeği Sokağı No:16, 34382 Şişli/İstanbul, sent through a notary, or transmitted to the santafarmaas@hs01.kep.tr KEP address with a secure electronic signature. If the requests require an additional cost, Santa Farma may request a fee in the amounts determined within the scope of the Communiqué on Procedures and Principles for Application to Data Controller.

2.8. Data Transfer Abroad

Personal data may be transferred abroad in accordance with the legislation for the purpose of processing, storage, management, or any other use specified in this Policy to meet the purposes exemplified in the 'Purposes of Processing Personal Data' section. Necessary measures are taken to protect personal data appropriately in these transfers.

2.9. Security of Personal Data

Santa Farma attaches importance to protecting the confidentiality and security of personal data. In this direction, necessary technical and administrative security measures are taken to protect personal data against unauthorized access, damage, loss, or disclosure. In this direction, necessary systemic access controls, data access controls, secure transfer controls, business continuity controls, and other necessary corporate controls are applied.

3. COOKIES AND SIMILAR TECHNOLOGIES

3.1. General

Small data files sent to users' devices by the internet network server through the internet browser being used are called cookies, and websites recognize users through these cookies, and the lifespan of cookies varies depending on browser settings. While these cookies are created through systems managed by Santa Farma, some service providers authorized by Santa Farma can also obtain IP addresses, unique identifiers, and device identifier information by placing similar technologies on users' devices. In addition, although links belonging to third parties in Santa Farma systems are subject to the privacy policies of these third parties, the responsibility for privacy practices does not belong to Santa Farma, and in this context, it is recommended to read the privacy policy of the site when the site within the scope of the relevant link is visited.

3.2. Cookie Types

Cookies, whose main purpose is to provide convenience to users, are basically collected in 4 main groups:

• Session Cookies: These are cookies that allow taking advantage of various features such as carrying information between internet pages and systematically remembering the information entered by the user and are necessary for the functions of the Santa Farma website to function properly.
• Performance Cookies: These are cookies that collect information on the frequency of visiting pages, possible error messages, the total time users spend on the relevant page, along with usage patterns of the site, and are used for the purpose of increasing the performance of the Santa Farma website.
• Functional Cookies: These are cookies that provide remembering previously selected options for the purpose of providing convenience to the user and aim to provide advanced internet features to users within the scope of the Santa Farma website.
• Advertising and Third-Party Cookies: These are cookies belonging to third-party suppliers and allow the use of some functions on the Santa Farma website and the tracking of advertisements.

3.3. Purposes of Using Cookies

The purposes of use for cookies used by Santa Farma are as follows:

• Uses for operational purposes: Santa Farma may use cookies that enable benefiting from functions on this site or detect irregular behavior for the purpose of ensuring the management and security of its systems.
• Uses for functionality: Santa Farma may use cookies that remind users of their information and past choices for the purpose of facilitating the use of its systems and providing usage features specific to the user.
• Uses for performance: Santa Farma may use cookies that evaluate and analyze user behavior and interaction with sent messages for the purpose of increasing and measuring the performance of its systems.
• Uses for advertising purposes: Santa Farma may use cookies that measure the effectiveness of these advertisements or analyze the click status for the purpose of transmitting advertisements and similar content within the scope of users' interests through systems belonging to itself or third parties.

3.4. Disabling Cookies

The use of cookies is pre-defined as selected in many browsers, and users can change this selection status from browser settings and therefore delete existing cookies and refuse future cookie uses; as a matter of fact, in case the use of cookies is canceled, it may be possible that some features in Santa Farma systems cannot be utilized. The method of changing the cookie usage choice varies depending on the browser type and can be learned from the relevant service provider at any time.

4. VALIDITY AND UPDATES

This Policy will enter into force on the date it is approved by the Company's Board of Directors. Changes to be made in the Policy will enter into force after the approval of the Chairman of the Board of Directors of the Company. The Policy is normally reviewed and updated once a year. However, the Company reserves the right to review this Policy and update, change, or eliminate the policy and create a new policy in necessary cases in line with legislative changes, changes in a referenced technical standard, actions and/or decisions of the Personal Data Protection Board, and court decisions. The authority to decide on the abolition of the Policy belongs to the Company's Board of Directors.