Healthcare Professional Privacy Notice

SANTA FARMA İLAÇ SANAYİİ A.Ş. THE PROTECTION AND PROCESSING OF PERSONAL DATA OF HEALTHCARE PROFESSIONALS PRIVACY NOTICE

1. Data Controller

With this Information Text on the Protection and Processing of Personal Data of Healthcare Professionals (“Information Text”), as Santa Farma İlaç Sanayii A.Ş. (“Company” or “Santa Farma”), in our capacity as Data Controller pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”), we would like to inform you within the scope of our obligation to inform under the KVKK.

2. Your Processed Personal Data

As defined in Article 3/1-d of the KVKK, personal data refers to any information relating to an identified or identifiable natural person (“Personal Data”).

Within the scope of this Information Text, “Personal Data” refers to your name-surname, T.C. Identification Number, title, photograph, address, date of birth, telephone number, e-mail address, tax number, CV, area of expertise, institutions and cities where you currently work or have worked, your unit, position, registry number, other information you convey during your request, primarily product information requests or medical information requests, as well as your opinions regarding Santa Farma products and personnel, flight details, accommodation information, passport details regarding possible congress/symposium trips you may attend with Santa Farma's support, your visual and audio data, financial data such as bank account information, IBAN, etc. in case you provide services to Santa Farma, and your professional association and foundation membership which are in the nature of special categories of personal data (hereinafter referred to as “Personal Data”).

3. Purposes and Legal Grounds for Processing Personal Data

To the extent appropriate for its purpose, your compliant and limited Personal Data will be processed based on the legal ground of explicit consent within the scope of Article 5/1 of the KVKK for the following purposes:

• Inviting you to domestic and international congresses and product promotion meetings organized or sponsored by Santa Farma, and contacting you for this purpose.
• Contacting you and conducting discussions to receive consultancy and speaker services from you regarding Santa Farma products and the activities we carry out, to the extent permitted by the legislation and on matters needed.
• Conducting surveys and planning and executing market research activities to measure the perception of Santa Farma products among healthcare professionals and/or collect opinions on new products.
• Creating, developing, and sharing on Santa Farma digital platforms, introducing Santa Farma products and services, and using them in in-company training and planning.
• Providing you with targeted/non-targeted information, making promotions, planning our promotional activities regarding Santa Farma products and services to the extent and scope permitted by the legislation, and sending you commercial electronic messages (via e-mail, telephone, or SMS/Whatsapp) for these purposes.

In the event of your participation in domestic and international scientific meetings sponsored by Santa Farma or product promotion meetings organized by Santa Farma, and/or receiving speaker/consultancy services from you by Santa Farma, and/or transferring value to you by Santa Farma within the scope of the Regulation on Promotional Activities of Medicinal Products for Human Use (“Promotional Regulation”), to the extent appropriate for its purpose, your compliant and limited personal data will be processed based on the following purposes and legal grounds:

• In case you participate in scientific meetings and product promotion meetings organized or contributed to by Santa Farma as a license holder in accordance with the Promotional Regulation and the Application Guideline for Scientific and Educational Activity Meetings (“Guideline”), in order for Santa Farma to fulfill its obligation to report the information of healthcare professionals it will support to the Turkish Medicines and Medical Devices Agency (“TİTCK”), on the ground that it is mandatory for the fulfillment of our legal obligations as a data controller pursuant to Article 5/2 (ç) of the KVKK, and that it is mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f);
• In order to organize travel, accommodation, and event participation organizations related to your participation in scientific meetings/product promotion meetings/advisory boards or your provision of speaker/consultancy services to the Company, to fulfill rights and obligations arising from contracts, and to take photographs and videos at relevant meetings/events and publish them on various online digital platforms and Santa Farma's accounts within the scope of internal and external corporate communication activities, on the ground that it is directly related to the establishment or performance of a contract pursuant to Article 5/2 (c) of the KVKK, and that it is mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f);
• In case you request information about Santa Farma products or medical issues, or in case free samples are delivered to you, in order to meet these requests and store the requests and relevant records as stipulated in the legislation, on the ground that it is mandatory for the fulfillment of our legal obligations as a data controller pursuant to Article 5/2 (ç) of the KVKK, and that it is mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f);
• In order for Santa Farma to fulfill its obligation to report transactions subject to value transfer made to you and value transfers regarding events to TİTCK as required by the Promotional Regulation, on the ground that it is directly related to the establishment or performance of a contract pursuant to Article 5/2 (c) of the KVKK, and that it is mandatory for the fulfillment of our legal obligations as a data controller pursuant to Article 5/2 (ç) of the KVKK;
• In order for Santa Farma to carry out contract processes, field visits, and operationally follow up the process, on the ground that it is directly related to the establishment or performance of a contract pursuant to Article 5/2 (c) of the KVKK, and that it is mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f);
• Within the scope of pharmacovigilance activities, in order to carry out reporting processes arising from the relevant legislation, including suspected, unexpected and/or adverse events, serious adverse events, and to follow up after reporting, on the ground that it is mandatory for the fulfillment of our legal obligations as a data controller pursuant to Article 5/2 (ç) of the KVKK, and that it is mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f);
• In order to carry out internal reporting, follow up compliance transactions and conduct and manage compliance audits necessary to carry out operations in accordance with Santa Farma procedures and/or relevant legislation, inform relevant institutions/organizations when necessary, resolve potential legal disputes, and keep and archive records in internal company systems and files, on the ground that it is mandatory for the fulfillment of our legal obligations as a data controller pursuant to Article 5/2 (ç) of the KVKK, mandatory for our legitimate interests as a data controller pursuant to Article 5/2 (f), and mandatory for the establishment, exercise, or protection of a right pursuant to Article 5/2 (e) of the KVKK.

4. Methods of Collecting Personal Data

Your Personal Data may be collected verbally, in writing, or electronically through face-to-face meetings, visits, meetings, events conducted with you by Santa Farma employees, or publicly available websites such as the website of the institution you work for or associations you are a member of to be used in accordance with the purpose of making your data public, as well as through Company forms you have filled out, e-mails you have sent, and contracts to which you are a party together with the Company, for the purposes and legal grounds specified in this Information Text; and with respect to your personal data specified as processed based on explicit consent in this Information Text, within the framework of the consent you have given in the annex of this Information Text.

5. To Whom and For What Purpose Personal Data May Be Transferred

The Company may transfer your Personal Data, based on your explicit consent or in cases legally permitted (within the framework of the purposes specified in Section 3), domestically or abroad; to business partners collaborated with and/or service received from, service providers (including lawyers, financial advisors, auditors, and travel agencies), to companies in the group to which the Company belongs in order to ensure management due to the Company's global structure, to institutions and organizations organizing the event and third-party companies from which they receive service/support/consultancy in case of an organized scientific event/meeting, to third parties providing support in pharmacovigilance activities, CRM activities, information technologies, and other areas related to the Company's activities (including storage, data processing, backup, software, cloud computing support companies and Microsoft 365, Drive servers), and/or open them to access for authorized institutions and organizations for the purpose of fulfilling obligations arising from legislation.

6. Your Rights

You may submit your requests regarding your personal data processed by Santa Farma within the scope of Article 11 of the KVKK at any time to the addresses below, in writing in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, or by using a registered electronic mail address (KEP), electronic signature, mobile signature, or your electronic mail address previously notified to us and registered in our systems.

Requests submitted within this scope will be concluded by Santa Farma free of charge as soon as possible and within thirty days at the latest. However, in the event that a fee is stipulated by the Personal Data Protection Board, the fee specified in the tariff determined by our Company shall be charged.

IDENTITY OF THE DATA CONTROLLER

Data Controller: Santa Farma İlaç Sanayii A.Ş.

Address: H. Edip Adıvar / Boru Çiçeği Sokak / No:16 Şişli / İstanbul

MERSİS: 0744001139900019

E-mail address: kvkk@santafarma.com.tr

Kep address: santafarmaas@hs01.kep.tr

I have read and understood the Information Text on the Protection and Processing of Personal Data of Healthcare Professionals.

Name and Surname:

Date:

Signature: