Personal Data Protection and Privacy Policy
Santa Farma İlaç Sanayii A.Ş.
PROTECTION OF PERSONAL DATA PRIVACY POLICY
Table of Contents
A. SCOPE
B. DEFINITIONS
C. REFERENCES
D. AMENDMENTS
1 PURPOSE
2 PURPOSE
2.1 General Principles Regarding the Processing of Personal Data
2.2. Data Processed by Santa Farma
2.3. Purposes of Processing Personal Data
2.4. Transfer of Personal Data
2.5. Collection of Personal Data
2.6. Retention Period of Personal Data
2.7. Rights of the Data Subject within the Framework of KVKK
2.8. Cross-Border Data Transfer
2.9. Security of Personal Data
3 COOKIES AND SIMILAR TECHNOLOGIES
3.1. General
3.2. Type of Cookies
3.3. Data Collected via Cookies
3.4. Purposes of Using Cookies
3.5. Cookie Retention Period
3.6. Disabling Cookies and Managing Preferences
4 ENFORCEMENTS AND UPDATES
A. SCOPE
This Policy named Protection of Personal Data Privacy Policy (the “Policy”) has been prepared for the purpose of providing necessary information by explaining the set of rules regarding the processing of personal data, and it has entered into force on xx.xx.2026 upon the approval of the management of Santa Farma İlaç Sanayii A.Ş. (“Santa Farma”).
B. DEFINITIONS
| Personal data | Any information relating to an identified or identifiable natural person, and encompassing all forms that allow the identification of the person as a result of bearing concrete content expressing the physical, economic, cultural, social, or psychological identity of the person or being associated with any record such as identity, tax, or insurance number. |
| Cookie | Cookies are small text files saved to your device via your browser by the websites you visit. Through these files, the website can remember your preferences, improve user experience, and collect statistical information regarding site usage. |
| Special category personal data | Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade-unions, health, sexual life, criminal convictions and security measures, and biometrics and genetics. |
| Explicit consent | Consent that relates to a specified issue, declared by free will based on information. |
| Anonymization | Rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data. |
| Processing of personal data | Any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means. All types of operations performed on the data, starting from their initial collection, fall within this scope. |
| Data Subject | The natural person whose personal data are processed. |
| Data recording system | The recording system in which personal data are structured and processed according to specific criteria. |
| Data controller | The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. |
| Data processor | The natural or legal person who processes personal data on behalf of the data controller upon their authorization. |
| KVKK | The Law on the Protection of Personal Data No. 6698 dated March 24, 2016, published in the Official Gazette No. 29677 dated April 7, 2016. |
| Board | Personal Data Protection Board. |
| Authority | Personal Data Protection Authority. |
| Policy | Santa Farma Protection of Personal Data and Privacy Policy. |
C. REFERENCES
| Law on the Protection of Personal Data (‘KVKK’): | While being the subject of this Policy, it is the Law No. 6698 dated March 24, 2016, published in the Official Gazette No. 29677 dated April 7, 2016. |
| Communiqué on the Procedures and Principles of Application to the Data Controller: | The Communiqué published in the Official Gazette No. 30356 dated March 10, 2018. |
D. AMENDMENTS
Amendments to be made to this Policy upon the entry into force of additional legislation under the Law or at various times can be tracked on the Santa Farma corporate website, and the current version of this Policy can also be accessed from this corporate site.
1 PURPOSE
Santa Farma processes the personal data of its guarantors, suppliers, employees, customers, visitors, and other natural persons who establish a relationship with it by applying for a job or through any other purpose or channel, in accordance with the law in order to carry out its activities. Relevant clarification texts may be consulted regarding the processing of personal data of employees and employee candidates.
The purpose of this policy is to inform the relevant persons by providing explanations about these processing activities carried out by Santa Farma and the systems containing personal data, and thus to ensure transparency regarding personal data.
In this context, Santa Farma has detailed and explained the processing of personal data under the KVKK, the data subjects subject to this processing and their rights, along with the use of cookies and similar technologies in this Policy.
2 PERSONAL DATA
2.1. General Principles Regarding the Processing of Personal Data
Santa Farma processes personal data in accordance with the following principles, pursuant to paragraph 2 of Article 4 of the KVKK and within the scope of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy:
- Lawfulness and conformity with rules of bona fides.
- Accuracy and being up to date, where necessary.
- Being processed for specific, explicit and legitimate purposes.
- Being relevant with, limited to and proportionate to the purposes for which they are processed.
- Being retained for the period of time stipulated by relevant legislation or the purpose for which they are processed.
2.2. Data Processed by Santa Farma
Personal data is processed within Santa Farma through the explicit consent obtained from the data subjects or in light of the activities that can be carried out without explicit consent as per Articles 5 and 6 of the KVKK, and this data is processed only within the framework of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy. These personal data types, which vary and differ depending on the type and nature of the relationship between Santa Farma and the data subject, the communication channels used, and the aforementioned purpose information, and which are processed in compliance with the principles in this Policy, are as follows:
- Identifying information of the data subject such as name, surname, profession, title, employment information, educational status, gender, marital status, spouse/child information, citizenship status, military service information, criminal record information, tax liability status,
- Data such as date of birth, place of birth, identity number, blood type, religion, and photograph found on identification documents like identity card photocopy, certificate of identity register copy, passport, and driver's license, communication information such as address, e-mail, telephone, and fax number, along with communication records and other audio data within the scope of telephone calls and e-mail correspondence,
- Natural person information in documents for legal entities such as tax plate, trade registry gazette, certificate of authorization, qualification certificates, circular of signatures, and certificate of activity,
- Detailed financial data regarding pricing, reconciliation, collection, and payment activities, title information, and communication information pertaining to customer and supplier representatives,
- Data such as IP address, unique identifier and device identifier information, and geographic location processed through cookies,
- Visual and audio data processed through call center and training or event recordings..
2.3. Purposes of Processing Personal Data
Personal data can be processed by Santa Farma within the scope of the following purposes and can be retained as long as foreseen by these purposes and the relevant legal periods:
- Execution of Santa Farma's commercial activities,
- Carrying out necessary studies by business units to ensure customers benefit from the products and services offered by Santa Farma,
- Planning and executing corporate sustainability activities,
- Providing support for the realization of corporate and partnership law transactions of group companies,
- Ensuring the legal and commercial security of Santa Farma and individuals who are in a business relationship or contractual relationship with Santa Farma,
- Execution of commercial activities for the purposes of determining and implementing Santa Farma's contractual relationships, commercial and business strategies,
2.4. Transfer of Personal Data
Santa Farma transfers data domestically and abroad within the framework of the purposes exemplified in the 'Purposes of Processing Personal Data' section of this Policy and in accordance with Articles 8 and 9 of the KVKK, and personal data can be processed and stored in servers and electronic environments used in this context. The nature of these transfers and the parties with whom they are shared vary depending on the type and nature of the relationship between the data subject and Santa Farma, the purpose of the transfer, and the relevant legal basis, and these parties are generally as follows:
- Domestic and foreign third parties from whom Services / Products are procured,
- Direct and indirect shareholders, affiliates, subsidiaries,
- Persons and institutions from whom Services / Products and/or consultancy are procured,
- Business partners with a contractual relationship
2.5. Collection of Personal Data
Personal data is retained within Santa Farma for the duration of the relevant legal retention periods and is stored for the time necessary to realize the activities associated with this data and the purposes also stated in this Policy. Personal data whose purpose of use has ended and legal retention period has expired is deleted, destroyed, or anonymized by Santa Farma in accordance with Article 7 of the KVKK.
2.6. Retention Period of Personal Data
Personal data is retained within Santa Farma for the duration of the relevant statutory retention periods and for the period necessary to carry out the activities and fulfill the purposes specified in this Policy. Personal data whose purpose of use has expired and whose statutory retention period has ended is deleted, destroyed, or anonymized by Santa Farma in accordance with Article 7 of the Law on the Protection of Personal Data (KVKK).
2.7. Rights of the Data Subject within the Framework of KVKK
The rights of natural persons whose personal data is processed are regulated within the scope of Article 11 of the KVKK, and under this article, data subjects have the following rights over Santa Farma:
- To learn whether personal data is being processed or not,
- To request information if personal data has been processed,
- To learn the purpose of processing the personal data and whether they are being used in accordance with their purpose,
- To know the third parties to whom personal data is transferred domestically or abroad,
- To request the rectification of the incomplete or inaccurate data, if any,
- To request the erasure or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,
- To request notification of the operations carried out concerning rectification, erasure, or destruction to third parties to whom personal data has been transferred,
- To object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
- To claim compensation for the damage arising from the unlawful processing of personal data.
Requests coming from data subjects intended for exercising one of the rights above will be fulfilled by Santa Farma as soon as possible and within 30 days at the latest. These requests may be submitted by delivering them in person with identifying documents to the address H. Edip Adıvar, Boru Çiçeği Sokağı No:16, 34382 Şişli/İstanbul, by sending them through a notary public, or by transmitting them with a secure electronic signature to the KEP address santafarmaas@hs01.kep.tr. Should the requests require an additional cost, Santa Farma may request a fee in the amounts determined within the scope of the Communiqué on the Procedures and Principles of Application to the Data Controller.
2.8. Cross-Border Data Transfer
Personal data may be transferred abroad in accordance with the applicable legislation for processing, storage, management, or any other use specified in this Policy, in order to fulfill the purposes set forth in the ‘Purposes of Processing Personal Data’ section of this Policy. Appropriate measures are taken to ensure the adequate protection of personal data during such transfers. Transfers abroad are carried out on the basis of an adequacy decision rendered by the Board or, in the absence of an adequacy decision, provided that appropriate safeguards such as Standard Contractual Clauses are ensured.
2.9. Security of Personal Data
Santa Farma attaches importance to protecting the confidentiality and security of personal data. In this direction, necessary technical and administrative security measures are taken to protect personal data against unauthorized access, damage, loss, or disclosure. Accordingly, necessary system access controls, data access controls, secure transfer controls, business continuity controls, and other necessary corporate controls are implemented.
3 COOKIES AND SIMILAR TECHNOLOGIES
3.1. General
Small data files sent to users' devices by the internet network server through the internet browser in use are referred to as cookies, and websites recognize users via these cookies, and the lifespan of cookies varies depending on the browser settings.
While these cookies are created through systems managed by Santa Farma, some service providers authorized by Santa Farma can also acquire IP address, unique identifier, and device identifier information by placing similar technologies on users' devices. Furthermore, although the links to third parties found in Santa Farma systems are subject to the privacy policies of these third parties, the responsibility for privacy practices does not belong to Santa Farma, and in this context, it is recommended to read the site's privacy policy when the site within the scope of the relevant link is visited.
The legal ground for the personal data processing activity carried out through cookies is determined according to the nature of the cookie. Cookies that are strictly necessary for the operation of the website are used based on the legitimate interest of Santa Farma pursuant to Art. 5/2-f of KVKK. Non-strictly necessary cookies (analytical data) are used only if the data subject has explicit consent pursuant to Art. 5/1 of KVKK.
Explicit consent regarding non-strictly necessary cookies is obtained through the cookie management tool presented upon the first entry to the website, separately for each cookie group and through the active choice of the user..
3.2. Type of Cookies
Cookies, the main purpose of which is to provide convenience to users, are basically grouped into two main categories:
- Strictly Necessary Cookies: These are cookies that allow the use of various features such as carrying information between internet pages and systematically remembering information entered by the user, and they are necessary for the proper functioning of the functions belonging to the Santa Farma website.
- Analytical Cookies: These are cookies that enable the production of analytical results such as the number of visitors visiting the website, the detection of pages viewed on the website, website visit hours, and website page scrolling movements via analytical cookies.
3.3. Data Collected via Cookies
During your visit to our site, data such as which site you came from, your IP address, unique identifier and device identifier information, your geographic location, your interaction with our site and our business partners, the preferences you make on the site, and your shares on social media may be collected through cookies.
This data can be used to generate statistics regarding site usage, analyze user behavior, and increase service quality. Furthermore, data shared with our business partners may be combined and analyzed.
3.4. Purposes of Using Cookies
The purposes of using the cookies utilized by Santa Farma are as follows:
- Uses for operational purposes: For the administration of its systems and ensuring their security, Santa Farma may use cookies that enable benefiting from the functions on this site or detect irregular behavior.
- Analytical uses: Santa Farma may use cookies that enable the production of analytical results such as the number of visitors visiting the website, the detection of pages viewed on the website, website visit hours, and website page scrolling movements for the purpose of analyzing website usage.
3.5 Cookie Retention Period
- Session Cookies: Session Cookies:
- Persistent Cookies: Remain on the device until manually deleted by the user or for a specific period of time. The duration may vary according to the type of cookie and device settings.
3.6 Disabling Cookies and Managing Preferences
Users can change their cookie preferences at any time through their browser settings. Depending on the browser type, you can perform actions regarding cookies such as:
- Blocking,
- Deleting,
- Allowing only specific cookies.
These preferences must be made separately for each device and browser.
You can access information about cookie management in different browsers from the links below:
Users can change the selection status regarding cookie usage from browser settings and therefore delete existing cookies and reject future cookie uses as well; as a matter of fact, in case the use of cookies is canceled, it may be possible that some features in Santa Farma systems cannot be utilized.
The method for changing the cookie usage selection varies depending on the browser type and can be learned from the relevant service provider at any time.
4 ENFORCEMENTS AND UPDATES
This Policy shall enter into force on the date it is approved by the Company's Board of Directors. Amendments to be made to the Policy shall enter into force after the approval of the Chairman of the Company's Board of Directors. The Policy is ordinarily reviewed and updated once a year. However, in line with legislative changes, changes in a referenced technical standard, actions and/or decisions of the Personal Data Protection Board, and court decisions, the Company reserves the right to review this Policy and, where necessary, to update, amend or abolish the policy and create a new one. The authority to decide on the abolishment of the Policy belongs to the Company's Board of Directors.