1. PURPOSE AND SCOPE OF THE POLICY
Vepamed Cosmetics and Medical Products IND. TRADE. A.Ş., PERSONAL DATA PROTECTION AND PROCESSING POLICY (“Policy Vepamed Kozmetik ve Tıp Ürünleri SAN. and was prepared to determine the principles.

​

With the paragraph added to Article 20 of the Constitution as a result of the amendment made in 2010, the protection of personal data was guaranteed by the Constitution and it was decreed that the procedures and principles regarding the protection of personal data would be regulated by law. In this context, Law No. 6698 on the Protection of Personal Data entered into force on 07.04.2016. First of all, regarding the protection of personal data, which is a constitutional right, Vepamed Kozmetik makes this a company policy by arranging the necessary works to raise awareness within the company and by harmonizing the internal operation with the legislation on the protection of personal data.

This Policy aims to guide Vepamed Kozmetik in terms of the implementation of the personal data protection law and the regulations set forth by the relevant legislation.

​

DEFINITIONS OF CONCEPTS

• OPEN CONSENT: Consent on a specific subject, based on information and expressed with free will.

• MAKING ANONYMOUS: Making personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching with other data.

• PERSONAL DATA OWNER: The natural person whose personal data is processed. E.g; Customers, employees.

• PERSONAL DATA: Any information relating to an identified or identifiable natural person.

• SPECIAL QUALIFIED PERSONAL DATA: Data on race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. data are of special nature.

• PROTECTION OF PERSONAL DATA: Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available personal data in whole or in part by automatic or non-automatic means provided that it is a part of any data recording system, It is all kinds of operations performed on data such as classification or prevention of use.

• DATA PROCESSOR: It is the natural and legal person who processes personal data on behalf of the data controller based on the authority given by him.

• DATA RESPONSIBLE: It is the natural and legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

• KVKK: Law No. 6698 on the Protection of Personal Data

​

RECORDING MEDIA OF PERSONAL DATA
Personal data is processed by Vepamed Kozmetik through the following recording media.

- Servers
- Removable memories (USB, Memory Card etc.)
- Information security devices (firewall, log file, antivirus, etc.)
- Personal computers
- Optical discs (CD, DVD, etc.)
- Printer, scanner, copier
- Software (office software, government software)
- Mobile devices (phone, tablet, etc.)
- Non-electronic written, printed and visual media
- Lockers

​

GROUPS OF EMPLOYEE, CANDIDATES, INTERNSHIP AND PHYSICAL VISITORS
Personal Data Collected Regarding the Intern and Candidate Person Group
Vepamed Kozmetik, regarding the candidate group applying for job application;

Identity Information, Contact Information, Professional Experience Information, Health Information, Education Information, Visual Data Information, Criminal Conviction and Security Measures, Name and Surname, Date of Birth, Address, Telephone, E-mail, Military Status, Relative Information, , Marital Status, Educational Status, Professional Experience, Reference Information, Vocational Training, Duty, Health Information, Driver's License Information, Photograph, TCKN, CV (prepared by himself) Information is processed.

Personal Data Collected Regarding the Employee Group
Vepamed Kozmetik, regarding the employee group for the reason and purpose of the employment relationship / performance of the employment contract; Credential Information, Contact Information, Legal Transaction and Compliance Information, Personal Information, Financial Information, Professional Experience Information, Health Information, Criminal Conviction and Security Measures,

Location Information, Legal Action and Compliance Information, Employee Transaction Information, Photograph, Employability Information, Account Information, Residence, Criminal Record Record, Diploma Information, Vocational Education Information, Blood Type, Date of Marriage, Spouse and Child Identity Information, Military Discharge or Status information, İşkur Registration Information, Reference Information, and employment information are processed.

Data Collected Regarding the Physical Visitor Person Group
Vepamed Kozmetik maintains the image record of its physical visitors in order to ensure physical security.

Purposes of Collection and Processing of Personal Data of Candidates and Interns
Considering the nature of the application, Vepamed Kozmetik processes the personal data of the candidate for the following purposes, since it is an obligation to carry out Human Resources Processes, Legal obligations, completion of bank transactions, and to share with the government, public and institutions:

• Incorporating effective personnel into the institution

• Evaluating the qualification, experience, interest and suitability of the Intern or Candidate for the open position,

• If necessary, checking the accuracy of the information submitted by the candidate or contacting third parties and conducting a reference search about the candidate,

• To contact the candidate about the application and recruitment process or, if appropriate, to contact the candidate for any position opened later in the country or abroad,

• To meet the requirements of any legislation or the demands of the authorized institution or organization,

• To develop and improve the recruitment principles applied by Vepamed Kozmetik,

• To carry out the activities that should be done within the framework of occupational health and safety.

​

4.5. Purposes of Collecting and Processing Personal Data of Employees
Vepamed Kozmetik processes the personal data of the employee group for the following purposes:

• To develop and improve the employment contract principles applied by Vepamed Kozmetik,
• Execution of emergency processes,
• To carry out audit ethical activities,
• Execution of human resources processes,
• Meeting the demands of authorized public institutions or organizations in disputes that may arise or in a judicial case that may occur,
• In order to fulfill the legal obligations regarding the employment of the employee,
• In order to open a salary account for the personnel, to provide rental cars when necessary, to provide telephone lines, to provide meal cards, to perform automatic individual retirement transactions,
• In order to monitor the health conditions necessary for the employee to fulfill his duty;
• In order to follow up the salary liens placed on the employee's salary,
• In order to ensure and control the quality, information security and privacy policies and standards of Vepamed Kozmetik,
• In case of emergencies, in order to communicate with the persons given by the Employee's own consent,
• In order to determine and control the entry and exit from the work,
• In order to prepare reports and analyzes to be made to the senior management,
• Software, enterprise resource planning, reporting, marketing etc. performing functions such as
• In order to evaluate performance and determine wage policies,
• Recording of camera images due to privacy and security practices in the workplace,
• Fulfillment of the requirements determined by laws and regulations (tax legislation, social security legislation, legislation on the law of obligations, legislation on commercial law, occupational health and safety law, legislation on electronic communication, etc. all relevant legislation)
• To carry out the activities that should be done within the framework of occupational health and safety.

Methods of Collection and Processing of Personal Data of Employees and Candidates
During the recruitment process, the personal data of the candidates are collected together with or in addition to other methods and means specified in this Policy, by the following methods and means:

• Application form published in print or electronic media,

• Resumes submitted by candidates to Vepamed Kozmetik via e-mail, cargo, reference and similar methods,

• Employment or consultancy companies, İŞKUR, HR sites, Linkedin and similar human resources social platforms,

• Controls made to confirm the accuracy of the information conveyed by the candidate and researches made by Vepamed Kozmetik. Vepamed Kozmetik processes the collected personal data automatically or non-automatically through computer systems and human resources personnel.

Reference Research on Candidates and Interns
Vepamed Kozmetik can conduct reference research about candidates and interns with the information that candidates and interns have specified by filling in the relevant fields in the job application form. The reference research to be conducted will generally aim to confirm the accuracy of the information given by the candidate and the trainee. In addition, it will be among the aims of the research to determine the information that the candidate and the intern keep about himself and that may cause risks for Vepamed Kozmetik.

The obligation to inform the persons to be contacted for reference research will be fulfilled by the Vepamed Kozmetik official at the first communication. Within the scope of the reference research to be made, necessary personal data such as identity information, work and education experiences of the candidates can be shared with third parties. In addition, personal data about interns and candidates can be obtained from third parties. Interns and Candidates can always contact Vepamed Kozmetik about the reference research to be done about them.

Rights of Employees and Candidates Regarding Personal Data
Candidates who want to exercise their rights arising from Article 11 of the Personal Data Protection Law No. 6698 (“KVKK”) can apply to Vepamed Kozmetik within the scope of the procedures and principles explained in this Policy.

Among the Personal Data Collected during the Internship and Candidacy Process, the Processing of which will continue in case of recruitment
All personal data collected and processed about the intern and the candidate during the recruitment processes are transferred to the personnel file if the candidate is decided to be employed in the relevant vacant position.

Security of Personal Data of Employees, Interns and Candidates
Vepamed Kozmetik does not discriminate between data subject groups (such as candidates, trainees) in terms of the security of the personal data it processes. Detailed information about the security of personal data can be found in the section of this document on the security of personal data.

CUSTOMERS AND SUPPLIERS
Although the service offered to the customer by Vepamed Kozmetik may vary depending on the product or commercial activity; The following personal data are processed verbally, in writing or electronically, provided by Vepamed Kozmetik and during your use of Vepamed Kozmetik products and services:

• Name surname

• Address

• Phone

• Email

• TRNC

• Bank IBAN No Information (During return transactions)

• Billing information

Personal Data Collected Regarding Supplier or Supplier employee
Although it may vary depending on the service, product or commercial activity received by Vepamed Kozmetik; The following personal data are processed in verbal, written or electronic media, provided by Vepamed Kozmetik and for the purpose of operating Vepamed Kozmetik business processes:

• Name and surname

• Phone number

• Address

• e-mail address

• Signature

• Bank Account Information

Purposes of Collection and Processing of Customers and Supplier or Supplier employee Data
Vepamed Kozmetik processes the personal data of the customer for the following purposes, taking into account the service it provides to the customer and the business relationship between them:

• Evaluation of the suggestion and request forms filled in by the customer and development of the business.

• Cargo provided to the customer, etc. the proper delivery of services.

• Making use of data for dispatch invoice sending

• To use to resolve any dispute

• Execution of Activities in Compliance with the Legislation

• Execution of Goods Service After Sales Support Services

• Execution of Goods/Service Sales Processes

• Execution of Goods/Service Procurement Processes

• Execution of Good/Service Production and Operation Processes

Methods of Collection and Processing of Personal Data of Customers and Supplier Employees/Authorities
Personal data of Customer and Supplier Employees/Authorities may be collected by the following methods and means, together with or in addition to other methods and means specified in this policy:

• via website

• Verbal, written or electronic media via the Call Center

• By e-mail, written petition/ suggestion-request forms/ technical service forms.

Rights of Customers and Supplier Employee/Authority Personal Data
Customer and supplier employee/authority who want to exercise their rights arising from the Law on Protection of Personal Data No. 6698 (“KVKK”) can apply to Vepamed Kozmetik within the scope of the procedures and principles explained in this policy.

PRINCIPLES ON THE PROCESSING OF PERSONAL DATA
Vepamed Kozmetik shows a special sensitivity to the protection of personal data as a company policy and acts in the light of the following basic principles in this direction.

Processing in Compliance with Law and Integrity
In the processing of personal data, the principles introduced by legal regulations and the general rule of trust and honesty are followed.

Ensuring Personal Data Are Accurate and Up-to-Date When Necessary
Periodic checks and updates are made to ensure that the processed personal data of individual groups are accurate and up-to-date, and necessary measures are taken accordingly. In this context, systems for checking the accuracy of personal data and making necessary corrections are created within Vepamed Kozmetik.

Processing for Specific, Explicit, and Legitimate Purposes
Personal data is processed based on clear, specific and legitimate data processing purposes. The purpose for which the data will be processed is detailed below.

Being Related to the Purpose for which they are Processed, Limited and Measured
Personal data is processed in a measured, purpose-related and limited manner in order to achieve the foreseen purpose/purposes, and the processing of personal data that is not related to the realization of the purpose or that is not needed is avoided.

Retention for as Long as Required for the Purpose of Processing or Envisioned in the Relevant Legislation
Vepamed Kozmetik retains personal data only for as long as required by the relevant legislation or for the purpose for which they are processed. In this context, first of all, it is determined whether a period is foreseen for the storage of personal data in the relevant legislation, if a period is determined, this period is acted upon.

In the event that the period expires or the reasons requiring its processing are eliminated, personal data is deleted, destroyed or anonymized in accordance with Vepamed Kozmetik's Personal Data Retention and Disposal Policy, unless there is a legal reason allowing them to be processed for a longer period of time.

TERMS OF PROCESSING PERSONAL DATA OF PERSON GROUPS
The explicit consent of the relevant groups of persons is only one of the reasons for compliance with the law that makes it possible to process personal data in accordance with the law. Apart from express consent, personal data may also be processed in the presence of one of the other legal compliance reasons listed below.

The basis of the personal data processing activity can be only one of the following reasons for compliance with the law, or more than one of these conditions can be the basis of the same personal data processing activity. In case the processed personal data is special quality personal data; The conditions set out in the "Conditions in which Special Quality Personal Data may be Processed" below apply. Person groups are informed about the personal data processed by this Policy, for what purposes and for what reasons their personal data is processed, from which sources their personal data is collected, with whom this personal data will be shared and how it will be used.

Explicitly Provided in Laws
In cases where the laws expressly stipulate the processing of personal data, Vepamed Kozmetik processes personal data without the explicit consent of the individual groups whose data will be processed. For example, processing personal data in processes such as membership, granting commercial electronic permission, order, payment, delivery, cancellation or return of the product in accordance with the Law on the Regulation of Electronic Commerce.

Failure to Obtain the Explicit Consent of the Person Related to the Cause of Actual Impossibility
In case the personal data of the group of persons who are unable to express their consent due to actual impossibility or whose consent cannot be validated is necessary to protect the life or physical integrity of the person or another person, the data may be processed without the explicit consent of the individual group.

Being Directly Related to the Establishment or Performance of the Contract
Provided that it is directly related to the establishment or performance of a contract, the data may be processed if it is necessary to process the personal data of the parties to the contract.

Vepamed Kozmetik Fulfilling Its Legal Obligation
In case the processing is necessary to fulfill legal obligations as a data controller, personal data of the individual group may be processed without obtaining explicit consent.

Making Personal Data of Person Groups Public
If the personal data of the person group has been made public by him, the data may be processed without the need for explicit consent. For example, the personal data shared by the Member publicly on the internet and in his social media accounts can be processed if this sharing is in accordance with his will and to the extent.

Mandatory Data Processing for the Establishment or Protection of a Right
If data processing is necessary for the establishment, exercise or protection of a right, the data may be processed without the explicit consent of the individual group. For example, putting the information in this complaint file based on a complaint made by the Member to the court.

Processing of Data Based on Legitimate Interest
Provided that it does not harm the fundamental rights and freedoms of the person group, personal data may be processed without the express consent of the person group, if data processing is necessary for the legitimate interests of Vepamed Kozmetik. For example, making satisfaction surveys by Vepamed Kozmetik to ensure customer satisfaction.

Processing of Personal Data of Person Group Based on Explicit Consent
In cases where the personal data of the person group cannot be processed based on any of the conditions specified in article 5(2) above, it will be processed based on express consent.

CONDITIONS WHERE SPECIAL QUALITY PERSONAL DATA MAY BE PROCESSED
Some of the personal data are regulated separately as "special quality personal data" and are subject to special protection.

Processing of Private Personal Data Based on Explicit Consent
Special categories of personal data can be processed by taking the principles set forth in this Policy and the necessary administrative and technical measures, in case of the explicit consent of the person group.

Cases in which Private Personal Data can be Processed without Express Consent
Special categories of personal data may be processed in the following cases, provided that adequate measures to be determined by the Personal Data Protection Board (“Board”) are taken, in cases where there is no explicit consent of the person group:

• Special categories of personal data other than the health and sexual life of the person group, in cases stipulated by the laws,

• Personal data of a special nature regarding the health and sexual life of the individual group can only be collected by persons or authorized institutions and organizations under the obligation of confidentiality for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing. .

ENLIGHTENING AND INFORMING THE PERSON GROUP
During the acquisition of personal data, the person group is informed by Vepamed Kozmetik. In this context, the identity of the Vepamed Kozmetik contact person, the purpose for which the personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method of collecting personal data and the rights of the individual groups for legal reasons are notified.

If groups of people request information regarding their personal data, they can be sent to the e-mail address vepamed@hs01.kep.tr, by using the registered e-mail (KEP) address, secure electronic signature, mobile signature or the e-mail address registered in Vepamed Kozmetik systems. If an application is made by sending an e-mail, the necessary information is given.

​