About Your Personal Data

INFORMATION NOTICE UNDER PERSONAL DATA PROTECTION LAW NO. 6698

This notice provides information on the processing of personal data collected by MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ (the “Company”), acting as DATA CONTROLLER under Personal Data Protection Law No. 6698 (the “Data Protection Law”) and applicable legislation.

In this notice, personal data and special categories of personal data may together be referred to as “personal data”. Your personal data processed for the purposes stated here may be processed and transferred in proportion to those purposes.

Groups Whose Personal Data Is Collected by the Company; Data Collected; Processing Purposes; Legal Grounds; Collection Methods; and Recipient Groups

Data Subject Group: JOB APPLICANT

Personal Data Collected: Identity data (name and surname, Turkish identity number, nationality, parents’ names, date of birth, marital status, place of birth, gender, passport number); contact data (telephone number, address, emergency contact number, address number, email); physical premises security data (employee and visitor CCTV recordings during their presence, entry/exit logbook); professional experience data (graduation, foreign languages, courses and seminars, computer skills, work experience); visual and audio records (passport photo, visual and audio recordings); health data (major illnesses, medications, disability, prostheses or devices used); criminal convictions and security measures (criminal record and related information); applicant transaction data (driving licence class, SRC certificate, obstacles to travel, position applied for, application date, salary expectation, suitability for shifts and overtime, willingness to relocate, interview information); signature data (handwritten or electronic signature, fingerprint, special marks on documents containing personal data); other data (competencies, private health or life insurance, military service status, references, applicant interview, employee body measurements, driving licence class, SRC certificate, obstacles to travel, position applied for, application date, salary expectation, suitability for shifts and overtime, willingness to relocate and interview information).

Purposes of Processing: Personal data is processed and may be transferred for recruiting new personnel; emergency management processes; archiving applicant information; sharing applicant information with management; reviewing applicants and identifying candidates to employ; selection and placement of applicants, interns and students; applicant application processes; fulfilment of employment-contract and statutory obligations for employees; conducting activities in compliance with legislation; planning and managing compliance with applicable legislation and Company procedures; physical premises security; communication activities; planning human resources processes; occupational health and safety activities; verifying data with references listed in your CV; checking suitability for the position; reference checks; retention and archiving activities; contract processes; recruiting new personnel; providing information to authorised persons, institutions and organisations; sharing with management.

Collection Methods: Our Company may collect personal data in physical or electronic environments. In physical form, data is collected directly from you through the job application form you complete. Electronically, it is collected through websites allowing CV submission or job applications, email and security cameras when entering the premises.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (c) necessity to process the parties’ data directly in connection with establishing or performing a contract; (d) the data subject has made the data public; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced. Article 6(3) prohibits processing special categories of personal data except where: (a) the data subject’s explicit consent; (b) express provision in laws; (ç) processing data made public by the data subject in accordance with the intention of making it public; (d) necessity to establish, exercise or protect a right; (f) necessity to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance.

Transfers of Personal Data: Your personal data is not transferred to third parties in any way.

Data Subject Group: EMPLOYEE

Personal Data Collected: Identity data (name and surname, Turkish identity number, nationality, parents’ names, date of birth, marital status, place of birth, gender, civil registration location, passport number); contact data (address number, email, correspondence address); physical premises security data (CCTV recordings of employees and visitors during their presence); professional experience data (professional and technical knowledge, total experience, employment status and title, employment history including company names, periods and job descriptions, certificates, computer skills, diploma information, courses, vocational training and transcripts); visual and audio records (passport photos, visual and audio recordings); health data (disability, pre-employment and periodic medical examinations, blood group, devices and prostheses, medical reports and report dates and days, tetanus vaccination, accident reports, accident date and time, number of workers at the time, work start time on the accident date, loss of limbs, description of the incident, personal health information); criminal convictions and security measures (criminal records and related information); signature data (handwritten signatures on personal-data documents); other data (military service status, applicant interview, employee body measurements); location data (vehicle GPRS, device GPRS, location); personnel data (photograph, education, payroll, employment start and termination information, CV, wages, duties, e-declarations, seniority base date, department, insurance, references, attendance, leave, disciplinary investigations, asset declarations, performance assessments and all data forming the basis of personnel entitlements of employees or natural persons with a working relationship with the Company, employment contract, graduation, suitability for duty, pension fund information, job application form, social security information, employment entry documents, minimum living allowance, personnel number, position, department and unit, title, most recent start date, entry and exit dates, flexible-hours status, working days, severance base date and additional days, leave seniority base date and additional days, leave group and departure/return dates); legal transaction data (correspondence with judicial and administrative authorities, litigation and enforcement files); transaction security data (IP and MAC addresses, website access records, passwords and passcodes); risk management data (commercial, technical and administrative risks concerning administrative and technical employees); financial data (balance sheets, financial performance, credit and risk information, assets, bank accounts, salary details, guarantees, enforcement files and debt); family data (spouse’s name, employment and income, child’s name, Turkish identity number, birth date, gender, parents’ names, biological/stepchild status, school registration date, school name and class).

Purposes of Processing: Personal data is processed and may be transferred for performance of the employment contract; fulfilment of legal requirements; emergency management processes; information security processes; selection and placement of applicants, interns and students; applicant application processes; employee satisfaction and engagement processes; fulfilment of employment-contract and statutory obligations for employees; employee fringe benefits and entitlements; monitoring employee development following training; monitoring Company vehicle use for employee safety and business operations; approval of annual and other employee leave; approval and arrangement of annual and other employee leave; audit and ethics activities; determining regulatory processes and Company management responsibilities; training activities; training planning; preparation of training certificates; operational requirements such as training and quality control; training reporting; management of access authorisations; conducting activities in compliance with legislation; planning and managing compliance with applicable legislation and Company procedures; finance and accounting operations; physical premises security; tracking employees participating in training; assignment processes; monitoring GSM lines and electronic devices for use consistent with their assigned purposes; monitoring and conducting legal affairs; payments of employee wage garnishments to enforcement files; internal audit, investigation and intelligence activities; communication activities; planning human resources processes; creation of work email accounts; conducting and auditing business activities; occupational health and safety activities; ensuring business continuity; controlling and managing employment entry and exit records; employment termination processes; viewing remaining leave and arranging leave; ensuring quality control; delivery of incoming cargo and courier packages to the relevant employee; printing business cards; ensuring and auditing compliance with corporate policies; logistics activities; goods and services purchasing processes; after-sales support for goods and services; goods and services sales processes; goods and services production and operational processes; tracking expense and leave forms; customer relationship management processes; customer satisfaction activities; marketing analysis; performance assessment processes; risk management processes; retention and archiving activities; organising shuttle services and travel; contract processes; strategic planning activities; Company management processes and organisation; tracking requests and complaints; security of movable assets and resources; management of supplier relationships; security of the controller’s operations; foreign personnel work and residence permit procedures; talent and career development activities; providing information to authorised persons, institutions and organisations; management activities.

Collection Methods: For the purposes stated in this notice, the Company may collect data in writing, orally or electronically, through automated or non-automated methods, directly from you, job application websites, email and documents such as expense and leave forms, in physical or digital media. CCTV installed at the workplace automatically collects digital data for the Company’s legal obligations and legitimate interest in workplace security. The workplace physician collects health data to fulfil legal obligations and statutory requirements. Where a vehicle is assigned to you, location, date and time are collected automatically through GPRS for the Company’s legitimate interest in monitoring work. Systems controlling entry and exit collect work arrival and departure dates and times through assigned access cards and passage systems for workplace security, monitoring employee hours, attendance records and payroll arrangements, based on legitimate interests and legal obligations.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (b) necessity to protect the life or physical integrity of a person unable to express consent due to actual impossibility, or whose consent is not legally valid, or of another person; (c) necessity to process the parties’ data directly in connection with establishing or performing a contract; (ç) necessity for the controller to fulfil a legal obligation; (d) the data subject has made the data public; (e) necessity to establish, exercise or protect a right; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced. Article 6(3) prohibits processing special categories of personal data except where: (a) the data subject’s explicit consent; (b) express provision in laws; (c) necessity to protect the life or physical integrity of a person unable to express consent due to actual impossibility, or whose consent is not legally valid, or of another person; (ç) processing data made public by the data subject in accordance with the intention of making it public; (d) necessity to establish, exercise or protect a right; (e) necessity for protection of public health, preventive medicine, medical diagnosis, treatment and care, and planning, management and financing of health services by persons subject to confidentiality obligations or authorised institutions and organisations; (f) necessity to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance.

Transfers of Personal Data: Under Article 8(1) of the Law, personal data cannot be transferred without the data subject’s explicit consent. Under Article 8(2), it may be transferred without explicit consent where one of the conditions in Article 5(2) applies or, subject to adequate measures, one of the conditions in Article 6(3) applies. The personal data shared with our Company:

Transfers are made within the conditions in Articles 8 and 9 of the Law and limited to the purposes listed above. No personal data is transferred to third parties beyond those specified.

Under the “establishment or performance of a contract” condition in Article 5(2)(c), data may be shared with banks, independent accountants/financial advisers and relevant suppliers to pay salaries, establish benefits and conduct Company activities, and with contracted private healthcare institutions so you can receive private healthcare as an employee benefit;

Under the “fulfilment of the controller’s legal obligation” condition in Article 5(2)(ç), only when necessary, with the Ministry of Labour and Social Security, Social Security Institution, Turkish Employment Agency, courts and other public bodies requesting information, and financial advisers/accounting firms;

Under the “establishment, exercise or protection of a right” condition in Article 5(2)(e), with law firms and other advisers to provide evidence in potential disputes, obtain legal advice and technical support, implement the employment contract and check parties’ compliance with their obligations;

Location, date and time data collected through GPRS for the legal and commercial security of our Company and business partners may, where necessary, be shared with the supplier providing the vehicle tracking system;

Based on explicit consent under Article 8(1), with third parties through social media accounts for advertising, marketing and promotional activities;

Based on explicit consent under Article 8(1), data may be shared and transferred for management activities with domestic business partners, audit companies, consultants, financial advisers, legal advisers, independent accountants, authorised public bodies, affiliates and subsidiaries, group companies, board members, private insurance companies, contracted service providers and cooperating organisations domestically or abroad, banks, notaries and other relevant persons and organisations;

For internal security, particularly workplace entry and exit controls, with workplace building management;

With affiliated or cooperating companies to ensure internal operations;

Necessary personal data may be shared and transferred to companies we work with for transport, vehicle supply, business card printing, parking registration and similar purposes.

Data Subject Group: POTENTIAL PRODUCT OR SERVICE RECIPIENT / PROSPECTIVE CUSTOMER

Personal Data Collected: Identity data (name, surname, Turkish identity number); contact data (telephone, address, email); marketing data (purchase history and campaign information); physical premises security data (CCTV recordings of employees and visitors during their presence).

Purposes of Processing: Personal data is processed and may be transferred for emergency management processes; physical premises security; conducting and auditing business activities; occupational health and safety activities; receiving and evaluating suggestions for improving business processes; organisation and event management; marketing analysis; advertising, campaign and promotional processes; providing information to authorised persons, institutions and organisations.

Collection Methods: Data may be collected through email, social media (Facebook, Twitter, Instagram, etc.), our website, physical forms and documents, questionnaires and fieldwork forms, or directly from you orally.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (d) the data subject has made the data public; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced.

Transfers of Personal Data: Based on explicit consent under Article 8(1), data may be shared and transferred to domestic business partners for management activities.

Data Subject Group: INTERN

Personal Data Collected: Identity data (name and surname, Turkish identity number, parents’ names, place and date of birth); contact data (telephone, address, email); financial data (bank and payment information); physical premises security data (CCTV recordings of employees and visitors during their presence); professional experience data (school information); visual and audio recordings; personnel data (photograph, education, payroll, employment start and termination details, wages, duties, e-declarations, attendance, leave, suitability for duty, employment entry documents, position, department and unit, legally required documents); transaction security data (IP and MAC addresses, website access, passwords and passcodes); health data (disability, blood group, personal health, devices and prostheses, medical reports); signature data (handwritten or electronic signatures on personal-data documents); family data (guardian’s name, telephone, relationship, residence and email).

Purposes of Processing: Personal data is processed and may be transferred for emergency management processes; information security processes; selection and placement of applicants, interns and students; fulfilment of employment-contract and statutory obligations for employees; employee fringe benefits and entitlements; audit and ethics activities; training activities; management of access authorisations; conducting activities in compliance with legislation; physical premises security; assignment processes; internal audit, investigation and intelligence activities; communication activities; conducting and auditing business activities; occupational health and safety activities; contract processes; talent and career development activities; providing information to authorised persons, institutions and organisations.

Collection Methods: Data may be collected digitally by email or physically through forms and documents.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (b) necessity to protect the life or physical integrity of a person unable to express consent due to actual impossibility, or whose consent is not legally valid, or of another person; (c) necessity to process the parties’ data directly in connection with establishing or performing a contract; (ç) necessity for the controller to fulfil a legal obligation; (e) necessity to establish, exercise or protect a right; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced. Article 6(3) prohibits processing special categories of personal data except where: (a) the data subject’s explicit consent; (b) express provision in laws; (c) necessity to protect the life or physical integrity of a person unable to express consent due to actual impossibility, or whose consent is not legally valid, or of another person; (d) necessity to establish, exercise or protect a right; (e) necessity for protection of public health, preventive medicine, medical diagnosis, treatment and care, and planning, management and financing of health services by persons subject to confidentiality obligations or authorised institutions and organisations; (f) necessity to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance.

Transfers of Personal Data: Based on explicit consent under Article 8(1), data may be shared and transferred for management activities with domestic business partners, audit companies, consultants, financial advisers, legal advisers, independent accountants, authorised public bodies, contracted service providers and cooperating organisations domestically or abroad, banks, and other relevant persons and organisations.

Data Subject Group: SUPPLIERS / SERVICE PROVIDERS

Personal Data Collected: Identity data (name and surname, Turkish identity number); contact data (address number, email address, contact address, registered electronic mail (KEP) address, telephone number); legal transaction data (correspondence with judicial and administrative authorities, litigation and enforcement files); financial data (bank accounts, tax office and tax number); customer transaction data (cheques, invoices, orders, tax office and tax number, counter transaction receipts); physical premises security data (CCTV recordings of employees and visitors during their presence); transaction security data (IP address, entry/exit logs, Turkish identity number, name and surname, date of birth, mobile number, internet access, visit traffic and passwords); signature data (handwritten signatures and similar on personal-data documents).

Purposes of Processing: Personal data is processed and may be transferred for emergency management processes; information security processes; audit and ethics activities; training activities; management of access authorisations; conducting activities in compliance with legislation; planning and managing compliance with applicable legislation and Company procedures; finance and accounting operations; physical premises security; assignment processes; monitoring and conducting legal affairs; internal audit, investigation and intelligence activities; communication activities; conducting and auditing business activities; collecting entry and exit records of business partner and supplier employees; sharing with business partners; planning and managing business partners’ and suppliers’ access to information and facilities; managing relationships with business partners and suppliers; occupational health and safety activities; receiving and evaluating suggestions for improving business processes; ensuring business continuity; logistics activities; goods and services purchasing processes; after-sales support for goods and services; retention and archiving activities; contract processes; providing information to authorised persons, institutions and organisations.

Collection Methods: Data may be collected digitally by email, physically through forms and documents, or directly from you orally.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (ç) necessity for the controller to fulfil a legal obligation; (d) the data subject has made the data public; (e) necessity to establish, exercise or protect a right; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced.

Transfers of Personal Data: Based on explicit consent under Article 8(1), data may be shared and transferred for management activities with domestic business partners, audit companies, consultants, financial advisers, legal advisers, independent accountants, authorised public bodies, contracted service providers and cooperating organisations domestically or abroad, banks, notaries, and other relevant persons and organisations.

Data Subject Group: PRODUCT OR SERVICE RECIPIENT / CUSTOMER

Personal Data Collected: Identity data (name and surname, Turkish identity number); contact data (telephone, address, email); legal transaction data (correspondence with judicial and administrative authorities, litigation and enforcement files); risk management data (commercial, technical and administrative risks); financial data (bank information); customer transaction data (cheques, invoices, orders, tax office and tax number); physical premises security data (CCTV recordings of employees and visitors during their presence); marketing data (purchase history and information obtained through surveys and campaigns).

Purposes of Processing: Personal data is processed and may be transferred for emergency management processes; information security processes; audit and ethics activities; finance and accounting operations; Company, product and service loyalty processes; physical premises security; monitoring and conducting legal affairs; internal audit, investigation and intelligence activities; communication activities; conducting and auditing business activities; sharing with business partners; managing relationships with business partners and suppliers; occupational health and safety activities; ensuring business continuity; logistics activities; goods and services purchasing processes; after-sales support for goods and services; goods and services sales processes; goods and services production and operational processes; customer relationship management processes; customer satisfaction activities; marketing analysis; advertising, campaign and promotional processes; risk management processes; retention and archiving activities; contract processes; tracking requests and complaints; product and service marketing processes; providing information to authorised persons, institutions and organisations.

Collection Methods: Data is collected directly from you orally, through email, our website and social media applications, or physically through forms and documents.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (c) necessity to process the parties’ data directly in connection with establishing or performing a contract; (ç) necessity for the controller to fulfil a legal obligation; (d) the data subject has made the data public; (e) necessity to establish, exercise or protect a right; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced. Article 6(3) prohibits processing special categories of personal data except where: (a) the data subject’s explicit consent; (b) express provision in laws.

Transfers of Personal Data: Under Article 8(1) of the Law, personal data cannot be transferred without the data subject’s explicit consent. Under Article 8(2), it may be transferred without explicit consent where one of the conditions in Article 5(2) applies or, subject to adequate measures, one of the conditions in Article 6(3) applies. Under Article 9(1), controllers and processors may transfer personal data abroad where one of the conditions in Articles 5 and 6 applies and an adequacy decision exists for the destination country, sectors within it or international organisations. Provisions of other laws concerning international transfers remain reserved.

Transfers are made within the conditions in Articles 8 and 9 of the Law and limited to the purposes listed above. No personal data is transferred to third parties beyond those specified.

Transfers of Personal Data: Based on explicit consent under Article 8(1), data may be shared and transferred for management activities with domestic business partners, audit companies, consultants, financial advisers, legal advisers, independent accountants, authorised public bodies, contracted service providers and cooperating organisations domestically or abroad, banks, notaries, and other relevant persons and organisations.

Data Subject Group: VISITOR

Personal Data Collected: Identity data (name and surname, Turkish identity number); physical premises security data (CCTV recordings of employees and visitors during their presence); contact data (telephone number); transaction security data (if you use our Wi-Fi during a visit: IP and MAC addresses, website access, passwords and passcodes); customer transaction data (website cookie records).

Purposes of Processing: Personal data is processed and may be transferred for emergency management processes; information security processes; audit and ethics activities; management of access authorisations; conducting activities in compliance with legislation; physical premises security; occupational health and safety activities; providing information to authorised persons, institutions and organisations.

Collection Methods: Your personal data is not processed by our Company through digital camera recordings, email, device access information if you use Wi-Fi, our website, social media applications, or physical forms and documents, particularly in relation to security services.

Legal Grounds for Collection: Data is collected and processed under Article 5(1) of the Personal Data Protection Law, which provides that personal data cannot be processed without the data subject’s explicit consent. Under Article 5(2), processing without explicit consent is possible where: (a) express provision in laws; (ç) necessity for the controller to fulfil a legal obligation; (f) necessity for the controller’s legitimate interests, provided the data subject’s fundamental rights and freedoms are not prejudiced. Article 6(3) prohibits processing special categories of personal data except where: (a) the data subject’s explicit consent; (b) express provision in laws.

Transfers of Personal Data: Under Article 8(2), personal data may be transferred without explicit consent where one of the conditions in Article 5(2) applies or, subject to adequate measures, one of the conditions in Article 6(3) applies. Data is transferred to authorised institutions and organisations when necessary.

Camera Monitoring and Image Recording

Images of designated areas are captured, monitored and recorded automatically through our Company’s closed-circuit recording systems.

Purposes of Processing: Collected data is processed digitally on the Article 5 legal ground of necessity for the controller’s legitimate interests without prejudicing data subjects’ fundamental rights and freedoms. Within the processing conditions and purposes, CCTV recordings are limited to ensuring security and confidentiality in our building, providing better services, evidence in potential disputes, meeting requests of authorised public bodies in judicial incidents and emergency management, evidence in theft and robbery, checking occupational health and safety requirements, detection in criminal incidents and auditing.

Transfers of Personal Data: Under the processing conditions and purposes in Articles 8 and 9, collected data may be shared with legally authorised institutions and organisations to ensure the legal, technical and commercial/business security of persons in a business relationship with the Company and the security of Company premises.

Collection Method and Legal Ground: Data is collected through closed-circuit cameras at our locations on the Article 5 ground of necessity for the controller’s legitimate interests without prejudicing data subjects’ fundamental rights and freedoms. CCTV is recorded 24 hours a day, seven days a week, limited to the stated purposes. Recordings are retained and disposed of at the end of the retention period.

General Information on Personal Data Transfers

Except for legal obligations and legally recognised rights, the Company does not share personal data with third parties prohibited by law, whether or not explicit approval exists. To conduct commercial activities lawfully, fulfil requested services, manage contracts, identify and verify signatories’ authority, plan commercial and/or legal business strategies, access statutory online applications, and meet other legal requirements, data may be obtained through the methods described in this notice, recorded, kept for retention periods, transferred to third parties to the extent permitted by legislation and your explicit consent, or otherwise processed.

Personal Data Retention Period

Personal data shared through the channels in this notice is retained for periods specified in Law No. 6698 and applicable legislation, if any. At the end of necessary retention, data is disposed of under the procedures and principles of Article 7. The Personal Data Retention and Destruction Policy explains the actions taken after a statutory period expires or where no period is specified.

Data Subject Rights Concerning Processing

Under Article 11 of the Law, which regulates data subject rights, you may apply to the Company concerning yourself to:

Learn whether personal data is processed; request information if it has been processed; learn processing purposes and whether use is consistent with them; know third-party recipients domestically or abroad; request correction of incomplete or inaccurate processing and notification of corrections to recipients; request erasure or destruction under the conditions in Law No. 6698 and other applicable laws and notification to recipients; object to an adverse result arising from analysis exclusively by automated systems; and claim compensation for damage caused by unlawful processing.

Methods of Applying to the Data Controller

To exercise your rights, submit applications with documents establishing your identity in accordance with the Communiqué on Procedures and Principles for Applications to the Data Controller dated 10 March 2018, No. 30356. Complete the Data Subject Application Form at https://mediteks.com/ and send a handwritten-signed copy:

In person or through a notary to: MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ, Organize Sanayi Bölgesi 4. Cadde No:5 Süloğlu/EDİRNE;

By email in digital form to abdurrahman@mediteks.com, using registered electronic mail (KEP), secure electronic signature, mobile signature or an email address previously notified to the Company and recorded in our systems;

Or through other application methods specified in the Law.

For third parties to apply on a data subject’s behalf, a special power of attorney issued by a notary by the data subject in the applicant’s name is required.

Requests will be concluded free of charge as soon as possible and within no more than 30 (thirty) days, according to their nature. If the procedure entails an additional cost for the Company, the fee in the Board’s tariff will be charged.

PERSONAL DATA RETENTION AND DESTRUCTION POLICY

This Personal Data Retention and Destruction Policy (the ‘Policy’) has been prepared by MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ (the ‘Company’), acting as data controller, pursuant to Personal Data Protection Law No. 6698 (‘KVKK’ or the ‘Law’) and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data (the ‘Regulation’), to fulfil our obligations and inform data subjects about the principles for determining the maximum retention period necessary for the purposes of processing and the processes for erasure, destruction and anonymisation.

Scope

This Policy covers all personal data of individuals, including our employees, processed wholly or partly by automated means or by non-automated means as part of a data filing system. Information about our personal data processing activities concerning individuals whose data will be processed by our Company, and the policy, is also available at https://mediteks.com/.

Definitions

Our Company acts in accordance with the following principles when retaining and disposing of personal data:

Personal data is processed in accordance with the principles listed in Article 4 of the Law: lawfulness and fairness; accuracy and keeping data up to date when necessary; processing for specific, explicit and legitimate purposes; relevance, limitation and proportionality to the purposes; and retention for the periods stipulated by applicable legislation or necessary for the processing purposes.

Our Company acts in line with the data security obligations under Article 12 of the Law. In erasure, destruction and anonymisation, it takes account of the technical and administrative measures in section 5.4.2 of this Policy, applicable legislation and Board decisions.

All operations concerning erasure, destruction and anonymisation are recorded by our Company, and these records are retained for at least five years, without prejudice to other legal obligations.

Unless the Board decides otherwise or legislation (the Law and secondary regulations) provides otherwise, our Company selects the appropriate method of erasure, destruction or anonymisation on its own initiative. Where the data subject makes a request, the appropriate method is selected with an explanation of the reasons.

When all processing conditions in Articles 5 and 6 of the Law cease to exist, our Company erases, destroys or anonymises personal data on its own initiative or at the data subject’s request. If the Relevant Person applies to our Company in this regard:

Requests are concluded within no more than 30 (thirty) days and the data subject is informed.

If the data concerned has been transferred to third parties, those recipients are notified and the necessary action is ensured at those third parties.

DUTIES AND POWERS OF THE PERSONAL DATA PROTECTION COMMITTEE

The Personal Data Protection Committee is responsible for communicating the Policy to relevant business units and monitoring compliance. It issues the announcements and notifications needed for units to follow changes in data protection legislation, regulatory acts and decisions of the Board, court judgments, and changes in processes, practices and systems, and to update business processes where necessary. It determines and communicates procedures for reviewing, evaluating, monitoring and concluding matters concerning the Law, secondary legislation, Board decisions and regulations, court judgments and decisions and/or requests of other competent authorities. It takes technical and administrative measures and carries out audits to ensure the necessary level of security in accordance with Board guidance.

Preparing and Updating Documents: It prepares basic personal data policies and manages updates following legislative changes.

Managing Information Notices and Explicit Consent Texts: It ensures lawful preparation of information notices and consent forms for employees, suppliers, customers and visitors, and their use at relevant points (accounting, HR, sales, website, etc.).

VERBİS Registration and Monitoring: If the Company is legally required to register, it completes and maintains the Data Controllers’ Registry Information System registration and coordinates the contact person.

Keeping the Data Inventory Current: It regularly reviews data processed by business units (Accounting, HR, Marketing, IT, etc.) and maintains the Personal Data Inventory. New software or business models are entered in the inventory when introduced.

Impact and Risk Analysis: It identifies risks in personal data processing (data leakage, unauthorised access, etc.) and develops mitigating measures.

MATTERS CONCERNING PERSONAL DATA PROTECTION

Our Company takes technical and administrative measures and conducts audits to provide the necessary level of security in line with guidance published by the Board.

3.1. Data Security Obligations

Our Company takes all necessary technical and administrative measures to ensure an appropriate level of security to prevent unlawful processing and unlawful access and to safeguard personal data.

DATA SUBJECT RIGHTS AND THEIR EXERCISE

Data subjects have the following rights:

To learn whether personal data is processed;

To request information if personal data has been processed;

To learn the purposes of processing and whether data is used in accordance with those purposes;

To know the third parties to whom personal data is transferred domestically or abroad;

To request correction of incomplete or inaccurate personal data and notification of that correction to recipients;

To request erasure or destruction where the reasons for processing cease to exist, even if data was processed in accordance with the Law and other applicable laws, and notification of that action to recipients;

To object to an adverse result arising from analysis of processed data exclusively through automated systems;

To claim compensation for damage caused by unlawful processing of personal data.

4.1. Exercise of Data Subject Rights

Data subjects may send requests concerning the rights listed under heading 3 of this section, free of charge, to MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ, by completing and signing the Data Subject Information Request Application Form, together with information and documents establishing identity, using the methods below or other methods determined by the Board:

After completing the Data Subject Application Form at https://mediteks.com/, deliver a copy bearing a handwritten signature in person or through a notary to: MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ, Organize Sanayi Bölgesi 4. Cadde No:5 Süloğlu/EDİRNE.

After completing and signing the Data Subject Application Form at https://mediteks.com/, email a digital copy to abdurrahman@mediteks.com.

You may also apply using other methods specified in the Personal Data Protection Law.

For a third party to apply on a data subject’s behalf, a special power of attorney issued by a notary by the data subject in the applicant’s name is required.

4.2. Our Company’s Response to Applications

Our Company takes the administrative and technical measures necessary to conclude data subject applications in accordance with the Law and Regulation. If a request is submitted using the procedure in section 4.1, the Company concludes it free of charge within no more than thirty days, according to its nature. If the Board stipulates a fee, the applicant will be charged the fee in the Board’s tariff.

RETENTION AND DESTRUCTION OF PERSONAL DATA

5.1. Legal Grounds Requiring Retention

Data is processed where one or more of the following applies: express provision in law; necessity to process parties’ data directly in connection with establishing or performing a contract; necessity for the controller to fulfil a legal obligation; the data subject has made the data public; necessity to establish, exercise or protect a right; necessity for the controller’s legitimate interests without prejudicing the data subject’s fundamental rights and freedoms; protection of public health; Company administration; conducting business; or implementation of Company policies.

5.2. Purposes of Processing Personal Data

Our Company retains personal data processed in its activities for the following purposes and legal grounds:

Our Company securely processes data in the physical or electronic media referred to above, within the limits of the Law and applicable legislation, for: emergency management processes; archiving applicant information; sharing applicant information with management; reviewing applicants and identifying candidates to employ; information security processes; selection and placement of applicants, interns and students; applicant application processes; employee satisfaction and engagement processes; fulfilment of employment-contract and statutory obligations for employees; employee fringe benefits and entitlements; monitoring employee development following training; monitoring Company vehicle use for employee safety and business operations; approval of annual and other employee leave; approval and arrangement of annual and other employee leave; audit and ethics activities; determining regulatory processes and Company management responsibilities; training activities; training planning; preparation of training certificates; operational requirements such as training and quality control; training reporting; management of access authorisations; conducting activities in compliance with legislation; planning and managing compliance with applicable legislation and Company procedures; finance and accounting operations; Company, product and service loyalty processes; physical premises security; tracking employees participating in training; assignment processes; monitoring GSM lines and electronic devices for use consistent with their assigned purposes; monitoring and conducting legal affairs; payments of employee wage garnishments to enforcement files; internal audit, investigation and intelligence activities; communication activities; planning human resources processes; creation of work email accounts; conducting and auditing business activities; collecting entry and exit records of business partner and supplier employees; sharing with business partners; planning and managing business partners’ and suppliers’ access to information and facilities; managing relationships with business partners and suppliers; occupational health and safety activities; receiving and evaluating suggestions for improving business processes; ensuring business continuity; controlling and managing employment entry and exit records; employment termination processes; viewing remaining leave and arranging leave; ensuring quality control; delivery of incoming cargo and courier packages to the relevant employee; printing business cards; ensuring and auditing compliance with corporate policies; logistics activities; goods and services purchasing processes; after-sales support for goods and services; goods and services sales processes; goods and services production and operational processes; tracking expense and leave forms; customer relationship management processes; customer satisfaction activities; organisation and event management; verifying data with references listed in your CV; marketing analysis; performance assessment processes; checking suitability for the position; reference checks; advertising, campaign and promotional processes; risk management processes; retention and archiving activities; organising shuttle services and travel; contract processes; strategic planning activities; Company management processes and organisation; tracking requests and complaints; security of movable assets and resources; management of supplier relationships; product and service marketing processes; security of the controller’s operations; foreign personnel work and residence permit procedures; recruiting new personnel; talent and career development activities; providing information to authorised persons, institutions and organisations; sharing with management; management activities.

5.3. Grounds Requiring Disposal of Personal Data

Under the Regulation, our Company erases, destroys or anonymises data subjects’ personal data on its own initiative or upon request in the following cases:

a. Amendment or repeal of the legislation forming the basis for processing or retention;

b. The purpose requiring processing or retention ceases to exist;

c. The conditions requiring processing under Articles 5 and 6 of the Law cease to exist;

d. Withdrawal of consent where processing is based solely on explicit consent;

e. The controller accepts the data subject’s request for erasure, destruction or anonymisation under the rights in Article 11(2)(e) and (f) of the Law;

f. Following rejection of a request for erasure, destruction or anonymisation, an inadequate response or failure to respond within the statutory period, a complaint is made to the Board and the Board approves the request;

g. The maximum retention period has expired and no condition justifying longer retention exists.

5.4. Our Company’s Retention and Disposal Procedures

5.4.1. Recording Media

Our Company securely retains personal data in the media listed below, in accordance with applicable legislation, particularly the KVKK, and international data security principles:

The administrative and technical measures taken by our Company under Article 12 of the KVKK to ensure secure retention, prevent unlawful processing and access, and lawfully dispose of data are listed below:

a. Administrative Measures:

Within the scope of administrative measures, our Company:

Restricts access to personal data to authorised personnel only.

Notifies the data subject and Board as soon as possible if processed data is unlawfully obtained by others.

Ensures data security through contractual provisions concerning personal data protection and security with persons receiving personal data.

Signs confidentiality agreements with employees concerning Company activities to protect personal data and ensure data security.

Before processing begins, fulfils the obligation to inform data subjects who may process their data, for what purposes and legal grounds, and to whom and for what purposes it may be transferred.

Undertakes not to process personal data without explicit consent except in statutory exceptional cases. Where consent is required, the obligation is fulfilled by obtaining freely given, informed consent concerning a specific matter.

When the statutory or Policy retention period expires, initiates erasure, destruction or anonymisation during the Company’s first periodic disposal operation.

Ensures all reasonable measures are taken to prevent theft, loss or corruption of information.

b. Technical Measures:

Within the scope of technical measures, our Company:

Performs the necessary internal controls in established systems.

Takes necessary measures for the physical security of IT equipment, software and data.

Conducts IT risk assessments and business impact analyses for established systems.

Identifies unlawful processing risks and takes corresponding technical measures. Establishes systems and infrastructure for notifying the data subject and Board upon detection of unlawful processing.

Establishes and implements procedures for access authority and roles. Applies an authorisation matrix, records access, controls inappropriate access, and defines and implements disposal processes consistent with the retention and destruction policy.

Purchases penetration testing services regularly and when needed to identify IT risks, threats, vulnerabilities and exposures, and takes necessary measures.

Monitors system vulnerabilities through penetration testing services regularly and when needed.

Keeps IT employees’ access authorisations to personal data under control.

Ensures destruction of personal data is irreversible and leaves no audit trail.

Establishes internal access procedures and performs reporting and analysis concerning personal data access.

Records access to storage areas containing personal data and controls inappropriate access or attempts.

Takes hardware measures (access control restricting server-room entry to authorised personnel, continuous 24/7 monitoring, physical protection of LAN edge switches, fire suppression, air conditioning, etc.) and software measures (firewalls, intrusion prevention, network access control, anti-malware systems, etc.) against environmental threats to IT security.

5.4.3. Assigned Personnel

The titles, units and job descriptions of personnel involved in retention and disposal are listed in Annex 1 to this Policy.

5.4.4. Personal Data Disposal Procedures

Personal data obtained in accordance with the KVKK and applicable legislation will, when processing purposes under the Law and Regulation cease to exist, be disposed of using the techniques below, on the Company’s own initiative or at the data subject’s request, in accordance with the Law and applicable legislation.

6.4.4.1. Erasure of Personal Data

Personal data is erased using the methods below.

Even where data was processed lawfully, the Company may erase or destroy it on its own decision or at the data subject’s request when the reasons for processing cease to exist. Following erasure, relevant persons will not be able to access or use the erased data again in any way. The Company manages an effective data tracking process to define and monitor disposal: identifying the data to erase, identifying relevant persons, determining their access methods, and immediately erasing the data.

5.4.4.3. Anonymisation of Personal Data

Anonymisation means making personal data incapable of being associated with an identified or identifiable natural person, even through matching with other data. For data to be anonymised, it must be impossible to associate it with an identified or identifiable person, even using techniques appropriate to the recording medium and field of activity, such as restoration by the controller or third parties and/or matching with other data.

RETENTION AND DISPOSAL PERIODS

The following criteria, in order, are used to determine retention and disposal periods for personal data obtained in accordance with the KVKK and other applicable legislation:

1. Where legislation specifies a retention period for the data, that period is observed. When it expires, the data is handled under paragraph 2.

2. Where a statutory retention period has expired or no retention period is specified in the applicable legislation, the following steps apply in order:

Personal data is classified as ordinary or special-category data using the definition in Article 6 of the KVKK. All data in physical or digital media identified as special-category data is disposed of where the data subject has not given explicit consent. The method is determined according to the nature of the data and its importance to our Company.

Compliance of retention with Article 4 principles is examined; for example, whether the Company has a legitimate retention purpose. Data whose retention may breach those principles is erased, destroyed or anonymised.

The applicable exceptions in Articles 5 and 6 of the KVKK are identified. Reasonable retention periods under those exceptions are determined. When these expire, the data is erased, destroyed or anonymised.

Company retention, disposal and periodic disposal periods are available in the ‘Table of Retention, Disposal and Periodic Disposal Periods’ in Annex 2 to this Policy.

Data whose retention period has expired is disposed of every six months in accordance with the procedures in this Policy and the disposal periods in Annex 2. The ‘Data Disposal Record’ concerning disposed data is in Annex 4.

All erasure, destruction and anonymisation operations are recorded, and these records are kept for at least five years, without prejudice to other legal obligations.

PERIODIC DISPOSAL INTERVAL

Our Company has set the periodic disposal interval at six months. Disposal is accordingly carried out in April and November each year.

PUBLICATION AND RETENTION OF OUR POLICY

The Policy is published in two forms: a handwritten-signed printed copy and an electronic copy, and is disclosed on our website. The printed copy is kept by the Human Resources department at our headquarters.

POLICY UPDATE SCHEDULE

The Policy is reviewed as needed and upon requests from relevant persons, and necessary sections are updated. Updates are announced within seven business days at MEDİTEKS SAĞLIK HİZMETLERİ TIBBİ MALZEME TEKSTİL ÜRÜNLERİ SANAYİ VE DIŞ TİCARET ANONİM ŞİRKETİ, Organize Sanayi Bölgesi 4. Cadde No:5 Süloğlu/EDİRNE; a printed copy is announced at the headquarters’ Human Resources department.

ENTRY INTO FORCE AND REPEAL OF OUR POLICY

The Policy was prepared by our Company and entered into force on 12 October 2026. If amended, its effective date and relevant provisions will be updated accordingly. The Update Table for possible updates is in Annex 3. In the event of a conflict between this Policy and the KVKK or other applicable legislation, the KVKK and other applicable legislation prevail.