Personal Data Protection and Processing Policy

MAMAJOO HEALTH & PRODUCTS INC.

 

PERSONAL DATA PROTECTION AND PROCESSING POLICY

This Policy sets out the principles that  Mamajoo Health & Products Inc. (“Company”)  will follow while fulfilling its obligations regarding the processing of personal data under the Law No. 6698 on the Protection of Personal Data (“KVKK”)  and the regulations stipulated in the relevant legislation. The Company undertakes to act in accordance with the procedures and principles set forth in this Policy with respect to the personal data processed within its own structure.

 

1. PURPOSE AND SCOPE
This Policy aims to set out the principles regarding the methods and processes for the processing and protection of personal data by the Company. This Policy covers all activities related to the personal data processed by the Company and applies to the aforementioned activities. This Policy may be amended in cases deemed necessary by the Company, provided that the KVKK Regulations require it. In the event of any inconsistency between the KVKK Regulations and this Policy, the KVKK Regulations shall prevail. This Policy may be amended by the Company where deemed necessary and where the KVKK Regulations require it.

 

2. DEFINITIONS
The definitions used in this Policy have the following meanings;

“Explicit Consent” refers to consent that is based on being informed about a specific matter and expressed with free will.

“Anonymization” refers to making personal data such that, even if matched with other data, it cannot be associated with any identified or identifiable natural person in any way.

“Duty to Inform” refers to the obligation of the data controller or the person authorized by the data controller to inform the data subject within the scope of Article 10 of the KVKK during the collection of personal data.

“Personal Data” refers to any kind of information relating to an identified or identifiable natural person (within the scope of this Policy, the term “Personal Data” shall, to the extent appropriate, also include the “Special Category Personal Data” defined below).

“Processing of Personal Data” refers to any kind of operation performed on data, such as obtaining personal data by fully or partially automated means or by non-automated means provided that it forms part of any data recording system, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making it available, classifying, or preventing its use.

“Board” refers to the Personal Data Protection Board.

“Institution” refers to the Personal Data Protection Authority.

“KVKK” refers to the Law No. 6698 on the Protection of Personal Data.

“KVK Regulations” refers to the Law No. 6698 on the Protection of Personal Data and other relevant legislation for the protection of personal data, including binding decisions, principle decisions, provisions, instructions issued by regulatory and supervisory authorities, courts, and other official bodies, as well as applicable international agreements for the protection of data and all other types of legislation.

“Special Category Personal Data” refers to data regarding a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership in an association, foundation or union, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

“Data Processor” refers to the natural or legal person who processes Personal Data on behalf of the Data Controller by obtaining authorization from the Data Controller.

“Data Subject” refers to all natural persons whose Personal Data are processed by the Company or on behalf of the Company.

“Data Controller” refers to the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for establishing and managing the data recording system.

 

3. PRINCIPLES TO BE APPLIED IN THE PROCESSING OF PERSONAL DATA
 
a) Processing Personal Data in Compliance with Law and the Rules of Good Faith
The Company will process personal data only to the extent necessary, in accordance with the law and the rules of good faith, and in line with the principle of proportionality, in a manner consistent with the purposes of data processing.

 

b) Taking Necessary Measures to Ensure Personal Data Are Accurate and Up to Date When Necessary
The Company will ensure that the personal data it processes are accurate and up to date and will take the necessary measures accordingly. In the event that the data subject requests changes to personal data within the scope of the KVKK Regulations, the Company will update the relevant personal data.

 

c) Processing Personal Data for Specific, Clear, and Legitimate Purposes
The Company will process personal data for specific, clear, and lawful reasons. The Company will determine the purposes for which personal data will be processed and will make these purposes available to the data subject before any personal data processing takes place. Within this scope, the data subject will be informed within the scope of the KVKK Regulations and, where necessary, explicit consent will be obtained.

 

d) Ensuring That Personal Data Are Related, Limited, and Proportionate to the Purpose for Which They Are Processed
The Company will process personal data in a way that is suitable for achieving the specified purposes and will refrain from processing data that is not relevant to the purpose and is not needed.

 

e) Retaining Personal Data for the Period Prescribed in the Relevant Legislation or for the Period Necessary for the Purpose for Which They Are Processed
The Company will retain personal data only for the periods stipulated in the laws or limited to the purpose for which they are processed. If the Company wishes to retain Personal Data for a period longer than the period stipulated in the KVKK Regulations or required by the purpose of processing personal data, the Company will act in accordance with the obligations specified in the KVKK Regulations.

 

4. CONDITIONS FOR PROCESSING PERSONAL DATA
 

a) Explicit Consent
Personal data will be processed after the data subjects are informed within the scope of fulfilling the duty to inform and provided that the data subjects give explicit consent. Within this framework, the data subjects’ rights will be communicated before obtaining explicit consent. Explicit consent will be obtained through methods compliant with the KVKK Regulations and the data will be retained for the necessary period within the same scope.

 

b) Processing Personal Data Without Obtaining Explicit Consent
In cases where the processing of personal data without obtaining explicit consent is envisaged within the scope of the KVKK Regulations, the Company may process personal data within the limits drawn by the KVKK Regulations without obtaining the data subject’s explicit consent. Within this scope,

Where expressly provided in the laws,
Where the data subject is unable to disclose consent due to actual impossibility or where consent is not granted legal validity, and processing is mandatory for the protection of the life or physical integrity of the data subject or of another person other than the data subject,
Where processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract,
Where processing of personal data is necessary for the Company to fulfill its legal obligation,
Where personal data have been made public by the data subject,
Where processing of personal data is necessary for the establishment, use, or protection of a right,
Where processing of personal data is necessary for the Company’s legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject,
Personal data may be processed by the Company without explicit consent.

 

b) Processing Special Category Personal Data
Special category personal data may be processed only if either the data subject has provided explicit consent or, for special category personal data other than data related to sexual life and personal health, the laws expressly require processing. Personal data related to health and sexual life may be processed without explicit consent only by persons under a duty of confidentiality (e.g., the Company physician) or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, and planning and managing health services and their financing. When processing special category personal data, measures determined by the Company will be taken.

 

5. DUTY TO INFORM THE DATA SUBJECT
The Company may process the personal data of employees, employee candidates, employees’ relatives, shareholders/partners, potential product or service recipients, interns, supplier employees, supplier representatives, persons who receive products or services, and visitors. The Company will inform data subjects, during the collection of personal data, about how their data will be processed. In the KVKK, the minimum matters that must be included in the information are as follows:

1. The identity of the Company and, if any, its representative as the data controller
2. The purpose for which personal data will be processed
3. To whom and for what purposes personal data may be transferred
4. The legal reasons for collecting personal data
5. The rights of the data subject
6. The obligation of the data subject to respond to applications
 

6. RIGHTS OF THE DATA SUBJECT
The rights of the data subject are as follows:

(1) Learning whether personal data are processed,

(2) Requesting information if personal data have been processed,

(3) Learning the purpose of processing personal data and whether they are used in accordance with their purpose,

(4) Knowing the third parties to whom personal data are transferred domestically or abroad,

(5) Requesting correction of personal data if they are processed incompletely or incorrectly and, within this scope, requesting that the transaction carried out be notified to third parties to whom personal data have been transferred,

(6) Requesting deletion or destruction of personal data, even though they have been processed in accordance with the law and the relevant other provisions of law, in the event that the reasons requiring processing cease to exist, and, within this scope, requesting that the transaction carried out be notified to third parties to whom personal data have been transferred,

(7) Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,

(8) Requesting compensation for damages in the event that the data subject suffers damage due to unlawful processing of personal data.

The data subject may send the requests regarding the above-mentioned rights using the methods determined by the Board to the e-mail address provided below, which may change from time to time, to the Company’s KEP address, or to the postal address specified below, which may also be changed from time to time.

Data Controller: Mamajoo Health & Products Inc
Registered E-mail (KEP): [email protected]
E-mail: destek@mamajoo.com
Mailing Address: Mimar Sinan Mah. Özgürlük Cad. No: 77/1 Sultanbeyli - ISTANBUL
If the data subject submits the request regarding the above-mentioned rights to our Company in accordance with the procedure, our Company will conclude the relevant request free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request. However, if the transaction additionally requires a cost, a fee may be charged in accordance with the tariff determined by the Board.

 

7. PURPOSES OF PROCESSING PERSONAL DATA
The Company processes personal data, limited to the purposes and conditions specified in Article 5, paragraph 2 and Article 6, paragraph 3 of the KVKK and stated in Article 4 of our policy. Likewise, the Company may process data in categories such as identity, communication, professional experience, personnel records, visual and audio records, finance, criminal matters, criminal convictions and security measures, health information, philosophical beliefs, religion, sect and other beliefs, biometric data, legal transaction, physical location security, transaction security, customer transaction, marketing and other categories, for the purposes specified in this Policy.

Within this scope, the Company processes your personal data for the following purposes:

• Carrying out Emergency Management Processes
• Carrying out Information Security Processes
• Carrying out Employee Candidate / Intern / Student Selection and Placement Processes
• Carrying out Employee Candidate Application Processes
• Fulfillment of employment contract and obligations arising from legislation for Employees
• Carrying out Processes for Fringe Benefits and Interests for Employees
• Carrying out Audit / Ethics Activities
• Carrying out Training Activities
• Carrying out Access Authorization Processes
• Carrying out Activities in Compliance with Legislation
• Carrying out Finance and Accounting Operations
• Carrying out Loyalty Processes Related to the Company / Product / Services
• Carrying out Marketing Processes of the Company / Product / Services
• Providing Physical Location Security
• Carrying out Assignment Processes
• Monitoring and Carrying Out Legal Affairs
• Carrying out Communication Activities
• Planning Human Resources Processes
• Carrying out / Auditing Business Activities
• Carrying out Occupational Health / Safety Activities
• Carrying out Logistics Activities
• Carrying out Procurement Processes for Goods / Services
• Carrying out After-Sales Support Services for Goods / Services
• Carrying out Sales Processes for Goods / Services
• Carrying out Production and Operations Processes for Goods / Services
• Carrying out Customer Relationship Management Processes
• Carrying out Activities Aimed at Customer Satisfaction
• Organization and Event Management
• Carrying out Marketing Analysis Studies
• Carrying out Advertising / Campaign / Promotion Processes
• Carrying out Storage and Archiving Activities
• Carrying out Contract Processes
• Providing Security for Movable Property and Resources
• Carrying out Loyalty Processes Related to Products / Services
• Carrying out Marketing Processes of Products / Services
• Providing Security for Data Controller Operations
• Providing Information to Authorized Persons, Institutions and Organizations
• Carrying out Management Activities

If, for the processing activities carried out in line with the purposes mentioned above, one of the conditions stipulated under the KVKK is not met, the Company will obtain the data owner’s explicit consent for the relevant processing.

 

8. TRANSFER OF PERSONAL DATA
 

a) General Conditions
The Company may, in line with the purposes of processing personal data, take the necessary measures and transfer personal data to real or legal persons located in Turkey and/or abroad in accordance with the regulations stipulated in the Law and this Policy.

Personal Data may be transferred to third parties located in Turkey or abroad either by obtaining the data subject’s explicit consent or without explicit consent in exceptional cases specified in Article 5.2 and Article 6.3. The Company will ensure that this transfer complies with the KVKK regulations.

In cases where personal data are transferred without obtaining explicit consent in accordance with the KVKK regulations, one of the following conditions must exist with respect to the foreign country to which the transfer is made:

• The foreign country to which the transfer is made is considered a country status with adequate protection determined by the Board
• If the foreign country to which the transfer is made is not considered a country status with adequate protection determined by the Board, the Company and the data controller in the relevant foreign country shall provide a written undertaking that adequate protection will be ensured and the Board shall grant permission for this undertaking.
   

b) Transfer of Special Category Personal Data
Special Category Personal Data may be transferred by the Company in accordance with the principles set out in this Policy and by taking the necessary administrative and technical measures, including the methods to be determined by the Board, provided that the following conditions exist:

Special category personal data other than health and sexual life may be processed without seeking explicit consent if it is expressly provided for in the laws—i.e., if there is an explicit provision in the relevant law regarding the processing of personal data. Otherwise, explicit consent of the data subject will be obtained.
Special category personal data related to health and sexual life may be processed without seeking explicit consent by persons under a duty of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, and planning and managing health services and their financing. Otherwise, explicit consent of the data subject will be obtained.
In addition to the above, personal data may be transferred, where one of the above conditions exists, to foreign countries that have adequate protection or to foreign countries where there is a data controller that undertakes to provide adequate protection in accordance with the conditions specified in the legislation, in the absence of adequate protection.

In accordance with Articles 8 and 9 of the KVKK, the Company may transfer the personal data of data subjects managed by this Policy to the following categories of persons:

(i) Company business partners,

(ii) Company suppliers,

(iii) Real Persons and Private Law Legal Entities,

(iv) Public institutions and organizations authorized by law

(v) Private law persons authorized by law

 

9. DATA SECURITY AND MANAGEMENT
The Company will take the necessary legal, technical, and administrative measures regarding data security and will show the utmost care and attention in this regard at the highest level. The Company takes technical and administrative measures in accordance with technological capabilities and the cost of implementation to ensure that personal data are processed lawfully. Employees will be informed that they may not disclose the personal data they learn to others in violation of the provisions of the KVKK, may not use them for purposes other than processing, and that this obligation will continue even after they leave their duties; and the necessary undertakings will be obtained from them accordingly.

The Company will take technical and administrative measures, depending on the nature of the protected data, technological means, and the cost of implementation, to prevent the unconscious or unauthorized disclosure, access, transfer, or any other unlawful access to personal data.

The Company will increase awareness among data processor entities such as business partners and suppliers to whom it has transferred personal data regarding preventing unlawful processing of personal data, preventing unlawful access to data, and ensuring lawful retention of data; and will take the necessary measures to ensure that business partners and suppliers carry out personal data processing activities in compliance with the KVKK.

 

10. RETENTION AND DESTRUCTION OF PERSONAL DATA
The Company will retain personal data in accordance with the minimum periods stipulated in the legal legislation related to the activity carried out and for the period necessary for the purpose for which the personal data are processed. If a period is stipulated in the relevant legislation for the retention of personal data, that period will be complied with. If no legal period exists, personal data will be retained for the period necessary for the purpose for which they are processed. At the end of the determined retention periods, personal data will be destroyed by the Company using destruction methods determined by the Company, in accordance with periodic destruction periods or the application of the data subject.

The provisions included in this Policy may be amended by the Company, if deemed necessary, and by an internal company decision.

This Policy entered into force on 03.11.2021.

Mamajoo Health & Products Inc