Personal Data Protection Law (KVKK) Information Text

NUCLEUS GENETIC DISCLOSURE STATEMENT 2.0

LAW ON THE PROTECTION OF PERSONAL DATA

Law Number: 6698

Date of Acceptance: 24/3/2016 Published in the Official Gazette : Date: 7/4/2016 Number: 29677 Published in the Compilation of Laws: Series: 5 Volume: 57 The following is an information text containing the rights and obligations regarding the Personal Data Protection Law, the details of which are given above. This information text has been published by NUCLEUS GENETİK ÜRÜNLERİ A.Ş. (“NUCLEUS GENETİK”) as the data controller within the scope of Article 10 of the Personal Data Protection Law No. 6698 (“Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform . We would like to inform our valued visitors, respected business owners, our valued employees and everyone reading this text that our duty of care is fulfilled not only in the services we offer through our website and our analysis and R&D activities, medical diagnoses, genetic research, corporate relations and managerial activities, but also in the security of your personal data. As the data controller for our commercial activities, we take the necessary care to process and store the personal data of individuals associated with us, including our visitors, doctors, customers, employees, and job applicants, who benefit from our services, in accordance with the Constitution of the Republic of Turkey, international conventions to which our country is a party regarding human rights, and all relevant legislation, primarily the Law No. 6698 on the Protection of Personal Data ("KVKK"), by obtaining services and training from professional consultants. Dear portal visitor, one of the purposes of this information text is to fulfill the obligation to inform you, as stipulated in Article 10 of the Law No. 6698 on the Protection of Personal Data (Personal Data Protection Law), regarding the use of personal data obtained during the use of the website located at https://nucleusgenetics.com.tr/ (Portal), which is owned and managed by our company, and/or received from third parties . Furthermore, we aim to inform our valued visitors transparently about the methods of collecting personal data by NUCLEUS GENETİK or the purposes of processing, the legal grounds, and the rights of visitors regarding the personal data they enter into the Portal with their explicit consent. Our cookie policy is also available on the site.DEFINITIONS

Explicit Consent : Approval given clearly and unequivocally regarding a specific matter, based on informed and free will, and limited solely to that particular transaction.
Making personal data public: Making personal data accessible to everyone by the data subject.
Making information public : The act of an individual making their personal information available to the public.
Anonymization : The process of rendering personal data impossible to link to an identified or identifiable natural person, even when combined with other data.
Employees : Valuable employees working within NUCLEUS GENETİK headquarters and branches.
Awareness Campaigns: Everyone within Nucleus Genetics who has access to personal data receives necessary training on preventing the unlawful disclosure or sharing of personal data, and on preventing physical and cyber attacks.
Factual Impossibility: The situation of a person who is unable to give consent or who lacks the capacity to make reasoned decisions due to factual impossibility.
Secure Sockets Layer (SSL) is a certificate that enables the security and integrity of data flowing between a server and a client.
Data Subject: The natural person whose personal data is being processed.
Destruction: The deletion, destruction, or anonymization of personal data.
Contact Person: The contact person of legal entities established in Turkey and the representative of legal entity data controllers not established in Turkey, in accordance with the Law and secondary regulations that may be issued based on this Law.

The natural person notified by the data controller during registration with the Registry for communication with the Authority regarding their obligations under the regulations.

Personal Data : Any data relating to an identified or identifiable natural person.
Processing of Personal Data : Any operation performed on personal data, such as obtaining, recording, storing, keeping, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, whether wholly or partly automated or non-automated, provided that it is part of a data recording system.
Data Subject (Relevant Person): The natural person whose personal data is being processed.
Personal data retention and destruction policy: This is the policy that data controllers use as a basis for determining the maximum period for which personal data is necessary for the purpose for which it is processed, as well as for the processes of deletion, destruction, and anonymization.
Board: Personal Data Protection
Institution: Personal Data Protection
KVKK : The Law on the Protection of Personal Data, published in the Official Gazette dated April 7, 2016, and numbered 29677.
Masking: Making personal data unidentifiable by deleting or asterisking certain fields.
Legitimate Interest: Data processing is permissible only if it is necessary for the legitimate interests of the data controller, provided that the fundamental rights of the data subject are not prejudiced.
Automated processing: Data processing performed by an interconnected and interactive electrical or electronic system that minimizes the need for human intervention or assistance.
Non-automatic processing : Refers to "a record system in which personal data is processed by structuring it according to specific criteria." These systems can be created in electronic or physical environments.
Special Category Personal Data : Information regarding a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, health information, fingerprints, appearance and clothing, membership in associations or foundations, etc.

This includes data relating to union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Periodic Audits: These are audit activities carried out by experts within the company at specific intervals. Our company also receives independent audit services on a quarterly basis.
Random Audits: These are audit activities carried out by experts within the company without specifying a date. Our company also obtains independent audit services from external sources.
Risk Analysis: This involves examining and reporting on the physical, software, hardware, and legal risks of NUCLEUS GENETİK.
Deletion or Erasure: Making personal data inaccessible or unusable for the relevant users.
Medical Diagnosis: The process of diagnosing illnesses or medical problems by processing anonymous or masked data received by our team.
Data Processor : A natural or legal person who processes personal data on behalf of the data controller, based on the authorization given by the data controller.
Data Controller : The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. For this text, the data controller is NUCLEUS GENETİK.
Data Derivation: This involves replacing existing detailed data with more general equivalents.
Backup: This refers to the software or hardware backup of personal data to protect against damage, destruction, theft, or loss for any reason.
Destruction: The complete destruction of personal data so that it cannot be recovered by anyone in any way.

Our organization, which also operates the website https://nucleusgenetics.com.tr/ , holds the title of "Data Controller" as defined in Article 3 of the Personal Data Protection Law, as stated above. Contact information is provided at the end of the text.

Method of Collecting Your Personal Data

“Personal data” means information relating to an identified natural person, or information that we possess or have access to, and which can be identified. Your personal data may be collected verbally, in writing, or electronically through various digital channels such as messages, phone calls, portal visits, your business activities, participation in tenders, and ordering products, when you visit and use our website at https://nucleusgenetics.com.tr/. Personal data may be collected automatically or non-automatically as part of our data recording system when you share personal information alongside company information, fill out a form on the Portal, sell goods and services, participate in dispute resolution, receive a quote, fill out our contact form, visit our headquarters or pass through camera surveillance areas, contact our organization, submit a request by sharing personal data, contact us or other users regarding our services, participate in surveys, visit our branches, make purchases, make payments with a credit card, and when your personal data is legitimately transferred to us by real or legal persons from whom you have purchased services with your explicit consent and approved the sharing of your personal data.

Purposes of Processing Your Personal Data

Providing Services: Offering all services, including tenders and bulk sales, in line with your requests and needs, conducting commercial and corporate activities, and presenting our website to our valued customers. Ensuring Your Access to Our Website : Providing access to our portal page. Continuity of Our Commercial Activities : Conducting communication activities, managing and monitoring business activities, managing contract processes, managing goods/services sales processes, ensuring business continuity, and managing finance and accounting. Utilizing Fast Payment Systems: Enabling us to conduct our commercial activities quickly and effortlessly for our customers through systems such as contactless payment. Dispute Resolution: Determining the rightful owner, serving notices, and resolving disputes that have been or may be brought before the courts. Promotion, Marketing and Business Development Activities: To promote, advertise and announce our services or services offered through the Portal, to improve our website and services, to make the Portal easier to use and to improve our services, to develop strategies and business models and conduct market research, and to submit reports to the relevant authorities upon request. Providing a Personalized Experience: To enable you to log in more easily and quickly when you register on the Portal, to track your service purchase and sale transactions, to report suspicious transactions, and to create a document that you can submit to official authorities when necessary. Order Tracking: To process and deliver your verbal or written orders submitted through communication channels, and to track the payment processes. Communication : To contact you regarding our services and to provide customer service. Cookies: With your explicit consent, in addition to the information you have shared with us, we use mandatory cookies through tracking technologies and those used on our site. You can access our cookie policy at https://nucleusgenetics.com.tr/ .

YOUR PERSONAL DATA THAT IS PROCESSED

For employees, interns, and job applicants: the information you have submitted to NUCLEUS GENETİK;

Your personal information,
Your date of birth,
Your contact address,
Your mobile phone number,
Your email address,
Your educational background and diploma information,
Your professional experience,
Please include your passport-style photos (visual records) with your resume.
If you include it in your resume, please provide your health information (disability status).
Please include information about criminal convictions and security measures (criminal record) in your resume.
Your reference information (if you provided it),
(If you submit your resume physically) Security camera footage, visitor entry records,
(You submit your resume via online channels) Transaction security (IP-log) records,
In your resume, you have provided us with other personal details based on your preferences.

Your personal data, as mentioned above, will be processed by NUCLEUS GENETİK, wholly or partially automatically, for the purposes of " conducting employee/intern selection and placement processes " and " conducting employee candidate application processes" by electronically storing and evaluating your resumes submitted in response to a job advertisement or directly to NUCLEUS GENETİK, based on the legal grounds of "the processing activity being necessary for the legitimate interest of the data controller" and "the processing of personal data being necessary for the establishment of a contract" as stated in Article 5 of the Law. This data will not be shared with any third party without your consent. The data processed from visitors, customers, and other third parties includes: your identity, contact, billing information, and bank account information that you share with our company during the goods/services supply processes. This data is processed for the purposes of "conducting communication activities," "contract processes," and "financial and accounting operations," based on the legal grounds specified in Article 5, paragraph 2, subparagraph "c" of the Law, which states that "the processing of personal data belonging to the parties of a contract is necessary provided that it is directly related to the establishment or performance of a contract," and is transferred to authorized institutions and organizations for the purpose of "providing information to authorized persons, institutions, and organizations." We do not request any special categories of personal data from you.

Transfer of Your Personal Data

Your personal data may be shared with our solution partners or business partners, group companies, service providers, financial institutions, legally authorized public institutions and organizations, law enforcement and judicial authorities, and, only upon your request, with our solution partners or business partners, group companies, and service providers who undertake to take the necessary measures in accordance with Law No. 6698 when necessary to enable us to achieve the purposes stated above, and with legally authorized public institutions and organizations, law enforcement and judicial authorities. In all cases, such sharing is carried out in accordance with the personal data processing conditions stipulated in Articles 8 ("Transfer of Personal Data") and 9 ("Transfer of Personal Data Abroad") of the Law on the Protection of Personal Data. When your personal data is shared with the third parties mentioned in this article, it will only be shared to the extent necessary and within the scope of its relevance, and the third parties with whom the data is shared will also conduct the necessary inquiries to ensure that the data has the protection stipulated by Law No. 6698 on the Protection of Personal Data.

Legal Grounds for Processing Your Personal Data

We always process your personal data based on one of the legal grounds set forth in Articles 5 and 6 of the Law on the Protection of Personal Data. The legal grounds we rely on are:

Explicit provision in the law : Your personal data is processed based on a legal basis stemming from a provision in the law. This basis is also referred to as "fulfilling legal obligations."
Necessity for the protection of life or bodily integrity : This legal basis applies in situations where consent cannot be given due to factual impossibility or is deemed legally invalid, or where the processing of data is necessary for the protection of the life or bodily integrity of the data subject or another person.
Fulfillment of a legal obligation : Processing your personal data is based on a legal reason where it is necessary for us to fulfill a legal obligation.
Public disclosure by the data subject : This legal basis applies when you voluntarily share your personal data with the public or on social media. This clause applies only if your purpose for making the data public is suitable for our use of the data.

- Establishment, exercise or protection of a right : This legal basis applies where the processing of your personal data is necessary for the establishment, exercise or protection of a right.

Performance of a Contract : This legal basis applies when the processing of your personal data is directly related to the establishment or performance of a contract.
Necessity for our legitimate interests, provided it does not harm your fundamental rights and freedoms: This legal basis applies when the processing of your personal data is necessary for the conduct of our business activities, but such processing does not harm your fundamental rights and freedoms. This basis may underpin some or all of our processing activities carried out for the purposes of "Promotion and marketing", "Improving our website and services", "Providing personalized experiences", "Ensuring internet and transaction security, preventing transactions that may involve fraudulent or illegal activities", and "Fulfilling our NUCLEUS GENETIC policies and objectives" .
Explicit Consent: This legal basis exists when you explicitly consent to the processing of your personal data. In cases where none of the above legal grounds exist, we only process your personal data with your explicit consent. You have the right to withdraw your explicit consent at any time if you have given it. You also have the right to change the information you have provided.

Measures taken regarding the protection and security of personal data

I and all our staff have received training from a professional consulting firm on the personal data protection law and administrative and technical measures.
Technical infrastructure and related oversight mechanisms have been established for the deletion, destruction, and anonymization of personal data.
Technical and administrative measures were taken in accordance with Law No. 6698 and institutional publications.
Our staff who access sensitive personal data receive regular training.
All our software products are licensed products.
Risk analysis was conducted, existing measures were optimized.
Backup system
By conducting risk analyses, as well as implementing fire and safety measures and obtaining professional security services, physical risks are minimized.
Firewall
Passwords have been assigned to all authorized personnel.
The consulting firm provides periodic and random audit services without sharing personal data.
Due to the limited number of staff hires and departures, our company's security and training are under strict control.
In areas requiring expertise, we employ qualified and trained personnel.
Key assignments have been made.
Only secure computers are used in our institution.
Access to personal data is limited to authorized personnel and areas of activity.
Only licensed software is used.
Data that is no longer needed for business operations is destroyed.

Personal Data Retention Period

We retain the personal data you share with us for the period necessary for the purpose for which the data was processed, in accordance with the conditions stated in this disclosure text, so that you can benefit from our services in the best way, and to fulfill our obligations arising from the laws. You can always access updates and current information regarding these periods through VERBİS or our NUCLEUS GENETİK Data Destruction Policy, and you can make requests within the scope of your rights under Article 11 of Law No. 6698. Your rights under Article 11 of the Law: Regarding the data we collect, you have the right to: You have the right to: learn whether your personal data is being processed; request information about the processing if it is being processed; learn the purpose of the processing and whether it is being used in accordance with its purpose; know the identities of third parties with whom your data is shared, if any, domestically or internationally; request correction of your data if it is incomplete or inaccurate; request the deletion or destruction of your processed data if the reasons requiring its processing cease to exist; request that, in the event of deletion or correction of your data upon your request, the actions be notified to third parties to whom your personal data has been transferred; object to an outcome that is detrimental to you in cases where your data is analyzed exclusively through automated systems; and demand compensation for damages if you suffer harm due to unlawful processing. To exercise these rights, you can contact us in writing at: Kazımdirik Mah. Üniversite Cad. No: 79 D: 23, 35100 Bornova/İzmir or via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or by sending an email to info@nucleusgenetik.com.tr using the email address you previously provided to us and which is registered in our system . Data Controller: NUCLEUS GENETIC PRODUCTS INC.