GDPR

1 Data Controller
With this Clarification Text on the Protection and Processing of Personal Data (“Clarification Text”), we,
ALELGEN SAĞLIK DANIŞMANLIK HİZM. TİC. LTD. ŞTİ. (“Company”), as the Data Controller
pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), would like to inform our valued customers
within the scope of our obligation to inform under the KVKK.
Under the KVKK, personal data refers to any information relating to an identified or identifiable natural person
(“Personal Data”). Our Company shows maximum sensitivity to the lawful processing, secure storage, and
protection of the confidentiality of your Personal Data.
2 Method of Collecting Personal Data and Legal Reasons for Processing
Your Personal Data is collected entirely electronically (by automatic means) through the following methods
in connection with your transactions with our Company via our website and within the scope and purpose
specified in Section 4 below:
• Through your visits, memberships, registrations, and form-filling processes on the Company's
websites,

• During your purchases, order forms, and the establishment of distance sales agreements made via
the website,

• Through requests, information updates, and complaints you submit via our customer relations channels,
social media accounts, support lines, or contact forms.
The legal reasons for processing Personal Data, as specified in Articles 5 and 6 of the KVKK and relied upon
by our Company, are as follows:
• It is necessary to process the personal data of the parties to a contract, provided that it is directly
related to the establishment or performance of a contract,
• It is mandatory for our Company to fulfill its legal obligations,
• It is explicitly stipulated in the laws,
• It is mandatory to process data for the legitimate interests of our Company, provided that it does not
harm your fundamental rights and freedoms,

• Your explicit consent is obtained in processes requiring explicit consent, such as sending campaigns,
advertisements, and commercial electronic messages.

3 Your Collected Personal Data
To ensure the uninterrupted and secure execution of our e-commerce processes, the following Personal Data is
processed, proportionate to the processing purposes stated in Section 4:
• Identity Information: Name, surname, Turkish ID number (if required for invoicing processes).
• Contact Information: Delivery and billing address, email address, mobile phone number.
• Customer Transaction Information: Order and purchase history, cart contents, billing information,
request and complaint details.
• Transaction Security Information: IP address, site entry-exit log records, password information, device
and browser information.

Important Note: Your credit card and debit card information, requested for the completion of your payment
transactions, is absolutely not stored on our Company's servers and database. All payment transactions

are carried out directly through the Shopify integrated infrastructure and licensed payment channels within
the framework of data security standards.

2

4 For What Purpose Personal Data Will Be Processed
Your Personal Data is processed by our Company for the following purposes in cases legally permitted under the
KVKK and within the framework of the specified legal grounds:

• Execution of Contract Processes: Packaging, shipping, tracking delivery processes of products you
purchase via the website, and ensuring healthy delivery of products to you (Legal reason: Establishment
and performance of the contract).

• Company Loyalty and Membership Processes: Carrying out membership transactions via the website,
managing member accounts, and offering special advantages to members (Legal reason:
Establishment and performance of the contract).
• Fulfillment of Financial and Legal Obligations: Issuing legal invoices after sales transactions,
creating tax declarations, and fulfilling all legal obligations arising from relevant legislation (Legal reason:
Explicitly stipulated in laws and legal obligation).

• Customer Relations and Support Processes: Providing after-sales support, carrying out cancellation
and return processes; tracking and resolving customer requests, questions, and complaints (Legal
reason: Performance of the contract and legitimate interest).

• Marketing and Advertising Activities (With Your Explicit Consent): Planning customized marketing
activities by analyzing past shopping habits and trends; sending electronic commercial messages (SMS,
email) within the scope of discounts, campaigns, promotions, gift codes, and e-newsletter processes
(Legal reason: Explicit consent).
• Ensuring Information and Transaction Security: Ensuring information security in online environments,
preventing illegal access in the internet environment, and controlling suspicious transactions (Legal
reason: Legal obligation and legitimate interest).
• Protection and Defense of Rights: Fulfilling requests of authorized administrative bodies, protecting
the rights of the Company and its employees in legal disputes, and defending these rights before courts
(Legal reason: Establishment, exercise, and protection of a right).
5 To Whom and For What Purpose Personal Data May Be Transferred
Our Company may share or grant access to the Personal Data it collects with the following third parties,
adhering to data security measures, within the purposes and legal grounds specified in Section 4:

• To contracted cargo and logistics companies to deliver the products you purchase to your address,

• To Shopify integrated secure payment infrastructure organizations to securely collect payment
transactions,
• To our financial advisor and tax consultants for the legal tracking of invoicing, finance, accounting,
and financial processes,
• To our global infrastructure provider Shopify and domestic/international information technology service
providers for the cloud-based e-commerce infrastructure, web hosting, CRM, backup, and cyber security
of the site (relevant transfers are carried out with technical security protocols in compliance with KVKK
legislation),

• To our legal advisors, authorized judicial authorities, law enforcement agencies, and administrative
institutions for the resolution of legal disputes and the fulfillment of obligations arising from legislation.

3

6 General Rights of the Personal Data Subject Under KVKK
As a personal data subject, you can request the following general rights from our Company, which is the data
controller, at any time pursuant to Article 11 of the KVKK:
1. To learn whether personal data is being processed,
2. To request information if personal data has been processed,
3. To learn the purpose of processing personal data and whether it is used appropriately for its purpose,
4. To know the third parties to whom personal data is transferred domestically or abroad,
5. To request the rectification of personal data if it is incomplete or incorrectly processed,

6. To request the deletion, destruction, or anonymization of personal data if the reasons requiring its
processing cease to exist,

7. To object to the emergence of a result against the person himself/herself by analyzing the processed
data exclusively through automated systems,

8. To demand compensation for damages if personal data is processed unlawfully.

You can submit your applications regarding your rights mentioned above by attaching official documents that
identify you, delivering them by hand or via a notary public with a wet signature to our postal address specified
below, or directly to info@alelgen.com using your email address registered in our Company's system. Your
applications will be concluded free of charge within thirty days at the latest, depending on the nature of the
request.
Data Controller: ALELGEN SAĞLIK DANIŞMANLIK HİZM. TİC. LTD. ŞTİ.
Postal Address: BARBAROS MAH. AHLAT SK. VARYAP MERIDIAN SITESI D1 BLOK NO: 1D
IC KAPI NO: 12 ATASEHIR / ISTANBUL
Mersis No: 0051123028000001
Email Address: info@alelgen.com