GDPR Policy

Discovery

BCMARIN

INFORMATION TEXT ON THE PROCESSING OF PERSONAL DATA

This Information Text has been prepared by ……………………………….. Company (Bcmarin) to inform the customers of the Company about the processing of their personal data by the Company within the scope of the Law No. 6698 on the Protection of Personal Data (“GDPR”).

You can access detailed information regarding the processing of your personal data within the scope of this Information Text from the Bcmarin Company’s Personal Data Protection and Processing Policy available at www.bcmarin.com.

a) Methods and Legal Grounds for Obtaining Personal Data

Your personal data is collected in electronic or physical environments. The personal data collected based on the legal grounds specified in this Information Text can be processed and shared within the framework of the personal data processing conditions stated in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Your personal data is processed by the Company for the purposes of planning and executing the necessary activities for the customization and promotion of the products and services offered by the Company according to the likes, usage habits, and needs of the relevant persons, performing the necessary work by the business units to benefit the relevant persons from the products and services offered by the Company, carrying out the relevant business processes, performing the necessary work by the relevant business units for the realization of the commercial activities carried out by the Company and conducting the related business processes, planning and executing the commercial and/or business strategies of the Company, and ensuring the legal, technical, and commercial-business security of the Company and the persons in business relationships with the Company.

c) Parties with Whom Personal Data Can Be Shared and Purposes of Sharing

Your personal data can be shared within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, with the business partners and suppliers of the Company, legally authorized public institutions and private individuals, for the purposes of planning and executing the necessary activities for the customization and promotion of the products and services offered by the Company according to the likes, usage habits, and needs of the relevant persons, performing the necessary work by the business units to benefit the relevant persons from the products and services offered by the Company, carrying out the relevant business processes, performing the necessary work by the relevant business units for the realization of the commercial activities carried out by the Company and conducting the related business processes, planning and executing the commercial and/or business strategies of the Company, and ensuring the legal, technical, and commercial-business security of the Company and the persons in business relationships with the Company.

d) Rights of Data Subjects and How to Exercise These Rights

As personal data subjects, if you submit your requests regarding your rights to the Company through the methods mentioned under the title "Exercising Rights by Data Subjects," your requests will be evaluated and concluded by our Company as soon as possible and within 30 (thirty) days at the latest.

Pursuant to Article 11 of the Law, you have the following rights as a personal data subject:

- To learn whether your personal data is processed,

- To request information if your personal data has been processed,

- To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

- To know the third parties to whom your personal data is transferred domestically or abroad,

- To request the correction of your personal data if it is incomplete or incorrectly processed and to request the notification of the transaction made in this context to the third parties to whom your personal data has been transferred,

- To request the deletion or destruction of your personal data in case the reasons for processing your personal data disappear despite being processed in accordance with the Law and other relevant legal provisions and to request the notification of the transaction made in this context to the third parties to whom your personal data has been transferred,

- To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,

- To demand the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.

Article 28(2) of the Law lists the situations in which data subjects do not have the right to request, and in this context:

- Personal data processing is necessary for the prevention of crime or for a criminal investigation,

- Processing of personal data made public by the data subject,

- Personal data processing is necessary for the performance of supervisory or regulatory duties and disciplinary investigations and prosecutions by authorized and responsible public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by the law,

- Personal data processing is necessary for the protection of the economic and financial interests of the State with regard to budgetary, tax, and financial matters,

In these cases, the above-mentioned rights cannot be exercised concerning the data.

According to Article 28(1) of the Law, since the following data will be outside the scope of the Law, data subjects' requests regarding these data will not be processed:

- Personal data processing by real persons within the scope of activities related to themselves or their family members living in the same residence, provided that they are not given to third parties and obligations regarding data security are complied with,

- Processing of personal data for official statistics and for research, planning, and statistical purposes after being anonymized,

- Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life, or personal rights or constitute a crime,

- Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by the law to ensure national defense, national security, public security, public order, or economic security,

- Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution proceedings.

Exercising Rights by Data Subjects

Data subjects can use the "Form for Applications to the Data Controller by the Personal Data Owner" available at [www.bcmarin.com] to exercise the above-mentioned rights.

Applications will be made with documents identifying the relevant data subject, by one of the following methods:

- Submitting a wet-signed copy of the form in person, via notary, or by registered mail with return receipt to the address [………………………………………………………..-Turkey],

- Sending the form signed with a secure electronic signature within the scope of the Electronic Signature Law No. 5070 to the registered electronic mail address [……………………..@hs02].kep.tr,

- Following a method stipulated by the Personal Data Protection Board.

The Company responds to the data subjects who wish to exercise their rights within the limits stipulated by the Law and within the maximum period of thirty (30) days as stipulated by the Law. For a third party to make a request on behalf of the personal data subject, there must be a special power of attorney issued by a notary on behalf of the person who will make the application.

While data subject applications are processed free of charge as a rule, a fee may be charged based on the fee schedule determined by the Personal Data Protection Board[1].

The Company may request information from the relevant person to determine whether the applicant is the personal data subject and may ask questions to the personal data subject to clarify the issues stated in the application.

[1] According to the “Communiqué on the Procedures and Principles of Application to the Data Controller” published in the Official Gazette dated 10.03.2018 and numbered 30356, if the response to the application is given in writing, no fee is charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page over ten pages. If the response to the application is given in a recording medium such as a CD or flash drive, the fee that may be charged by the Institution cannot exceed the cost of the recording medium.