Personal Data Protection Law

CUSTOMER INFORMATION NOTICE

1. PURPOSE OF PROCESSING PERSONAL DATA

The purpose of this Customer Information Notice is to inform you, as our valued customer, about which of your personal data may be processed, how and for what purposes they may be processed, the security of your personal data, and your rights and obligations. As Dokucell Genetic Diagnosis, Laboratory and Research Center Industry and Trade Inc. ("Company"), acting in our capacity as the Data Controller pursuant to the Personal Data Protection Law No. 6698 ("Law" or "PDPL"), we provide this information in fulfillment of our obligation to inform you under the Law.

Under the PDPL, personal data refers to any information relating to an identified or identifiable natural person ("Personal Data"). A special category of personal data ("Special Categories of Personal Data") includes data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Accordingly, the term "Personal Data" also includes your Special Categories of Personal Data.

Our Company reserves the right to update this Customer Information Notice on the Protection of Personal Data at any time in accordance with amendments to the applicable legislation.

2. METHODS OF COLLECTING PERSONAL DATA AND LEGAL GROUNDS FOR PROCESSING

Your Personal Data is collected, in connection with your relationship with our Company and for the purposes and within the scope specified in Section 3 below, through automated or non-automated means, verbally, in writing, or electronically, using the following methods and through third parties.

• 1. While using our corporate website,
• 2. While using our mobile website,
• • Through calls you make to our Company,
• 1. During your personal visit to our headquarters,
• 2. Via e-mail, SMS, WhatsApp, or other communication channels,
• 3. During the execution of service agreements and/or throughout the service procurement and service delivery process,
• • During the transfer of your samples to laboratories providing testing services within the scope of laboratory services,
• • Through information obtained for the purpose of benefiting from your private health insurance policies,
• 1. Through technical communication files known as "cookies," which enable our systems to recognize you automatically when you visit our website,
• 2. During e-mail communications with our employees,
• 3. During lost-and-found procedures,
• • Through social media, visual recordings taken during events organized by our Company, our business partners, and other similar channels through various methods.
• Your Personal Data is processed based on your explicit consent and the legal grounds specified in Article 5 of the Law.

The legal grounds set forth in Articles 5 and 6 of the Personal Data Protection Law (PDPL) regarding the processing of Personal Data are as follows;

The legal grounds for the processing of Personal Data under Articles 5 and 6 of the Personal Data Protection Law (PDPL) are as follows:
Conditions for Processing Personal Data
Explicit consent of the Data Subject is one of the legal grounds that permits the lawful processing of Personal Data. In addition to explicit consent, Personal Data may also be processed where one of the other conditions set out below applies. While a single legal ground may be sufficient for a particular Personal Data processing activity, more than one legal ground may also apply simultaneously. Where the processed data consists of Special Categories of Personal Data, in addition to the rules set out herein, the conditions specified below under the heading "Cases Where Special Categories of Personal Data May Be Processed" shall also apply.

Processing Personal Data Based on Explicit Consent
Where your Personal Data is not processed on any other legal basis, it will be processed based on your explicit consent. You will be informed about which of your Personal Data is processed, the purposes and legal grounds for such processing, the sources from which your Personal Data is collected, the parties with whom it may be shared, and how it will be used. Your explicit consent will then be obtained accordingly. The procedure for obtaining explicit consent is tailored to each data collection method, taking into account the source from which the Personal Data is collected.

Where Explicitly Required by Law
Where the processing of Personal Data is expressly provided for by law, your Personal Data may be processed without obtaining your explicit consent.

Where Explicit Consent Cannot Be Obtained Due to Actual Impossibility
Where it is necessary to protect the life or physical integrity of the Data Subject or another person, and the Data Subject is unable to provide explicit consent due to actual impossibility or where such consent cannot be deemed legally valid, your Personal Data may be processed without obtaining your explicit consent.

Where Directly Related to the Establishment or Performance of a Contract
Your Personal Data may be processed where such processing is necessary for the establishment or performance of a contract to which you are a party.

Compliance with the Company's Legal Obligations
Your Personal Data may be processed without obtaining your explicit consent where such processing is necessary for the Company, acting as the Data Controller, to fulfill its legal obligations.

Where the Data Subject Has Made Their Personal Data Public
Where you have made your Personal Data publicly available, it may be processed without obtaining your explicit consent.

Where Processing Is Necessary for the Establishment or Protection of a Legal Right
Your Personal Data may be processed without obtaining your explicit consent where such processing is necessary for the establishment, exercise, or protection of a legal right.

Processing Personal Data Based on Legitimate Interests
Provided that it does not prejudice your fundamental rights and freedoms, your Personal Data may be processed without obtaining your explicit consent where such processing is necessary for the legitimate interests of the Company.

Cases Where Special Categories of Personal Data May Be Processed
Certain Personal Data is classified as Special Categories of Personal Data and is subject to enhanced legal protection. Due to the risk of discrimination or harm if processed unlawfully, these categories of data are afforded special protection.

Processing Special Categories of Personal Data Based on Explicit Consent
Your Special Categories of Personal Data may be processed where you have provided your explicit consent. Such processing is carried out in accordance with the principles set forth in the Company's Personal Data Processing and Protection Policy, together with the necessary administrative and technical safeguards appropriate to the nature of the data.

Cases Where Special Categories of Personal Data May Be Processed Without Explicit Consent
In the absence of your explicit consent, your Special Categories of Personal Data may be processed, provided that the adequate measures determined by the Personal Data Protection Board ("Board") have been implemented, in the following circumstances:

(i) For Special Categories of Personal Data other than data relating to health and sexual life, where expressly provided for by law,

(ii) For Special Categories of Personal Data relating to health and sexual life, where processing is carried out by persons under a legal duty of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

2. PERSONAL DATA WE COLLECT
The Personal Data we collect from our customers in our capacity as the Data Controller is processed in proportion to the purposes specified in Section 4 below. Acting as the Data Controller, our Company processes the following Personal Data collected during the registration process, as it is directly related to the establishment and performance of the contractual relationship with the customer.

Identity and Contact Information; Your first name, last name, and similar identification information; e-mail address, Registered Electronic Mail (REM) address, telephone number, mobile phone number, identity document information, and address information.

Visual and Audio Records; Your photograph, video recordings captured for security purposes, and call center recordings.

Customer Transaction Data Related to the Services You Receive from Our Company; Financial records, credit card or other payment information, information relating to your private health insurance policy, and Social Security Institution (SSI) records.

Current and Historical Transaction Information; Information relating to your current reservation, including hotel or package tour preferences and travel information.

Request and Complaint Information; Written or verbal records of your requests or complaints regarding the services provided by our Company, as well as any special requests related to the services you receive.

Special Categories of Personal Data; As the services provided by our Company include laboratory services, we may process your blood type, blood test results, genetic data (where requested as part of the relevant laboratory analysis), previous or existing medical conditions, chronic diseases, gender, disability information, information regarding medical devices and prostheses used, other health information classified as Special Categories of Personal Data, and, where required by applicable legislation, health-related information such as infectious disease (e.g., COVID-19) test results, vaccination records/cards, and/or your HES code.

3. PURPOSES OF PROCESSING PERSONAL DATA
Your Personal Data is processed by DENTUR, based on your explicit consent or, where permitted by the PDPL, on other lawful grounds, in accordance with the fundamental principles set forth in the Law and within the scope of the data processing conditions and purposes specified in Articles 5 and 6 of the PDPL. Personal Data belonging to the data subject or to third parties designated by the data subject may be processed for the purposes listed below, including but not limited to the following:

• 1. To enable the relevant individuals to benefit from the products and services offered by our Company, and to carry out the necessary business operations and related processes through the relevant departments,
• 2. To review and/or respond to your requests and complaints,
• • To communicate medical laboratory test results and, where applicable, the related test reports,
• 1. To carry out communication activities,
• 2. To plan and implement our Company's commercial and business strategies,
• 3. To provide information to authorized persons, institutions, and public authorities in order to fulfill legal obligations and respond to requests from competent administrative authorities,
• • To promote the products and services offered by our Company and to send informational, promotional, and marketing communications via SMS, MMS, telephone, e-mail, or other electronic communication channels, including text, voice, image, animation, and multimedia content,
• • To prepare and/or send customer-specific promotions, marketing campaigns, and announcements,
• 1. To ensure the legal, technical, and commercial security of our Company and the individuals with whom we maintain business relationships, and to organize internal business operations,
• 2. To ensure transaction and information security,
• 3. To fulfill our contractual obligations under applicable legislation, comply with our legal obligations, and exercise our rights arising from applicable laws,
• • To create and maintain your financial records and prepare all records and documents required as the basis for processing in electronic or physical form,
• • To provide information to authorized public officials upon request where required by law for matters relating to public security,
• • To use such information as evidence in the event of legal disputes,
• 1. To carry out cancellation, refund, and re-service procedures.

Your Personal Data is processed within the scope of the conditions and purposes for processing Personal Data specified in Articles 5 and 6 of the PDPL. For more detailed information regarding the processing of your Personal Data, please refer to our Personal Data Processing and Protection Policy prepared in accordance with the Personal Data Protection Law No. 6698.

4. TO WHOM AND FOR WHAT PURPOSES PERSONAL DATA MAY BE TRANSFERRED
Our Company may transfer your Personal Data, where expressly permitted by law and/or based on your explicit consent (within the scope of the purposes specified in Section 4), to third parties located in Türkiye and/or abroad, in accordance with the purposes set forth in our Personal Data Protection Policy and pursuant to Articles 8 and 9 of the Personal Data Protection Law (PDPL).

The sharing of our customers' Personal Data with third parties is carried out within the scope of the customers' consent, and, as a general rule, Personal Data is not transferred to third parties without the consent of the relevant Data Subject.

In accordance with Articles 8 and 9 of the PDPL, the Company may transfer customers' Personal Data to the following categories of recipients:

(i) The Company's business partners,

(ii) The Company's domestic and international suppliers,

(iii) Legally authorized public institutions and organizations,

(iv) Legally authorized private legal entities,

(v) Other third parties, where the conditions for data transfer are satisfied.

All data transfers carried out by our Company are performed in accordance with the provisions set forth in our Personal Data Processing and Protection Policy.

The Personal Data transferred domestically and internationally as described above is protected not only through appropriate technical and organizational security measures, but also through PDPL-compliant contractual provisions, taking into account whether the receiving party acts as a Data Controller or Data Processor.

When transferring Personal Data to countries outside Türkiye, we ensure that such transfers are carried out in accordance with this Policy and in compliance with the applicable data protection legislation.

The Company may transfer and/or make your Personal Data accessible within Türkiye, based on your explicit consent or in other cases permitted by law (and within the scope of the purposes and legal grounds specified in Section 4), to third parties providing support services related to the Company's operations (such as legal service providers, information technology support companies, cloud service providers, etc.), as well as to competent public authorities and institutions for the resolution of legal disputes and the fulfillment of legal obligations, and, where requested, to judicial authorities or law enforcement agencies.

4.1 Transfer of Personal Data Within Türkiye
The Company is obliged to comply with the provisions of the Personal Data Protection Law (PDPL) and with the decisions and regulations issued by the Personal Data Protection Board regarding the transfer of Personal Data. Personal Data and Special Categories of Personal Data belonging to the Data Subject may not be transferred to other natural or legal persons without the Data Subject's explicit consent. However, where required by the PDPL or other applicable legislation, such data may be transferred, without explicit consent, to authorized administrative or judicial authorities within the limits and procedures prescribed by law.

Furthermore, pursuant to Article 8 of the PDPL, Personal Data may be transferred without the Data Subject's explicit consent where one of the conditions set forth in Article 5(2) applies, or, in the case of Special Categories of Personal Data, where the conditions specified in Article 6(3) are met. Personal Data may be transferred only to the extent necessary for carrying out the Company's commercial activities and business operations, provided that all necessary security measures are implemented and the requirements of the PDPL are fulfilled.

4.2 Transfer of Personal Data Abroad
Except where the Data Subject has provided explicit consent or where otherwise permitted by applicable law, the Company will not transfer Personal Data abroad. However, Personal Data may be processed in Türkiye and subsequently transferred abroad for processing and/or storage purposes. In the exceptional cases specified under the PDPL where explicit consent is not required for the transfer of Personal Data, in addition to the applicable legal grounds for processing and transfer, the recipient country must provide an adequate level of data protection. Whether such adequate protection exists is determined by the Personal Data Protection Board. If the recipient country does not provide an adequate level of protection, both the Data Controller in Türkiye and the Data Controller in the recipient country must provide a written undertaking ensuring adequate protection, and the approval of the Personal Data Protection Board must be obtained.

5. CCTV RECORDING AND MONITORING AT THE COMPANY PREMISES
In order to improve the quality and reliability of the services provided by the Company, ensure the safety of the Company, its guests, and other individuals, and protect the interests of customers and visitors regarding the services they receive, your Personal Data is processed through 24/7 CCTV monitoring at our Company premises.

The CCTV monitoring activities carried out by our Company are conducted in compliance with the applicable legislation. Surveillance is not performed in areas where it would interfere with an individual's privacy beyond what is necessary for security purposes.

In accordance with Article 10 of the Personal Data Protection Law (PDPL), the Company informs Data Subjects by placing notification signs at the entrances of monitored areas indicating that CCTV surveillance is in operation. The Personal Data obtained through such monitoring is protected by the administrative and technical measures set forth in this Policy.

6. RIGHTS OF THE DATA SUBJECT UNDER ARTICLE 11 OF THE PDPL
As the Data Subject, you may, at any time, exercise the rights granted to you under Article 11 of the Personal Data Protection Law by submitting a request to our Company, acting as the Data Controller.

Your rights under the PDPL include the following:

• 1. To learn whether your Personal Data is being processed,
• 2. To request information if your Personal Data has been processed,
• • To learn the purpose of processing your Personal Data and whether it is being processed in accordance with that purpose,
• 1. To know the third parties to whom your Personal Data has been transferred, whether within Türkiye or abroad,
• 2. To request the correction of your Personal Data if it has been processed incompletely or inaccurately, and to request that such correction be notified to third parties to whom the Personal Data has been transferred,
• 3. To request the deletion, destruction, or anonymization of your Personal Data within thirty (30) days in accordance with the Personal Data Deletion, Destruction, or Anonymization Regulation where the reasons requiring its processing no longer exist, even though it has been processed in compliance with the PDPL and other applicable legislation, and to request that such action be notified to third parties to whom the Personal Data has been transferred,
• • To object to any outcome that is to your detriment resulting exclusively from the automated processing and analysis of your Personal Data,
• • To request compensation for damages incurred due to the unlawful processing of your Personal Data.

7. EXERCISING THE RIGHTS OF THE DATA SUBJECT
The requests specified above may be submitted to the Company, acting as the Data Controller, in writing or by any other method determined by the Personal Data Protection Board ("Board").

The Data Subject may exercise the rights listed above by completing the Company's Data Subject Application Form and submitting it through one of the following methods:

By delivering a handwritten and signed copy in person, through a notary public, or by registered mail to the Company's address at Tatlısu Mah. Akif İnan St. No:5 Apt.23 Ümraniye - ISTANBUL / TÜRKİYE; or by scanning the completed form, signing it with a secure electronic signature in accordance with the Electronic Signature Law No. 5070, and sending it via Registered Electronic Mail (REM) to dokucell@hs03.kep.tr; or by sending the scanned form via the e-mail address registered in the Data Controller's system to kvkk@dokucell.com.tr; or by using any other method prescribed by the Personal Data Protection Board.

Where an application is submitted on behalf of the Data Subject by a third party, a special power of attorney issued through a notary public authorizing such representative must be provided.

The Company shall take all necessary administrative and technical measures to ensure that applications submitted by the Data Subject are processed effectively, lawfully, and in accordance with the principles of good faith.

The Company reserves the right to accept or reject the Data Subject's request, provided that the reasons for such decision are explained. The Company's response will be communicated to the Data Subject in writing or by electronic means.

If the Data Subject submits a request regarding the rights listed under Section 6 ("Rights of the Data Subject") in accordance with the procedures specified in this Section, the Company shall finalize the request free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. However, where the process requires additional costs, a fee may be charged in accordance with the applicable legislation.

If the Company's response is provided in writing, no fee will be charged for up to ten (10) pages. For each page exceeding ten pages, a processing fee of TRY 1.00 (One Turkish Lira) may be charged in accordance with the PDPL and other applicable legislation. If the response is requested in a physical recording medium such as a CD or USB flash drive, the applicant may be charged the actual cost of the requested medium.