Disclosure Statement on the Processing of Personal Data

This Disclosure Statement has been prepared by Muhammed Mustafa Vanlı, operating under the DentinCloud brand ("DentinCloud") in its capacity as data controller, within the scope of Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK"), and other applicable data protection laws (including the GDPR where applicable), and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

1. IDENTITY OF THE DATA CONTROLLER

Title: Muhammed Mustafa Vanlı

Telephone: ⁦+90 850 304 54 71⁩

E-mail: [email protected]

KEP: [email protected]

2. PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING

3. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed based on the following legal grounds set out in Article 5 of the KVKK, and other applicable data protection laws (including the GDPR where applicable):

3.1. Explicit Consent (KVKK Art. 5/1):

• Sending commercial electronic messages
• Marketing and profiling activities
• Use of non-mandatory cookies

3.2. Establishment or Performance of a Contract (KVKK Art. 5/2-c):

• Creating and managing the membership account
• Providing Platform services
• Carrying out subscription and payment transactions
• Providing user support

3.3. Legal Obligation (KVKK Art. 5/2-ç):

• Keeping invoice and accounting records within the scope of tax legislation
• Storing access logs within the scope of Law No. 5651
• Responding to information requests from authorized institutions and organizations
• Responding to data subject applications within the scope of the KVKK

3.4. Legitimate Interest (KVKK Art. 5/2-f):

• Ensuring Platform security and fraud prevention
• Measuring and improving service quality
• Internal reporting and statistical analysis (anonymized data)

4. REGARDING SPECIAL CATEGORIES OF PERSONAL DATA

4.1. DentinCloud does not process special categories of personal data (health data, etc.) in user registration and service processes.

4.2. With respect to health data processed by users on the Platform on behalf of their own patients: The User holds the position of data controller, while DentinCloud holds the position of data processor. This data is processed technically only in accordance with the User's instructions and is not used by DentinCloud for any other purpose.

4.3. The User is responsible for personally fulfilling its obligations under Article 6 of the KVKK (obtaining explicit consent, taking adequate measures, etc.) when processing the special categories of personal data of its patients.

4.4. In the event that data stored on the Platform is, for any reason (including but not limited to cyber attack, technical failure, third-party intervention, force majeure), disclosed, lost, or damaged, DentinCloud, provided that it has taken reasonable security measures, cannot be held liable for the damages arising from such situation. The User, in its capacity as data controller, personally assumes all notification and indemnification obligations toward the relevant persons and authorized institutions.

5. TRANSFER OF PERSONAL DATA

5.1. Domestic Transfer:

5.2. Cross-Border Transfer:

Within the scope of Platform infrastructure services, personal data is transferred, pursuant to Article 9 of the KVKK:

• To countries with adequate protection (safe countries announced by the Personal Data Protection Board)
• To countries without adequate protection, on the condition of explicit consent or the data controller's written undertaking to provide adequate protection and the existence of the Board's authorization.

6. METHODS OF COLLECTING PERSONAL DATA

Your personal data is collected by the following methods:

• Through registration and membership forms on the Platform (automated)
• Through customer service and communication channels (partially automated)
• Through cookies and similar technologies (automated)
• Through e-mail and other electronic communication channels (partially automated)

7. RETENTION PERIOD OF PERSONAL DATA

Your personal data is retained for the period required by the purposes of processing. When the period expires, the data is deleted, destroyed, or anonymized pursuant to Article 7 of the KVKK.

Basic retention periods:

• Membership data: During membership + 1 year from the closure of the account
• Financial data: 10 years (Tax Procedure Law No. 213)
• Access logs: 2 years (Law No. 5651)
• Contract data: Contract term + 10 years (statute of limitations)
• Commercial message consent records: 3 years from the withdrawal of consent (Law No. 6563)
• Cookie data: From the session duration up to a maximum of 2 years

8. YOUR RIGHTS AS A DATA SUBJECT

Pursuant to Article 11 of the KVKK, as a data subject, you have the following rights:

a) To learn whether your personal data is being processed

b) To request information if your personal data has been processed

c) To learn the purpose of processing your personal data and whether it is used in accordance with that purpose

d) To know the third parties to whom personal data is transferred, domestically or abroad

e) To request the correction of personal data in the event that it has been processed incompletely or incorrectly

f) To request the deletion or destruction of personal data within the framework of the conditions provided for in Article 7 of the KVKK

g) To request that the operations carried out pursuant to subparagraphs (e) and (f) be notified to the third parties to whom the personal data has been transferred

h) To object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems

i) To request the indemnification of damages in the event of suffering damage due to the unlawful processing of personal data

9. APPLICATION PROCEDURE

To exercise your rights under the KVKK, you may apply by the following methods:

b) E-mail: To [email protected] by petition signed with a secure electronic signature or mobile signature

c) KEP: To [email protected] by registered electronic mail

Information that must be included in the application:

• First name, last name, and signature if the application is in writing
• Turkish ID number (passport number for foreigners)
• Residence or workplace address for notification purposes
• If any, e-mail address, telephone, and fax number for notification
• Subject of the request

Applications are concluded free of charge within 30 (thirty) days at the latest. In the event that the operation requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

10. RIGHT TO COMPLAIN TO THE PERSONAL DATA PROTECTION BOARD

In the event that your application is rejected, the response given is found insufficient, or no response is given within the time limit, you may file a complaint with the Personal Data Protection Board within 30 (thirty) days from the date you learn of the response, and in any case within 60 (sixty) days from the date of application.

Personal Data Protection Authority

Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No:4, 06520 Balgat-Çankaya/Ankara

Telephone: 0312 216 50 50

Web: www.kvkk.gov.tr

11. CHANGES TO THE DISCLOSURE STATEMENT

This Disclosure Statement may be updated in line with legal regulations and changes in DentinCloud's practices. Updates are published on the Platform, and significant changes are notified by e-mail.

Last updated: 01.01.2025

This Disclosure Statement has been prepared for informational purposes pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.