Privacy Notice

1. Data controller

The data controller under the Law is our company, whose details are given below (“Eta Vizili” or the “Company”):

• Registered name: ETA VİZİLİ MEDİKAL ÜRETİM LİMİTED ŞİRKETİ
• Address: Saray Mah. 675. Cad. No:21, Kahramankazan / Ankara, Türkiye
• E-mail: info@etavizilimed.com

2. Personal data we process

We process the following personal data through this website and in the correspondence that follows:

Identity data: the first name and surname you enter in the contact form.

Contact data: your work e-mail address and, if you provide it, your country.

Request data: the subject you select (General enquiry, Distribution enquiry or Careers), the content of your message, the address of the page from which it was sent, the language in which the site was displayed, and any correspondence that follows by e-mail.

Transaction security data: the access logs kept automatically on the hosting provider’s server (IP address, time of access, page requested and browser information) and, when you submit the form, a temporary record consisting of a hash (SHA-1) of your IP address. The form does not write your IP address itself anywhere.

Job applications: when you write under the Careers subject, in addition to the data above we process the education, work experience, language, certification and reference details you include in your message or in the CV you later send by e-mail.

Please do not include in your application or CV any of the special categories of personal data listed in Article 6 of the Law: race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sex life, criminal convictions and security measures, and biometric and genetic data. We do not ask for such data; if they are sent to us, they are deleted without being considered.

3. Purposes of processing

We process your personal data only for the following purposes:

Responding to your request: assessing and answering the questions and requests you send us through the contact form or by e-mail.

Establishing and conducting a business relationship: where your request leads to a distribution, supply or other commercial relationship, establishing and conducting that relationship and the correspondence it involves.

Assessing job applications: assessing applications and CVs sent under the Careers subject for open positions, and contacting applicants.

Website security and prevention of misuse: operating the website and its server securely, and preventing automated and repeated form submissions.

Applicants: the personal data you send with a job application are processed only to assess that application and to contact you about it.

4. Legal grounds

Your personal data are processed not on the basis of your explicit consent but on the following legal grounds listed in Article 5(2) of the Law. The “I have read the Privacy Notice” box on the contact form only records that this notice was made available to you; it is not a declaration of explicit consent.

• Article 5(2)(c) — processing is necessary and directly related to the establishment or performance of a contract: responding to your request, establishing and conducting a business relationship, and assessing job applications.
• Article 5(2)(f) — processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms: responding to your request and keeping a record of the correspondence; securing the website and preventing misuse through server access logs and the IP hash record.
• Article 5(2)(ç) — processing is necessary for the data controller to comply with a legal obligation: keeping correspondence that becomes part of a business relationship for the periods required by commercial and tax legislation, and responding to lawful requests from competent public authorities.

5. How your data are collected

Your personal data are collected electronically and directly from you: through the contact form on this website (or, if the form cannot reach our server, through an e-mail prepared in your own e-mail program) and through the e-mail correspondence that follows. The address of the page and the display language are added automatically when the form is sent.

Server access logs and the IP hash record are generated by automated means when you visit the website and when you submit the form. The website uses no cookies; the only item stored in your browser is described in the Cookie notice.

6. Recipients and transfer abroad

Your personal data are not sold and are not shared with third parties for marketing purposes. They are transferred only to the following recipients, for the purposes stated, in accordance with Articles 8 and 9 of the Law:

Our hosting and e-mail infrastructure provider (SiteGround): to host the website, convert form messages into e-mail and deliver them, operate the info@etavizilimed.com mailbox and keep server access logs, on the grounds in Article 5(2)(c) and (f) of the Law.

Competent public authorities: only where there is a legal obligation to do so and the authority makes a request within its powers, on the ground in Article 5(2)(ç) of the Law.

Transfer abroad: the servers of our hosting and e-mail provider are located outside Türkiye, in data centres in the European Union, the United States or Asia. The data you send through the contact form, the e-mail correspondence and the server access logs are therefore processed abroad, which is a transfer of personal data abroad within the meaning of Article 9 of the Law. The transfer is carried out in accordance with the procedures and safeguards provided for in Article 9 of the Law.

7. Retention periods

Your personal data are kept for as long as the purpose for which they are processed requires and for the periods laid down in the applicable legislation. When the periods below expire, the data are deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data:

• Correspondence about a request: 2 years from the date the request is concluded.
• Correspondence that becomes part of a business relationship: for the duration of the relationship and, after it ends, for the statutory retention period laid down in commercial and tax legislation (10 years).
• Job applications: no more than 1 year after the position concerned is closed.
• Form IP hash records: no more than 1 hour; records older than one hour are deleted automatically whenever the form is used.
• Server access logs: kept by the hosting provider for security purposes, for the period set by its technical logging practice.

8. Your rights

Under Article 11 of the Law, you may apply to the data controller to exercise the following rights:

• (a) to learn whether your personal data are processed;
• (b) if they have been processed, to request information about it;
• (c) to learn the purpose of the processing and whether the data are used in accordance with that purpose;
• (ç) to know the third parties, in Türkiye or abroad, to whom your personal data are transferred;
• (d) to request the correction of your personal data if they are incomplete or inaccurate;
• (e) to request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law;
• (f) to request that the operations carried out under (d) and (e) be notified to the third parties to whom your personal data have been transferred;
• (g) to object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems;
• (ğ) to claim compensation if you suffer damage because your personal data are processed unlawfully.

9. How to apply

You may send requests concerning your rights under Article 11 of the Law, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in one of the following ways:

In writing: by a signed letter, delivered in person or sent by post to Saray Mah. 675. Cad. No:21, Kahramankazan / Ankara, Türkiye.

By e-mail: to info@etavizilimed.com, from the e-mail address you have previously given us and which is recorded in our system (for example, the address you used in the contact form), or signed with a secure electronic signature or mobile signature.

Your application must state your name and surname; your signature, if the application is in writing; your Turkish identity number if you are a citizen of Türkiye, or your nationality and passport number or, if any, identity number if you are a foreign national; your address for notifications; if any, your e-mail address, telephone and fax number for notifications; and the subject of your request. To confirm that the application is yours, we may need to verify your identity and may ask you for additional information for that purpose.

Your application will be concluded free of charge as soon as possible according to the nature of the request, and within thirty days at the latest. If the action requires an additional cost, the fee set in the tariff of the Personal Data Protection Board may be charged.

If your application is rejected, if you find the answer insufficient or if no answer is given in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 14 of the Law within thirty days of learning of the answer and, in any case, within sixty days of the date of your application.

10. Changes to this notice

This notice is updated when the way the website works or the applicable legislation changes. The current version is always published on this page, with the date below updated accordingly. Changes that materially affect the processing of your personal data are stated expressly in the notice.