Company / Privacy Policy
Personal Data Protection, Confidentiality, Storage, Destruction and Cookie Use Policy and Disclosure Text In accordance with the Personal Data Protection Law (KVKK), the EU General Data Protection Regulation (GDPR), and our company's information security policy, we have adopted the following principles and act accordingly in our operations.
- Our brands "TFLL Pharma, Thinking Future Long Life, Custom Supplements, Gelecek Düşünce Terzletiyoruz, The Future of Longevity, life span health span brain span" are protected by trademark registration.
- We sign confidentiality and competition agreements with all our personnel.
- We take measures to protect the confidentiality of our and our customers' information against unauthorized disclosure.
- We authorize access to information only to authorized individuals and based on business necessity.
- We protect the integrity of information against unauthorized modification.
- We meet all relevant legal and regulatory requirements, as well as contractual requirements.
All information provided on our website belongs to TFLL Pharma and cannot replace consultation with a physician or pharmacist. If you have any medical conditions, please consult a physician or pharmacist for more information.
Our company may collect personal data for various purposes. Below, we explain how and how personal data is collected, how and how it is processed and protected.
Personal Data Protection, Confidentiality, Storage, Destruction, and Cookie Use Policy and Disclosure Statement
TFLL Pharma (the "Company") is committed to protecting and processing personal data, ensuring that it is processed, protected, and transferred in accordance with Personal Data Protection Law No. 6698 and the European General Data Protection Regulation (GDPR) regulations (the "Law"). The Personal Data Protection Policy and Information Notice ("Information Notice"), which we have prepared due to the fact that we, as a company, operate the website www.tfllpharma.com which is operated and owned by our Company, contains our declarations and explanations regarding the personal data processed, the purpose of data processing, data categories, the method and legal basis for collecting data, to whom and for what purposes it may be transferred, our information as the data controller, the duration of data processing, and your rights regarding your data.
1. DEFINITIONS AND ABBREVIATIONS
• Explicit Consent: Refers to consent based on information and expressed freely regarding a specific subject.
• Anonymization: Refers to rendering personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.
• Relevant Person/Data Subject: Refers to the natural person whose personal data is processed.
• Law: Law No. 6698 on the Protection of Personal Data, published in the Official Gazette No. 29677 dated April 7, 2016. Law No. 6698 on the Protection of Personal Data ("Law") was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Some articles of the "Law" entered into force on October 7, 2016.
• Personal Data: Refers to any information relating to an identified or identifiable natural person. • Special Data: This includes data related to individuals' race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Processing of Personal Data: This refers to any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of personal data, whether fully or partially automated, or non-automated, provided that it is part of any data recording system. Any operation performed on data within the scope of the "Law" is considered "processing of personal data," and data may only be disclosed/transferred, classified, and processed to third parties in cases permitted by the "Law." • Data Controller: The natural or legal person responsible for determining the purposes and means of processing personal data and for establishing and managing the data recording system.
• Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
• Data Recording System: A recording system in which personal data is structured and processed according to specific criteria.
• Application Form: The form containing the application of the data subject to exercise their rights within the framework of relevant legislation.
• Policy: Personal Data Protection, Confidentiality, Storage, and Destruction Policy ("Policy")
• Destruction: The deletion, destruction, or anonymization of personal data.
• Storage Medium: Any medium containing personal data processed by fully or partially automatic means, or non-automatic means provided that it is part of any data recording system.
2. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
• Compliance with the law and rules of integrity: All personal data processed by the Company is processed in accordance with the law, particularly the Constitution of the Republic of Turkey and the KVKK, without violating all legislation and rules of integrity.
• Accuracy and, where necessary, up-to-dateness: The Company prioritizes ensuring that the personal data it processes is accurate, does not contain false information, and updates personal data in the event of any changes to personal data and notification of such changes.
• Processing for specific, explicit, and legitimate purposes: The Company processes personal data for explicitly and explicitly defined legitimate purposes. It does not process data for purposes other than these purposes.
• Relevance, limitation, and proportionality to the purpose for which it is processed: Personal data processed by the Company is used in accordance with the KVKK and other legislation, limited to the purpose for which it is processed, and to the extent necessary for the service.
• Retention for the period stipulated in the relevant legislation or necessary for the purpose for which it is processed: Personal data processed by the Company is retained for the period required for the purpose for which it is processed in the relevant legislation.
3. CONDITIONS FOR PROCESSING PERSONAL DATA
• Personal data processed by the Company is processed in accordance with the conditions set forth in the KVKK. The conditions for processing personal data are listed in Article 5 of the Personal Data Protection Law. Accordingly, personal data may be processed if at least one of the following conditions is met:
• The explicit consent of the relevant person,
• It is expressly provided for by law,
• The processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract,
• It is necessary for the protection of the life or physical integrity of the person who is unable to give his consent due to a physical impossibility or whose consent is not legally valid, or of another person,
• To identify the transaction owner's information within the scope of Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, published in the Official Gazette No. 29457 dated August 26, 2015, which was prepared based on these regulations, the Regulation on Distance Contracts published in the Official Gazette No. 29188 dated November 27, 2014, and other relevant legislation. To record identity, address, and other necessary information,
• To prepare all records and documents that will form the basis of payment systems, electronic contracts, or paper transactions required in the field of banking and electronic payments; and to comply with information storage, reporting, and information obligations stipulated by legislation and other authorities,
• To provide information to prosecutors, courts, and relevant public officials upon request and in accordance with legislation regarding matters related to public security and legal disputes,
• It is necessary for the data controller to fulfill its legal obligation,
• It is made public by the data subject,
• Data processing is necessary for the establishment, exercise, or protection of a right,
• Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
• The conditions for processing personal data, i.e., legal compliance, are specified in the Law by enumeration, and these conditions cannot be expanded.
4. PERSONAL DATA COLLECTED
The following personal data may be collected within the scope of the Company's business and activities:
• In accordance with our quality policy, your conversations with our +90 850 377 77 01 hotline are recorded to measure customer satisfaction.
• Contact Information ("Contact Information"): Address information, email address, contact address, registered email address (KEP), phone number, fax number, social media account of the workplace.
• Identity Information ("Identity Information"): Name and surname, Turkish ID number.
• To identify system-related issues and quickly resolve any issues or disputes that may arise, our company records and uses visitors' IP addresses. IP addresses can also be used to identify users in general and to gather comprehensive demographic information. Our company is committed to keeping confidential information strictly private and confidential, considering this a confidentiality obligation, and undertaking all necessary measures and due diligence to ensure and maintain confidentiality, and to prevent all or any portion of confidential information from entering the public domain, unauthorized use, or disclosure to third parties.
• The Company may obtain information about users visiting our website and their use of the website using a technical communication file (cookie). These technical communication files are small text files that a website sends to a user's browser to be stored in the main memory. A technical communication file facilitates Internet use by storing site status and preferences. A technical communication file helps us obtain statistical information about how many people visit the site, the purpose of each visit, how many times they visit, and how long they stay on the site. It also helps us dynamically generate advertising and content from user-specific user pages. A technical communication file is not designed to collect data or any other personal information from the main memory or your email address. Most browsers are initially designed to accept technical communication files, but users can optionally change their settings to prevent the receipt of technical communication files or to receive a warning when one is sent.
• Preferences on pages accessed using their username and password, IP records of transactions performed, cookie data collected by the browser, including browsing time and details, location data, internet access logs, login and exit logs, page views, and statistics related to mobile and other digital applications.
• Data obtained verbally, in writing, or electronically through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers.
• Data obtained indirectly through other channels, such as websites, blogs, contests, surveys, games, campaigns, and similar (micro) websites and social media, e-newsletter reading or click-through behavior, data provided by public databases, and profiles and data available for sharing on social media platforms can be processed and collected. • Personal Information: Candidates applying for a job with the Company must provide information such as: educational background, certificate and diploma information, foreign language skills, CV, courses attended, work experience, references, performance information, work preferences, length of service, education and skills, and information on which training they received and when, email address, signed participation form, goal achievement status, and bank account information to which payments are sent.
• Responses to surveys and forms: Information on periodic surveys conducted by the Company via phone or email, responses to forms or surveys, and responses to surveys conducted by individuals and legal entities with whom the Company collaborates.
• Visual and Audio Data: Photographs, audio recordings, and video footage of individuals.
5. PERSONAL DATA SUBJECTS
• Visitor: Individuals who visit the Website, individuals who physically visit the Company and fill out the "Visitor Form," individuals who participate in seminars and events organized by the Company, or individuals who visit the Company's stand at congresses and share their personal data through the interview form.
• Talent/Talent Candidate: Natural persons who have applied to join the Company or made their CV and related information available for review by the Company. In accordance with Article 4/2(3) of the Personal Data Protection Law, which stipulates that "data must be relevant, limited, and proportionate to the purpose for which it is processed," the personal information of candidates who apply to our company through job search portals and whose applications are printed, downloaded, and shared with third parties is destroyed after the recruitment process is completed and is not stored. Records of candidates who withdraw their applications during the recruitment process are also destroyed and are not stored in accordance with the same article.
• Customer: Individuals who purchase products or services from the Company.
• In accordance with our quality policy, your conversations with our +90 850 377 77 01 hotline are recorded to measure customer satisfaction.
• Company Shareholders: Natural persons who are shareholders of the Company.
• Company Officers: Members of the Company's board of directors and other authorized natural persons.
• Employees, Shareholders, and Officials of Collaborating Institutions/Customers: Natural persons who work for institutions/companies with which the Company has any kind of business relationship (such as, but not limited to, business partners and suppliers) and its Customers, including shareholders and officials of these institutions.
6. PERSONAL DATA COLLECTION METHOD AND LEGAL REASONS
Your personal data will be collected physically and/or electronically through the website, mobile application, marketplaces, user agreement, written forms and declarations, and email. It will be stored for the period necessary for the purpose for which it is processed, as required by the KVKK and relevant legislation. You can review the Storage and Destruction Periods for the period your personal data will be retained in Article 13.
Your personal data may be collected, processed, and transferred by the Company in accordance with the basic principles stipulated by the Personal Data Protection Law (KVKK) in order to achieve the purposes described above, and for the purposes specified in this Disclosure Statement, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.
In this context, your personal data may be collected, processed, and transferred based on the legal grounds, as defined in Article 5 of the KVKK, that (i) it is necessary for the data controller to fulfill its legal obligations, (ii) the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract, (iii) the processing is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject, or (iv) your explicit consent.
7. PURPOSES AND USE OF PERSONAL DATA PROCESSING
The Company processes personal data within the framework permitted by the Law and for the purposes and reasons listed below.
• Providing products and services,
• Processing orders and sales,
• Carrying out customer service activities,
• Fulfilling our legal obligations regarding the compliance of activities and the operation of the website, and fulfilling our tax obligations,
• Conducting finance and accounting,
• Conducting/auditing business activities,
• Conducting customer satisfaction activities,
• Conducting marketing, analysis, and advertising activities (with your explicit consent),
• Monitoring requests/complaints,
• Providing information to authorized persons, institutions, and organizations,
• Precautions taken for the safe use of our website and monitoring the security of data controller operations,
• Processing personal data is necessary for performance and is mandatory for the establishment, exercise, or protection of a right,
• Being a party to a contract,
• Carrying out storage and archiving activities,
• Informing the public and users and providing additional benefits to users,
• Processing data is necessary for the legitimate interests of the company, provided that fundamental rights and freedoms are not violated,
• Being the provider of the company's e-commerce infrastructure, Individuals and organizations related to the services provided, such as suppliers and cargo companies, are program partner organizations with which we collaborate, domestic/international organizations, and other third parties from whom we receive services in order to carry out our activities and/or as Data Processors.
Accordingly, the Company processes your personal data in accordance with this Policy.
If you have entered your personal information to benefit from the Company's services, we will use your data to provide you with access to these services and to monitor your access to these services. The consent you have given for the use of your personal data on the Website will also apply to the Website managed by the Company for the purposes and within the scope specified in this Disclosure Statement on the Protection and Processing of Personal Data, and the Company may use your personal data on the website.
Your personal data may be processed with your explicit consent, obtained in accordance with Articles 5 and 8 of the KVKK, for the purposes of fulfilling contractual and legal requirements, including the purposes listed above.
Legitimate Interest: In addition, we process some of your data based on our legitimate interest for administrative purposes. This includes ensuring secure access to the Website, taking precautions against fraud, and accounting requirements.
Explicit Consent: Your personal data may be processed in accordance with Articles 5 and 8 of the KVKK, including the purposes listed above, for the purpose of fulfilling contractual and legal requirements. For example, we process your personal data based on your explicit consent, obtained in accordance with Articles 5 and 8 of the KVKK. For example, in cases where your profile photo is reused by our services or you have not created an account on the platform but wish to receive information about our commercial offers/newsletter, we process your personal data based on your explicit consent.
Legal Obligations: Your personal data is processed due to the legal obligations imposed on us in connection with the management of payments made through the platform and, in particular, the fight against terrorism and money laundering.
Other Reasons for Data Processing: We may also process your personal data if the processing is expressly prescribed by law, if the data has been made public by the relevant person, or if processing is necessary for the establishment, exercise, or protection of a right.
Your Sensitive Data: We specifically avoid processing your personal data. In this context, within the context of your membership, we strongly recommend that you refrain from disclosing any personal information, and particularly sensitive data (such as race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal convictions and security measures, biometric and genetic data) in your written CV and other documents. If you provide us with your personal data for a purpose other than purchasing products and services, we may use your data in accordance with this purpose. For example, if you contact us via email, we may use the data you provide to respond to you or resolve your issue.
The Company, its subsidiaries, or business partners will use the personal data you provide to contact you regarding services. You may withdraw your consent for the use of your personal data at any time by contacting the Company in writing (including via email). Withdrawal of consent will also terminate your right to benefit from the services provided by the Company through the Website. However, if the use of your personal data is necessary for other users of the Website or within the scope of your commercial relationship with the Company during the period in which you have consented, the Company may use your personal data to the extent necessary until the service and related payments are processed and completed.
Your personal data collected through the Website will also be used to keep you informed about Company services and developments. The advertising and promotional emails sent to you will include a section allowing you to unsubscribe from these promotional emails at any time.
You may request the cessation of the use of your personal data or the amendment of information you believe to be inaccurate by submitting a written request to the Company. Cookies are used for the purposes specified in this Information Notice.
8. CASES WHERE PERSONAL DATA MAY BE PROCESSED WITHOUT EXPRESS CONSENT
The Company has the right to process general and special data with the express consent of the Data Subject and without explicit consent in the cases stipulated in Articles 5 and 6 of the Law.
Cases in which data may be processed without explicit consent include:
Explicitly provided for by law; It is necessary for the protection of the life or physical integrity of the person who is unable to give consent due to a physical impossibility or whose consent is not legally valid, or of another person; It is necessary for the processing of personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of a contract; It is necessary for the data controller to fulfill its legal obligation; It is made public by the data subject; It is necessary for the establishment, exercise, or protection of a right; and It is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject.
For example, this includes contact and identification information such as name, surname, phone number, email address, company information, responses to survey questions, entries made into forms, documents uploaded to the system, information regarding your education and CV, employment history, and bank account information/credit card payment records. The Site will not allow this data to be transferred to Company records unless you, as the user, read and approve the Personal Data Protection, Confidentiality, Storage, Destruction, Cookie Use Policy and Disclosure Statement regarding the Protection, Processing, and Transfer of Personal Data.
9. YOUR PERSONAL DATA THAT MAY BE TRANSFERRED
Your personal data, as specified below, may be transferred within the scope of the Company's business and activities.
Contact and Identity Information: Your contact information, such as address information, email address, contact address, registered electronic mail address (KEP), telephone number, fax number, etc., may be transferred to Company officials, employees, and officers for the purposes specified in Article 7. Furthermore, if services are purchased for the performance of these transactions, and if necessary, to the business partner, sponsor, supplier, natural person, or legal entity from which services are purchased, and their officials and employees.
Transaction Information: Email information sent through the Company's website, call center records, website browsing and clickstream information, internet access logs, login and logout logs, cookie usage information, internet protocol (IP) address, device ID, location information, web page views, statistics related to mobile and other digital applications, purchase history, past transaction information, and other information may be shared with Company employees, officers, and shareholders, third parties from whom services are purchased for these purposes, and their employees and officials, to ensure website security and efficiency. Furthermore, this data may be shared with authorized public institutions and organizations upon request for reasons arising from the Law.
Survey/Question Answers: Information and responses to periodic surveys conducted by the Company via telephone, email, and/or within the Platform, as well as responses to surveys conducted by individuals and legal entities with whom the Company collaborates, may be shared with the Company's talent and clients, individuals and legal entities with whom the Company collaborates, their employees, and officers, and through channels such as the Company's social media accounts, digital communication platforms, e-bulletins, and website.
Visual and Audio Data: Photos shared by data subjects with the Company, including photos taken at seminars, congresses, and events, and video recordings, may be shared with the public through the Company's social media accounts, digital communication platforms, e-bulletins, and website with the data subject's explicit consent.
Message Content: Messages received via platforms such as email, Instagram, Facebook, Twitter, and Pinterest.
Personal Information: For candidates or employees applying for a job with the Company, the following information may be shared with Company Officials responsible for recruitment: Educational background, certificate and diploma information, foreign language skills, CV, courses attended, work experience, references, performance information, work preferences, length of service, education and skills, information on which training they received and when, email address, signed participation form, goal achievement status, payment preferences and information.
10. PURPOSES FOR TRANSFERRING YOUR PERSONAL DATA
As explained in detail above, personal data processed by the Company, limited to the purposes mentioned in this disclosure statement and in accordance with Articles 5 and 6 of the law, may be transferred for the following purposes:
• The purposes of conducting and performing business activities, ensuring user registration on the site, as required by legislation or the performance of activities, and fulfilling requirements related to analyzing user opinions and expectations and ensuring efficiency.
• In the event of a commercial enterprise transfer, if the Company is transferred to another company through a merger or transfer, establishing a partnership, or merging its businesses with another company, personal data may also be transferred as assets of the Company. In such cases, the data of individuals who apply for and become members in the system will be accessible to the relevant Company as part of the system.
• To registration companies and representatives we have authorized, operating on behalf of our Company,
• To regulatory and supervisory authorities and public institutions or organizations expressly authorized by law to request personal data,
• To business partnerships, supplier and contractor companies, banks, credit risk and financial institutions, and other natural or legal persons for the specified purposes,
• To tax and similar consultants, required persons related to legal proceedings, public institutions and organizations, and third parties from whom we receive consultancy, including auditors, and, without limitation, to business partners, third parties from whom we receive services, and authorized individuals and organizations for the purposes specified above.
• Your personal data is not transferred abroad by the Company in any way. If necessary, your explicit consent for such transfer will be obtained separately.
• Your personal data collected through any of the methods listed above, whether processed in Turkey or processed and stored outside of Turkey, may also be transferred to service intermediaries located abroad (to countries accredited by the Personal Data Board and with adequate protection for personal data protection) in accordance with the contractual purposes, provided that it remains within the scope of the Personal Data Protection Law.
• Your personal data may be transferred with your explicit consent, obtained in accordance with Article 8 of the Personal Data Protection Law, for the purposes listed above, as well as for the fulfillment of requirements arising from individual and customer user agreements, and for other legal purposes.
11. CASES WHERE YOUR PERSONAL DATA MAY BE TRANSFERRED WITHOUT REQUESTING EXPRESS CONSENT
Confidential information and personal information requested by legal authorities in an official letter from our company will be shared with legal authorities.
Your personal data may be transferred in accordance with Article 8, Paragraph 2 of the KVKK. If it is expressly provided for in the law; If it is necessary for the protection of the life or physical integrity of the person who is unable to give his consent due to a de facto impossibility or whose consent is not legally valid, or if it is necessary for the protection of the life or physical integrity of another person; If it is directly related to the establishment or performance of a contract, the processing of personal data belonging to the parties to the contract is necessary; If it is necessary for the data controller to fulfill its legal obligation; If it has been made public by the relevant person; If data processing is necessary for the establishment, exercise, or protection of a right; Provided that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Personal data, other than those related to health and sexual life, listed in the first paragraph of Article 6 of the KVKK, may be transferred without the explicit consent of the data subject in the cases prescribed by law. Personal data related to health and sexual life may only be transferred without the explicit consent of the data subject, in accordance with the obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.
12. TRANSFERRED PERSONS AND TRANSFER METHODS
We may transfer your personal data within the framework of the purposes, requirements, and limits specified in the legislation described above; We share our personal data with legally authorized public and private institutions and organizations, Company officials, employees, officers, and shareholders, domestic business partners, suppliers, and sponsors, group companies, affiliates, and subsidiaries, independent auditing companies, and with real and legal persons within the limits required for service procurement for the performance of our activities, and with related real and legal persons through secure electronic or other communication channels, depending on the nature of the data and activity.
Within the scope of our Company's activities, if we communicate with users using electronic communication devices and applications, and if personal data previously provided by the user to a third party, the device or application operator ("Third Party"), for the use of the relevant device and applications is processed by the Third Party and/or transferred to other individuals, institutions, or organizations due to the communication being conducted through Third Party applications, this is subject to the terms of use, privacy, and personal data protection policies of the Third Party devices or applications. The Company has no liability in this situation.
13. STORAGE AND DESTRUCTION OF PERSONAL DATA
The Company will retain personal data, which is kept in accordance with all relevant legislation, particularly the Personal Data Protection Law, for the purpose of carrying out its commercial activities and for the period required for the processing purposes specified in this information document, and will be kept confidentially, taking into account the statutes of limitations as required by Article 12 of the Personal Data Protection Law and other legislation. Data will not be shared with third parties under any circumstances other than legal obligations and the regulations specified in this document.
The Company will retain the personal data it obtains, in accordance with the conditions specified in this Information Document, to ensure that Users can make the most of the website's services, and for the period necessary for the purpose for which it is processed, in order to fulfill its obligations arising from the nature of these Agreements.
In addition, in the event of any dispute arising from the Individual/Corporate User Agreement or the Information Document and Cookie Policy, the Company may retain personal data for the limited period of time specified in relevant legislation, limited to the purpose of asserting the necessary defenses within the scope of the dispute. In accordance with the general principles regarding the processing of personal data, the Company bases all transactions and activities on the personal data specified in this Policy, and periodically updates all administrative and technical protection measures required by law, to ensure the preservation of personal data within the framework of the purposes specified in this Policy.
If the purpose of processing personal data ceases to exist, our institution will delete, destroy, or anonymize the data, either ex officio or at the request of the relevant person. If the data is deleted as specified, it will not be reused or recovered under any circumstances.
Upon the expiration of the terms or services, the data in question will be deleted or destroyed in accordance with the Law.
Your personal data will be stored confidentially in the Company's database and systems in accordance with Article 12 of the Personal Data Protection Law (KVKK). Except for legal obligations and the regulations specified in this document, it will not be shared with third parties under any circumstances. The Company is obligated, in accordance with Article 12 of the Personal Data Protection Law, to prevent unlawful processing of personal data, prevent unauthorized access, and implement software and physical security measures such as access management. If it becomes known that personal data has been obtained by others through unlawful means, the situation must be reported immediately, in writing, and in accordance with legal regulations, to the Personal Data Protection Board.
14. PERSONAL DATA OBTAINED BEFORE THE ENFORCEMENT OF THE PDPL
Your personal data lawfully obtained before the effective date of the PDPL, April 7, 2016, through membership, electronic message consent, product/service purchases, or other means, will be processed and stored in accordance with the terms and conditions set forth in this document.
15. MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA
The Company is committed to protecting your personal data securely. The Company undertakes to take all necessary technical and administrative measures and to ensure the protection of personal data, to prevent unlawful processing and access to personal data, and to ensure the timely and complete completion of all necessary audits, in accordance with the conditions set forth in the Law and this Disclosure Statement. Your personal data will be processed in accordance with all necessary information security measures, provided that it is not used for purposes other than those specified and within the scope specified to you. It will be stored and processed for the legal retention period, or if no such period is stipulated, for the period required for the purpose of processing. Upon expiration of this period, your personal data will be removed from the Company's data flows through deletion, destruction, or anonymization.
16. LEGAL BASIS
Your personal data is processed for the following legal reasons:
KVKK Basis
Explicit consent (Article 5/1)
Establishment/performance of the contract (Article 5/2-c)
Legal obligation (Article 5/2-ç)
Legitimate interest (Article 5/2-f)
GDPR Basis
Explicit consent Article 6/1-a)
Performance of the contract (Article 6/1-b)
Legal obligation (Article 6/1-c)
Legitimate interest (Article 6/1-f)
17. YOUR RIGHTS AS A RELATED PERSON
Pursuant to Article 4 of the Personal Data Protection Law (KVKK), the Company is obligated to keep your personal data accurate and up-to-date. In this context, the Company is required to share accurate and up-to-date data of our Customers or update it through its website/mobile application in order to fulfill its obligations arising from applicable legislation. Article 11 of the KVKK No. 6698 entered into force on October 7, 2016. Pursuant to this article, the rights of the Personal Data Owner from that date onward are as follows: The Personal Data Owner may contact the "Company Data Controller" at any time to obtain information regarding the following matters within the scope of the Law:
a) To learn whether personal data has been processed,
b) To request information if personal data has been processed,
c) To learn the purpose of processing personal data and whether it is being used in accordance with its intended purpose,
ç) To know the third parties to whom personal data has been transferred, both domestically and internationally,
d) To request correction of personal data if it has been processed incompletely or inaccurately,
e) To request the deletion or destruction of personal data under the conditions stipulated in Article 7 of the Personal Data Protection Law,
f) To request notification of the actions taken pursuant to subparagraphs (d) and (e) above to third parties to whom personal data has been transferred,
g) To object to any adverse outcome resulting from analysis of personal data solely through automated systems,
ğ) To request compensation for damages if you suffer damages due to unlawful processing.
Furthermore, if you are an EU citizen, your rights under the GDPR, which entered into force on May 25, 2018, are as follows: Personal Data Subjects can contact the "Company Data Controller" at any time to obtain information about the following matters under the GDPR:
• Right to Data Portability (GDPR Article 20): According to this article, individuals have the right to receive personal data concerning them processed by automated means in a structured, commonly used, and machine-readable format, and to transmit this data to another data controller without hindrance.
• Right to Object to Processing (GDPR Article 21): The data subject has the right to object at any time to data processing based on legitimate interest grounds for reasons relating to their particular situation. Similarly, they may object at any time to data processing for direct marketing purposes.
• Right to Object to Profiling and Automated Decision-Making (GDPR Article 22): Individuals have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significant effects. However, this article includes some exceptions (for example, if it is necessary for the performance of the contract or if explicit consent has been obtained).
• Right to Complain to the Competent Data Protection Authority (GDPR Article 77): Anyone who believes that the processing of their personal data violates the GDPR may lodge a complaint with the national data protection authority (supervisory authority) where they live, work, or where the violation occurred.
YOU CAN CHANGE YOUR COMMUNICATION PREFERENCES AT ANY TIME AND EXERCISE YOUR RIGHT TO BE FORGOTTEN.
Channels to Contact Us for Your Requests
Your personal data will be processed by:
CT Farma Pharmaceuticals and Biotechnology Research and Development Industry and Foreign Trade Ltd.
TFLL Pharmaceuticals Food Supplements and Cosmetics Industry and Foreign Trade Ltd.
TFLL Pharma Belgium BV (Turkey does not provide this data controller)
Planto Health Food Cosmetics Textile Products Industry and Trade Ltd.
We are the Data Controller under the Personal Data Protection Law, and the company information is provided below. The Data Controller Representative to be appointed by our company will be announced in the Data Controllers Registry and on the website where this document is located once the legal framework is in place. You can submit your requests, questions, and comments under Article 11 of the Personal Data Protection Law, which regulates the rights of the data subject, to any of the communication channels below, via a notary public, or by other methods determined by the Personal Data Protection Board. We will respond to your request as soon as possible and within thirty (30) days, in accordance with the law. However, if the process requires additional costs, the Company reserves the right to charge a fee in accordance with the law, based on the tariff determined by the Personal Data Protection Board. The Data Controller Representative to be appointed by the Company will be announced in the Data Controllers Registry and on the website where this document is located, once the legal basis is in place.
EU citizens may also file a complaint with the data protection authorities in their country of residence.
For Turkey
Company Name: TFLL Pharmaceuticals, Food Supplements and Cosmetics Industry Foreign Trade Ltd.
Address: Barbaros Mh. Kardelen Sk. Palladium Tower No: 2/10-33, Ataşehir/ISTANBUL
Email: info@tfllpharma.com
Phone: +90 216 687 09 53
+90 850 377 77 01
For Belgium
Company Name: TFLL Pharma Belgium BV
Address: Life Sciences Incubator BioVille Agoralaan Building Abis 3590
Diepenbeek / Belgium
Email: info@tfllpharma.com
Phone: +32 11 286 900
18. EFFECTIVENESS
This Policy is effective September 12, 2025. The Company reserves the right to make changes to the Policy in accordance with legal regulations. You can access the current version of the Policy on our website. If the provisions of the Privacy Policy change, they will become effective on the date they are published on the website.
We recommend that you read this Disclosure Statement before accepting it. Thank you in advance for reading it.
Personal Data Protection, Confidentiality, Storage, Destruction and Cookie Use Policy and Disclosure Text In accordance with the Personal Data Protection Law (KVKK), the EU General Data Protection Regulation (GDPR), and our company's information security policy, we have adopted the following principles and act accordingly in our operations.
- Our brands "TFLL Pharma, Thinking Future Long Life, Custom Supplements, Gelecek Düşünce Terzletiyoruz, The Future of Longevity, life span health span brain span" are protected by trademark registration.
- We sign confidentiality and competition agreements with all our personnel.
- We take measures to protect the confidentiality of our and our customers' information against unauthorized disclosure.
- We authorize access to information only to authorized individuals and based on business necessity.
- We protect the integrity of information against unauthorized modification.
- We meet all relevant legal and regulatory requirements, as well as contractual requirements.
All information provided on our website belongs to TFLL Pharma and cannot replace consultation with a physician or pharmacist. If you have any medical conditions, please consult a physician or pharmacist for more information.
Our company may collect personal data for various purposes. Below, we explain how and how personal data is collected, how and how it is processed and protected.
Personal Data Protection, Confidentiality, Storage, Destruction, and Cookie Use Policy and Disclosure Statement
TFLL Pharma (the "Company") is committed to protecting and processing personal data, ensuring that it is processed, protected, and transferred in accordance with Personal Data Protection Law No. 6698 and the European General Data Protection Regulation (GDPR) regulations (the "Law"). The Personal Data Protection Policy and Information Notice ("Information Notice"), which we have prepared due to the fact that we, as a company, operate the website www.tfllpharma.com which is operated and owned by our Company, contains our declarations and explanations regarding the personal data processed, the purpose of data processing, data categories, the method and legal basis for collecting data, to whom and for what purposes it may be transferred, our information as the data controller, the duration of data processing, and your rights regarding your data.
1. DEFINITIONS AND ABBREVIATIONS
• Explicit Consent: Refers to consent based on information and expressed freely regarding a specific subject.
• Anonymization: Refers to rendering personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.
• Relevant Person/Data Subject: Refers to the natural person whose personal data is processed.
• Law: Law No. 6698 on the Protection of Personal Data, published in the Official Gazette No. 29677 dated April 7, 2016. Law No. 6698 on the Protection of Personal Data ("Law") was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. Some articles of the "Law" entered into force on October 7, 2016.
• Personal Data: Refers to any information relating to an identified or identifiable natural person. • Special Data: This includes data related to individuals' race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Processing of Personal Data: This refers to any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of personal data, whether fully or partially automated, or non-automated, provided that it is part of any data recording system. Any operation performed on data within the scope of the "Law" is considered "processing of personal data," and data may only be disclosed/transferred, classified, and processed to third parties in cases permitted by the "Law." • Data Controller: The natural or legal person responsible for determining the purposes and means of processing personal data and for establishing and managing the data recording system.
• Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
• Data Recording System: A recording system in which personal data is structured and processed according to specific criteria.
• Application Form: The form containing the application of the data subject to exercise their rights within the framework of relevant legislation.
• Policy: Personal Data Protection, Confidentiality, Storage, and Destruction Policy ("Policy")
• Destruction: The deletion, destruction, or anonymization of personal data.
• Storage Medium: Any medium containing personal data processed by fully or partially automatic means, or non-automatic means provided that it is part of any data recording system.
2. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
• Compliance with the law and rules of integrity: All personal data processed by the Company is processed in accordance with the law, particularly the Constitution of the Republic of Turkey and the KVKK, without violating all legislation and rules of integrity.
• Accuracy and, where necessary, up-to-dateness: The Company prioritizes ensuring that the personal data it processes is accurate, does not contain false information, and updates personal data in the event of any changes to personal data and notification of such changes.
• Processing for specific, explicit, and legitimate purposes: The Company processes personal data for explicitly and explicitly defined legitimate purposes. It does not process data for purposes other than these purposes.
• Relevance, limitation, and proportionality to the purpose for which it is processed: Personal data processed by the Company is used in accordance with the KVKK and other legislation, limited to the purpose for which it is processed, and to the extent necessary for the service.
• Retention for the period stipulated in the relevant legislation or necessary for the purpose for which it is processed: Personal data processed by the Company is retained for the period required for the purpose for which it is processed in the relevant legislation.
3. CONDITIONS FOR PROCESSING PERSONAL DATA
• Personal data processed by the Company is processed in accordance with the conditions set forth in the KVKK. The conditions for processing personal data are listed in Article 5 of the Personal Data Protection Law. Accordingly, personal data may be processed if at least one of the following conditions is met:
• The explicit consent of the relevant person,
• It is expressly provided for by law,
• The processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract,
• It is necessary for the protection of the life or physical integrity of the person who is unable to give his consent due to a physical impossibility or whose consent is not legally valid, or of another person,
• To identify the transaction owner's information within the scope of Law No. 6563 on the Regulation of Electronic Commerce, Law No. 6502 on Consumer Protection, and the Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce, published in the Official Gazette No. 29457 dated August 26, 2015, which was prepared based on these regulations, the Regulation on Distance Contracts published in the Official Gazette No. 29188 dated November 27, 2014, and other relevant legislation. To record identity, address, and other necessary information,
• To prepare all records and documents that will form the basis of payment systems, electronic contracts, or paper transactions required in the field of banking and electronic payments; and to comply with information storage, reporting, and information obligations stipulated by legislation and other authorities,
• To provide information to prosecutors, courts, and relevant public officials upon request and in accordance with legislation regarding matters related to public security and legal disputes,
• It is necessary for the data controller to fulfill its legal obligation,
• It is made public by the data subject,
• Data processing is necessary for the establishment, exercise, or protection of a right,
• Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
• The conditions for processing personal data, i.e., legal compliance, are specified in the Law by enumeration, and these conditions cannot be expanded.
4. PERSONAL DATA COLLECTED
The following personal data may be collected within the scope of the Company's business and activities:
• In accordance with our quality policy, your conversations with our +90 850 377 77 01 hotline are recorded to measure customer satisfaction.
• Contact Information ("Contact Information"): Address information, email address, contact address, registered email address (KEP), phone number, fax number, social media account of the workplace.
• Identity Information ("Identity Information"): Name and surname, Turkish ID number.
• To identify system-related issues and quickly resolve any issues or disputes that may arise, our company records and uses visitors' IP addresses. IP addresses can also be used to identify users in general and to gather comprehensive demographic information. Our company is committed to keeping confidential information strictly private and confidential, considering this a confidentiality obligation, and undertaking all necessary measures and due diligence to ensure and maintain confidentiality, and to prevent all or any portion of confidential information from entering the public domain, unauthorized use, or disclosure to third parties.
• The Company may obtain information about users visiting our website and their use of the website using a technical communication file (cookie). These technical communication files are small text files that a website sends to a user's browser to be stored in the main memory. A technical communication file facilitates Internet use by storing site status and preferences. A technical communication file helps us obtain statistical information about how many people visit the site, the purpose of each visit, how many times they visit, and how long they stay on the site. It also helps us dynamically generate advertising and content from user-specific user pages. A technical communication file is not designed to collect data or any other personal information from the main memory or your email address. Most browsers are initially designed to accept technical communication files, but users can optionally change their settings to prevent the receipt of technical communication files or to receive a warning when one is sent.
• Preferences on pages accessed using their username and password, IP records of transactions performed, cookie data collected by the browser, including browsing time and details, location data, internet access logs, login and exit logs, page views, and statistics related to mobile and other digital applications.
• Data obtained verbally, in writing, or electronically through our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers.
• Data obtained indirectly through other channels, such as websites, blogs, contests, surveys, games, campaigns, and similar (micro) websites and social media, e-newsletter reading or click-through behavior, data provided by public databases, and profiles and data available for sharing on social media platforms can be processed and collected. • Personal Information: Candidates applying for a job with the Company must provide information such as: educational background, certificate and diploma information, foreign language skills, CV, courses attended, work experience, references, performance information, work preferences, length of service, education and skills, and information on which training they received and when, email address, signed participation form, goal achievement status, and bank account information to which payments are sent.
• Responses to surveys and forms: Information on periodic surveys conducted by the Company via phone or email, responses to forms or surveys, and responses to surveys conducted by individuals and legal entities with whom the Company collaborates.
• Visual and Audio Data: Photographs, audio recordings, and video footage of individuals.
5. PERSONAL DATA SUBJECTS
• Visitor: Individuals who visit the Website, individuals who physically visit the Company and fill out the "Visitor Form," individuals who participate in seminars and events organized by the Company, or individuals who visit the Company's stand at congresses and share their personal data through the interview form.
• Talent/Talent Candidate: Natural persons who have applied to join the Company or made their CV and related information available for review by the Company. In accordance with Article 4/2(3) of the Personal Data Protection Law, which stipulates that "data must be relevant, limited, and proportionate to the purpose for which it is processed," the personal information of candidates who apply to our company through job search portals and whose applications are printed, downloaded, and shared with third parties is destroyed after the recruitment process is completed and is not stored. Records of candidates who withdraw their applications during the recruitment process are also destroyed and are not stored in accordance with the same article.
• Customer: Individuals who purchase products or services from the Company.
• In accordance with our quality policy, your conversations with our +90 850 377 77 01 hotline are recorded to measure customer satisfaction.
• Company Shareholders: Natural persons who are shareholders of the Company.
• Company Officers: Members of the Company's board of directors and other authorized natural persons.
• Employees, Shareholders, and Officials of Collaborating Institutions/Customers: Natural persons who work for institutions/companies with which the Company has any kind of business relationship (such as, but not limited to, business partners and suppliers) and its Customers, including shareholders and officials of these institutions.
6. PERSONAL DATA COLLECTION METHOD AND LEGAL REASONS
Your personal data will be collected physically and/or electronically through the website, mobile application, marketplaces, user agreement, written forms and declarations, and email. It will be stored for the period necessary for the purpose for which it is processed, as required by the KVKK and relevant legislation. You can review the Storage and Destruction Periods for the period your personal data will be retained in Article 13.
Your personal data may be collected, processed, and transferred by the Company in accordance with the basic principles stipulated by the Personal Data Protection Law (KVKK) in order to achieve the purposes described above, and for the purposes specified in this Disclosure Statement, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.
In this context, your personal data may be collected, processed, and transferred based on the legal grounds, as defined in Article 5 of the KVKK, that (i) it is necessary for the data controller to fulfill its legal obligations, (ii) the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract, (iii) the processing is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject, or (iv) your explicit consent.
7. PURPOSES AND USE OF PERSONAL DATA PROCESSING
The Company processes personal data within the framework permitted by the Law and for the purposes and reasons listed below.
• Providing products and services,
• Processing orders and sales,
• Carrying out customer service activities,
• Fulfilling our legal obligations regarding the compliance of activities and the operation of the website, and fulfilling our tax obligations,
• Conducting finance and accounting,
• Conducting/auditing business activities,
• Conducting customer satisfaction activities,
• Conducting marketing, analysis, and advertising activities (with your explicit consent),
• Monitoring requests/complaints,
• Providing information to authorized persons, institutions, and organizations,
• Precautions taken for the safe use of our website and monitoring the security of data controller operations,
• Processing personal data is necessary for performance and is mandatory for the establishment, exercise, or protection of a right,
• Being a party to a contract,
• Carrying out storage and archiving activities,
• Informing the public and users and providing additional benefits to users,
• Processing data is necessary for the legitimate interests of the company, provided that fundamental rights and freedoms are not violated,
• Being the provider of the company's e-commerce infrastructure, Individuals and organizations related to the services provided, such as suppliers and cargo companies, are program partner organizations with which we collaborate, domestic/international organizations, and other third parties from whom we receive services in order to carry out our activities and/or as Data Processors.
Accordingly, the Company processes your personal data in accordance with this Policy.
If you have entered your personal information to benefit from the Company's services, we will use your data to provide you with access to these services and to monitor your access to these services. The consent you have given for the use of your personal data on the Website will also apply to the Website managed by the Company for the purposes and within the scope specified in this Disclosure Statement on the Protection and Processing of Personal Data, and the Company may use your personal data on the website.
Your personal data may be processed with your explicit consent, obtained in accordance with Articles 5 and 8 of the KVKK, for the purposes of fulfilling contractual and legal requirements, including the purposes listed above.
Legitimate Interest: In addition, we process some of your data based on our legitimate interest for administrative purposes. This includes ensuring secure access to the Website, taking precautions against fraud, and accounting requirements.
Explicit Consent: Your personal data may be processed in accordance with Articles 5 and 8 of the KVKK, including the purposes listed above, for the purpose of fulfilling contractual and legal requirements. For example, we process your personal data based on your explicit consent, obtained in accordance with Articles 5 and 8 of the KVKK. For example, in cases where your profile photo is reused by our services or you have not created an account on the platform but wish to receive information about our commercial offers/newsletter, we process your personal data based on your explicit consent.
Legal Obligations: Your personal data is processed due to the legal obligations imposed on us in connection with the management of payments made through the platform and, in particular, the fight against terrorism and money laundering.
Other Reasons for Data Processing: We may also process your personal data if the processing is expressly prescribed by law, if the data has been made public by the relevant person, or if processing is necessary for the establishment, exercise, or protection of a right.
Your Sensitive Data: We specifically avoid processing your personal data. In this context, within the context of your membership, we strongly recommend that you refrain from disclosing any personal information, and particularly sensitive data (such as race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal convictions and security measures, biometric and genetic data) in your written CV and other documents. If you provide us with your personal data for a purpose other than purchasing products and services, we may use your data in accordance with this purpose. For example, if you contact us via email, we may use the data you provide to respond to you or resolve your issue.
The Company, its subsidiaries, or business partners will use the personal data you provide to contact you regarding services. You may withdraw your consent for the use of your personal data at any time by contacting the Company in writing (including via email). Withdrawal of consent will also terminate your right to benefit from the services provided by the Company through the Website. However, if the use of your personal data is necessary for other users of the Website or within the scope of your commercial relationship with the Company during the period in which you have consented, the Company may use your personal data to the extent necessary until the service and related payments are processed and completed.
Your personal data collected through the Website will also be used to keep you informed about Company services and developments. The advertising and promotional emails sent to you will include a section allowing you to unsubscribe from these promotional emails at any time.
You may request the cessation of the use of your personal data or the amendment of information you believe to be inaccurate by submitting a written request to the Company. Cookies are used for the purposes specified in this Information Notice.
8. CASES WHERE PERSONAL DATA MAY BE PROCESSED WITHOUT EXPRESS CONSENT
The Company has the right to process general and special data with the express consent of the Data Subject and without explicit consent in the cases stipulated in Articles 5 and 6 of the Law.
Cases in which data may be processed without explicit consent include:
Explicitly provided for by law; It is necessary for the protection of the life or physical integrity of the person who is unable to give consent due to a physical impossibility or whose consent is not legally valid, or of another person; It is necessary for the processing of personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of a contract; It is necessary for the data controller to fulfill its legal obligation; It is made public by the data subject; It is necessary for the establishment, exercise, or protection of a right; and It is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject.
For example, this includes contact and identification information such as name, surname, phone number, email address, company information, responses to survey questions, entries made into forms, documents uploaded to the system, information regarding your education and CV, employment history, and bank account information/credit card payment records. The Site will not allow this data to be transferred to Company records unless you, as the user, read and approve the Personal Data Protection, Confidentiality, Storage, Destruction, Cookie Use Policy and Disclosure Statement regarding the Protection, Processing, and Transfer of Personal Data.
9. YOUR PERSONAL DATA THAT MAY BE TRANSFERRED
Your personal data, as specified below, may be transferred within the scope of the Company's business and activities.
Contact and Identity Information: Your contact information, such as address information, email address, contact address, registered electronic mail address (KEP), telephone number, fax number, etc., may be transferred to Company officials, employees, and officers for the purposes specified in Article 7. Furthermore, if services are purchased for the performance of these transactions, and if necessary, to the business partner, sponsor, supplier, natural person, or legal entity from which services are purchased, and their officials and employees.
Transaction Information: Email information sent through the Company's website, call center records, website browsing and clickstream information, internet access logs, login and logout logs, cookie usage information, internet protocol (IP) address, device ID, location information, web page views, statistics related to mobile and other digital applications, purchase history, past transaction information, and other information may be shared with Company employees, officers, and shareholders, third parties from whom services are purchased for these purposes, and their employees and officials, to ensure website security and efficiency. Furthermore, this data may be shared with authorized public institutions and organizations upon request for reasons arising from the Law.
Survey/Question Answers: Information and responses to periodic surveys conducted by the Company via telephone, email, and/or within the Platform, as well as responses to surveys conducted by individuals and legal entities with whom the Company collaborates, may be shared with the Company's talent and clients, individuals and legal entities with whom the Company collaborates, their employees, and officers, and through channels such as the Company's social media accounts, digital communication platforms, e-bulletins, and website.
Visual and Audio Data: Photos shared by data subjects with the Company, including photos taken at seminars, congresses, and events, and video recordings, may be shared with the public through the Company's social media accounts, digital communication platforms, e-bulletins, and website with the data subject's explicit consent.
Message Content: Messages received via platforms such as email, Instagram, Facebook, Twitter, and Pinterest.
Personal Information: For candidates or employees applying for a job with the Company, the following information may be shared with Company Officials responsible for recruitment: Educational background, certificate and diploma information, foreign language skills, CV, courses attended, work experience, references, performance information, work preferences, length of service, education and skills, information on which training they received and when, email address, signed participation form, goal achievement status, payment preferences and information.
10. PURPOSES FOR TRANSFERRING YOUR PERSONAL DATA
As explained in detail above, personal data processed by the Company, limited to the purposes mentioned in this disclosure statement and in accordance with Articles 5 and 6 of the law, may be transferred for the following purposes:
• The purposes of conducting and performing business activities, ensuring user registration on the site, as required by legislation or the performance of activities, and fulfilling requirements related to analyzing user opinions and expectations and ensuring efficiency.
• In the event of a commercial enterprise transfer, if the Company is transferred to another company through a merger or transfer, establishing a partnership, or merging its businesses with another company, personal data may also be transferred as assets of the Company. In such cases, the data of individuals who apply for and become members in the system will be accessible to the relevant Company as part of the system.
• To registration companies and representatives we have authorized, operating on behalf of our Company,
• To regulatory and supervisory authorities and public institutions or organizations expressly authorized by law to request personal data,
• To business partnerships, supplier and contractor companies, banks, credit risk and financial institutions, and other natural or legal persons for the specified purposes,
• To tax and similar consultants, required persons related to legal proceedings, public institutions and organizations, and third parties from whom we receive consultancy, including auditors, and, without limitation, to business partners, third parties from whom we receive services, and authorized individuals and organizations for the purposes specified above.
• Your personal data is not transferred abroad by the Company in any way. If necessary, your explicit consent for such transfer will be obtained separately.
• Your personal data collected through any of the methods listed above, whether processed in Turkey or processed and stored outside of Turkey, may also be transferred to service intermediaries located abroad (to countries accredited by the Personal Data Board and with adequate protection for personal data protection) in accordance with the contractual purposes, provided that it remains within the scope of the Personal Data Protection Law.
• Your personal data may be transferred with your explicit consent, obtained in accordance with Article 8 of the Personal Data Protection Law, for the purposes listed above, as well as for the fulfillment of requirements arising from individual and customer user agreements, and for other legal purposes.
11. CASES WHERE YOUR PERSONAL DATA MAY BE TRANSFERRED WITHOUT REQUESTING EXPRESS CONSENT
Confidential information and personal information requested by legal authorities in an official letter from our company will be shared with legal authorities.
Your personal data may be transferred in accordance with Article 8, Paragraph 2 of the KVKK. If it is expressly provided for in the law; If it is necessary for the protection of the life or physical integrity of the person who is unable to give his consent due to a de facto impossibility or whose consent is not legally valid, or if it is necessary for the protection of the life or physical integrity of another person; If it is directly related to the establishment or performance of a contract, the processing of personal data belonging to the parties to the contract is necessary; If it is necessary for the data controller to fulfill its legal obligation; If it has been made public by the relevant person; If data processing is necessary for the establishment, exercise, or protection of a right; Provided that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Personal data, other than those related to health and sexual life, listed in the first paragraph of Article 6 of the KVKK, may be transferred without the explicit consent of the data subject in the cases prescribed by law. Personal data related to health and sexual life may only be transferred without the explicit consent of the data subject, in accordance with the obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.
12. TRANSFERRED PERSONS AND TRANSFER METHODS
We may transfer your personal data within the framework of the purposes, requirements, and limits specified in the legislation described above; We share our personal data with legally authorized public and private institutions and organizations, Company officials, employees, officers, and shareholders, domestic business partners, suppliers, and sponsors, group companies, affiliates, and subsidiaries, independent auditing companies, and with real and legal persons within the limits required for service procurement for the performance of our activities, and with related real and legal persons through secure electronic or other communication channels, depending on the nature of the data and activity.
Within the scope of our Company's activities, if we communicate with users using electronic communication devices and applications, and if personal data previously provided by the user to a third party, the device or application operator ("Third Party"), for the use of the relevant device and applications is processed by the Third Party and/or transferred to other individuals, institutions, or organizations due to the communication being conducted through Third Party applications, this is subject to the terms of use, privacy, and personal data protection policies of the Third Party devices or applications. The Company has no liability in this situation.
13. STORAGE AND DESTRUCTION OF PERSONAL DATA
The Company will retain personal data, which is kept in accordance with all relevant legislation, particularly the Personal Data Protection Law, for the purpose of carrying out its commercial activities and for the period required for the processing purposes specified in this information document, and will be kept confidentially, taking into account the statutes of limitations as required by Article 12 of the Personal Data Protection Law and other legislation. Data will not be shared with third parties under any circumstances other than legal obligations and the regulations specified in this document.
The Company will retain the personal data it obtains, in accordance with the conditions specified in this Information Document, to ensure that Users can make the most of the website's services, and for the period necessary for the purpose for which it is processed, in order to fulfill its obligations arising from the nature of these Agreements.
In addition, in the event of any dispute arising from the Individual/Corporate User Agreement or the Information Document and Cookie Policy, the Company may retain personal data for the limited period of time specified in relevant legislation, limited to the purpose of asserting the necessary defenses within the scope of the dispute. In accordance with the general principles regarding the processing of personal data, the Company bases all transactions and activities on the personal data specified in this Policy, and periodically updates all administrative and technical protection measures required by law, to ensure the preservation of personal data within the framework of the purposes specified in this Policy.
If the purpose of processing personal data ceases to exist, our institution will delete, destroy, or anonymize the data, either ex officio or at the request of the relevant person. If the data is deleted as specified, it will not be reused or recovered under any circumstances.
Upon the expiration of the terms or services, the data in question will be deleted or destroyed in accordance with the Law.
Your personal data will be stored confidentially in the Company's database and systems in accordance with Article 12 of the Personal Data Protection Law (KVKK). Except for legal obligations and the regulations specified in this document, it will not be shared with third parties under any circumstances. The Company is obligated, in accordance with Article 12 of the Personal Data Protection Law, to prevent unlawful processing of personal data, prevent unauthorized access, and implement software and physical security measures such as access management. If it becomes known that personal data has been obtained by others through unlawful means, the situation must be reported immediately, in writing, and in accordance with legal regulations, to the Personal Data Protection Board.
14. PERSONAL DATA OBTAINED BEFORE THE ENFORCEMENT OF THE PDPL
Your personal data lawfully obtained before the effective date of the PDPL, April 7, 2016, through membership, electronic message consent, product/service purchases, or other means, will be processed and stored in accordance with the terms and conditions set forth in this document.
15. MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA
The Company is committed to protecting your personal data securely. The Company undertakes to take all necessary technical and administrative measures and to ensure the protection of personal data, to prevent unlawful processing and access to personal data, and to ensure the timely and complete completion of all necessary audits, in accordance with the conditions set forth in the Law and this Disclosure Statement. Your personal data will be processed in accordance with all necessary information security measures, provided that it is not used for purposes other than those specified and within the scope specified to you. It will be stored and processed for the legal retention period, or if no such period is stipulated, for the period required for the purpose of processing. Upon expiration of this period, your personal data will be removed from the Company's data flows through deletion, destruction, or anonymization.
16. LEGAL BASIS
Your personal data is processed for the following legal reasons:
KVKK Basis
Explicit consent (Article 5/1)
Establishment/performance of the contract (Article 5/2-c)
Legal obligation (Article 5/2-ç)
Legitimate interest (Article 5/2-f)
GDPR Basis
Explicit consent Article 6/1-a)
Performance of the contract (Article 6/1-b)
Legal obligation (Article 6/1-c)
Legitimate interest (Article 6/1-f)
17. YOUR RIGHTS AS A RELATED PERSON
Pursuant to Article 4 of the Personal Data Protection Law (KVKK), the Company is obligated to keep your personal data accurate and up-to-date. In this context, the Company is required to share accurate and up-to-date data of our Customers or update it through its website/mobile application in order to fulfill its obligations arising from applicable legislation. Article 11 of the KVKK No. 6698 entered into force on October 7, 2016. Pursuant to this article, the rights of the Personal Data Owner from that date onward are as follows: The Personal Data Owner may contact the "Company Data Controller" at any time to obtain information regarding the following matters within the scope of the Law:
a) To learn whether personal data has been processed,
b) To request information if personal data has been processed,
c) To learn the purpose of processing personal data and whether it is being used in accordance with its intended purpose,
ç) To know the third parties to whom personal data has been transferred, both domestically and internationally,
d) To request correction of personal data if it has been processed incompletely or inaccurately,
e) To request the deletion or destruction of personal data under the conditions stipulated in Article 7 of the Personal Data Protection Law,
f) To request notification of the actions taken pursuant to subparagraphs (d) and (e) above to third parties to whom personal data has been transferred,
g) To object to any adverse outcome resulting from analysis of personal data solely through automated systems,
ğ) To request compensation for damages if you suffer damages due to unlawful processing.
Furthermore, if you are an EU citizen, your rights under the GDPR, which entered into force on May 25, 2018, are as follows: Personal Data Subjects can contact the "Company Data Controller" at any time to obtain information about the following matters under the GDPR:
• Right to Data Portability (GDPR Article 20): According to this article, individuals have the right to receive personal data concerning them processed by automated means in a structured, commonly used, and machine-readable format, and to transmit this data to another data controller without hindrance.
• Right to Object to Processing (GDPR Article 21): The data subject has the right to object at any time to data processing based on legitimate interest grounds for reasons relating to their particular situation. Similarly, they may object at any time to data processing for direct marketing purposes.
• Right to Object to Profiling and Automated Decision-Making (GDPR Article 22): Individuals have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significant effects. However, this article includes some exceptions (for example, if it is necessary for the performance of the contract or if explicit consent has been obtained).
• Right to Complain to the Competent Data Protection Authority (GDPR Article 77): Anyone who believes that the processing of their personal data violates the GDPR may lodge a complaint with the national data protection authority (supervisory authority) where they live, work, or where the violation occurred.
YOU CAN CHANGE YOUR COMMUNICATION PREFERENCES AT ANY TIME AND EXERCISE YOUR RIGHT TO BE FORGOTTEN.
Channels to Contact Us for Your Requests
Your personal data will be processed by:
CT Farma Pharmaceuticals and Biotechnology Research and Development Industry and Foreign Trade Ltd.
TFLL Pharmaceuticals Food Supplements and Cosmetics Industry and Foreign Trade Ltd.
TFLL Pharma Belgium BV (Turkey does not provide this data controller)
Planto Health Food Cosmetics Textile Products Industry and Trade Ltd.
We are the Data Controller under the Personal Data Protection Law, and the company information is provided below. The Data Controller Representative to be appointed by our company will be announced in the Data Controllers Registry and on the website where this document is located once the legal framework is in place. You can submit your requests, questions, and comments under Article 11 of the Personal Data Protection Law, which regulates the rights of the data subject, to any of the communication channels below, via a notary public, or by other methods determined by the Personal Data Protection Board. We will respond to your request as soon as possible and within thirty (30) days, in accordance with the law. However, if the process requires additional costs, the Company reserves the right to charge a fee in accordance with the law, based on the tariff determined by the Personal Data Protection Board. The Data Controller Representative to be appointed by the Company will be announced in the Data Controllers Registry and on the website where this document is located, once the legal basis is in place.
EU citizens may also file a complaint with the data protection authorities in their country of residence.
For Turkey
Company Name: TFLL Pharmaceuticals, Food Supplements and Cosmetics Industry Foreign Trade Ltd.
Address: Barbaros Mh. Kardelen Sk. Palladium Tower No: 2/10-33, Ataşehir/ISTANBUL
Email: info@tfllpharma.com
Phone: +90 216 687 09 53
+90 850 377 77 01
For Belgium
Company Name: TFLL Pharma Belgium BV
Address: Life Sciences Incubator BioVille Agoralaan Building Abis 3590
Diepenbeek / Belgium
Email: info@tfllpharma.com
Phone: +32 11 286 900
18. EFFECTIVENESS
This Policy is effective September 12, 2025. The Company reserves the right to make changes to the Policy in accordance with legal regulations. You can access the current version of the Policy on our website. If the provisions of the Privacy Policy change, they will become effective on the date they are published on the website.
We recommend that you read this Disclosure Statement before accepting it. Thank you in advance for reading it.
