Personal Data Protection and Privacy Policy

1. PURPOSE

The purpose of this policy is to ensure that the personal data processed by Medianova is protected in accordance with the principles of lawfulness, transparency, purpose limitation, data minimisation and security. The policy extends the existing ISMS with ISO/IEC 27701:2019 and is based on compliance with the Turkish Personal Data Protection Law No. 6698 (KVKK); for EU customers, the contractual obligations arising from the GDPR are also observed.

2. SCOPE AND ROLE

All personal data processed by Medianova in its capacity as data controller and/or data processor. Role determination and the PIMS scope are defined in DD.28.01 PII Role Determination and PIMS Scope; implementation rules are set out in PR.28 Personal Data Protection and Privacy Management Procedure.

3. POLICY PRINCIPLES

• Personal data is processed lawfully, for specific, explicit and legitimate purposes, and limited to those purposes.
• All processing activities are recorded in the Record of Processing Activities (RoPA) and kept consistent with the VERBİS registry.
• Data subjects are informed through privacy notices; explicit consent is obtained where required; their requests are answered within the statutory period.
• A Privacy Impact Assessment (DPIA) is carried out for high-risk processing.
• Data processing agreements (DPAs) are concluded with processors; international transfers are managed with safeguards compliant with the legislation.
• Personal data breaches are managed in line with KVKK notification obligations; data is destroyed at the end of its retention period.
• The security of personal data is ensured through ISO/IEC 27001 controls and the additional ISO/IEC 27701 controls.
• Privacy objectives are set, measured and regularly reviewed.
• The PIMS is continually improved through internal audits, management reviews and corrective actions.

4. RESPONSIBILITY

The Integrated Management Representative is responsible for implementing this policy; all employees and suppliers processing personal data are responsible for complying with it.

Data subject requests: kvkk@medianova.com.

5. COMMUNICATION AND ACCESS

This policy is documented, communicated to all employees and made available to interested parties as appropriate.

FOUNDER & CEO