KVKK Information Notice

ŞİRKETİN RESMİ TİCARİ ÜNVANI

Topçular Mah. Rami Kışla Cad. Sarıyaşar Pala İş Merkezi No:23/21A Eyüpsultan / İstanbul

General contact: [email protected] · 0532 250 59 15

KVKK requests: [email protected]

This notice applies to individuals who use Doktor Matbaa, create an account, request a quote, place an order, make a payment, upload files or contact customer support.

Identity data may include name and surname and, where card payment is selected, the Turkish identity number required for the payment transaction.

Contact data may include email address, phone number and other contact information supplied by the customer.

Account data may include account details, email-verification status, authentication/session information and security records. Passwords are not stored in plain text.

Shipping and billing data may include recipient name, address, phone, city, district, postal code and, for corporate billing, company and tax information.

Order and customer-transaction data may include orders, quotes, products, quantities, payment method/status, production status, shipping information and proof/revision records.

Personalization and production content may include text, logos, artwork, print files, customer notes and proof files supplied for production.

Technical and security data may include IP address, transaction date/time, session information and security logs.

When card payment is selected, the Turkish identity number is transmitted to the payment provider iyzico to create and process the payment session.

The current Doktor Matbaa application does not store the Turkish identity number as a separate persistent field in the user or order record.

Card number, expiry date and security-code data are not stored in the Doktor Matbaa application database. Card processing is handled through the payment provider infrastructure.

Doktor Matbaa provides printing services and does not provide healthcare services. Processing patient health data or other special-category personal data is not intended as part of the normal service.

Customers should not upload real patient health information, diagnoses, laboratory results, prescriptions, biometric or genetic data, or other unnecessary special-category data in artwork or production files.

Where sample data is needed for printed material, anonymous, fictional or example data should be used whenever possible.

Account management, email verification, sign-in and account security may be processed where necessary for contract formation/performance and the controller's legitimate interests.

Orders, quotes, personalization, proofs, production and delivery may be processed where necessary for the performance of a contract.

Payments, invoicing, accounting and statutory records may be processed for contract performance, compliance with legal obligations and where processing is expressly provided by law.

Customer support, dispute handling and protection of legal rights may be processed for contract performance, establishment/exercise/protection of rights and legitimate interests.

Technical data may be processed to protect information systems and prevent misuse or fraud based on legitimate interests and, where applicable, establishment/exercise/protection of legal rights.

Where necessary, personal data may be shared with payment providers, banks, shipping/logistics providers, accounting and financial advisers, and IT providers involved in hosting, databases, storage, backups, email and security.

Data may also be disclosed to competent public authorities, judicial or administrative bodies, lawyers and authorised advisers where required by law or necessary to protect legal rights.

Domestic transfers are carried out in accordance with Article 8 of the KVKK and applicable legislation.

If hosting, backup, email, security or other technology services are provided or processed outside Türkiye, an international transfer of personal data may occur.

International transfers are carried out only where a condition under Article 9 of the KVKK is met and the required safeguards are in place.

Personal data may be collected electronically through registration/profile forms, order and quote forms, shipping and billing forms, payment processes, uploaded files, proof and revision workflows, email/support communications and website, server and security systems.

Personal data is retained only for the period required by the relevant processing purpose and applicable statutory retention obligations.

Order, payment, invoice and commercial records may be retained for legally required periods; account, production, proof and support records may be retained for service delivery, legal obligations and resolution of potential disputes.

When the retention period expires and no other legal basis remains, personal data is deleted, destroyed or anonymised in accordance with applicable rules.

Under Article 11 of the KVKK, you may ask whether your personal data is processed, request information about processing, learn the purposes of processing and whether data is used consistently with those purposes, and learn the third parties to whom data is transferred domestically or abroad.

You may request correction of incomplete or inaccurate data and, where legal conditions are met, deletion or destruction and notification of those actions to recipients.

You may object to adverse results produced exclusively by automated analysis and request compensation for damage caused by unlawful processing of personal data.

This notice is provided to inform you about the processing of personal data. Delivery of this information notice is not conditional on consent or acceptance of a contract.

Where a separate processing activity requires explicit consent, that consent will be requested separately from this notice.

This notice may be updated if Doktor Matbaa services, technology providers or personal-data processing activities change.

You may submit KVKK requests in writing to Topçular Mah. Rami Kışla Cad. Sarıyaşar Pala İş Merkezi No:23/21A Eyüpsultan / İstanbul or electronically to [email protected]. If email is used, the request should be sent from an address previously notified to and registered with the data controller where required by applicable application procedures.

The request should contain the identity and contact information required by law and clearly describe the request. Applications are handled as soon as possible and no later than thirty days, depending on the nature of the request.