KVKK PRIVACY NOTICE AND PRIVACY POLICY

Effective date: 25 May 2026

1. Identity of the Data Controller

Under Turkish Law No. 6698 on the Protection of Personal Data (the “KVKK”), your personal data is processed by Medex Corporate Consultancy (hereinafter “Medex” or the “Company”) in its capacity as data controller, within the scope and principles set out below.

Name: Medex Corporate Consultancy

Ankara office: Ehlibeyt Mah., Tekstilciler Cad. No: 35/7, 06520 Çankaya / Ankara

İstanbul office: Cevizli Mah., Zuhal Cad., Ritim İstanbul B Blok No: 44, Maltepe / İstanbul

Email: info@medexmedikal.com  /  medexkurumsal@gmail.com

Telephone: +90 505 580 4622  /  +90 312 389 1354

Website: www.medexmedikal.com

2. Categories of Personal Data Processed

Within the scope of its activities, Medex may process the following categories of personal data:

• Identity data: first name, surname, Turkish national identity number (solely for official applications and authorisation procedures)

• Contact data: email address, telephone number, postal address

• Customer and business partner data: company name, position, tax number, trade registry information, signature circular

• Transaction data: application and document information relating to procedures carried out by Medex by proxy in official systems such as ÜTS, EUDAMED and TİTCK

• Financial data: invoice and contract information

• Technical data: IP address, browser type, time of visit and website usage data collected through cookies

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes, within the conditions laid down in Articles 5 and 6 of the KVKK:

• Providing medical device regulatory and ÜTS registration consultancy services (ÜTS company/document/product registration, MDR and EUDAMED compliance processes, TİTCK applications, IVDR conformity procedures and similar)

• Responding to customer requests and maintaining communication

• Performing contractual obligations

• Fulfilling legal obligations (tax, commercial law, KVKK and similar)

• Carrying out invoicing and accounting operations

• Answering enquiries received through the website

• Ensuring the security, performance and user experience of the website

4. Transfer of Personal Data

To the extent necessary to achieve the purposes set out above, and in accordance with Articles 8 and 9 of the KVKK, your personal data may be transferred to the following parties:

• Competent public institutions and bodies: the Turkish Medicines and Medical Devices Agency (TİTCK), the Ministry of Health, the Ministry of Trade, Provincial Health Directorates and the relevant administrative authorities (as required by law)

• Suppliers from whom we receive services: accounting, certified public accountants, legal counsel, sworn translators, IT infrastructure and hosting service providers

• Transfer abroad: within the scope of the customer’s EU MDR/EUDAMED compliance process and on the customer’s express instruction, transfers may be made to the European Commission’s EUDAMED system and, where necessary, to the customer’s authorised representative in the EU.

Transfers of data abroad are carried out within the framework of Article 9 of the KVKK and the safeguard methods prescribed by the Board.

5. Method of Collection and Legal Basis

Your personal data is collected electronically or in physical form through website contact forms, quotation request forms, email correspondence, telephone calls, contracts and documents submitted to Medex by the customer.

The legal bases for processing are the following conditions set out in Article 5/2 of the KVKK:

• Being necessary for the establishment or performance of a contract

• Being mandatory for the data controller to fulfil its legal obligation

• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Where these legal bases do not apply, the explicit consent of the data subject is obtained.

6. Data Retention Period

Your personal data is retained for the periods prescribed in the relevant legislation (the Tax Procedure Law, the Turkish Commercial Code, the Medical Device Regulation and similar); once those periods expire it is deleted, destroyed or anonymised under Medex’s Personal Data Retention and Destruction Policy. In determining the retention period, the duration of contractual obligations, statutory retention obligations (as a rule 10 years) and the burden of proof in potential disputes are taken into account.

7. Your Rights Under Article 11 of the KVKK

Under Article 11 of the KVKK, every data subject may apply to the data controller and exercise the following rights:

• To learn whether their personal data is being processed

• To request information if their personal data has been processed

• To learn the purpose of processing and whether the data is used in accordance with that purpose

• To know the third parties in Türkiye or abroad to whom the personal data is transferred

• To request rectification where personal data has been processed incompletely or incorrectly

• To request the erasure or destruction of personal data within the conditions laid down in Article 7 of the KVKK

• To request that rectification, erasure and destruction operations be notified to third parties to whom the personal data has been transferred

• To object to an adverse outcome arising from the analysis of processed data exclusively by automated systems

• To claim compensation for loss suffered as a result of unlawful processing of personal data

8. How to Apply

To exercise the rights set out above, you may submit your requests to Medex, together with documents establishing your identity, by one of the following methods:

• By email: to info@medexmedikal.com

• By post: by wet-signed petition to Ehlibeyt Mah., Tekstilciler Cad. No: 35/7, 06520 Çankaya / Ankara

Under the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, your requests are concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. However, where the operation entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

​

• This page contains the KVKK Privacy Notice and Privacy Policy for visitors to www.medexmedikal.com and for recipients of our services. For detailed information on cookies, please see our Cookie Policy page.