KVKK Disclosure Text
Information under Turkish Law No. 6698 on Protection of Personal Data.
Last updated: 18 August 2026
As DATA FARMA ECZA DEPOSU İLAÇ ANONİM ŞİRKETİ ("Data Farma", "we"), we inform you under Law No. 6698 on Protection of Personal Data ("KVKK") about personal data processed through our marketing website and online warehouse platform for pharmacies ("Platform") at www.datafarma.com.tr. Details on cookies are set out in the Cookie Policy; general privacy principles for Platform use are explained in the Privacy Agreement.
1. Data Controller
Data controller under the KVKK: DATA FARMA ECZA DEPOSU İLAÇ ANONİM ŞİRKETİ Tax ID: 2712070608 Address: Macun Mah. 187. Cad. No: 54/66 Yenimahalle / Ankara Email: info@datafarma.com.tr Phone: 0537 777 42 00
2. Scope
This Disclosure Text covers: • persons visiting the website, • persons using contact and human resources forms, • persons applying for pharmacy membership, • approved pharmacy account users, • users performing order and payment transactions on the Platform, • authorized users accessing the depot management panel.
3. Personal Data Processed
Depending on the service provided and the transaction performed, the following data categories may be processed:
3.1. Identity and Organization Data
Pharmacy or company name, authorized person's name and surname, tax identification number or, where required, national ID number, GLN, and other information required for membership and verification processes.
3.2. Contact and Address Data
Email address, phone number, delivery and billing addresses, tax office, city and district information.
3.3. Account and Transaction Security Data
User account information, session and authentication records, access logs, password reset requests, and other records created to ensure Platform security.
3.4. Order and Commercial Transaction Data
Order content, product and quantity information, delivery information, invoice-related information, ledger account movements, cancellation and return records, and other transaction data required to conduct the commercial relationship.
3.5. Payment and Collection Data
Payment method used, order and collection amounts, payment status, transaction time, reference or transaction information relating to payment, and cancellation and refund records required to conduct the payment process. Where payment is made by credit or debit card, payment transactions may be carried out through authorized payment service provider(s) contracted by Data Farma. How card data is processed may vary depending on the payment infrastructure used. Where card data is processed directly in the payment service provider's secure infrastructure, Data Farma does not store the full card details.
3.6. Application Data
Name and surname, email address, phone number, message content and, where applicable, CV and other information provided by the user through contact and human resources forms.
3.7. Technical and Usage Data
IP address, browser and device information, access and log records, session information, and technical and usage data obtained through cookies and similar technologies.
4. Methods of Collecting Personal Data
Your personal data may be collected electronically or physically, by automatic or non-automatic means, through: • membership and registration forms, • login, authentication and password processes, • order, cart and account screens, • payment and collection processes, • contact and human resources forms, • email and phone channels, • delivery and invoicing processes, • service providers integrated with the Platform, • electronic records created during use of the website and Platform.
5. Purposes of Processing Personal Data
Your personal data may be processed for the following purposes: • receiving, evaluating and verifying pharmacy membership applications, • creating and managing user accounts, • operating cart and order processes through the online depot, • preparing, delivering and invoicing orders, • operating ledger account and collection processes, • conducting and verifying payment transactions by credit or debit card, • carrying out payment, cancellation and refund processes, • ensuring user account security and authentication, • responding to requests and support applications, • managing customer relations, • evaluating human resources applications, • preventing fraud, unauthorized transactions and misuse, • ensuring information and transaction security, • conducting accounting and finance processes, • fulfilling legal obligations, • responding to lawful requests from competent public authorities, • improving service quality, system security and Platform performance, • resolving disputes and protecting legal rights.
6. Legal Bases for Processing Personal Data
Your personal data may be processed under the legal bases set out in Articles 5 and, where applicable, 6 of the KVKK. Depending on the specific processing activity, these legal bases may include: • explicit provision in law, • being directly related to the establishment or performance of a contract, • being mandatory for the data controller to fulfill a legal obligation, • being mandatory for the establishment, exercise or protection of a right, • being mandatory for processing for the legitimate interests of Data Farma, provided that fundamental rights and freedoms of the data subject are not harmed, • explicit consent where required under applicable legislation. The appropriate legal basis is applied according to the nature of each processing activity.
7. Transfer of Personal Data
Your personal data may be shared, to the extent necessary to achieve the purposes stated above and within the conditions set out in the KVKK and related legislation, with: • payment service providers, • banks and relevant financial institutions, • cargo, logistics and delivery service providers, • information technology, hosting and infrastructure service providers, • email and communication service providers, • accounting, ERP and business process integration service providers, • financial advisors, lawyers and other authorized consultants, • competent public authorities by law, • other authorized parties permitted or required by legislation. Transfers are carried out in compliance with the legal conditions set out in the KVKK according to the relevant data category and nature of the transfer. Personal data is not sold to third parties for data trading purposes.
8. International Transfer of Personal Data
Some information technology, hosting, communication or other service providers used by Data Farma may have infrastructure located abroad, or data may be processed on systems located abroad. Hosting, database and communication services within the Platform infrastructure may be provided through systems located abroad. Where international transfer of personal data is required, transfers are carried out within the framework of the KVKK provisions on international data transfer and related secondary legislation.
9. Retention of Personal Data
Your personal data is retained for as long as required by the processing purposes and taking into account statutory retention and limitation periods. Where the processing purpose ceases and there is no other legal basis requiring retention, personal data is deleted, destroyed or anonymized in accordance with applicable legislation.
10. Security of Personal Data
Data Farma takes technical and administrative measures appropriate to the nature of the data and systems processed in order to prevent unlawful processing of and access to personal data and to ensure that personal data is stored securely.
11. Data Subject Rights
Under Article 11 of the KVKK, data subjects have the right to: • learn whether their personal data is processed, • request information if their personal data has been processed, • learn the purpose of processing and whether it is used in accordance with that purpose, • know third parties to whom personal data is transferred domestically or abroad, • request correction if personal data is incomplete or inaccurate, • request deletion or destruction of personal data under the conditions set out in the KVKK, • request that correction, deletion or destruction be notified to third parties to whom personal data has been transferred, • object to a result arising to their detriment through analysis of processed data exclusively by automated systems, • claim compensation for damage arising from unlawful processing of personal data.
12. Application Method
You may submit your requests under the KVKK to Data Farma together with information suitable to verify your identity and request. You may submit applications via: Email: info@datafarma.com.tr Address: Macun Mah. 187. Cad. No: 54/66 Yenimahalle / Ankara Applications are reviewed and concluded within the periods set out in the KVKK and related legislation, depending on the nature of the request. Data Farma may request additional information and documents to verify that the application was made by the data subject.
13. Contact
DATA FARMA ECZA DEPOSU İLAÇ ANONİM ŞİRKETİ Tax ID: 2712070608 Address: Macun Mah. 187. Cad. No: 54/66 Yenimahalle / Ankara Email: info@datafarma.com.tr Phone: 0537 777 42 00