This notice explains how GREENMED Tıbbi Sağlık (“the Company”) processes personal data in its capacity as data controller under the Turkish Personal Data Protection Law No. 6698 (“the Law”), and the rights you have in that regard. It is prepared in accordance with Article 10 of the Law and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1. Identity of the data controller

Company	GREENMED Tıbbi Sağlık
Address	Rumeli Mahallesi, Cenap Şehabettin Sokak No: 50, İç Kapı No: 5, Kat: 1, Era Plaza, Çorlu / Tekirdağ, Türkiye
Telephone	+90 538 212 77 08 · +90 544 536 46 47
E-mail	info@greenmedsaglik.com
Registered e-mail (KEP)	greenmedsaglik@hs01.kep.tr
MERSIS number	0411105089900001
Trade registry number	22500
Tax office	Çorlu
Tax number	4111050899
Website	www.greenmedsaglik.com

2. Our field of activity and what it means for your data

The Company supplies medical devices and medical products to health institutions, physicians and health professionals. We are not a health facility: we do not examine, diagnose or treat patients. For that reason we do not, as a rule, process health data through this website. Enquiries reaching us from patients are limited to general information about the technology concerned and are, where necessary, directed to a health institution.

Please do not write information about your health, diagnosis or treatment in the contact form. Health data is a special category of personal data within the meaning of Article 6 of the Law and is subject to stricter conditions. If such information reaches us even though it was not requested, it is used solely to answer your enquiry and is deleted once the enquiry is concluded.

3. Personal data we process

Category	Data
Identity	Name and surname; for corporate contacts, title and organisation
Contact	E-mail address, telephone number, address where supplied
Enquiry content	The subject and message you write in the contact form
Customer and supplier records	Order, delivery, invoicing and payment records of the health institutions, physicians and suppliers we work with, and the contact details of their representatives
Device traceability records	Records that must be kept for medical devices under the Product Tracking System (ÜTS) and related legislation, such as lot, serial and delivery information
Transaction security	IP address, browser and device information, request logs, cookie consent record

We do not collect data relating to children under the age of 18 through this website, and we do not carry out profiling that produces legal effects concerning you.

4. Purposes and legal grounds

Purpose	Legal ground (Article 5/2)
Answering enquiries sent through the contact form	5/2-c — necessary for the conclusion or performance of a contract 5/2-f — legitimate interest in answering enquiries
Supplying medical devices and products, managing orders, delivery and after-sales support	5/2-c — performance of a contract
Keeping the records required of a medical device sales centre, including Product Tracking System (ÜTS) notifications and traceability records	5/2-a — expressly provided for by law 5/2-ç — necessary for compliance with a legal obligation
Complying with accounting, tax and commercial record-keeping obligations	5/2-ç — legal obligation
Website security, log keeping, spam and bot protection	5/2-f — legitimate interest in keeping the service secure
Measuring visitor statistics (Google Analytics)	5/1 — explicit consent, given through the cookie banner
Displaying the location map	5/1 — explicit consent
Establishing, exercising or protecting a right in the event of a dispute	5/2-e — necessary for the establishment, exercise or protection of a right

5. How we collect your data

Personal data is collected in automated or partly automated form through the contact form on our website, cookies and server logs; and in non-automated form through e-mail, telephone, the messaging channel we publish on our site, correspondence, and documents exchanged in the course of commercial relations.

6. Recipients (domestic transfers)

Within the limits set by Article 8 of the Law and only to the extent necessary for the purposes above, your data may be transferred to: our accountant and independent audit firms; our legal advisers; cargo and logistics companies where a delivery is involved; banks for payment transactions; our information technology and hosting service providers; and, where there is a legal obligation or a lawful request, to authorised public institutions — including the Turkish Medicines and Medical Devices Agency through the Product Tracking System (ÜTS) — and to judicial authorities.

7. Transfers abroad (Article 9)

Our website is hosted in the United States of America (Leaseweb USA, Inc., Manassas, Virginia). Consequently every piece of personal data collected through the site — the content of the contact form, server logs and IP addresses — is physically processed abroad. In addition, Google Analytics, Google reCAPTCHA and Google Maps are provided by Google Ireland Ltd., which may transfer data to the United States.

Article 9 of the Law, as amended by Law No. 7499 and in force since 1 June 2024, sets out a three-step order for transfers abroad:

1. Adequacy decision	A transfer may be made to a country, sector or international organisation for which the Board has issued an adequacy decision. The Board has to date issued no adequacy decision for any country.
2. Appropriate safeguards	In the absence of an adequacy decision the transfer may rest on one of the appropriate safeguards listed in the Law: standard contractual clauses, binding corporate rules, an agreement between public institutions, or an undertaking approved by the Board.
3. Incidental cases	Explicit consent appears only at this third step, and only for transfers that are one-off or occasional, not continuous, and not an ordinary part of the business process.

Hosting is an ordinary and continuous part of our business process. It therefore cannot rest on explicit consent: the second step is mandatory, and standard contractual clauses are concluded with our hosting provider. Where the Law requires it, the clauses are notified to the Board within five business days of signature. You may request a copy of the safeguards in place by writing to info@greenmedsaglik.com. For analytics and the location map, which run only with your explicit consent and can be switched off at any time, consent is relied upon as the legal ground.

8. Retention periods

Record	Period
Contact form records	Two years after the enquiry is concluded
Contracts and commercial books	Ten years from the end of the legal relationship (Turkish Commercial Code)
Invoices and accounting records	Five years (Tax Procedure Law)
Device traceability and ÜTS records	The period required by the medical device legislation in force
Server and security logs	Two years
Cookie consent record	180 days

At the end of these periods personal data is deleted, destroyed or anonymised in the first periodic destruction cycle.

9. Your rights under Article 11

a	To learn whether your personal data is processed
b	To request information if it has been processed
c	To learn the purpose of processing and whether the data is used in accordance with that purpose
ç	To know the third parties to whom the data is transferred, at home or abroad
d	To request rectification of incomplete or inaccurate data
e	To request erasure or destruction within the conditions of Article 7
f	To request that rectification, erasure or destruction be notified to third parties to whom the data was transferred
g	To object to an adverse result arising exclusively from automated analysis
ğ	To claim compensation for damage arising from unlawful processing

10. Data security and your own precautions

Under Article 12 of the Law the following technical and organisational measures are in place: the entire website is served over TLS (HTTPS) with the HSTS header enabled; the contact form is protected by Google reCAPTCHA and submissions are verified server-side; access to the administration panel is limited to authorised users and excluded from search engine crawling; no cookie requiring consent is set before consent is given; browser security headers are set in server responses; and a contractual relationship governing data processing obligations is in place with our hosting provider.

Please send only the data necessary for your enquiry, and do not include health data or copies of identity documents in the form.

11. Applications and complaints

You may exercise the rights listed above through the channels and with the information set out in our Data Subject Application Form, in accordance with Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application is answered in writing and free of charge within thirty days at the latest.

If your application is rejected, the answer you receive is insufficient, or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the answer and in any event within sixty days of the date of application.

12. Cookies

Which cookies are used on our website, for what purposes, for how long, and how you can withdraw your consent are explained in our Cookie Policy. No analytics or external content cookie is set, and no related script is loaded, before you give consent.

13. Data subjects located in the European Union

If you are located in the European Economic Area or the United Kingdom, your rights under the General Data Protection Regulation (EU) 2016/679 and the safeguards applied to transfers outside that area are explained in our GDPR Privacy Notice.

14. Updates

This notice was last updated on 21.10.2026. It may be revised in line with changes in legislation and in our processing activities; the version in force is always published on this page.