Personal Data Processing and Protection Policy

AS KARE HEALTH PRODUCTS MARKETING CONSULTANCY SOFTWARE SERVICES INDUSTRY AND FOREIGN TRADE INC.
PERSONAL DATA PROCESSING AND PROTECTION POLICY

Last Updated: [01.08.2026]

Table of Contents

A. INTRODUCTION
B. CATEGORIZATION OF PERSONAL DATA, PURPOSES OF PROCESSING AND RETENTION PERIODS

Categorization of Data

Purposes of Processing Personal Data

Retention Periods of Personal Data

Categorization of Data Subjects
C. TRANSFER OF PERSONAL DATA
D. PROCESSING OF EMPLOYEE PERSONAL DATA
E. RECORD MANAGEMENT
F. WEBSITE PRIVACY NOTICE
G. SECURITY MEASURES
H. POLICY MANAGEMENT
I. MEASURES TAKEN
J. AS KARE POLICIES

A. INTRODUCTION

The confidentiality and security of personal data are important for AS Kare Health Products Marketing Consultancy Software Services Industry and Foreign Trade Inc. (“As Kare”, “Torq Nutrition” or the “Company”).

This Personal Data Processing and Protection Policy (“Policy”), together with the Personal Data Retention and Destruction Policy (“Retention Policy”), regulates the methods by which As Kare (the “Data Controller” or the “Company”) collects, processes, and transfers personal data. As Kare aims to act in compliance with all applicable laws, primarily the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and its secondary legislation (“Data Protection Legislation”), and adheres to the following principles:

i. Processing personal data in accordance with the law and good faith:
As Kare conducts personal data processing activities in compliance with the Constitution of the Republic of Türkiye and relevant data protection legislation, in accordance with the principles of lawfulness and good faith.

ii. Ensuring accuracy and up-to-dateness of personal data:
As Kare takes all necessary administrative and technical measures to ensure that personal data is accurate and up-to-date. Mechanisms are in place to correct inaccurate data, and relevant departments conduct annual checks in June and may request updates from data subjects.

iii. Processing for specific, explicit, and legitimate purposes:
As Kare clearly determines legitimate and lawful purposes for processing personal data and processes such data only to the extent necessary in connection with its products and services.

iv. Processing in a limited and proportionate manner:
Personal data is processed in connection with and limited to the purposes for which it is collected. Data processing purposes are determined before processing begins, and data is not processed based on assumptions of future use.

v. Retaining personal data for the required period:
Personal data is retained only for the period required by applicable legislation or for the purpose of processing. Once the purpose ceases, data is deleted, destroyed, or anonymized.

B. CATEGORIZATION OF PERSONAL DATA, PURPOSES OF PROCESSING AND RETENTION PERIODS

1. Categorization of Data

The Company processes personal data under the conditions specified in Article 5 of KVKK in the following categories:

Identity Information: Name, surname, national ID number, date/place of birth, marital status, photo, education details, etc.

Contact Information: Address, email, registered email (KEP), phone number.

Professional Experience: Diplomas, courses, certificates, transcripts.

Employee Records (HR Data): Payroll, performance evaluations, employment records.

Visual and Audio Records: Images, audio recordings.

Physical Security Data: Entry/exit logs, CCTV records.

Religion and Belief: Religious affiliation information.

Criminal Records: Convictions and security measures.

Financial Data: IBAN, financial performance, credit/risk data, asset information.

2. Purposes of Processing Personal Data

As Kare processes personal data within the scope of Articles 5 and 6 of KVKK for purposes including:

Evaluating job applications

Contacting candidates

Creating employee personnel files

Providing company assets and benefits

Payroll and payment processes

Sending documents and marketing materials

Customer account creation

Campaign communication via email

Logistics and delivery operations

Product sales and delivery

Issuing meal cards

Covering operational expenses

Ensuring security

3. Retention Periods of Personal Data

Personal data is retained in accordance with legal retention periods. If no legal period is specified, data is retained for as long as necessary for the purpose of processing.

When the purpose ceases, data is deleted, destroyed, or anonymized. Data may be retained for legal disputes within statute of limitations periods and accessed only when necessary.

4. Categorization of Data Subjects

Personal data processed by As Kare relates to:

Job Applicants

Employees

Visitors

Supplier Representatives and Employees

Employee Family Members

Contractual Parties

Other categories (e.g., sponsorship data, procurement processes)

C. TRANSFER OF PERSONAL DATA

Personal data may be transferred to:

Group Companies: For operational, financial, HR, and coordination purposes

Suppliers: For logistics, IT, and support services

Customers: For delivery, invoicing, and communication

Shareholders: For corporate governance and reporting

Authorities: For legal compliance

For international transfers, explicit consent is obtained unless adequate protection is ensured in accordance with KVKK Article 9.

D. PROCESSING OF EMPLOYEE PERSONAL DATA

Employee personal data is processed lawfully and protected. Detailed information is available in the Employee Data Protection Policy.

E. RECORD MANAGEMENT

As Kare ensures that personal data is accurate and up-to-date. Data is not retained longer than necessary and is securely deleted or destroyed when no longer needed.

F. WEBSITE AND SOCIAL MEDIA PRIVACY NOTICE

As Kare provides appropriate privacy notices for its websites and social media platforms and undertakes to maintain such disclosures.

G. SECURITY MEASURES

The Company implements appropriate technical and administrative measures to protect personal data from unauthorized access, loss, or misuse. Regular audits and staff training are conducted.

H. POLICY MANAGEMENT

This Policy is managed by the IT Department and is reviewed periodically and updated when necessary.

I. MEASURES TAKEN

A data inventory has been created, risk areas identified, and necessary legal and technical measures implemented and continuously improved.

J. AS KARE POLICIES

The following policies are in force:

Personal Data Processing Inventory

Personal Data Processing and Protection Policy

Personal Data Retention and Destruction Policy

Employee Data Protection Policy

Special Categories of Personal Data Policy

Cookie Policy

Data Subject Application Procedure