Policy on the Protection of Special Categories of Personal Data

Last Updated: [01.08.2026]

Table of Contents

A. Introduction
B. Our Purposes for Processing Special Categories of Personal Data
C. Our Principles for Processing Special Categories of Personal Data
D. Transfer of Special Categories of Personal Data
E. Technical and Administrative Measures Taken for Processing Special Categories of Personal Data
F. Retention Periods and Destruction of Special Categories of Personal Data

A. INTRODUCTION

The privacy and security of personal data are important to AS Kare Sağlık Ürünleri Pazarlama Danışmanlık Yazılım Hizmetleri San. ve Dış Tic. A.Ş. (“As Kare”, “Torq Nutrition” or the “Company”). In this context, this Special Categories of Personal Data Protection Policy (“Policy”) has been prepared to explain how we process, for what purposes we use, and how we protect the special categories of personal data we obtain from our customers, suppliers, business partners, their employees and representatives, and other third parties in the course of our business relationships.

All terms used in this Policy shall have the meanings assigned to them under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other applicable legislation. The term “personal data” shall also include special categories of personal data.

In this Policy, the terms “we”, “Torq Nutrition”, “As Kare”, or the “Company” refer to As Kare operating at Ferhatpaşa Mahallesi 6. Sokak No:23-25 34888 Ataşehir/Istanbul.

In processing personal data classified as “special categories” under KVKK, our Company complies with the provisions set forth in KVKK. Article 6 of KVKK defines certain personal data that may lead to discrimination or victimization if processed unlawfully as “special categories of personal data,” requiring heightened care and sensitivity. These include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

B. OUR PURPOSES FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

Our Company processes special categories of personal data in compliance with KVKK, provided that necessary measures are taken and based on the explicit consent of the data subject.

Special categories of personal data are processed lawfully for the following purposes:

Creation of personnel files;

Fulfillment of obligations arising from employment contracts and applicable legislation for employees.

C. OUR PRINCIPLES FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

All personal data processed by our Company are handled in compliance with KVKK and relevant legislation. In accordance with Article 4 of KVKK, the fundamental principles we adhere to are as follows:

i. Processing in compliance with the law and good faith:
As Kare conducts personal data processing activities in accordance with the Constitution of the Republic of Türkiye and applicable data protection legislation, acting in good faith.

ii. Ensuring accuracy and up-to-dateness:
We take all necessary administrative and technical measures, within available technological means, to ensure that personal data are accurate and up to date. Mechanisms are in place to correct inaccurate data, and our relevant department conducts annual reviews (in June) to request updates where necessary.

iii. Processing for specific, explicit, and legitimate purposes:
We clearly define lawful purposes for data processing and process personal data only in connection with and to the extent necessary for our products and services.

iv. Processing in a limited and proportionate manner:
Personal data are processed only to the extent necessary to achieve the intended purposes. Data processing purposes are determined prior to processing, and data are not processed based on potential future use.

v. Retention for the required period:
Personal data are retained only for the duration required by applicable legislation or the purpose of processing. Upon expiration of such periods or when the reasons for processing cease, personal data are deleted, destroyed, or anonymized. Data are not retained based on potential future use.

D. TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA

Our Company may transfer special categories of personal data, by exercising due care and taking necessary security measures, in line with lawful processing purposes and based on the explicit consent of the data subject, to the following parties:

Group Companies

For conducting HR processes, ensuring coordination among group companies, managing occupational health and safety processes, and fulfilling legal obligations.

Suppliers

For providing occupational health and safety services, IT services, HR processes, fringe benefits, support services, and fulfilling legal obligations.

Authorized Public Institutions and Organizations

For fulfilling legal obligations, audit, and information disclosure requirements.

Transfers Abroad

For cloud computing, IT infrastructure, and email services hosted on servers located abroad.

E. TECHNICAL AND ADMINISTRATIVE MEASURES

Our Company demonstrates utmost care in protecting special categories of personal data processed in accordance with KVKK. Technical and administrative measures implemented for personal data protection are applied with additional diligence for special categories of personal data, and internal audits are conducted regularly.

In line with the Personal Data Protection Board’s decision dated 31/01/2018 and numbered 2018/10, the measures we implement include:

A dedicated policy for special categories of personal data has been prepared and enforced.

Measures for employees:

Training and awareness programs on data protection legislation;

Confidentiality agreements signed by employees with access to such data;

Clearly defined access authorizations;

Periodic access control checks;

Immediate revocation of access upon role change or termination.

Measures for electronic environments:

Data encrypted using cryptographic methods;

Secure storage of encryption keys;

Logging of all data access and activities;

Regular security updates and testing;

User authorization controls for software access;

Two-factor authentication for remote access.

Measures for physical environments:

Protection against risks such as fire, theft, and natural disasters;

Prevention of unauthorized physical access.

Measures for data transfer:

Encrypted email or registered electronic mail (KEP);

Encrypted portable media transfers;

Secure transfer via VPN or sFTP;

Protection measures for physical document transfers.

Additional applicable measures recommended by the Personal Data Protection Authority are also implemented.

F. RETENTION PERIODS AND DESTRUCTION

Our Company retains special categories of personal data only for the period necessary to fulfill the purposes for which they were collected. These periods are determined separately for each business process.

At the end of the relevant retention period, if there is no legal basis to retain the data, they are deleted, destroyed, or anonymized in accordance with KVKK.

For more detailed information, you may refer to the “As Kare Personal Data Retention and Destruction Policy.”