KVKK Clarification Text
- Ana Sayfa
- KVKK Clarification Text
Protection of personal data
KVKK Clarification Text
Your personal data processed in accordance with Law No. 6698, the processing purposes and legal grounds, transfer, retention periods, and your rights.
Effective date September 1, 2026 · Version 1.0
1Data controller
| Data controller | Majistral Pharmacists Association |
| Address | Sultan Mesud Mah. İstanbul Cad. Dış Kapı No: 82, İç Kapı No: 1, Karatay / KONYA |
| Registry No | 42-047-032 |
| Tax No | 6101157751 |
| Application email | [email protected] |
| Phone | 0532 312 85 55 |
2Processed personal data
| Data category | Example data |
|---|---|
| Identity | First name, last name, date of birth, Republic of Turkey ID number (only when required by legislation) |
| Contact | Email address, phone number, delivery and billing address |
| Membership | Association membership status, membership date, dues payment records, profession and diploma information |
| Customer transaction | Order records, billing information, event registrations, request and complaint records |
| Financial | Payment amount, payment date, transaction number, IBAN (for refund transactions). Card numbers are not viewed or stored by us. |
| Transaction security | IP address, log in-out records, cookie records, browser and device information |
| Marketing | Commercial electronic communication consent, newsletter subscription, preference records |
| Visual record | Photographs and video recordings taken at events (with explicit consent) |
Special category dataPursuant to Article 6 of the Law, information regarding association membership is special category personal data. This data is processed only in the presence of one of the processing conditions stipulated in Article 6 of the Law and is protected by taking adequate measures determined by the Personal Data Protection Board.
3Processing purposes and legal grounds
| Purpose | Legal ground (Law Art. 5) |
|---|---|
| Receiving orders placed via the Site, collecting payments, delivering products, and performing services | Directly related to the conclusion or performance of a contract — Art. 5/2-c |
| Issuing invoices, maintaining accounting records, fulfilling book and document retention obligations | Fulfillment of a legal obligation by the data controller — Art. 5/2-ç |
| Retention of information and documents regarding distance contracts for three years | Legal obligation — Art. 5/2-ç (Regulation on Distance Contracts Art. 20) |
| Evaluating association membership applications, maintaining the member registry book, tracking dues, conducting general assembly procedures | Explicitly provided for in the laws — Art. 5/2-a (Turkish Civil Code, Law on Associations No. 5253, and Regulation on Associations); also Art. 6 with respect to membership data |
| Creation and management of the Site account | Performance of a contract — Art. 5/2-c |
| Handling request, complaint, and return processes | Performance of a contract — Art. 5/2-c; establishment, exercise, or protection of a right — Art. 5/2-e |
| Ensuring Site security, preventing fraud and abuse, resolving technical issues | Legitimate interest — Art. 5/2-f; Art. 5/2-ç regarding obligations under Law No. 5651 |
| Exercising the right of defense in legal disputes | Establishment, exercise, or protection of a right — Art. 5/2-e |
| Sending newsletters, promotional, and campaign messages | Explicit consent — Art. 5/1 (also Law No. 6563 Art. 6) |
| Analyzing Site usage with non-essential cookies | Explicit consent — Art. 5/1 |
| Using event photos and videos for promotional purposes | Explicit consent — Art. 5/1 |
You may withdraw your consent at any time for processing activities based on explicit consent. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the date of withdrawal.
4Data collection method
Your personal data is obtained fully or partially by automated means or by non-automated means provided that it forms part of a data filing system, through:
- Filling out registration, order, contact, membership application, donation, and dues payment forms on the Site,
- Contacting us via email, phone, or fax,
- Cookies and similar technologies during your visit to the Site,
- Transaction information received from payment institutions and shipping companies
.
5Transfer of personal data
5.1Not transferring or disclosing personal data is our priority. However, your data may be transferred to the following parties strictly limited to the purposes specified above and in accordance with Article 8 of the Law:
| Recipient group | Transfer purpose |
|---|---|
| Licensed payment and electronic money institutions, banks | Payment collection, refund procedures, fraud prevention |
| Cargo and logistics companies | Delivery of the product |
| Hosting, email, and software service providers | Operation of the Site and technical support |
| Accounting and financial advisory service providers | Fulfillment of financial obligations |
| Legal counsel | Follow-up of legal disputes |
| Authorized public institutions and organizations | Information and document requests arising from legislation |
| Commercial Electronic Message Management System (İYS) | Recording commercial electronic message consents |
5.2Transfer abroad. In the event that hosting, email, online event platform, and analytics services are procured from providers based abroad, your data may be transferred abroad. These transfers are carried out in compliance with the conditions stipulated in Article 9 of the Law (adequacy decision, appropriate safeguards, or occasional cases).
6Retention periods
| Data | Retention period |
|---|---|
| Information and documents regarding distance contracts | 3 years (Regulation on Distance Contracts Art. 20) |
| Invoices, accounting, and financial records | 10 years (Turkish Commercial Code Art. 82); 5 years in terms of tax legislation |
| Association books and records | For the periods stipulated in the associations legislation |
| Membership records | Throughout the membership and during statutory limitation periods following its termination |
| Site account data | Until the account is deleted; retention obligations arising from legislation are reserved thereafter |
| Traffic and access logs | The period stipulated in Law No. 5651 and secondary legislation |
| Commercial electronic communication consent records | 3 years from the withdrawal of consent |
Data whose retention period has expired is deleted, destroyed, or anonymized during the first periodic disposal period.
7Rights of the data subject
By applying to the data controller pursuant to Article 11 of the Law, you have the right to:
- Learn whether your personal data is being processed,
- Request information if it has been processed,
- Learn the purpose of processing and whether it is used in accordance with its purpose,
- Know the third parties to whom data is transferred domestically or abroad,
- Request rectification if it is processed incompletely or inaccurately,
- Request erasure or destruction within the framework of the conditions stipulated in Article 7 of the Law,
- Request notification of rectification, erasure, and destruction operations to third parties to whom the data has been transferred,
- Object to the occurrence of a result against you by analyzing it exclusively through automated systems,
- Demand compensation for damages in case you suffer damage due to unlawful processing
.
8Application method
8.1You may submit your requests regarding your rights in accordance with the Communiqué on the Principles and Procedures for the Request to Data Controller:
- With a wet-ink signed written application to the address above,
- Via registered electronic mail (REM/KEP) address, secure electronic signature, or mobile signature,
- By sending an email to [email protected] from your email address previously notified to us and registered in our system
.
8.2Your application must include your first and last name, signature (for written applications), Republic of Turkey ID number, address for notification, email and phone information (if any), and the subject matter of the request.
8.3Your request will be concluded free of charge as soon as possible and within thirty days at the latest, depending on its nature. If the procedure requires an additional cost, the fee in the tariff determined by the Board may be charged.
8.4If your application is rejected, you find the response insufficient, or no response is provided within the due period, you may lodge a complaint with the Personal Data Protection Board within thirty days from the date you receive the response and, in any case, within sixty days from the date of application.
9Updates
This Clarification Text may be updated in accordance with legislative amendments and changes in processing activities. The up-to-date text is published on this page.
