GENERAL DISCLOSURE STATEMENT ON THE PROCESSING OF PERSONAL DATA FOR JOB APPLICANTS

Pursuant to the Law on the Protection of Personal Data No. 6698 (“KVKK“), published in the Official Gazette dated 07.04.2016 and numbered 29677, our company, One Dose Health Technologies Joint Stock Company (the “Company“), may process your personal data within the limits and for the circumstances specified by the KVKK, acting as the “Data Controller”. As the Company, we would like to inform and enlighten you about our personal data processing activities, in accordance with Article 10 of the KVKK.

The term “Sensitive Personal Data” refers to data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

The term “Processing” refers to any operation performed on personal data, wholly or partly by automated means or by non-automated means provided that it is part of a data recording system, including but not limited to collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use. Your personal data may be processed by authorized personnel within the Company.

1. Personal Data We Process

The categories of personal data we process are as follows:

Identity Data: Includes full name, Turkish ID number, date of birth, and gender.

Contact Data: Includes phone number, email address, emergency contact information, and mobile phone.

HR Data: Includes resume/CV information, in-service training details, previously worked companies, attended courses, certifications, references, and information provided in cover letters or resumes.

Physical Space Security Data: Includes building/office entrance and exit records.

Visual Data: Includes photos and other visual data.

Your personal data may be processed physically and/or electronically, via automated or non-automated methods, with your explicit consent, to be used for fulfilling future workforce requirements through the candidate talent pool system.

2. Purpose of Processing Your Personal Data

Categories of Personal Data Processed

Purpose of Processing

Legal Grounds

Identity Data

· Ensuring compliance with legal obligations

· Carrying out communication activities

· Execution/audit of business activities

· Conducting audit/ethical activities

· Ensuring security of data controller operations

· Follow-up and execution of legal affairs

· Execution of storage and archiving activities

· Execution of human resources processes

Art. 5/2 (a) Clearly stipulated by law

Clearly stipulated by law

KVKK m.5/2 (c) “A

It is necessary for the establishment, exercise, or protection of a right.

Art. 5/2 (ç) “ It is necessary for the data controller to fulfill its legal obligation.

Art. 5/2 (e) It is necessary for the establishment, exercise, or protection of a right.

KVKK . 5/2 (f) Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary for the legitimate interests of the data controller.

necessary for the legitimate interests of the data controller.

Contact Data

· Carrying out communication activities

· Execution of storage and archiving activities

· Execution of human resources processes

Art. 5/2 (a) Clearly stipulated by law

KVKK m.5/2 (c) “A

It is necessary for the establishment, exercise, or protection of a right.

Art. 5/2 (ç)“ It is necessary for the data controller to fulfill its legal obligation.

It is necessary for the data controller to fulfill its legal obligation.

Art. 5/2 (f) Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary for the legitimate interests of the data controller.

necessary for the legitimate interests of the data controller.

Categories of Personal Data Processed	Purpose of Processing	Legal Grounds

Employment Data	· Ensuring compliance with legal obligations · Ensuring compliance with legal obligations · Execution of storage and archiving activities faaliyetlerinin yürütülmesi, · Execution/audit of business activities · Execution/audit of business activities · Execution of management activities · Conducting audit/ethical activities faaliyetlerinin yürütülmesi, · Ensuring physical space security güvenliğin temini · Providing information to authorized persons, institutions, and organizations · Execution of contract processes · Execution of human resources processes süreçlerinin yürütülmesi	Art. 5/2 (a) Clearly stipulated by law KVKK m.5/2 (c) “A It is necessary for the establishment, exercise, or protection of a right. işlenmesinin gerekli olması” Art. 5/2 (ç)“ It is necessary for the data controller to fulfill its legal obligation. Art. 5/2 (e) It is necessary for the establishment, exercise, or protection of a right. Art. 5/2 (f) Provided that it does not harm fundamental rights and freedoms of the data subject, processing is necessary for the legitimate interests of the data controller
Physical Space Security Data	· Ensuring physical space security	Art. 5/2 (f) Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary for the legitimate interests of the data controller. necessary for the legitimate interests of the data controller.

Categories of Personal Data Processed	Purpose of Processing	Legal Grounds
Visual Data	· Execution of recruitment processes	KVKK Art. 5/2 (f)“Provided that it does not harm fundamental rights and freedoms of the data subject, processing is necessary for the legitimate interests of the data controller.“

Additionally, in case of a security breach or suspicion thereof, or if there is a violation or suspicion of a violation of the Company’s internal policies or legal regulations, investigations and audits may be carried out by our Company on all work equipment containing your personal data, including business correspondence, business emails, communication tools, and applications on Company devices.

3. Method of Collecting Personal Data

Your personal data may be collected by the Company via various channels such as directly from the individual, from internal departments, verbally, in writing, or electronically, based on the purposes mentioned above, to carry out our activities.

4. Transfer of Your Personal Data

Your personal data, excluding sensitive personal data, may be transferred to the companies within the Güven Health Group, which includes our Company’s subsidiaries and affiliates, and to competent courts and/or public institutions and organizations, in accordance with the basic principles set out in the KVKK and the conditions and purposes of personal data processing specified in Article 8 of the KVKK. Your data may also be shared with and/or accessed by third parties who provide consultancy, support, or other services within the framework of relevant data processing conditions and purposes.

Your sensitive personal data may be transferred to the companies within the Güven Health Group, which includes our Company’s subsidiaries and affiliates, based on your explicit consent pursuant to Article 6/3 (a) of the KVKK, in accordance with the basic principles of the KVKK and due to the operational requirements and HR processes carried out by these companies.

5. Transfer of Your Personal Data Abroad

Your personal data may be transferred to third-party service providers located abroad, provided that appropriate safeguards are ensured through the standard contract regulated under Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.

6.KVKK’nın 11. Your Rights as a Relevant Person Pursuant to Art.

As the data subject, you may submit your requests in writing, including identification documents and a written petition explaining the right you wish to exercise, to the Company’s address at Konutkent Mah. 3028 Cad. No: 8d İç Kapı No: 27 Çankaya / Ankara in person or via registered mail with return receipt. Your request will be evaluated by the Company and finalized within 30 (thirty) days as stipulated under the KVKK. While there is no fee for processing your request as a rule, the Company reserves the right to charge a fee based on the tariff set by the Personal Data Protection Board.

Except for the exceptions set out in Article 28 of the KVKK titled “Exceptions,” you have the right to:
Learn whether your personal data is processed,
Request information if it is processed,
Learn the purpose of the processing and whether it is used in accordance with that purpose,
Know the third parties to whom your data is transferred domestically or abroad,
Request correction of incomplete or incorrect data,
Request deletion or destruction of your data if the reasons requiring its processing cease to exist,
Request that such actions be notified to third parties to whom your personal data has been transferred,
Object to the occurrence of a result against you through the analysis of your data exclusively by automated systems,
Request compensation for damages in case you suffer damage due to unlawful processing of personal data.

You can access One Dose Sağlık Teknolojileri Anonim Şirketi’s “Data Subject Application Form” and obtain further information through our website: https://www.onedose.io/en

One Dose Sağlık Teknolojileri Anonim Şirketi

Head Office: Konutkent Mah. 3028 Cad. No: 8d İç Kapı No: 27 Çankaya / Ankara

Mersis No 0544128049300001