This English text is provided for information. The Turkish version is the binding text; in case of any difference, the Turkish version prevails.
Privacy Notice on the Processing of Personal Data
Last updated: 15.10.2026 · Version: 1.2
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").
1. Data controller
| Company | Kardan Dijital Teknoloji ve İlaç Sağlık Dan. Ltd. Şti. ("Kardan.Digital") |
| Address | Caferağa Mah. Nail Bey Sk. No:40 Daire 3, Moda, Kadıköy / Istanbul 34710, Türkiye |
| Tax ID | 7331213888 |
| info@kardan.digital | |
| Phone | +90 532 421 52 86 |
Under the eKT.one, eIFU.one and EUP.one brands, Kardan.Digital provides electronic package leaflet (e-KT), electronic instructions for use (eIFU), ePI and digital product passport services (the "Platform").
2. Who does this notice cover?
- Website visitors: visitors to the ekt.one, eifu.one and eup.one websites.
- Assistant users: people who ask questions to the AI-assisted chat assistant on the websites.
- People who fill in the contact form: users of the "Let us get back to you" form within the assistant and similar contact channels.
- Registrants and customer representatives: company employees and representatives who register for or use the Platform.
- Product page visitors: visitors to product pages published by our customers on the Platform (e-KT / eIFU / product passport pages opened via QR code). See Section 9 for these persons.
3. Which personal data do we process?
| Category | Example data | Source |
|---|---|---|
| Identity | Name and surname | Registration, contact form |
| Contact | E-mail, phone, company name and title | Registration, contact form |
| Customer transaction | Subscription and package details, billing details (company name, tax ID, tax office, address), account statements | Registration and subscription steps |
| Finance | Cardholder name, last four digits of the card, card reference issued by the payment institution. The card number is not stored by Kardan.Digital. | Payment institution (iyzico) |
| Transaction security | IP address (only an irreversible hash in visit statistics and contact requests; in clear form for contract acceptance and automatic payment authorisation), session and login records, a hash of the random visitor identifier stored in the browser | Automatic |
| Location | Country and city derived from the IP address (not precise location). Determined with a database on our own server; your IP address is not sent to third parties for this purpose. | Automatic |
| Chat content | Questions you write to the assistant, the assistant's answers | Assistant |
| Marketing / request | Product of interest, your sector, interest level derived from the chat | Assistant, contact form |
| Usage | Pages visited, duration, language, clicks (e.g. PDF download, audio playback) | Automatic (analytics) |
Important note on chat content:
- Please do not write personal or health information to the assistant.
- The full text of your questions is not stored on our servers. Only a short summary of the question with personal data removed and statistical signals such as the question topic are stored.
- The chat transcript is attached to your request only if you give separate consent in the contact form.
4. For which purposes and on which legal grounds do we process it?
| Purpose | Data categories | Legal ground (KVKK Art. 5/2) |
|---|---|---|
| Registration, account opening, provision of the Platform service | Identity, contact, customer transaction, transaction security | Establishment and performance of a contract (c) |
| Trial period, subscription, account statements, card payments and invoicing | Customer transaction, finance | Performance of a contract (c); legal obligation — tax and commercial records legislation (ç) |
| The chat assistant answering your questions | Chat content, transaction security | Direct relation to the establishment of a contract — providing information at your request (c); legitimate interest (f) |
| Responding to your contact form request and preparing an offer | Identity, contact, marketing / request, (with your consent) chat transcript | Direct relation to the establishment of a contract (c) |
| Preventing abuse (question and form limits, bot protection), information security | Transaction security | Legal obligation — Law No. 5651 and data security obligations (ç); legitimate interest (f) |
| Measuring service quality, detecting missing content, statistics | Usage, location (country / city), chat signals | Legitimate interest (f) |
| Calculating AI costs and applying monthly limits | Transaction security, usage | Performance of a contract (c) |
| Proof of contract acceptance — versions of the terms of use and trial terms accepted at registration, time of acceptance and IP address | Identity, contact, transaction security | Establishment of a contract (c); establishment, exercise or protection of a right (e) |
| Proof of automatic payment authorisation (time of consent, IP address, consent text) — evidence in payment disputes | Transaction security, customer transaction | Performance of a contract (c); establishment, exercise or protection of a right (e) |
| Protection of rights in legal disputes | All relevant categories | Establishment, exercise or protection of a right (e) |
Sending commercial electronic messages (campaigns and newsletters) is outside the scope of this notice. If we send such messages, we will obtain your separate consent under Law No. 6563.
5. How do we collect personal data?
- Directly from you, electronically: registration form, subscription steps, contact form and chat assistant.
- Automatically: server logs, the visitor identifier stored in your browser and analytics measurement. Visit statistics are measured with Google Analytics. The cookies and browser storage entries we use are listed in the Cookie Policy.
- From the payment institution: card verification and payment results (iyzico).
6. To whom do we transfer personal data?
| Recipient group | Purpose | Location |
|---|---|---|
| Hosting (server) service — Hostinger | Running the Platform; all Platform data is stored on these servers | Germany (EU) |
| AI service providers — OpenRouter and, through it, model providers (Anthropic, Google) | Answering chat questions, content generation and translation | USA |
| Text-to-speech — Google (Vertex AI) | Text-to-speech for product page texts | USA / EU |
| E-mail delivery service — SMTP2GO | Verification, reminder and notification e-mails | Abroad |
| Payment institution — iyzico | Card verification, card storage and payments | Türkiye |
| Web analytics — Google Analytics 4 | Visit statistics | USA |
| Authorised public institutions | Legal obligations (tax, judiciary) | Türkiye |
These recipients process data on our instructions and only for the purposes above (data processors).
7. Transfers abroad
Our servers are in Germany. Some of our service providers are in the USA (Section 6). Your personal data is therefore transferred abroad.
Transfers are made under KVKK Article 9 on the basis of the appropriate safeguards provided for in the Law, primarily the standard contracts announced by the Personal Data Protection Board. Standard contracts are notified to the Authority within five business days of signature.
8. Retention periods
| Data | Period |
|---|---|
| Customer, invoice and payment records | Contract term + periods under tax and commercial legislation (generally 10 years) |
| Contract acceptance records (including IP address) | For records converted into customers, contract term + 10 years after its end; for trials that do not convert, 2 years |
| Automatic payment authorisation records (including IP address) | Contract term + 10 years after its end |
| Contact form requests and lead records | 2 years from last contact (IP address only as an irreversible hash) |
| Chat signals and short question summaries | 2 years, then as anonymous statistics |
| Server and traffic logs | Periods under Law No. 5651 and related legislation (2 years) |
| Analytics data | 14 months |
Data whose retention period has expired is deleted, destroyed or anonymised.
9. About our customers' product pages
The content of product pages opened via QR code (package leaflet, instructions for use, product passport) belongs to our customer, the manufacturer or marketing authorisation holder.
- Kardan.Digital is the data controller for the operation and security of these pages.
- For the reports provided to our customer, it acts as a data processor on behalf of our customer. These reports consist of anonymous usage statistics and question topics.
- If a message written to the assistant contains a possible adverse event or incident, this report is forwarded to the product's manufacturer or marketing authorisation holder as required by pharmacovigilance and medical device legislation.
10. Your rights (KVKK Art. 11)
By applying to Kardan.Digital you may:
- Learn whether your personal data is processed.
- Request information if it has been processed.
- Learn the purpose of processing and whether data is used in line with that purpose.
- Know the third parties to whom data is transferred in Türkiye or abroad.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction within the conditions of KVKK Article 7.
- Request that corrections and deletions be notified to third parties to whom the data has been transferred.
- Object to a result to your detriment arising from analysis exclusively by automated systems.
- Claim compensation for damage suffered due to unlawful processing.
How to apply (under the Communiqué on the Procedures and Principles of Application to the Data Controller):
- Write to info@kardan.digital from the e-mail address registered in our systems.
- Send a petition with a wet signature to the address above.
We conclude your application free of charge within 30 days at the latest.