Privacy and Personal Data Protection Policy

In accordance with the EU and UK General Data Protection Regulation (GDPR)

Dr Derman İlaç ve Yem Katkıları San. Tic. A.Ş. ("Dr Derman", "we", "us", or "the Company"), operating the website yemsiparis.com/en, acts as the data controller for the personal data processed through this website. We are committed to protecting your personal data and processing it lawfully, fairly, and transparently in accordance with Regulation (EU) 2016/679 (the "EU GDPR") and, for customers in the United Kingdom, the UK GDPR and the Data Protection Act 2018 (together, the "GDPR").

This policy explains what personal data we collect about members, users, and visitors ("you"), how and why we use it, who we share it with, how long we keep it, and the rights you have over your data.

1. Data Controller

2. What Personal Data We Collect

Depending on how you use our website, we may collect the following categories of personal data:

• Identity and contact data: name, surname, email address, phone number, delivery and billing address.
• Order and transaction data: products purchased, order history, invoice details, and payment confirmation (we do not store full card numbers; payments are handled by our payment provider).
• Account data: username and any preferences saved in your account.
• Technical and usage data: IP address, browser type, device information, and cookie data collected when you use the website.
• Communication data: messages you send us via email, contact forms, or social media.

3. Why We Process Your Data and Our Legal Basis

Under the GDPR, we only process your personal data where we have a lawful basis to do so. The table below sets out our purposes and the corresponding legal basis (Article 6 GDPR):

Purpose	Legal Basis
Creating and managing your account, processing and delivering your orders, issuing invoices, and providing customer support.	Performance of a contract (Art. 6(1)(b))
Complying with our legal obligations, such as tax, accounting, and consumer protection law.	Legal obligation (Art. 6(1)(c))
Improving our website, ensuring security, preventing fraud, and analyzing performance.	Legitimate interests (Art. 6(1)(f))
Sending marketing communications about campaigns, discounts, and personalized offers; using non-essential cookies.	Your consent (Art. 6(1)(a))

Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Who We Share Your Data With

We share your personal data only where necessary, with the following categories of recipients, each bound to protect your data:

• Logistics and shipping providers (including DHL) to deliver your orders.
• Payment service providers to process your payments securely.
• E-commerce platform, hosting, and cloud/IT service providers that operate our website.
• Professional advisers and, where legally required, competent public authorities and courts.

Some of our service providers may be located outside the European Economic Area (EEA) and the United Kingdom, including in Türkiye. Where we transfer your data internationally, we ensure appropriate safeguards are in place: for transfers from the EEA, the Standard Contractual Clauses (SCCs) approved by the European Commission or an adequacy decision; and for transfers from the United Kingdom, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs issued by the UK Information Commissioner's Office (ICO).

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Order and invoice data is kept for the period required by applicable tax and commercial law; account data is kept while your account remains active; and marketing data is kept until you withdraw your consent. When data is no longer needed, it is securely deleted or anonymized.

6. Your Rights Under the GDPR

As a data subject, you have the following rights in relation to your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten") — to have your data deleted in certain circumstances.
• Right to restriction — to limit how we process your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
• Right to object — to object to processing based on legitimate interests or to direct marketing at any time.
• Rights related to automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Right to withdraw consent — where processing is based on consent, at any time.

To exercise any of these rights, please contact us at [email protected] or at the address above. We will respond to your request without undue delay and within one month, as required by the GDPR. This period may be extended by two further months where necessary, in which case we will inform you.

If you believe your data protection rights have been breached, you also have the right to lodge a complaint with a supervisory authority. In the EU, this is the authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement. In the United Kingdom, this is the Information Commissioner's Office (ICO), at ico.org.uk.

7. How We Collect Your Data

We collect personal data directly from you when you create an account, place an order, contact us, or subscribe to our communications, and automatically through cookies and similar technologies when you use our website. For details on cookies, please see our Cookie Policy.

8. Data Security

We take appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction, taking into account the nature of the data and the risks involved.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will take effect once published on this page. We encourage you to review this policy periodically.

10. Data Subject Request Form

To make a formal request regarding your personal data, please provide the details below and send them to [email protected] or to our address above.

I would like to exercise the following right(s):

• [ ] Access — confirm whether you process my data and provide a copy.
• [ ] Rectification — correct my incomplete or inaccurate data.
• [ ] Erasure — delete my personal data.
• [ ] Restriction — restrict the processing of my data.
• [ ] Portability — provide my data in a portable format.
• [ ] Objection — object to processing or to direct marketing.
• [ ] Automated decisions — object to decisions based solely on automated processing.
• [ ] Withdraw consent — withdraw my previously given consent.

Preferred response method:

• [ ] By email (recommended for a faster response)
• [ ] By post to my address

Signature: ______________________________    Date: ____________