As Pilatus Swiss Dental GmbH ("Company"), the brand owner of NTA Implant, the safety and protection of personal data is treated with the utmost care. In accordance with the Law on the Protection of Personal Data No. 6698 of the Republic of Turkey, the following declarations apply to all third parties: recipients of our services, business partners, and visitors to our website. The Company reserves the right to update this notice in line with the applicable legal framework.

Under the Law on the Protection of Personal Data published in the Official Gazette of the Republic of Turkey dated 07.04.2016, No. 29677, personal data means any information relating to an identified or identifiable natural person. Your personal data processed by companies within the Pilatus Swiss Dental network as data controllers, together with the processing purposes, recipient groups, collection methods, legal grounds, your rights regarding such data, and the contact details for exercising those rights, are set out below.

Explicit consent: Consent on a particular subject, based on information and freely expressed, giving permission and authority to the addressee on the permitted subject.

Personal data: Any information relating to an identified or identifiable natural person.

Sensitive personal data: Data concerning race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership of associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

The Law: The Law on the Protection of Personal Data No. 6698 of the Republic of Turkey.

The Board: The Personal Data Protection Board established under Law No. 6698.

Processing of personal data: Obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying, or blocking personal data, wholly or partly, by automated or non-automated means, and any other operation performed on such data.

Identity: Name and surname, parents' names, mother's maiden name, date and place of birth, marital status, ID document number, etc.

Contact: Address, email address, registered email address, telephone number, etc.

Personnel information: Payroll information, disciplinary records, recruitment documents, property declarations, CV information, performance evaluation reports, etc.

Legal transactions: Correspondence with judicial authorities, case file information, etc.

Customer operations: Call center records, invoices, promissory notes, cheque information, point-of-sale receipts, order and request information, etc.

Physical space security: Entry and exit records of employees and visitors, camera recordings, etc.

Finance: Balance sheet information, financial performance information, credit and risk information, asset information, etc.

Professional experience: Diploma information, courses attended, in-service training records, certificates, transcripts, etc.

Visual and audio recordings.

Health information: Disability status, blood group, personal health information, information on devices and prostheses used, etc.

Biometric data: Palm print, fingerprint, retina scan, facial recognition information, etc.

Pilatus Swiss Dental GmbH

Address: Dorfchärn, CH-6243 Egolzwil, Switzerland

Phone: +41 41 982 07 07

Email: info@pilatusswiss.ch

The personal data collected may vary depending on the employment, service, or commercial relationship with our Company. Such data may be collected verbally, in writing, or electronically, through automated or non-automated methods, via our Company's units and offices, group companies, website, social media channels, mobile applications, and similar means.

For the purposes of determining and implementing our Company's commercial and business strategies and ensuring the execution of our human-resources policies, personal data may be processed within the scope of the processing conditions and purposes set out in Articles 5 and 6 of Law No. 6698, and may be transferred to third-party customers to carry out the purposes described below.

In order to ensure security within the Company:

• Ensuring the physical security of the workplace;
• Controlling entry to and exit from Company premises, as required for the performance of customer contracts;
• Assessing customer complaints, increasing customer satisfaction, understanding customer needs, and improving customer-related processes;
• Evaluating service quality and training staff;
• Establishing business relationships, conducting the service process, and issuing policies;
• Following up and carrying out communication with official institutions;
• Fulfilling legal obligations arising from employment contracts;
• Informing data subjects about changes to contracts;
• Conducting market research and organizing activities to build or increase loyalty to products and services;
• Performing accounting transactions, including invoicing related to sales;
• Planning, auditing, and carrying out information-security processes;
• Responding to customer requests by email;
• Processing manual and online payments, invoice cancellations, and refunds;
• Registering customers in our systems and opening customer records;
• Conducting customer visits, participating in customer meetings, and providing technical information to customers.

Within the scope of the purposes described above, your personal data may be transferred to: the Company's relevant units, departments, personnel, managers, shareholders, and board members; Company suppliers; legally authorized public institutions and private individuals; courts and enforcement offices; service-provider and IT companies engaged to ensure record security and document storage; Company customers and their officials with whom contact is required; insurance companies with which the Company has a legal relationship; telecommunications companies engaged for staff communication services; and banks, for the purposes of payment collection, invoice cancellation, and refunds — all within the framework of the processing conditions and purposes set out in Articles 8 and 9 of Law No. 6698.

Your personal data is obtained verbally, in card-system, written, or electronic form, to carry out the Company's business in line with the purposes described above and to fulfil our contractual and legal obligations accurately and completely. On the basis of the Company's legitimate interest in ensuring security, visual data may be obtained through cameras and audio recorders placed on Company premises. Data collected on this legal basis may be processed and transferred, by automated or non-automated means, for the purposes described in this notice, within the processing conditions and purposes set out in Articles 5 and 6 of Law No. 6698.

Where a retention period for the data is set by law or applicable legislation, the data is kept for at least that period.

To account for the possibility that a court request or a request from an authorized administrative body relating to the data may reach us late, or that a dispute involving the Company may arise, the retention period may be extended by six months to one year beyond the period stipulated by legislation. At the end of this period, the data is deleted, destroyed, or anonymized.

Where legislation does not set a retention period, the data is stored for as long as required by the underlying relationship with you. After that relationship ends, or after the period specified in the applicable contract, your data will be deleted, destroyed, or anonymized without a separate request being necessary.

If you request deletion or destruction of data before a legally mandated retention period has elapsed, that request cannot be fulfilled during that period. Where no specific retention period is set by legislation, a request for deletion or destruction will be carried out on the first periodic destruction date, and in any event within six months.

Pursuant to Article 11 of Law No. 6698, regardless of whether you have given explicit consent, you may apply to our Company to exercise the following rights regarding your personal data:

• Learning whether your personal data is being processed;
• Requesting information about the processing, if your data has been processed;
• Learning the purpose of processing and whether the data is used in accordance with that purpose;
• Knowing the third parties, in the country or abroad, to whom your personal data is transferred;
• Requesting correction of incomplete or inaccurate data, and requesting that such correction be notified to third parties to whom the data has been transferred;
• Requesting deletion or destruction of your personal data once the reasons for processing it no longer apply, and requesting that this be notified to third parties to whom the data has been transferred;
• Objecting to a result reached against you based solely on automated analysis of your processed data;
• Requesting compensation for damage arising from unlawful processing of your personal data.

You may submit your requests in person, by petition, or through a notary, to the Company address set out above. You may also send your request by registered email, secure electronic signature, mobile signature, or the email address you have previously registered with our systems, to info@pilatusswiss.ch.

Requests submitted through the above procedure will be answered free of charge within 30 days at most. If your request is refused, the response is insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of the response, and in any event within 60 days of your original application, once the applicable complaint procedure has been exhausted.