Effective date: 11/11/2026Version 1
SUBMED Su Biyomedikal Sistemler ve Sağlık Hizmetleri San. ve Tic. A.Ş. ("SUBMED" or the "Company") attaches great importance to the protection of the personal data we process through the website www.diyalizmarket.com (the "Platform"). This Privacy Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, published in the Official Gazette dated 10 March 2018 and numbered 30356.
DiyalizMarket is a B2B platform intended for hospitals, dialysis centers, healthcare institutions, medical device sales centers, distributors, public institutions, and other corporate or professional buyers authorized to purchase products under applicable legislation. No sales are made through the Platform to natural persons acting as consumers; this is without prejudice to a natural person acting as a buyer within the scope of their commercial or professional activity. Natural persons who act on behalf of a corporate account on the Platform do so as the representative, authorized person, or employee of the relevant institution.
This Privacy Notice covers the personal data processed within the membership, order, and account management processes of the DiyalizMarket platform. The confidentiality and terms of use of branch-level business information that does not constitute personal data are separately governed under the Mutual Confidentiality and Non-Disclosure Agreement to be signed.
Data controller: SUBMED Su Biyomedikal Sistemler ve Sağlık Hizmetleri San. ve Tic. A.Ş.
Address: Velimeşe OSB Mah. 242. Sok. No:9/2, 59930 Ergene/Tekirdağ, Türkiye
Tax Office: Çorlu Tax Office — Tax ID (VKN): 7810897506
MERSİS No: 0781089750600001
Trade Registry No: 25313
Phone: +90 212 444 85 46
Registered e-mail (KEP) address: subiyomedikal@hs06.kep.tr
Data protection contact e-mail: info@submed.com.tr
DiyalizMarket is not a separate legal entity; it is a B2B digital procurement and sales platform operated by SUBMED. As the purposes and means of the personal data processing activities carried out through the Platform are determined by SUBMED, SUBMED is the data controller with respect to these activities.
The Platform is designed as a business-to-business (B2B) procurement system. For this reason, a significant part of the data processed belongs not to the member institution itself, but to the natural person (authorized representative, purchasing officer, employee) acting on behalf of that institution. Information such as the institution's trade name, tax identification number (VKN), and address belongs to the legal entity and therefore does not, on its own, constitute personal data; the list below covers only personal data belonging to natural persons:
Identity — Example Data: Full name, and Turkish ID number (TCKN) where required (only where an invoice must be issued in the name of a natural person/sole proprietorship); Collection Channel: Membership form, quotation/order form
Contact — Example Data: Corporate e-mail, phone; Collection Channel: Membership form, contact/quotation form
Customer Transaction — Example Data: Order history, quotation requests, invoice information, current account movements; Collection Channel: Platform use, ERP integration
Transaction Security — Example Data: IP address, log records, cookie identifiers, session information; Collection Channel: Server logs, cookies
Marketing — Example Data: Browsing history, campaign interaction, newsletter preferences; Collection Channel: Cookies, newsletter subscription
Professional Experience — Example Data: Title, position, and institution of the authorized person (corporate contact information); Collection Channel: Membership/company profile form
Legal Transaction — Example Data: Contracts, notices, dispute records; Collection Channel: Contractual processes
The TCKN (Turkish ID number) constitutes personal data as it belongs to a natural person; the corporate VKN, on the other hand, does not constitute personal data where it belongs to a legal entity. The Platform is not intended to collect special categories of personal data, such as patients' health data. Users must not enter patient names, Turkish ID numbers, diagnoses, treatments, health status, or other special categories of personal data into quotation, support, description, or other free-text fields. SUBMED applies appropriate information and technical/administrative measures to reduce the risk of such data being transmitted by mistake. Should such data be transmitted inadvertently, it will not be used for any purpose other than the purpose of processing; access to it will be restricted, and, depending on the nature of the incident, lawful deletion/destruction and statutory notification procedures will be considered.
The personal data processing activities carried out on the Platform, their purposes, and the legal grounds on which they are based are set out below. With respect to the data of the authorized person/representative acting on behalf of a corporate account, since the party to the contract is the institution itself, the legitimate interest ground under Article 5/2-f of the Law applies as a rule, rather than Article 5/2-c:
Processing of corporate authorized-person information — Purpose: Corporate account verification; Legal Basis: KVKK Art. 5/2-f (legitimate interest)
Corporate account management — Purpose: Conducting the commercial relationship; Legal Basis: KVKK Art. 5/2-f
Information of the authorized person placing the order — Purpose: Processing the corporate order; Legal Basis: KVKK Art. 5/2-f (legitimate interest)
Information of a sole proprietorship owner — Purpose: Establishment/performance of the contract; Legal Basis: KVKK Art. 5/2-c
Invoicing and accounting records — Purpose: Fulfillment of legal obligations; Legal Basis: KVKK Art. 5/2-a, 5/2-ç
Dispute records — Purpose: Establishment, exercise, or protection of legal rights; Legal Basis: KVKK Art. 5/2-e
Security logs — Purpose: Ensuring account and system security; Legal Basis: KVKK Art. 5/2-f
Contact information of the authorized person in product-safety/recall processes — Purpose: Product safety notification, recall, and corrective actions; Legal Basis: KVKK Art. 5/2-ç (legal obligation), 5/2-f
Marketing communications — Purpose: Sending campaigns and newsletters; Legal Basis: KVKK Art. 5/1 (explicit consent)
Your personal data is collected through electronic channels such as the membership form, contact/quotation form, cookies, and server log records on the Platform, by automatic or partly automatic means.
Your personal data may be transferred, for and limited to the purposes of membership, orders, payment, delivery, customer relations, information security, accounting, and compliance with legal obligations, to hosting and information technology service providers, e-mail and communication infrastructure providers, accounting/ERP service providers, payment institutions, cargo/logistics companies, legal and financial advisors, and authorized public institutions and organizations. Such transfers are carried out to the extent required by the service provided by the relevant recipient group and in accordance with the conditions set out in Article 8 of Law No. 6698. The current categories of recipients and the purposes of transfer are further set out in SUBMED's data inventory and related process documentation.
Personal data is, as a rule, retained on systems located in Türkiye. However, depending on the nature of the software, cloud, e-mail, remote support, or similar services used, access from abroad or a cross-border transfer may arise. Where such a transfer is in question, SUBMED will not carry it out without first ensuring, depending on the nature of the transfer, whichever of the following is applicable: an adequacy decision, appropriate safeguards, or another transfer condition provided for under Article 9 of Law No. 6698. The security and compliance checks performed on service providers are carried out in proportion to the nature of the service and the level of risk involved.
Your personal data is retained for periods determined by taking into account the relevant data category, the purpose of processing, and the applicable legislation. Retention periods are determined on a category basis in SUBMED's personal data retention and destruction policy and data inventory, based on the nature of the data, the statutory limitation periods and retention obligations under the applicable legislation, the limitation periods for disputes and claims, and the periods required by the purpose of processing. Once the reason for retention ceases to exist, personal data is deleted, destroyed, or anonymized in accordance with the applicable legislation. Records required to be retained under the applicable legislation are kept only for the relevant statutory period and only to the extent required by that obligation.
Pursuant to Article 11 of the Law, by applying to SUBMED, you have the right to:
Learn whether your personal data is being processed,
Request information about such processing, if any,
Learn the purpose of processing and whether the data is used in accordance with that purpose,
Know the third parties, domestic or abroad, to whom the data has been transferred,
Request the correction of the data if it has been processed incompletely or incorrectly,
Request the deletion or destruction of the data within the framework of the conditions set out in Article 7 of the Law,
Request that the correction/deletion be notified to the third parties to whom the data has been transferred,
Object to a result arising against you from the analysis of the data exclusively through automated systems,
Request compensation for damages you suffer due to unlawful processing of the data.
You may submit your applications in writing, through the registered electronic mail (KEP) address subiyomedikal@hs06.kep.tr, using a secure electronic signature/mobile signature, or through the e-mail address you have previously notified to SUBMED and which is registered in our systems. The application must include the elements set out in the Communiqué on the Procedures and Principles of Application to the Data Controller: full name and, if the application is in writing, a signature; the Turkish ID number for Turkish citizens (nationality and passport or identification number for foreign nationals); the residential or business address for service of notice; the e-mail address, telephone, and fax number for notification, if any; and the subject matter of the request. Applications are, as a rule, concluded free of charge, as soon as possible and within thirty days at the latest, depending on the nature of the request; where the transaction requires an additional cost, the fee set out in the tariff determined by the Board may be charged.