Monostron Privacy Policy Last updated: 19 September 2026 A. INTRODUCTION This Website and the Monostron application are operated by BTL WORKS. The Data Controller is BTL WORKS (Yunus Badeci), Esentepe, Keskin Kalem Sok. No: 17 · 34394 Şişli / İstanbul · Türkiye ("BTL WORKS", "we", "us" or "our"). BTL WORKS is committed to keeping your information secure and managing it in accordance with our legal responsibilities under the applicable privacy and data protection laws (the Turkish Personal Data Protection Law No. 6698 "KVKK" and, where applicable, the EU General Data Protection Regulation 2016/679 "GDPR"). This Privacy Policy provides information about how we process personal information through the website https://monostron.com ("Website"), the Monostron application at app.monostron.com and clinic subdomains, and our Products and Services. Upon reading this Privacy Policy, you will be informed regarding the following: 1. What personally identifiable information of yours or third-party personally identifiable information is collected from you through the Website as well as through the Products and Services; 2. The organisation collecting the information; 3. How the information is and will be used and disclosed; 4. With whom the information may be shared; 5. What choices are available to you regarding collection, use and distribution of the information, and your rights; 6. The kind of security procedures that are in place to protect the loss, misuse or alteration of information under BTL WORKS's control; and 7. How you can access and correct any inaccuracies in the information collected about you. THIS PRIVACY POLICY IS INCORPORATED INTO AND MADE A PART OF THE Monostron TERMS OF SERVICE (https://monostron.com/kullanim-kosullari). PLEASE READ THIS DOCUMENT CAREFULLY. IT CONTAINS IMPORTANT INFORMATION THAT YOU SHOULD KNOW BEFORE CONTINUING TO USE OUR WEBSITE OR SERVICES. BY CONTINUING TO USE OUR WEBSITE AND SERVICES YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. Your use of our Website and the Products and Services provided herein, including any dispute concerning privacy, is subject to this privacy statement ("Privacy Policy"), the Monostron Terms of Service and the Data Processing terms in Section 26 of those Terms. By visiting our Website or using any of our Products and Services (defined below), you agree to your personal information being used and disclosed in the manner set out in this Policy and in the Terms of Service. You do not have to provide your personal information to us, but if you do not provide certain information it may affect the service we are able to provide to you. By continuing to use this Website, you agree to us, as data controller, collecting and using your personal information in accordance with this Privacy Policy and for the purposes of properly running the Website and offering our Products and Services to you. Our role. Monostron is software with which clinics manage their own patients' data. For Website visitors and application users (clinic owners and staff), the data controller is BTL WORKS. For data about a clinic's patients, the data controller is the clinic and BTL WORKS is a data processor acting only on the clinic's instructions. When you message a clinic or fill in its form, that clinic's own privacy notice applies; information about patients appears in this Policy for transparency. Changes in the Privacy Policy. We reserve the right to update this Privacy Policy from time to time. Please review this Policy periodically for changes. If you do not accept the amended Policy, please stop using this Website. B. COLLECTED INFORMATION Personally identifiable information we collect Most of the Products and Services offered to visitors of the Website require you to register for a user account within Monostron ("User Account"). When registering for a User Account, BTL WORKS will ask you to voluntarily supply certain information about yourself by filling out and submitting an online form. Such information may include your name, phone number, e-mail address, clinic name, billing information and business address. Card and other payment details are collected and processed by the licensed payment institutions we use for payment processing, including automatic subscription renewals; BTL WORKS does not store card details. We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows: * Identity Data includes first name, last name, username or similar identifier and job title. In some cases, and in order to comply with our legal obligations (sanctions law, invoicing), we may ask you to provide identity documents, a tax number or your country of residence. * Contact Data includes billing address, e-mail address and telephone numbers. * Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us. * Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting, operating system and platform, and other technology on the devices you use to access the Website. The IP address is kept in memory briefly to prevent abuse; it is written to the database only as part of the administrator's contract acceptance record (together with the time of acceptance, the contract version and browser information). * Profile Data includes your username and password (as a one-way hash), purchases made by you, your preferences, feedback and survey responses. * Usage Data includes information about how you use our Website, Products and Services (access and activity logs). * Marketing Data includes your preferences in receiving marketing from us and your communication preferences. * Communications Data includes the messages that you exchange with your patients or website visitors through the third-party messaging tools the clinic connects, including but not limited to Instagram Direct, Facebook Messenger, WhatsApp, e-mail, web forms and ad forms. This data is processed on behalf of the clinic in our capacity as data processor. You never have to answer any questions, and you can decline this exchange of information at any time. However, if you choose to withhold requested information, we may not be able to provide you with some or all of the Products and Services. Depending on the activity, some of the information we ask you to provide is identified as mandatory and some as optional. If you do not provide the mandatory information with respect to a particular activity or purchase, you will not be able to engage in that activity or make that purchase. BTL WORKS will inform you of the mandatory and/or optional character of the requested information. You may be provided an opportunity to subscribe to a periodic newsletter and product updates. This newsletter allows BTL WORKS to inform you of new Products and Services, updates, and other news relevant to the company. The subscription requires your first and last name and your e-mail address; optionally, the name of the clinic you represent. Commercial electronic messages are sent only with your consent in line with Turkish Law No. 6563 and the Message Management System (İYS) rules. Browsing websites and e-mail interactions When you request a page from our Website or click a link included in our e-mail, our servers log the information provided in the HTTP request header (the IP number, the time of the request, the URL of your request and similar information). We collect this information in order to make the Website function correctly and provide you the functionality that you see on the Website. We also use this information to better understand how visitors use the Website and how we can better adjust the Website, its contents and functionality to meet the needs of our users. For e-mails we send, delivery status and unsubscribe events are recorded by our e-mail delivery service. Files BTL WORKS collects and stores the files you upload, download or access via the Products and Services offered through the Website. We understand that these files may be confidential or contain sensitive information. Accordingly, BTL WORKS does not share or permit third parties to access such files; files are not public and are accessed only from authorised sessions through time-limited signed links. However, no password-protected system of data storage and retrieval can be made entirely impenetrable. Although BTL WORKS uses a number of security technologies and procedures to make sure that the data is secure, it may be possible for an unauthorised third party to access, view, copy, modify and distribute the data and files you store despite BTL WORKS's efforts. Your User Account and profile As described above, you will be given an opportunity to create a User Account containing your personal information. A User Account is required for using most Products and Services. Once the User Account is created, you may provide additional information to your profile, and access, review and update your account information online. Providing additional information about yourself beyond what is minimally required for account creation is entirely up to you. Any information you provide at registration or in your profile section may be used by us as described in the Terms of Service and this Privacy Policy. You can review the personal information you provide to us and make any desired changes at any time by logging in to your account. If you wish to deactivate your User Account, you can do so through the User Account interface or by contacting BTL WORKS at info@btlworx.com. When a Clinic Account is closed, all information stored and maintained as part of the account, including the files you stored, is deleted from our servers within 30 days in accordance with Section 26.9 of the Terms of Service; records that the law requires us to retain are kept for the statutory period. Information relating to children We do not knowingly collect personal information from children under 18. You must be 18 years old or the age of majority in your jurisdiction in order to use our Website, Products or Services. Data about clinics' patients under 18 is processed by the controller clinic with the consent of a parent or guardian. Parents and legal guardians may request that we review, delete or stop the collection of the personally identifiable information of their child by contacting us by letter (using the address at the bottom of this page) or by e-mail to info@btlworx.com. Securing the transmission and storage of information BTL WORKS is committed to protecting the security of your personal information. We use a variety of security technologies and procedures to help protect your personal information. In particular, we use all reasonable endeavours to ensure that appropriate security measures are in place to protect your personal data. We apply the security measures foreseen in the applicable regulations as well as our own technical and organisational security measures, including policy, governance, procedures, responsibilities, risk assessment, network and sub-processor security. BTL WORKS operates secure data networks protected by industry-standard firewall, encryption and password protection systems. Our security and privacy policies are periodically reviewed and enhanced as necessary, and only authorised individuals have access to the information provided by our users. BTL WORKS takes steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, the transmission of information via the internet is not completely secure and so we cannot guarantee the security of your personal data transmitted through the Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. We treat the information you provide to us, including the files, as confidential information; it is, accordingly, subject to our security procedures and policies regarding protection and use of confidential information. After personally identifiable information reaches BTL WORKS, it is stored in the European Union (Frankfurt, Germany) on servers with physical and electronic security features customary in the industry, including login/password procedures and electronic firewalls designed to block unauthorised access from outside. Databases and files are encrypted at rest. Clinics share a single database; every record is locked to the clinic it belongs to at database level through enforced row-level security, files are kept in each clinic's own folder, and a user of one clinic cannot technically access another clinic's data. Meta and WhatsApp access tokens and two-factor authentication keys are additionally encrypted at field level (AES-256-GCM). All BTL WORKS personnel are obligated by our privacy and security policies. Your information is only accessible to those personnel who perform technical support of the service; such access is logged, and patient data is not displayed in administration screens. If a password is used to help protect your accounts and personal information, it is your responsibility to keep your password confidential. Do not share this information with anyone. If you are sharing a computer with anyone you should always log out before leaving any site or service to protect access to your information from subsequent users. C. USE AND DISCLOSURE OF INFORMATION How your personal information is used On the contract lawful basis. If you subscribe to a service or register a product, such information is used to register your rights, if any, to technical support or other benefits made available to registered users. We also use your personal information for registering you for an account or a demo, sending a confirmation e-mail, responding to your requests and helping to process the purchase or service you have selected, communicating with you when you contact a sales consultant or authorised partner, processing, fulfilling and following up on transactions for our products and services, support and training, processing any request by you for information or advice, managing your account and content that you upload, and dealing with enquiries, complaints and feedback from you and our partners (KVKK Art. 5/2-c; GDPR Art. 6/1-b). Based on our legitimate interests. BTL WORKS may use statistical data to help diagnose problems with our servers and administer the Website, or to improve your browsing experience by personalising the Website. We reserve the right to send a one-time registration confirmation e-mail and infrequent service alert messages to users to inform them of specific changes that may impact their ability to use a service they have previously signed up for, regardless of e-mail contact opt-in status (KVKK Art. 5/2-f; GDPR Art. 6/1-f). Based on our legitimate interests and your consent. We use your personal information to develop and conduct our business. Some examples of how we use personal information include: improving our products and services; personalising communications with you; conducting customer surveys. BTL WORKS collects your information in order to record and support your participation in the activities you select. AI tools may be used to provide direct services to you (such as message classification, reply suggestions or summaries); your personal information is not used to train general-purpose AI models, and no decisions producing legal effects concerning you are made solely by automated means. To opt out please contact us at info@btlworx.com. Based on your consent, your personal information may also be used to keep you informed about new products, product upgrades, patches, special offers and other products and services of BTL WORKS, if you have consented to receive such communications (KVKK Art. 5/1; GDPR Art. 6/1-a; Law No. 6563 and İYS). When you create a User Account within Monostron and/or provide your e-mail address and other personal identification information, based on your personal preferences, we or our trusted partners on our behalf may periodically contact you via e-mail and provide information about our products and services that may be of interest to you. We may use a third-party e-mail service provider to send e-mails to you. This service provider is prohibited from using your e-mail address for any purpose other than to send Monostron-related e-mail. If you do not wish to receive e-mails with updates and information, please unsubscribe by sending an e-mail to info@btlworx.com. In addition, every time you receive an e-mail you will be provided the choice to opt out of future e-mails by following the instructions provided in the e-mail. You may also opt out online by updating your User Account. Legal obligation. We may hold some of your information for complying with legal requirements and enforcing our Website terms of use or otherwise protecting our legal rights (KVKK Art. 5/2-a, ç, e; GDPR Art. 6/1-c). We also reserve the right to contact you if compelled to do so as part of a legal proceeding or if there has been a violation of any applicable licensing, warranty or purchase agreements. BTL WORKS is retaining these rights because in limited cases we may need to contact you as a matter of law or regarding matters that will be important to you. These rights do not allow us to contact you to market a new or existing service if you have asked us not to do so, and issuance of these types of communications is rare. Special categories of data. Health data is a special category of personal data (KVKK Art. 6; GDPR Art. 9). BTL WORKS processes health data only as a data processor, on the instructions of the controller clinic, on the basis of the explicit consent the clinic obtains from the patient or another exception provided by law, and with the additional safeguards required by the Turkish Personal Data Protection Board for special categories of data. Disclosure of your personal data to third parties BTL WORKS uses services of third parties, such as e-mail service providers and hosting providers, that act as independent contractors on behalf of BTL WORKS. We will not share your information with any third parties for the purposes of direct marketing or any other purposes as data controller; we do not sell or rent your personal information and do not transfer it to advertising partners. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. The data processing consisting of hosting provider services (storage and maintenance of databases containing your personal data, protected by password) is performed on our behalf and under written confidentiality and data processing agreements by our authorised data processors Supabase (Amazon Web Services data centres, Frankfurt, Germany) and Vercel (Frankfurt region). Our other sub-processor categories are e-mail delivery services (Resend and similar), social media and messaging platforms (Meta Platforms: the Instagram, Messenger, WhatsApp and Lead Ads channels a clinic connects; Ireland/USA), messaging and bot infrastructures if the clinic chooses them (ManyChat and similar), automation tools the clinic connects (Make, Zapier, n8n and similar), AI providers for AI features (Anthropic Claude, OpenAI, Google Gemini and similar) and, for browser notifications that staff turn on, the browser vendors' push services (Google, Mozilla, Apple and similar). The providers, models and integrations currently in use are announced dynamically at https://monostron.com/guvenlik. BTL WORKS is liable for its onward transfers of data to third parties to the extent required by data protection law. BTL WORKS may disclose your personally identifiable information if we believe in good faith that we are required to do so in order to comply with applicable law, a subpoena or other legal process. BTL WORKS may also disclose personally identifiable information when we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be violating this Privacy Policy or the terms of your agreements with us (such as the Terms of Service), or to protect the safety of our users and the public, or under confidentiality and licensing agreements with certain third parties which assist us in developing, operating and maintaining the Website and its content. BTL WORKS may be required by law enforcement or judicial authorities to provide personally identifiable information to appropriate governmental authorities. If requested by law enforcement or judicial authorities, BTL WORKS will provide this information upon receipt of appropriate documentation. BTL WORKS may also provide information to law enforcement to protect its property and the health and safety of individuals as permitted by statute. BTL WORKS may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. In the event that all or substantially all of BTL WORKS's business and/or assets are transferred or sold to another entity, BTL WORKS may transfer personally identifiable information to the acquiring entity. If, as a result of such a business transition, your personally identifiable information will be used in a materially different manner, you will be given choice consistent with our policy regarding notification of changes. Where we store your personal data Personal data obtained via Monostron is processed by BTL WORKS, established in Türkiye, and stored inside the European Union in Frankfurt, Germany, in Amazon Web Services data centres (via Supabase), which are fully GDPR compliant, and in Vercel's Frankfurt region. Clinics share a single database; every record is locked to the clinic it belongs to at database level, and a user of one clinic cannot technically access another clinic's data. Data passed to sub-processors outside the European Union for services such as AI, e-mail and browser notifications is described below and in the current list at https://monostron.com/guvenlik. International transfers Because BTL WORKS is established in Türkiye, hosting your personal data in Frankfurt is a transfer abroad within the meaning of KVKK Article 9. Such transfers are made to countries with an adequacy decision, under appropriate safeguards such as standard contractual clauses notified to the Turkish Personal Data Protection Board, or with your explicit consent. For clinics' patient data, consent for international transfer is obtained from patients by the controller clinic. Personal data within the scope of the GDPR may be processed outside the European Union (by our support team in Türkiye, Meta Platforms, messaging and bot infrastructures, automation tools, AI providers and similar) only subject to appropriate safeguards under Article 46 GDPR, specifically the standard data protection clauses adopted by the European Commission in accordance with the examination procedure. A message sent via Instagram, Messenger or WhatsApp passes through Meta's servers before it reaches us; that transfer is governed by your agreement with Meta. D. YOUR CHOICES, CHOICES FOR LIMITING THE USE AND DISCLOSURE OF YOUR PERSONAL DATA, RIGHTS AND PRIVACY-RELATED INQUIRIES AND COMPLAINTS Choices available to you You can always choose whether or not to disclose personally identifiable information, and that choice will not prevent you from using the Website. Please note, however, that if you choose to withhold requested information, we may not be able to provide you with some of the services dependent upon the collection of this information, and you will be given an opportunity to opt in and make your preference choices for any items that are optional and not a prerequisite for rendering such services. You can choose at any time to opt out of receiving e-mails from BTL WORKS or from having your personally identifiable information shared with selected companies. If you wish to opt out, you can do so by editing your User Account preferences. If you elect to opt out we will not, as applicable, share your personal information with third parties or send you e-mails. However, we may continue to use your personal information for internal purposes, to enhance your user experience, or as necessary to administer the site or comply with applicable law. California, Virginia, Colorado privacy choices We will not share any personal data with third parties for their direct marketing purposes to the extent prohibited by California, Virginia or Colorado law. We do not sell your personal information. If our practices change, we will do so in accordance with applicable laws and will notify you in advance. Cookies and tracking pixels (device data collection tools) A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Our Website and application use only the following cookies: * Strictly necessary cookies. These are cookies that are required for the operation of the Website and the application: the session cookie that keeps you signed in and short-lived technical cookies for security (protection against request forgery). * Functionality cookies. These are used to remember your preferences, such as theme or language. We do not use analytical or performance cookies, advertising cookies, tracking pixels or third-party device data collection tools (such as Meta Pixel, TikTok or Google Analytics), and we do not set third-party cookies. Should analytics cookies be introduced in the future, this Policy will be updated and your consent requested on your first visit. Choices about cookie usage No consent is requested for strictly necessary cookies. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly; the session cookie is required to sign in to the application. E. Monostron INTEGRATIONS, THIRD-PARTY LINKS AND EXTENSIONS PRIVACY STATEMENT Introduction. This Privacy Statement describes how personal data is processed under Monostron third-party integrations, third-party links and non-Monostron applications. Definitions "BTL WORKS", "we", "us", "our" means BTL WORKS; "Customer", "you" means the organisation (clinic) that subscribes to the Services and through whom you, the end user of such Services, are provided access to the Services; "Customer Data" means electronic data and information submitted by or for Customer to the Services; "Personal data" means any information relating to an identified or identifiable natural person; "Services" means products and services that are ordered by our Customers and made available online by BTL WORKS as described in the Terms of Service (https://monostron.com/kullanim-kosullari); "Third Party Services" means services that are provided to the Customer by a third party and/or listed in an online directory, catalogue or marketplace of applications that interoperate with the Monostron Services ("non-Monostron Applications"). Limited use disclosure Should an integration using Google APIs be offered, our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. What data is collected? Meta integrations (Instagram, Messenger, WhatsApp, Lead Ads) If you connect your Monostron account to apps or services provided by Meta Platforms, certain Customer Data may be collected through Meta's application programming interfaces (Graph API, Messenger Platform, WhatsApp Business Platform), and may include: * The ID and name of the Facebook Page you connect, the ID and username of the linked Instagram professional account, and the WhatsApp Business phone number ID; * The content, sender ID and timestamps of messages that patients send to your Page or account, and the replies you send from the panel; * The fields submitted to Facebook Lead Ads forms (name, phone, e-mail and any other field you define in the form), and form and campaign IDs; * If the clinic consents to it when connecting its WhatsApp Business account, that number's past conversations (up to the last 6 months) may be imported into the CRM to the extent Meta allows; * Customer Data that you send from your Monostron account to Meta, or data that you request from Meta services. As a security precaution, when you request data from Meta services, information that identifies you or your device may also be sent in order to authenticate the request. A patient's profile, posts, followers and conversations with others are never accessed. You can revoke access at any time from "Apps and Websites" in your Facebook or Instagram settings, or with the "Disconnect" action in the panel. * Our use of information received from Meta APIs, and its transfer to any other app, adheres to the Meta Platform Terms and Developer Policies. Messaging and bot infrastructures (ManyChat and similar) If the clinic chooses it, Instagram and WhatsApp messages pass through a messaging and bot infrastructure (ManyChat and similar) for automated replies; only the message content and sender ID are transmitted to that infrastructure, and its own terms apply. AI providers (Anthropic Claude, OpenAI, Google Gemini and similar) The provider currently in use is Anthropic (USA). After every patient message received through a connected channel, the latest messages of the conversation (up to 20) together with the patient's name, city and pipeline stage are sent to Anthropic to produce a card summary, a lead temperature score and a suggested next step. If the clinic turns on the greeting and follow-up assistant, the latest messages (up to 24), the patient's name, language, city, country and pipeline stage, and the clinic's treatment and price list are also sent so that the assistant can reply to the patient. The patient's stored phone number, e-mail address, files and images are not sent; your data is not used to train models; the provider and models in use are announced at https://monostron.com/guvenlik. Automation and webhook integrations (Make, Zapier, n8n and similar) When you connect an automation tool, Monostron sends only the events you configure (new record, appointment, status change and similar) to the address you specify; processing of that data by the receiving service is subject to that service's terms. E-mail delivery E-mails sent from the panel are delivered with the clinic's own sender address through our e-mail delivery service (Resend); the service processes only the recipient address, subject and content, and delivery status. Browser notifications If staff turn on browser notifications, notifications such as a new patient message are delivered through the push service of that browser's vendor (for example Google, Mozilla or Apple). A notification may contain the patient's name and a short part of the message or note (up to 120 characters); the content is end-to-end encrypted under the Web Push standard and the push service cannot read it. How your personal information is used via the third-party integrations Based on our legitimate interests or as necessary to perform our contract with you, to administer, improve and provide to you our extended integration Services upon your request. Legal obligation We may hold or request some of your information for complying with legal requirements and enforcing our Website terms of use or otherwise protecting our legal rights. In order to comply with the United States and European Union export control and economic sanctions laws and regulations to which our infrastructure providers are subject, in certain cases BTL WORKS might request you to provide your identity documentation. Disclosure of your personal data to third parties BTL WORKS is not responsible for the data processing practices of any Third Party Providers. We encourage you to review your Third Party Providers' respective privacy notices before enabling a Third Party Service integration. Choices available to you You can always choose whether or not to disclose personally identifiable information, and that choice will not prevent you from using our Services. Please note, however, that if you choose not to make available some of your personal information, we may not be able to provide you with some of the services described in this Integrations, Third-Party Links and Extensions Privacy Statement. F. DATA RETENTION BTL WORKS may retain your personal data for a period of time consistent with the original purpose of collection. Data is retained while the account remains active. When a subscription ends, the clinic's data, files and backups are permanently deleted or anonymised within 30 days in accordance with Section 26.9 of the Terms of Service. While the service is running, daily backups are retained for 30 days and older ones are deleted automatically; a record deleted in the panel may therefore remain in backups for up to 30 more days. The retention period for clinics' patient records is set by the controller clinic according to record-keeping obligations under health legislation. Records that the law requires us to retain, such as invoices, contract acceptances and access logs, are kept for the statutory period. We may retain data longer where a complaint or a prospect of litigation exists. G. YOUR RIGHTS In Türkiye, under Article 11 of the KVKK you have the right: to learn whether your personal data is processed; to request information if it has been; to learn the purpose of processing and whether the data is used in line with it; to know the third parties to whom it is transferred in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request erasure or destruction under Article 7; to request that corrections, erasures and destructions be notified to third parties to whom the data was transferred; to object to a result against you produced by analysis exclusively through automated systems; and to claim compensation for damage caused by unlawful processing. You may submit your application in writing or by e-mail in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller; applications are concluded free of charge within 30 days at the latest. If your application is refused, the reply is insufficient or no reply is given in time, you may lodge a complaint with the Personal Data Protection Authority (https://www.kvkk.gov.tr). In the European Union, the United Kingdom, Switzerland and some other jurisdictions you may have the following rights concerning our processing of your personal data: Right to access. You have the right to ask us for copies of your personal information. This right always applies. Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. Right to erasure. This right is applicable when one of the following applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; (c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing; (d) the personal data have been unlawfully processed. Right to restriction of processing. When processing is restricted, we will store your personal data, but not further process it. Right to data portability. Your right to receive the personal data which you have given to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller, applicable where the processing is based on consent or on a contract and is carried out by automated means. The "Download data package" function in the panel can be used for this. Right to object. You have the right to object to processing (on grounds relating to your particular situation) if we process your information in our legitimate interests. The only reasons we will be able to deny your request are if we can show compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims, or the processing is necessary for the performance of our contract with you. Right to withdraw your consent at any time in case of any consent-based processing of your personal data, without affecting the lawfulness of processing based on consent before your withdrawal. Right to lodge a complaint with a supervisory authority (in the EU, the data protection authority of your country; in the UK, the ICO, www.ico.org.uk; in Switzerland, the Federal Data Protection and Information Commissioner). You may exercise your legal rights by contacting us via e-mail at info@btlworx.com. This request must include at least the following information: the address (subdomain) of your clinic panel and your administrator registration e-mail address. If you are a patient of a clinic, please direct your request to that clinic first; patient requests that reach us are forwarded to the clinic and answered within 30 days. Step-by-step deletion instructions are published at https://monostron.com/veri-silme. BTL WORKS takes and addresses its users' privacy concerns with the utmost respect and attention. If you believe that there was an instance of non-compliance with this Privacy Policy with regard to your personal information, or you have other related inquiries or concerns, you may write to BTL WORKS at info@btlworx.com. In your message, please describe in as much detail as possible the nature of your inquiry or the ways in which you believe that the Privacy Policy has not been complied with. We will investigate your inquiry or complaint promptly. Please note that if you provide BTL WORKS with inconsistent privacy preferences (for example, by indicating on one occasion that we may contact you with marketing offers and indicating on another occasion that we may not), BTL WORKS cannot guarantee that your most recent privacy preference will be honoured and will contact you to clarify. You may also exercise your legal rights by contacting our Data Protection and Grievance Officer, Yunus Badeci, via e-mail at info@btlworx.com. Contact: BTL WORKS (Yunus Badeci) · Esentepe, Keskin Kalem Sok. No: 17 · 34394 Şişli / İstanbul · Türkiye · info@btlworx.com · monostron.com