Privacy Policy

01Data controller

The data controller is Garry Medikal Ithalat Ihracat Ltd Sti., Oruçreis Mah. Tekstilkent Cad. A5 Blok No:13 Esenler, İstanbul / Türkiye. For any question about personal data, write to info@garrymedical.com.

02Whose data we process

We operate on a business-to-business basis. Most of the personal data we process belongs to people acting on behalf of companies and institutions:

• Visitors to this website.
• People who contact us through our forms, by email, by phone or on WhatsApp.
• Representatives and employees of distributors, dealers, hospitals and clinics that apply for an account, hold an account or order from us.
• Contacts at our suppliers, carriers and other business partners.

03Personal data we process

Depending on how you interact with us, we process:

• Identity and professional data: name, surname, job title, company or institution.
• Contact data: email address, phone number, business address and country.
• Customer transaction data: quotation requests, orders and order references, invoices, delivery details, correspondence, complaints, returns and warranty claims.
• Account data: sign-in email, password stored in encrypted (hashed) form, account status and the records of the application review.
• Financial data: billing details and payment status. Card details are entered on our payment provider's page and are not stored by us.
• Transaction security data: IP address, date and time of access, browser and device information and security logs.
• Marketing data: your email address and subscription status, if you subscribe to our updates.
• Usage data: pages visited, time spent on each page, scroll depth, clicks on links (WhatsApp, email, phone, external links and file downloads), form submissions, the referring website and campaign parameters (utm), your IP address and the approximate location derived from it (country, region, city), browser, operating system, device type and, where your browser reports it, device model, screen size, browser language and time zone. Our own visit statistics record this data without cookies. Only with your consent do we also store a visitor identifier in your browser and use Google Analytics and Metricool, as described in our Cookie Policy.

04Please do not send patient data

Our forms and email addresses are intended for business correspondence. Please do not send us health data, patient information or other special categories of personal data. If such data reaches us unrequested, we delete it unless we are required by law to keep it.

05Purposes of processing

We process personal data to:

• Answer inquiries and prepare quotations.
• Review account applications, verify eligibility and manage accounts.
• Process orders, invoicing, payments and deliveries.
• Handle complaints, returns and warranty claims, and send product safety notices.
• Meet our legal obligations, including commercial, tax and medical device obligations, and respond to requests from authorities.
• Keep this website and our systems secure and prevent fraud and misuse.
• Establish, exercise and defend legal claims.
• Send product updates and newsletters, if you have subscribed.
• Measure and improve this website with visit statistics and, if you have accepted analytics cookies, with Google Analytics and Metricool.

06Legal grounds

Under Article 5(2) of the KVKK, we process personal data where it is necessary for the conclusion or performance of a contract, for compliance with a legal obligation, for the establishment, exercise or protection of a right, or for our legitimate interests, provided that your fundamental rights and freedoms are not harmed. Our visit statistics, which are recorded without cookies, are based on our legitimate interest in measuring, improving and securing this website (Article 5(2)(f) of the KVKK); you may object to this processing at any time by writing to info@garrymedical.com. Analytics cookies (the visitor identifier, Google Analytics and Metricool) and marketing emails are based on your explicit consent under Article 5(1) of the KVKK; you may withdraw this consent at any time.

Where the GDPR applies, the corresponding legal bases are Article 6(1)(b) (contract), 6(1)(c) (legal obligation), 6(1)(f) (legitimate interests, including our visit statistics) and 6(1)(a) (consent).

07How we collect personal data

We collect personal data directly from you through our forms, the dealer portal, email, phone and WhatsApp; from the company or institution you act for; from public registers used to verify business details; and automatically through our visit statistics, server logs and cookies, as described in this policy and our Cookie Policy.

08Who we share personal data with

We share personal data only as far as necessary for the purposes above:

• Service providers who host and operate our website and database, including our own visit statistics, and deliver our emails, acting on our instructions.
• Web analytics providers, Google (Google Analytics) and Metricool, only if you have accepted analytics cookies.
• Our payment provider, for approved accounts that pay online.
• Carriers, couriers, freight forwarders and customs brokers, to deliver orders.
• Banks, accountants, auditors, lawyers and insurers, where needed.
• The authorized distributor for your territory, where your inquiry concerns a market that distributor serves, so that it can respond to you.
• Competent public authorities and courts, where required by law.

09Transfers abroad

Some of our service providers operate servers outside Türkiye, including in the European Union and the United States, and our customers and carriers are located in many countries. Personal data is transferred abroad in accordance with Article 9 of the KVKK, on the basis of an adequacy decision, appropriate safeguards such as standard contracts, or the other conditions set out in that article, and, for data subject to the GDPR, in accordance with Chapter V of the GDPR.

10Retention

We keep personal data only for as long as the purpose requires or the law obliges us to, and then delete, destroy or anonymize it. Commercial books and supporting records, including orders and invoices, are kept for 10 years as required by the Turkish Commercial Code, and tax records for the periods set by tax law. Inquiries that do not lead to an order are kept for up to 2 years after the last correspondence, declined account applications for up to 1 year, and security logs for the periods required by law. Visit statistics, including the IP addresses recorded with them, are kept for up to 13 months and then deleted. Analytics cookies are kept for the periods set out in our Cookie Policy.

11Your rights

Under Article 11 of the KVKK you have the right to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of the processing and whether the data is used in accordance with that purpose.
• Know the third parties in Türkiye or abroad to whom your data is transferred.
• Request the correction of incomplete or inaccurate data.
• Request the deletion or destruction of your data under the conditions of Article 7 of the KVKK.
• Request that third parties to whom your data was transferred are informed of a correction, deletion or destruction.
• Object to a result that is to your detriment and arises exclusively from the automated analysis of your data.
• Claim compensation for damage caused by the unlawful processing of your data.

12How to exercise your rights

Send your request in writing to Oruçreis Mah. Tekstilkent Cad. A5 Blok No:13 Esenler, İstanbul / Türkiye, or by email to info@garrymedical.com from the email address you have registered with us, or by another method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, stating your name, surname and contact details and the subject of your request. We respond free of charge within 30 days at the latest; where the response involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected or not answered in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Where the GDPR applies, you also have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with the data protection authority of your country.

13Security

We take technical and organizational measures appropriate to the risk, including encrypted connections, passwords stored only in hashed form, access limited to the staff who need the data, and regular review of our safeguards.

14Third-party services and links

When you contact us on WhatsApp, pay on our payment provider's page or load the map on our contact page, the provider of that service also processes your data under its own privacy policy. This policy does not cover third-party websites linked from our site.

15Cookies

We use strictly necessary cookies to run the site and, only with your consent, analytics cookies. Our own visit statistics are recorded without cookies. Details and your choices are set out in our Cookie Policy.

16Children

This website serves businesses and healthcare professionals and is not directed to children. We do not knowingly collect personal data from children.

17Changes to this policy

We may update this policy from time to time. The current version, with its date, is published on this page.