Informationshinweis zu Zahlungen

2. Payment Channels and Roles of the Parties

Purchases made through the Application are carried out through one of the following channels depending on the device platform and the nature of the product:

• In-app purchase (App Store / Google Play) — Party processing the payment: Apple Inc. or Google LLC (store operator). Company's access to card data: None — card details are processed directly by the store operator.
• Direct in-app payment — Party processing the payment: A licensed payment or electronic money institution. Company's access to card data: None — card details are processed directly on the payment institution's secure infrastructure.

Your Card Details Are Not Held by the Company: In both channels, your credit/debit card number, expiry date and security code (CVV) are never seen, processed or stored by our Company. This information is processed only on the PCI-DSS compliant secure infrastructure of the relevant store operator (Apple/Google) or the licensed payment institution.

Our Company receives only the information relating to the outcome of the transaction and billing (transaction ID, amount, date, result status, subscription/product details).

In the in-app purchase channel, payment, subscription management, refund and billing processes are subject to the rules and agreement of the relevant store operator. In this channel the store operator acts as an independent data controller with respect to card data and applies its own privacy policy.

3. Payment and Billing Data Processed

In connection with your purchase, our Company processes the following data:

• Transaction Data: Transaction/order ID, transaction date and time, amount and currency, payment status (successful/failed/refunded), product or subscription purchased
• Subscription Data: Subscription start and renewal date, subscription type, cancellation and renewal records, store subscription identifier
• Billing Data: Name/company name and contact details required for the invoice; billing address and tax details if requested
• Verification Data: Transaction verification and receipt information returned by the payment institution or store operator

Sensitive payment instrument data such as credit/debit card number, expiry date and security code (CVV) is not processed or stored by our Company.

4. Purposes of Processing

• Carrying out and managing purchase and subscription transactions,
• Providing access to paid features and digital content,
• Conducting billing and accounting processes,
• Handling refund, cancellation and subscription renewal requests,
• Preventing payment fraud and ensuring transaction security,
• Resolving requests and complaints,
• Fulfilling retention and documentation obligations arising from financial legislation,
• Establishing, exercising or protecting a right in legal disputes.

5. Legal Grounds

• Performance of the purchase and subscription: KVKK Art. 5/2-c — Establishment or performance of a contract
• Billing, accounting and financial record-keeping obligations: KVKK Art. 5/2-a — Expressly provided for by law (Tax Procedure Law, Turkish Commercial Code)
• Payment security and fraud prevention: KVKK Art. 5/2-f — Legitimate interest
• Refund, cancellation and complaint processes: KVKK Art. 5/2-c — Performance of a contract
• Defence in legal disputes: KVKK Art. 5/2-e — Establishment, exercise or protection of a right

The processing of payment and billing data is based on the performance of the contract and legal obligations inherent in the nature of the purchase; separate explicit consent is not obtained for this data. Where the payment institution's infrastructure is located abroad, the related transfer is carried out with appropriate safeguards under Article 9 of the Law.

6. Transfer of Payment Data

Your payment and billing data may be transferred, limited to the purposes of processing, to the following parties:

• Store operators (Apple Inc., Google LLC) — in the in-app purchase channel,
• Licensed payment and electronic money institutions — for carrying out the transaction in the direct payment channel,
• Financial advisory, accounting and independent audit service providers,
• Information technology infrastructure and hosting service providers,
• Authorised public institutions and judicial authorities (within the scope of requests and obligations arising from legislation).

Subscription and payment records kept within the Application are stored on the Company's own servers located in Türkiye.

7. Retention Period

• Invoices, financial records and documents: 5 years (Tax Procedure Law Art. 253)
• Commercial books and records: 10 years (Turkish Commercial Code Art. 82)
• Contract and subscription records: 10 years from the end of the relationship (Turkish Code of Obligations Art. 146 — general limitation period)
• Transaction and payment verification records: 10 years from the transaction date (evidence and financial obligations)
• Refund and complaint records: 3 years from the conclusion of the request (consumer legislation / evidence)

Data whose retention period has expired is deleted, destroyed or anonymised in accordance with the Personal Data Retention and Destruction Policy. The periodic destruction interval is at most six months.

8. Information on Purchases, Subscriptions and the Right of Withdrawal

In the in-app purchase channel (App Store / Google Play), the charging, automatic renewal, cancellation and refund of subscriptions are governed by the rules of the relevant store operator. You can manage your subscription and turn off automatic renewal through your device's app store settings. The store operator's relevant policies apply to cancellation requests and refund conditions.

For digital content and services purchased through the direct payment channel, the provisions of the Consumer Protection Law No. 6502 and the Distance Contracts Regulation apply. For digital content delivered instantly in electronic form, you are separately informed before the purchase that the right of withdrawal may not be exercisable if your approval is obtained before performance begins. Where the right of withdrawal can be exercised, your requests are submitted to info@ungmedical.com and concluded within the period provided for in legislation.

The scope of paid features, the fee amount, currency, subscription period and renewal conditions are clearly displayed on the purchase screen; the purchase is completed only if you confirm this information.

9. Your Rights and Applications

Under Article 11 of the Law you have the following rights with respect to your payment and billing data:

• To learn whether your personal data is processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether the data is used in accordance with that purpose,
• To know the third parties, in Türkiye or abroad, to whom your personal data is transferred,
• To request correction if your personal data is incomplete or inaccurate,
• To request deletion or destruction of your personal data under the conditions set out in Article 7 of the Law,
• To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
• To object to a result against you produced by analysis of the processed data exclusively through automated systems,
• To claim compensation for damages suffered due to unlawful processing of your personal data.

You may submit your requests by email to info@ungmedical.com or by registered electronic mail (KEP) to ung@hs01.kep.tr. Requests are concluded free of charge as soon as possible depending on their nature, and in any case within thirty (30) days at the latest. Please note that requests concerning payment instrument data in the in-app purchase channel may need to be directed to the relevant store operator, which is the controller of that data.

10. Updates to the Notice

This notice may be updated in line with changes in the payment infrastructure and legislation. The current text is available within the Application and at www.ungteknoloji.com. The effective date is the date on which the text is published.