LEGAL OBLIGATIONS

5. Principles Regarding the Processing of Personal Data

Personal data will be processed by Pratikargo through verbal, written, or electronic means using both automated and non-automated methods, and actions will be taken in accordance with the Constitution and the Personal Data Protection Law (KVKK) regarding the processing of personal data.

In the process of processing your personal data, KVKK and the fundamental principles of Personal Data Law will be adhered to. In this context:

• Personal data will be processed by Pratikargo in accordance with the law and principles of honesty, based on proportionality and necessity, only as much personal data will be processed as necessary for its intended purpose.

• Personal data will be processed by Pratikargo in accordance with the law and principles of honesty, based on proportionality and necessity, only as much personal data will be processed as necessary for its intended purpose.

• Pratikargo retains personal data only for the duration prescribed by law or as long as necessary for the purpose for which it was processed. In this context, if a period has been determined for the storage of personal data in relevant legislation, this period will be followed; if no period has been specified, personal data will be retained for as long as necessary for the purpose it was processed. However, this period may be extended to comply with legal obligations determined by the legislation or to protect legitimate business interests.

• Pratikargo is responsible for the destruction of all data when the purpose for which personal data was collected ceases to exist and the legal retention periods expire.
  All operations performed regarding the deletion, destruction, and anonymization of personal data will be recorded, and these records will be kept for at least three (3) years, apart from other legal obligations.

• Pratikargo takes necessary measures to ensure that the personal data it processes is accurate and, when necessary, up to date.

6. Purposes of Personal Data Processing

As Pratikargo, your personal data will be processed in accordance with the relevant articles of KVKK and the principles stated below, as long as your connection with our company continues, and in line with our legitimate interests during the provision of services.

• To fulfill our legal obligations specified in the relevant legislation,

• Identity verification and validation,

• Execution of our activities stated in the Main Contract, planning and managing financing,

• Planning and managing the internal operations at Pratikargo Headquarters and/or Branches while providing our services,

• To notify you about your shipments upon your request, provide information, and/or send reminders,

• To carry out risk management and quality improvement activities,

• To meet legal and regulatory requirements,

• To share and respond to the information obtained from various Ministries and public institutions and/or organizations as required by the legislation,

• To generate invoices in exchange for the services we provide,

• To take all necessary technical and administrative measures regarding data security of the systems and applications located at Pratikargo Headquarters and/or Branches,

• To analyze your service usage and store your data for the purpose of improving and enhancing the services we provide, responding to your queries or complaints regarding our services,

• To provide necessary information in line with inquiries and audits by regulatory and supervisory authorities,

• To store the information regarding the data that must be retained by applicable legislation,

• To comply with internal policies and principles,

• To measure customer satisfaction and increase customer satisfaction after you receive services,

• To conduct promotional and informational activities tailored to you and ensure your benefit, contacting you for informational purposes regarding our services, and not limited to these, planning and managing the operation and financing of our postal services, express cargo transportation, and all other services, increasing the customer base, researching, and associated reasons.

7. Legal Grounds and Conditions for Processing Personal Data

As Pratikargo, we can process your personal data based on the Personal Data Protection Law numbered 6698, the Turkish Commercial Code numbered 6102, the Social Security Law numbered 5510, the Labor Law numbered 4857, the Occupational Health and Safety Law numbered 6331, the Tax Procedure Law numbered 213, the Postal Services Law numbered 6475, and the Road Transport Law numbered 4925 as well as various permissions and certificates obtained from Ministries and various Institutions/Organizations for providing our services. Your data will be processed in accordance with the "Relevant Legislation" which includes the necessary data to be collected as mandated by the special laws and legislation for our operational area that we have described above. Based on the relevant legal provisions; your data can be processed by Pratikargo without your explicit consent.

According to KVKK.m.5, under the circumstances listed below, we can process your personal data without requiring your explicit consent as Pratikargo;

• Where explicitly provided for by law,

• If you are unable to state your consent due to physical impossibility or if circumstances arise where your consent is not legally valid, processing of your data is mandatory for the protection of your or another person's life or bodily integrity,

• If processing personal data of the parties to a contract is necessary for the establishment or performance of a contract,

• If it is mandatory for the fulfillment of a legal obligation,

• If your personal data has been made public by you,

• If processing your personal data is mandatory for the establishment, exercise, or protection of a right,

• Provided that it does not harm your fundamental rights and freedoms, if processing your personal data is mandatory for the legitimate interests of Pratikargo.

7.1. Processing of Special Categories of Personal Data

Special categories of personal data are regulated under KVKK m.6. There are a limited number of special categories of personal data in KVKK, and it is not possible to expand these categories. The legal grounds for processing special categories of personal data according to KVKK are provided below. Accordingly,

• The relevant person's explicit consent,

• Explicitly provided for by law,

• If the person is in a situation where they are unable to express their consent due to physical impossibility or if circumstances arise where their consent is not legally valid, and processing is necessary for the protection of themselves or another person's life or bodily integrity,

• Relating to personal data disclosed by the relevant person and being in accordance with the intent of the disclosure,

• Processing is mandatory for the establishment, exercise, or protection of a right,

• Necessary for public health protection, preventive medicine, medical diagnosis, treatment and care services, and planning, management, and financing of health services by persons or authorized institutions and organizations under a confidentiality obligation,

• Also necessary for the fulfillment of legal obligations in the field of employment, occupational health and safety, social security, social services, and social assistance,

• Organizations or entities established for political, philosophical, religious, or union purposes, which properly adhere to the legislation and purposes they are subject to, provided they are limited to their fields of activity and not disclosed to third parties.

Special categories of personal data can be processed.

Pratikargo does not directly collect your special categories of personal data through its website. However, if you choose to share special categories of personal data, it may be based on the legal grounds mentioned above, applicable to the specific case.

8. Transfer of Personal Data
8.1. Domestic Transfer

Personal data can only be transferred to third parties in Turkey with the explicit consent of the relevant person or if one of the circumstances listed in Article 7 of this Policy exists where explicit consent is not required.

8.2. International Transfer

Transfer abroad shall be directly based on the institution having issued a competence decision under KVKK.m.9; in cases where no competence decision is available, data belonging to the relevant person shall be transferred abroad in accordance with the standards contract subject to the approval of the Board and the provisions within the standards contract.

Transfer abroad is provided based on the adequacy decisions stated in KVKK.m.9 and specified in the Regulations on the Procedure and Principles Regarding the Transfer of Personal Data Abroad. If no adequacy decision is made, the standard contract and binding corporate rules provide the necessary measures for ensuring such transfer. In the scope of the transfer abroad, Pratikargo performs transfer activities according to the provisions outlined in standard contracts signed mutually and duly reported to the Board, related to data controllers/data processors with which it is connected internationally and involved in commercial activities.

Pratikargo may share personal data covered by this Policy with third parties (including cloud service providers) and other collaborating third-party companies from which it receives support or services in accordance with the 8th and 9th articles of the Law as needed to fulfill the purposes of processing personal data. In addition to these transfers, your personal data may be shared with third-party service providers for the purpose of improving and developing the website, addressing software-related errors. Personal data obtained from the website may also be shared with judicial and administrative authorities or agencies that request them as part of legal processes when necessary.

8.3. Parties to Whom Data is Transferred

Pratikargo informs the relevant person about the groups of people to whom personal data is transferred in accordance with Article 10 of KVKK.

Pratikargo may transfer personal data governed by this Policy to the following parties in accordance with Articles 8 and 9 of KVKK:

• Real persons or legal entities of private law,

• Shareholders

• Business partners

• Affiliates and subsidiaries

• Suppliers

• Group companies

• Authorized public institutions and organizations

9. Rights of the Personal Data Owner and the Obligation of the Data Controller to Inform

Pratikargo will inform individuals whose data will be processed about how their data will be processed during collection, in accordance with Article 10 of KVKK. The minimum information that must be included in the notification specified in KVKK is as follows:

• The identity of the company as the data controller and, if any, its representative,

• The purpose of processing personal data,

• To whom and for what purpose the processed personal data may be transferred,

• The method of collecting personal data and the legal grounds for processing,

• The rights of the personal data owner

To the extent that your personal data is processed by Pratikargo as the Data Controller, you may fill out the "Personal Data Information Request Form" below and deliver it by hand to the Pratikargo address where you received the service, or send it via notary, or email it by using a secured electronic signature or by sending a “Word or PDF” file signed with a secure electronic signature to info@pratikargo.com;

• To learn whether any personal data of yours is being processed,

• To request information regarding the processing activities of your personal data,

• To learn the purposes of the processing of your personal data,

• In the case of your personal data being transferred to third parties in Turkey or abroad, to learn about these persons/institutions/entities,

• To request the correction/updates of your personal data in case of inaccurate or incomplete processing,

• To request the deletion or destruction of your personal data when the reasons for processing no longer exist or if Pratikargo has no legal basis for processing your personal data,

• To object to the negative consequences that may arise from the automated processing of your personal data, and

• To request compensation for damages incurred due to unlawful processing of your personal data.

Pratikargo will respond to the relevant request as soon as possible and no later than thirty days free of charge, depending on the nature of the request. If any actions in response to the request involve costs, it is possible to charge fees and costs based on the tariff determined by the Personal Data Protection Board according to Article 13 of the Law No. 6698.

As a result of the assessment, Pratikargo may either accept the applications and take the necessary actions or may reject the applications on justified grounds either by electronic mail or mail. If the personal data owner’s application is rejected, if the response is found to be insufficient, or if no response to the application is given within a reasonable time, he/she may file a complaint with the KVK Board within 30 days.

10.  Deletion, Destruction, and Anonymization of Personal Data

Pratikargo, even if personal data has been processed in accordance with the Law and other relevant legal provisions, will delete, destroy, or anonymize personal data either ex officio or upon the request of the relevant person when the reasons requiring processing cease to exist.

Personal data will be deleted and disposed of in such a way that it cannot be reused or recovered. Accordingly, data will be deleted in a way that it cannot be restored from documents, files, CDs, disks, hard disks, etc., where they are recorded.

Pratikargo reserves the right not to fulfill the request of the data owner in cases where it has the right and/or obligation to preserve personal data under relevant legislation.

Pratikargo can anonymize personal data when the reasons requiring processing of such data cease to exist.

The most commonly used anonymization techniques by Pratikargo are listed below:

• Masking Data: This method involves removing the key identifying information from the dataset to make the personal data anonymous.

• Aggregation Data: This method aggregates many pieces of data, ensuring that the personal data can not be associated with any individual.

• Data Generation: This method creates a more general content from the personal data ensuring that it cannot be associated with any individual.

• Data Mixing: This method ensures that the values within the personal dataset are mixed to sever the connection between values and individuals.
  
  

11.  Measures to Ensure Personal Data Security

As Pratikargo, we take legal, technical, and administrative measures regarding the areas stated below to ensure data security, demonstrating utmost care and diligence in this matter. Actions and measures taken by Pratikargo to ensure data security in accordance with Article 12 of KVKK are outlined below:

• Pratikargo regularly trains its staff; ensuring that they cannot disclose personal data contrary to the provisions of KVKK, cannot use it for purposes other than the processing purpose, and that this obligation will continue after they leave their duties.

• Pratikargo takes technical and administrative measures according to the nature of the data to be protected, technological possibilities, and application costs to prevent any disclosure, access, transfer, or other illegal access to personal data.

• Pratikargo takes necessary measures to ensure that business partners and suppliers comply with the provisions of KVKK regarding personal data processing activities.

• Pratikargo conducts or arranges necessary audits within its own structure in accordance with Article 12 of KVKK. The audit results are reported to the relevant department of Pratikargo within its internal processes, and measures for the improvement of the actions taken are undertaken.

• Pratikargo has a system that promptly reports any instances where personal data processed in accordance with Article 12 of KVKK are obtained unlawfully by others, to the relevant personal data owner and the Personal Data Protection Board.
  
  

12.  Storage Period of Personal Data

Pratikargo will retain personal data for the duration specified in the laws and relevant legislation if foreseen therein.

If there is no specified period in the legislation regarding how long personal data should be retained, personal data will be processed for the duration required depending on the activities carried out by Pratikargo while processing that data and in accordance with its practices and commercial customs, and will then be deleted, destroyed, or anonymized. However, this period shall not exceed a period of ten years in any case.

If the purpose of processing personal data has ceased, and if the storage periods determined by the relevant legislation and Pratikargo have also come to an end; the personal data can only be retained for the purpose of serving as evidence in potential legal disputes or for the assertion or defense of rights relating to personal data.

After this period ends, personal data will be deleted, destroyed, or anonymized. During this period, access to personal data will only be granted to those individuals who work in information technologies and regulate user permissions under the data controller’s authority.

13.  Personal Data Inventory

Pratikargo has a data inventory that complies with KVKK, detailing the categories of data it processes, the purposes of data processing, the duration for which data is processed, to whom the data is transferred, which data is transferred abroad, and the measures taken regarding data protection security.