PAKET TAŞIMACILIK SİSTEMLERİ A.Ş.
THE POLICY ON PROTECTION AND PROCESSING OF PERSONAL DATA

1- INTRODUCTION :
The protection of personal data is included in the Values and Policies considered important in corporate aspects by Paket Taşımacılık Sistemleri A.Ş. (shortly referred to as "PTS").

Hereby the Policy on Protection and Processing of Personal Data (shortly referred to as "the Policy") sets forth the principles to be adopted in the protection and processing of personal data pursuant to the provisions of the Law on Protection of Personal Data no 6698 ("Law on PPD") and other relevant legislations and to be considered by PTS in terms of application.

PTS hereby undertakes to act according to this Policy and consequential procedures to be adopted in terms of the processing and storage of any kind of personal data belonging to all the relevant persons in compliance with the Law on Protection of Personal Data no 6698.

2- OBJECTIVE OF THE POLICY :
The objective of this Policy is to determine the principles regarding the methods and procedures for the protection of personal data in terms of conformity to the Law on PPD.

Accordingly, PTS shall provide the regulations necessary for conformity to the Policy and ensure continuity of conformity to the Policy by executing the internal audit mechanisms in terms of periodical conformity and take all the necessary administrative and technical measures in respect to processing and protection of personal data within its own body.

3- SCOPE OF THE POLICY :
This Policy covers the Personal Data relating to PTS personnel, customers, website visitors, mobile application users collected, processed or shared during the activities of PTS, it is applicable for the relevant activities and it can be amended upon the approval of the board if required as per the PPD Regulations or when deemed necessary by the data controller of PTS.

4- DEFINITIONS :
Personal Data means any kind of information directly or indirectly allowing identification of a Relevant Person by itself or combining with other information in possession or control of PTS.
Personal Data of Special Nature means the data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data.
Personal Health Data means any health information relating to an identified or identifiable natural person.
Data Processing means any operation which is performed upon personal data such as collection, recording, storage, preservation, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization or blocking.
Relevant Person means all the natural persons whose Personal Data is processed by or on behalf of PTS.
Express Consent means the approval granted on a certain subject with free will after being informed.
Destruction means the deletion or destruction of Personal Data.
Anonymized Data means the making of Personal Data non-relatable to an identified or identifiable natural person by no means even if after using all the reasonable and ordinary methods by data controller or another person entitled to make a Relevant Person identifiable.
Data Processor means the natural or legal person who processes personal data based on the authority granted by and on behalf of the data controller. In each concrete case, the identity of Data Processor should be considered separately.
Data Controller means the natural or legal person who determines the purposes and means of the processing of personal data, and who is responsible for establishment and management of the data recording system. Data Controller can be PTS itself or any other third person authorized by or acting on behalf of PTS. In each concrete case, the identity of data controller should be considered separately.
Commission means the Commission for Protection of Personal Data.

5- PRINCIPLES TO BE APPLIED IN THE PROCESSING OF PERSONAL DATA :
Personal data shall be processed by PTS verbally, in written or electronically by using automatic or manual methods, and PTS shall act in compliance with the Constitution and Law on PPD in terms of the processing of personal data.

Also, a number of principles shall be followed in the processing of personal data. Within this scope;

a. Personal data shall by processed by PTS by considering the law and good faith as suitable for its purpose as required by the principle of proportionality.

b. Personal data shall be processed by PTS for certain, explicit, legal and lawful purposes. PTS duly informs the Data Owners about the intended purposes before obtaining their Personal Data.

c. PTS shall store the personal data only for a period specified by laws or suitable for the intended purpose. Accordingly, if any period specified in the relevant legislation for the storage of personal data, such period shall be adapted, however, if there is no period specified, the personal data shall be stored for a period required for the intended purpose of processing. In so far, such period can be extended in order to act according to the liabilities specified in the legislation or secure the legitimate business interests.

PTS shall be responsible for the Destruction of all data in compliance with the legislation in case of the termination of legal storage periods and disappearance of the purpose of collecting these data regarding the Personal Data stored in material and electronic data recording system.
All transactions relating the deletion, destruction and anonymization of Personal Data shall be recorded, and the relevant records shall be stored for at least three (3) years except for other legal liabilities.
d. PTS takes all the measures necessary for the accuracy and currency of Personal Data processed.

6- PROCESSING OF PERSONAL DATA :
Personal data shall be processed after informing the data owner and upon express consent of data owner. As required by the Obligation of Clarification, the data owner shall be informed about their rights before obtaining express consent, and such consent shall be obtained in compliance with the PPD Regulations.

In cases when the processing of personal data is required without express consent pursuant to the PPD Regulations (PPD Law Article 5.2 and Article 6.3), PTS shall be entitled to process personal data without obtaining express consent of the data owner. Within this scope:

a. In case it is clearly specified in the laws,
b. In case the processing of personal data is mandatory for PTS's fulfillment of its legal liability,
c. In case the processing of personal data relating to the contract parties is required on condition that it is directly related to the drawing-up, execution or termination of a contract,
d. In case the processing of personal data without express consent is mandatory for the establishment, use or protection of a right,
e. In case the data processing is mandatory for PTS's legitimate interests provided that the fundamental rights and freedoms of the data owner are not harmed,
f. In case of protection of life or physical integrity of a data owner who is unable to give its consent due to physical impossibility or with no legally valid consent and/or another person other than the data owner,
g. If the personal data has been open to public by the data owner,

Personal data can be processed by PTS without express consent.

7- PROCESSING OF PERSONAL DATA OF SPECIAL NATURE :
PTS processes the personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data upon express consent of data owner.
Personal Data of Special Nature other than health and sexual life can be processed without express consent of the relevant person in some conditions specified in the laws.
Personal data of special nature relating to health and sexual life can be processed without express consent of the relevant person by the persons or authorized institutions and organizations with confidentiality obligation only for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of finance of health services. For example, processing of reports and documents relating to person employed in scope of mandatory employment of disabled persons.
PTS carries out the necessary transactions to take the measures determined by the Commission in the processing of personal data of special nature.

8- TRANSFER OF PERSONAL DATA :
Personal Data can be transferred to third parties in Turkey only if the Relevant Person's express consent for data transfer is obtained or in conditions not necessitating Express Consent specified in the Processing of Personal Data section.
For the transfer of Personal Data to third parties Abroad, in addition to the considerations specified above, the following shall be available;
• The foreign country to whom the Personal Data is transferred shall have the sufficient level of protection or;
• In case of insufficiency of protection in the relevant country, PTS shall undertake to provide the sufficient protection in written and obtain permission from the Commission.

9- DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA :
PTS deletes, destructs or anonymizes personal data on its own motion or upon request of the relevant person in case of disappearance of the purposes necessitating data processing even though they are processed in compliance with the Law and other relevant law provisions.

Personal data is deleted and destructed so that they cannot be reused and recovered. Accordingly, the data is deleted so that they cannot be recovered from files, documents, CD's, disks, hard disks etc.

10- OBLIGATION OF CLARIFICATION OF PERSONAL DATA OWNER :
PTS shall inform the person whose data will be processed about the way of processing during the collection of such personal data in compliance with the article 10 of the PPD Law. The minimum considerations required by the PPD Law that will be included in the clarification are as follow:
1. The identity of the Company or agent, if any, acting as data collector,
2. The purposes of personal data processing,
3.To whom and for what the processed personal data can be transferred,
4. The method of personal data collection and legal grounds,
5. The rights of personal data owner
6. Being informed about that any of your Personal Data is processed or not,
7. Information request relating to the processing activities for your Personal Data,
8. Being informed about the purposes of processing your Personal Data,
9. In case of transferring of your Personal Data to third parties in Turkey or abroad, being informed about such parties,
10. In case of incomplete or incorrect processing of your Personal Data, requesting correction/updating,
11. In case of disappearance of the purposes necessitating processing of your Personal Data or absence of legal grounds or legitimate interest necessary for PTS to process the relevant data, requesting deletion or destruction of your Personal Data,
12. Objecting to the negative results that may ensue as a result of processing of your Personal Data via automatic systems, and
13. In case of any loss incurred due to illegal processing of your Personal Data, seeking compensation for such a loss

In the cases where Data Owners seek to exercise their rights, they may send their requests with secure e-signature attached to the e-mail address specified below, which may be subject to occasional change, or deliver said requests by hand or via the notary office to the mail address specified below, which may also be subject to occasional change, along with identification documents and an original signed petition.

Data Controller : Paket Taşımacılık Sistemleri A.Ş.
E-mail : [email protected]
Mail Address : Yenibosna Merkez Mahallesi Cemal Ulusoy Caddesi No:57/2 34197 Merkez Bahçelievler İstanbul

PTS will conclude the request as soon as possible, in (30) thirty day at the latest and free of charge depending on the nature of the request. In the case that the procedures in question require any cost, the Personal Data Protection Board to charge fees and expenses based on the pricing list established in the Article 13 of the Law on Protection of Personal Data No. 6698.

After evaluation process, PTS may either accept the request and take actions accordingly, or reject it via mail or e-mail, along with the reason for rejection. In cases where the request has been rejected, the Personal Data Owner finds the reason for rejection unsatisfactory, or PTS fails to reply to the request in due time, the Personal Data Protection Board may be filed a complaint within 30 days.

11- AMENDMENTS ON THE POLICY AND EFFECTIVE DATE :
The provisions included in this Policy may be amended if deemed necessary by PTS provided that being announced in the websites in compliance with the legislation provisions. In case of amendment on any of these provisions, the relevant amendments shall enter into force on the date of announcement of such amendment.
This Policy entered into force after being published in January, 2020.