Personal Data Protection Notice

This translation is provided for information. View the Turkish original.

KVKK Information

PERSONAL DATA POLICY ACCORDING TO MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI PERSONAL DATA PROTECTION LEGISLATION

1. INTRODUCTION

1.1. Purpose of Policy

This Personal Data Policy (“Policy”) aims to ensure compliance with the Personal Data Protection Law (“KVKK” or “Law”) by MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI (“MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI” or “Company”) and to determine the principles to be followed in fulfilling the obligations regarding the processing, protection, storage and destruction of personal data.

Our company; Personal data belonging to employees, prospective employees, suppliers, business partners, vendors, visitors, customers, employees of institutions or organizations and other third parties are transferred to the Republic of Turkey. It prioritizes the processing in accordance with the Constitution, international agreements, KVKK and other legislation and the effective use of the rights of the relevant persons. Protection, processing, storage and destruction of personal data carried out by MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI; website privacy and cookie permissions; Work and transactions regarding the provision and use of anti-virus, e-mail, computer, USB, archive room, internet are carried out by the real/legal person in accordance with this Policy before you.

1.2. Scope

This Policy; It covers all kinds of information and documents that can be associated with an identified or identifiable natural person, and the measures taken and regulations made regarding them. This Policy applies to activities related to the processing of all personal data within the scope of the Law by the specified persons and the Company, where personal data owned by MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI or managed by MAPEX LOJISTIK ITHALAT VE IHRACAT LIMITED SIRKETI is processed by automatic or non-automatic means provided that it is part of any data recording system.

1.3. Abbreviations and Definitions

The definitions and abbreviations to be used in the relevant law are included in Article 3 titled "Scope" of the Personal Data Protection Law No. 6698. Among the concepts included in the Policy you are reviewing;

Recipient Group: The category of natural or legal person to whom personal data is transferred by the data controller,
Explicit Consent: Consent regarding a specific subject, based on being informed and expressed with free will,
Anonymization: Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data,
Employee: Persons working within the company and having a business relationship with the company,
Employee Candidate: Real persons who have applied for a job to the Company by any means or who have made their CV and related information available for review by the Company,
EBYS: Electronic Document Management System,
Electronic Environment: Environments where personal data can be created, read, changed and written with electronic devices,
Non-Electronic Environment: Environments where personal data can be created, read, changed and written with electronic devices,
Service Provider: A natural or legal person who provides services within the framework of a specific contract with a real/legal person,
Relevant Person: The real person whose personal data is processed,
Relevant User: Persons who process personal data within the data controller organization or in line with the authorization and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of data,
Destruction: Deletion, destruction or anonymization of personal data,
Recording Medium: Any environment containing personal data processed by fully or partially automatic or non-automatic means, provided that it is part of any data recording system,
Personal data: Any information regarding an identified or identifiable natural person,
Personal Data Processing Inventory: Personal data processing activities carried out by data controllers depending on their business processes; The inventory they create by associating the personal data with the purposes and legal reason for processing personal data, the data category, the transferred recipient group and the data subject person group, and detailing the maximum retention period required for the purposes for which personal data are processed, the personal data envisaged to be transferred to foreign countries and the measures taken regarding data security,
Processing of Personal Data: All kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system,
Board: Personal Data Protection Board,
Customer: Real persons who use or have used the products or services offered by the Company, regardless of whether they have any contractual relationship with the Company.
Personal Data of Special Nature: Data regarding people's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, and biometric and genetic data,
Periodic Destruction: The process of deleting, destroying or anonymizing personal data specified in the personal data storage and destruction policy and to be carried out ex officio at recurring intervals in case all the conditions for processing personal data specified in the law are eliminated.
Potential Customer: A person who has requested or is interested in using the Company's products and services, or who has been evaluated in accordance with a commercial practice and rules of honesty that may have this interest,
Company Business Partners: Real and legal persons with whom the Company has all kinds of business relations,
Company Stakeholder: Real persons who are company stakeholders,
Company Official: Persons who have authority and knowledge regarding company transactions,
Third party: Other natural persons who do not fall into any personal data owner category in this Policy,
Data Processor: Real or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller,
Data Recording System: The recording system in which personal data is structured and processed according to certain criteria,
Data Controller: The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system,
Data Controllers Registry Information System (VERBİS): The information system created and managed by the Prime Ministry that can be accessed over the internet, to be used by data controllers in applying to the Registry and other related transactions related to the Registry,
Regulation: Regulation on Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017,
Visitor: It is used to refer to all real persons who enter the physical premises of the Company or persons authorized by the Company for various purposes or visit the websites for any purpose.
GENERAL PRINCIPLES

With this policy, regulations are made in accordance with the general principles set out within the framework of Article 4 of the KVKK. In line with these principles, your personal data will be processed by our Company:

Compliance with the law and the rules of honesty: Processing is carried out in accordance with the legislation, case law and universal principles of law in terms of procedure and substance, and data processing activities are carried out in accordance with morality.
Being accurate and up-to-date when necessary: The accuracy of the personal information obtained is confirmed and this information is updated if necessary.
Processing for specific, clear and legitimate purposes: It will be processed clearly and lawfully for use in matters related to the transportation activity and main service activity.
Being related to the purpose for which they are processed, being limited and proportionate: They are used in matters related to the transportation activity and main service activity, provided that they are limited to these transactions and are used in moderation.
Storage for the period stipulated in the relevant legislation or required for the purpose for which they are processed: Ex officio and upon the request of the personal data owner, in accordance with the periods regulated in the Law and determined in this Policy of our Company, they will be stored for a limited period of time necessary for the purpose for which they are processed.

PERSONAL DATA CATEGORIES

Depending on the relationship between the Company and the personal data owner, Personal Data shared with the Company or obtained by the Company from third parties consists of the data listed below:

Table-1: Personal data types

Personal Data Type	Personal Data
Identity Data	Name and surname information of users, T.R. identification number, date of birth, gender
Contact Data	Users' personal or corporate address information, telephone numbers and e-mail addresses
Financial Data	Users' credit card information, bank information, debit card or credit card number, expiration date and CVV code
Customer Transaction Data	Call center records; invoice, bill of exchange, check information, order information, request information
Physical Space Security Data	Camera recordings of company headquarters, branches and warehouses
Transaction Security Data	Users' IP address information, website login and logout information, cookie information
Marketing Data	Users' service history information, survey information, information obtained through campaign work, cookie information
Audiovisual Records	Camera recordings in case of visits to our stores, voice recordings in case of calls to our call center and contact numbers; Audio and camera recordings in support applications

METHOD AND LEGAL REASON FOR COLLECTION OF PERSONAL DATA

Your Personal Data is processed by the Company through channels such as https://www.gknkargo.com/ website address, e-mail, call center, camera, mobile application or through employees in stores, agencies and warehouses, in accordance with the basic principles stipulated by the KVKK, in order to achieve the purposes specified in this Policy within the scope of the "Personal Data Processing Conditions" specified in Articles 5 and 6 of the KVKK and/or to fulfill the responsibilities arising from the law completely and accurately within the framework of legislation, contract, demand and legal reasons based on demand. It is collected so that it can be fulfilled in some way. Your personal data collected for this legal reason may be processed and transferred by our Company and/or data processors assigned by our Company for the purposes specified in Article 5 of this Policy, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698. Our company;

It records personal data about suppliers and sellers who provide goods and services in order to check whether these individuals fulfill their responsibilities and to ensure the orderliness of their activities. The data of the employees and authorized real persons of the business partners with which our company cooperates are recorded in line with the purposes of establishing the business partnership. Personal data belonging to this group of people are obtained from signed contracts, sent invoices, device delivery minutes, e-mails sent and received as a result of communication established with them, communication established by telephone and other means, and business card and website information.

The company requests and processes the personal data of employees and employee candidates in order to complete the mandatory documents in the personnel file of the individuals in accordance with the practices of the current Labor Law and Occupational Health and Safety Law in order to be registered with the Social Security Institution. These personal data are obtained through the CVs and job application forms they submit with their explicit consent during the recruitment and job application stages, the CV display methods offered by human resources software programs that provide candidate pool services (Kariyer.net, LinkedIn, etc.), and the answers they give to the questions asked during the interview and answered with their consent. Our company requests and processes personal data obtained from real persons applying for a job in order to communicate with the person for interview purposes during the recruitment process and to determine whether the person's qualifications and experiences are compatible with the open position to be recruited during the interview. The aforementioned personal data is obtained by applicants sending their CVs to the human resources department with their explicit consent, by answering questions asked with their own consent during the interview, or by CV viewing methods offered by human resources software programs that provide advertisement publishing and candidate pool services.

PURPOSES OF PROCESSING AND TRANSFER OF PERSONAL DATA, PERSONS TO WHICH THEY WILL BE TRANSFERRED

Your personal data, in accordance with the general principles set out in Article 4 of KVKK; In accordance with the law and the rules of honesty, accurately and, when necessary, up to date; They are processed for specific, clear and legitimate purposes, in connection with the purpose for which they are processed, in a limited and proportionate manner and kept for a period of time stipulated in the relevant legislation or required for the purpose for which they are processed. In accordance with Article 5 of the KVKK, it is stipulated that Personal Data cannot be processed without the express consent of the Personal Data Owner. However, according to the provision of the same article, it is possible to process personal data without the explicit consent of the Data Owner if one of the following conditions exists, these conditions are:

It is clearly stipulated in the law,
It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,

ç) It is mandatory for the Data Controller to fulfill its legal obligations,

It has been made public by the person concerned,
Data processing is mandatory for the establishment, exercise or protection of a right,
It is necessary to process data for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Our company may use your personal data subject to this Information Text based on any of the above-mentioned conditions and for the purposes listed below. The purposes in question are;

Fulfilling the obligations arising from the legislation, sharing information arising from the legislation with authorized institutions; Performance and proof of cargo service and its complementary services, enabling relevant persons to benefit from these services; creating customer records, receiving payments from customers, making compensation payments or refunds and keeping a record of these payments, receiving and delivering orders; Increasing customer satisfaction and carrying out studies for this purpose, preparing advantageous campaigns for customers and ensuring that customers benefit from them, informing customers especially in the field of cargo operations and additional services that complement this service; Planning and execution of sales and marketing processes in our company's cargo services; tracking shipments, making shipment inquiries, communicating with customers when necessary; Performing and executing collateral and collection transactions, determining payment risks, ensuring account reconciliations; Establishment of possible rights and receivables of the relevant parties; creation and tracking of visitor records; conducting analysis and reporting studies; Regulating the personal data of the sender, recipient, cargo deliverer and receiver during the cargo process in accordance with the Road Transport Law No. 4925, the Road Transport Regulation, the Postal Services Law No. 6475 and the Procedures and Principles for Security Measures for Postal Shipments, approved by the Information Technologies and Communication Board's decision dated 27/12/2016 and numbered 2016/DK-YED/517,

Tax Procedure Law No. 213, Turkish Commercial Code No. 6762, Road Transport Law No. 4925, Road Transport Regulation, Postal Services Law No. 6475 and Procedures and Principles for Security Measures for Postal Shipments approved by the Information Technologies and Communication Board's decision dated 27/12/2016 and numbered 2016/DK-YED/517 and other relevant legal regulations. 5/2-a "Clearly foreseen in the laws" and 5/2-ç "Data" of Law No. 6698 in order to record the information that is legally required to be received within the scope of the regulations, to create invoices that need to be issued and to forward them to you, to keep tax records, to prepare documents proving service delivery, to make regular notifications within the scope of legal obligations to the relevant institutions, to respond to requests from official institutions and to keep other legal records, to fulfill storage obligations, to operate the complaint resolution mechanism, to make suspicious transaction notifications. Law No. 6698 aims to carry out the necessary legal procedures and legal processes by the company in case of loss or damage to the shipments in accordance with the legal reasons stated in the articles "It is mandatory for the responsible party to fulfill its legal obligations", to detect this damage, to carry out compensation procedures, to apply to insurance companies, to prepare and keep documents/records as a means of proof in possible disputes, to carry out the necessary legal procedures and legal processes by the company in cases where payments for services are not made or situations in which legal rights need to be exercised due to compensation claims and other disputes arising from the transportation contract. In accordance with the legal reason "Data processing is mandatory for the establishment, exercise or protection of a right" in Article 5/2-e, camera recording is taken in our mail reception centers in accordance with Article 6 of the Procedures and Principles for Security Measures Regarding Postal Shipments. In accordance with the legal reason that the personal data processed in this regard is "It is mandatory for the data controller to fulfill its legal obligations" in Article 5/2-ç of Law No. 6698, camera recordings are taken for the purpose of security, evaluation of customer complaints and requests, and as evidence in disputes. Your "camera recorded" personal data obtained in this context may be processed in accordance with the legal reason "Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person" in Article 5/2-f of Law No. 6698.

If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the Law, your express consent is obtained by the Company regarding the relevant processing process.

Data transfer of your personal data to be made by our company, based on the reasons and purposes stated above, in accordance with the legislation and the Law; It can be made to company stakeholders, suppliers, business partners, vendors, company officials and employees, legally authorized private legal persons and public institutions and organizations.

Table-2: Reasons for transfer of personal data and persons who can transfer data

Persons to whom data can be transferred	Reason for Transfer of Personal Data
Company Stakeholders	In accordance with the provisions of the relevant legislation, data transfer may be made limited to the purposes of the activities carried out by the Company within the scope of corporate law, event management and corporate communication processes.
Supplier, Business Partner, Seller	Transfers can be made limited to the receipt of the services provided.
Company Officials	It can be transferred to a limited extent for the purposes of designing strategies regarding company activities, ensuring top-level management and auditing purposes.
Company Employees	In order to provide services within the company, limited data transfer is provided, which is required due to its duties.
Legally Authorized Public Institutions and Organizations	Limited data transfer can be provided within the scope of information requested by relevant public institutions and organizations within the framework of the law.
Legally Authorized Private Legal Persons	In accordance with the legislative provisions, data transfer can be provided within the limits of legal authority.

TERMS OF PROCESSING OF PERSONAL DATA
1. CONDITIONS FOR PROCESSING GENERAL PERSONAL DATA

With Article 3 of the Law, the concept of processing personal data is regulated as "All kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system." The conditions for processing personal data are listed in a limited number in the Law, and these conditions cannot be expanded.

As a rule, your personal data collected by our company is not processed without the explicit consent of the data owner, but pursuant to KVKK 5/2. In accordance with the article, if one of the following conditions is met, it is possible to process the personal data of the relevant person without seeking his/her explicit consent. These states;

There must be explicit consent of the personal data owner,
It is clearly stipulated in the law,
It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
It is mandatory for the data controller to fulfill its legal obligation,
Personal data has been made public by the relevant person himself,
Processing personal data is mandatory for the establishment, exercise or protection of a right,
It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.
1. CONDITIONS FOR PROCESSING SPECIAL PERSONAL DATA

In accordance with Article 6 of the Law titled "Conditions for Processing of Special Personal Data", special data cannot be processed without the explicit consent of the person. Pursuant to this article, "data regarding people's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special personal data." It has been said. Such special categories of personal data will not be processed, if necessary and without the explicit consent of the data owner, in accordance with our Policy and clear legal provisions.

CONDITIONS FOR TRANSFER OF PERSONAL DATA
1. CONDITIONS FOR TRANSFER OF GENERAL PERSONAL DATA

Transfer of personal data; It means sharing personal data with third parties by the data controller. Our company may transfer data to another data controller or data processor, provided that it remains within the legal limits specified in the Law. In this context, our Company may transfer personal data to third parties in line with legitimate and lawful personal data processing purposes, based on one or more of the personal data processing conditions specified in Article 5 of the Law and listed below, if certain conditions are met. These situations; There is a clear consent of the personal data owner, there is a clear regulation in the law regarding the transfer of personal data, it is necessary to protect the life or physical integrity of the personal data owner or someone else, the personal data owner is not able to express his/her consent due to actual impossibility or his/her consent is not given legal validity, it is necessary to transfer the personal data of the parties to the contract provided that it is directly related to the establishment or execution of a contract, personal data transfer is mandatory to fulfill the legal obligation of our Company, personal data has been made public by the personal data owner, Data transfer is mandatory for the establishment, exercise or protection of a right, and personal data transfer is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

Within the scope of the law, data transfer is regulated in two different provisions: Article 8 regarding domestic transfer and Article 9 regarding international transfer. This Policy has been prepared in accordance with the mandatory provisions of the Law.

1. 1. Domestic Transfer Conditions (KVKK article 8)
Existence of explicit consent; Our Company will be able to transfer data if the explicit consent of the Data Controller is obtained.
Law No. 6698 art. Situations specified in Articles 5 and 6; In case of one of the situations where data can be processed without the explicit consent of the relevant person, our Company will be able to transfer the shared data.
1. 1. Conditions for Transfer Abroad (KVKK article 9)
Existence of explicit consent; Our company will be able to transfer data with the explicit consent of the Data Controller.
Law No. 6698 art. Situations specified in Articles 5 and 6; In case of one of the situations where data can be processed without the explicit consent of the relevant person, our Company will be able to transfer the shared data.
If the country to be transferred is included in the list of countries with adequate protection for personal data to be announced by the Board, or although the country to be transferred is not on this list, a commitment is made between the parties to provide adequate protection and permission is obtained from the Board; Our company will be able to transfer shared data.
1. CONDITIONS FOR TRANSFER OF SPECIAL PERSONAL DATA

Our company takes the precautions prescribed by the KVK Board by showing the necessary care and taking security measures, and in line with the legitimate and lawful personal data processing purposes, the special personal data of the personal data owner; It can be transferred to third parties without the express consent of the personal data owner, if the personal data owner has the express consent or if the following conditions are met. Regarding this issue, a distinction has been made between special quality personal data regarding the health and sexual life of the personal data owner and other special quality personal data. In this direction;

In cases stipulated by law: Personal data owner's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing; data regarding association, foundation or union membership, criminal convictions and security measures, and biometric and genetic data,
Limited to the purposes of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing, only by persons or authorized institutions and organizations under the obligation of confidentiality: Special personal data regarding the health and sexual life of the personal data owner may be transferred abroad.
DISTRIBUTION OF RESPONSIBILITIES AND DUTIES REGARDING THE PROTECTION OF PERSONAL DATA

By the employees and departments in our company; In cases where the necessary conditions are met, the responsible units are actively supported to properly implement the technical and administrative measures taken within the scope of the Policy by the Disciplinary Board and the KVKK Board, to increase the training and awareness of the unit employees, to monitor and supervise them, to prevent the unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the legal storage of personal data.

The distribution of the titles, units and job descriptions of those involved in the storage and destruction processes of personal data are given in Table-3.

Table-3: Storage and destruction processes of personal data and task distribution

TITLE	UNIT	DUTY
Chairman of the Board	Company/Company name	Employees are responsible for acting in accordance with the Policy.
Person or Unit Employees Who Prepared the Policy Document	Unit	It is responsible for the preparation, development, execution, publication and updating of the Policy in relevant media.
IT Unit (Employees)	Unit	It is responsible for providing the technical solutions needed in the implementation of the Policy.
Employees in Other Units	Units	He is responsible for the execution of the Policy in accordance with his duties.

RECORDING MEDIA

Personal data is stored lawfully and securely by the real person and/or legal entity in the environments listed below. These environments used by our company:

1. Electronic environments: Servers (Domain, Backup, E-Mail, Database, Web, File Sharing, etc.), Software (Office Software, Portals, EBYS, VERBIS), Information Security Devices (Firewall, Intrusion Detection and Prevention, Log File, Anti-Virus, etc.), Personal Computers (Desktop, Laptop), Mobile Devices (Phone, Tablet, etc.), Optical Discs (CD, DVD, etc.), Removable Memory (USB, Memory Card, etc.), Printers, Scanners, Photocopiers
2. Non-Electronic Media: Paper, Manual Data Recording Systems (Survey Forms, Visitor Login Book); Written, Printed, Visual Media

constitutes.

STORAGE AND DESTRUCTION OF PERSONAL DATA

Our company collects personal data; If a period is determined in the legislation for the purpose of processing, in accordance with this period; If a legal period is not stipulated, personal data will be kept for the period necessary for the purpose of processing. Personal data will be destroyed at the end of the specified storage periods, by one of the specified methods, in accordance with the periodic destruction periods or the data owner's application. Even though the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and the Company have come to an end; Your personal data may be stored only for the purpose of serving as evidence in possible legal disputes, asserting the relevant right based on personal data, or establishing a defense.

1. PURPOSE OF STORING PERSONAL DATA

Our company will store the personal data it processes within the scope of its activities for the following purposes:

Carrying out human resources processes,
Providing corporate communication,
Ensuring real/legal person security,
Conducting statistical studies,
Performing work and transactions as a result of signed contracts and protocols,
Within the scope of VERBIS, identifying the preferences and needs of employees, data controllers, contact persons, data controller representatives and data processors, arranging the services provided accordingly and updating them if necessary,
Ensuring that legal obligations are fulfilled as required or required by legal regulations,
Providing contact between parties in mutual business relations,
Making legal reporting,
Managing call center processes,
Existence of the burden of proof as evidence in legal disputes that may arise in the future

creates. In other cases where these situations are not included, personal data is subject to the provisions of Article 7.2 of the Policy. et al. It will be regulated in the "Destruction of Personal Data" section in the articles.

1. DESTRUCTION OF PERSONAL DATA

Even though your personal data has been processed in accordance with the legal legislation in accordance with Article 7 of the Law, if the reasons requiring processing are eliminated or the period stipulated in the legislation expires, our Company will delete, destroy or anonymize it ex officio or upon the request of the data owner. In accordance with the provision of Article 7 of the Law, the destruction of personal data is possible in 3 ways: Deletion, destruction and anonymization of personal data. Our company will destroy personal data in the following cases:

Amendment or abolition of the relevant legislative provisions that constitute the basis for processing,
The purpose that requires processing or storage is eliminated,
Withdrawal of explicit consent by the relevant person in cases where processing of personal data occurs only on the basis of explicit consent,
In accordance with Article 11 of the Law, the application made by the relevant person for the deletion and destruction of personal data within the framework of his rights is accepted by the data controller,
In cases where the application made to our Company by the relevant person requesting the deletion, destruction or anonymization of personal data is rejected, the answer given is found to be insufficient or the answer is not given within the time period stipulated in the Law; Making a complaint to the Board and this request being approved by the Board,
The maximum period requiring personal data to be stored has passed and there are no conditions that justify storing personal data for a longer period of time.

personal data in such cases; It is deleted, destroyed or anonymized upon the request of the relevant person or ex officio.

1. WAYS OF DESTRUCTION OF PERSONAL DATA

If the reasons requiring the processing of personal data specified in Articles 5 and 6 of the KVKK disappear, the personal data is destroyed by the company ex officio or upon the request of the relevant person (data owner), if the request is found positive as a result of the evaluation. In addition, if all the conditions for processing personal data have been eliminated and the personal data subject to the request has been transferred to third parties, this situation will be notified to the third party by the company; Necessary actions are requested to be taken before the third party.

Deletion of Personal Data: Deletion of personal data is the process of deleting personal data from systems to make them inaccessible and unusable for the relevant users in any way. Accordingly, personal data; They are irreversibly deleted from devices such as documents, files, CDs, hard disks and external memory in which they are recorded. Personal data on paper in the physical environment will be deleted using blackout management. According to the regulation, the blackout process is carried out by cutting off the personal data on the relevant document when possible, and in cases where it is not possible, by making it invisible to the relevant users by using fixed ink in a way that is irreversible and unreadable with technological solutions. In order to delete a file on the computer, the file must be deleted with the delete command in the operating system or the access rights of the relevant user on the file or the directory where the file is located must be removed. Data in flash-based storage media should be stored encrypted and deleted using software suitable for these media. The relevant lines containing personal data will be deleted with database commands. While performing the mentioned operations, attention will be paid to whether the relevant user is also the database administrator.

Table-4: Ways of deleting and destroying personal data

DATA RECORDING MEDIUM	EXPLANATION
Personal Data on Servers	For personal data on the servers whose storage period has expired, the system administrator removes the access authorization of the relevant users and deletes them.
Personal Data Contained in Electronic Media	Among the personal data in the electronic environment, those whose period of storage has expired are made inaccessible and unusable in any way for other employees (relevant users), except the database administrator.
Personal Data Held in Physical Environment	For personal data kept in physical media, for which the period requiring its storage has expired, it is made inaccessible and unusable in any way for other employees, except for the unit manager responsible for the document archive. In addition, blackening is also applied by drawing/painting/erasing the surface so that it cannot be read.
Personal Data Contained in Portable Media	Among the personal data kept in Flash-based storage media, those whose period of storage has expired are encrypted by the system administrator and the access effect is given only to the system administrator and stored in a secure environment with encryption keys.

Destruction of Personal Data: Destruction of personal data; It refers to the destruction of materials suitable for storing data, such as documents, files, CDs, hard disks, external memory, in which the data is recorded so that the information cannot be retrieved or used again. In our company, the methods specified in the Regulation include de-magnetization, physical destruction, overwriting, paper shredding machines and destruction of all copies of cloud environment encryption keys.

Table-5: Ways of destruction of personal data

DATA RECORDING MEDIUM	EXPLANATION
Personal Data in Physical Environment	Personal data stored on paper that have expired are irreversibly destroyed in paper shredders.
Personal Data Contained in Optical/Magnetic Media	Personal data contained in optical media and magnetic media whose storage period has expired are physically destroyed, such as melting, burning or pulverizing. Additionally, the magnetic media is passed through a special device and exposed to a high magnetic field, making the data on it unreadable.

Anonymization of Data: Personal data will be anonymized by our Company so that it cannot be associated with an identified or identifiable natural person, even if it is matched with other data. Starring, aggregation and masking methods will be applied to anonymise the data. In this context, even if personal data exists in the data controller, it will be removed from the scope of personal data by making it impossible to establish a relationship between the data and the data owner.
1. STORAGE AND DESTRUCTION PERIOD OF PERSONAL DATA

If the reasons requiring the processing of personal data disappear, personal data will be destroyed, and periodic checks and destruction for this situation are carried out by our Company every 6 months. Your personal data processed by our company; Personal Data Protection Law No. 6698, Turkish Code of Obligations No. 6098, Public Procurement Law No. 4734, Civil Servants Law No. 657, Social Security and General Health Insurance Law No. 5510, Law No. 5651 on the Regulation of Publications Made on the Internet and Combating Crimes Committed Through These Publications, Public Financial Management Law No. 5018, Occupational Health and Safety Law No. 6331, Right to Information Law No. 4982, Law No. 3071 on the Exercise of the Right to Petition, Labor Law No. 4857, Higher Education Law No. 2547, Pensioner Health Law No. 5434, Social Services Law No. 2828, Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Attachments, Regulation on Archive Services and these It is stored for the periods stipulated within the framework of other secondary regulations in force in accordance with the law; Personal data whose storage period has expired is destroyed every 6 months. Accordingly, periodic destruction will be carried out every year in June and December within MAPEX LOGISTIK ITHALAT VE IHRACAT LIMITED SIRKETI.

The destruction procedure for personal data processed by our company within the scope of its activities will be carried out during the first periodic destruction period following the retention period, and the retention periods are as follows:

Period	Storage Period	Legal Basis
Call Center Voice Recordings	3 Years	Law No. 6563 and Other Legislation
All Records Regarding Accounting and Financial Transactions	10 Years	Law No. 6098
Cookies and Logs	6 Months - Maximum 2 Years	Law No. 6102, 213
Commercial Electronic Mail Approval Records	1 Year from the Date of Withdrawal of Approval	Internet Law No. 5651
Traffic Information About Online Visitors	2 Years	Law No. 5651
Personal Data Regarding Customers	3 Years Within the Framework of Law No. 6563 and Related Legislation, 10 Years After the Legal Relationship Ends	Law No. 6563, 6102, 6098, 213, 6502
Personal Data Regarding Suppliers, Sellers and Business Partners	10 Years Following the End of the Activity	Law No. 6102, 6098, 213
Personal Data Protection Board Procedures	10 Years	Personal Data Protection Agency Personal Data Storage and Destruction Policy Published by KVKK
Contracts	10 Years Following the Termination of the Contract
Institutional Communication Activities	10 Years Following the End of the Activity
Human Resources Processes	10 Years Following the End of the Activity
Hardware and Software Access Processes	2 Years
Visitors and Meeting Users	2 Years from the End of the Event
Camera Recordings	2 Years
Within the Scope of Labor Law: Data	5 Years from Termination of Business Relationship	Labor Law No. 4857 and Related Legislation
Within the Scope of Labor Law: Personal Information	10 Years from Termination of Business Relationship	Labor Law No. 4857 and Other Legislation, Law of Obligations No. 6098
Within the Scope of Labor Law: Union Information	10 Years from Termination of Business Relationship	Law of Obligations No. 6098
Data Collected Within the Scope of Occupational Health and Safety Legislation	15 Years from Termination of Business Relationship	Occupational Health and Safety Law No. 6331, Occupational Health and Safety Services Regulation
Data Held Within the Scope of SSI Legislation	10 Years from Termination of Business Relationship	Social Insurance and General Health Insurance Law No. 5510 and Other Legislation
In accordance with the Labor Law: Answering Court / Enforcement Information Requests Regarding the Employee	10 Years from Termination of Business Relationship	Labor Law No. 4857 and Related Legislation
Information about Company Partners and Board Members	10 Years	Turkish Commercial Code No. 6102
Share Book Information of Company Partners and Board Members	Indefinitely Due to the Obligation to Keep the Share Ledger	Turkish Commercial Code No. 6102
Employee Advance Payment	10 Years	Turkish Commercial Code No. 6102