INFORMATION AND CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA (KVKK) UNDER LAW NO. 6698

Data Controller: Avrasya Taahhüt Lojistik A.Ş.
Address: Yedi Eylül Mah. Celal Umur Cad. No:12 Torbalı/İzmir
Tax No: 1050614686
Mersis No: 0105061468600021

Under Law No. 6698, the data controller is Avrasya Taahhüt Lojistik A.Ş.
Hereinafter, “Avrasya Taahhüt Lojistik A.Ş.” shall be referred to as the “Company.”

As the Company, we show utmost care in processing and protecting your personal data. Within the framework of the Personal Data Protection Law and relevant regulations, we take all necessary technical and administrative measures to prevent unlawful processing and unauthorized access to personal data, and to ensure the secure storage of such data.

This clarification text has been prepared by the Company, in its capacity as data controller, in accordance with the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform under the Personal Data Protection Law (“Law”).

Detailed information on the purposes for which your personal data is processed by our Company can be found in the Avrasya Personal Data Processing and Protection Policy.

With full awareness of our responsibilities, we process your personal data in the manner described below and within the limits prescribed by the legislation. The personal data you share with our Company as a business partner, supplier, consumer, subscriber, or customer may be processed in accordance with the Law, proportionate to our operational purposes, transferred to third parties within Türkiye, stored, used for profiling, and classified.

Collection, Processing, and Purposes of Processing Personal Data

Your personal data, collected in accordance with the Personal Data Protection Law and relevant legislation, may be obtained wholly or partially through automatic or non-automatic means, recorded, stored, modified, reorganized, and processed, provided it forms part of a data recording system.

Your personal data is processed by the Company in accordance with Articles 4, 5, and 6 of the Law and within the scope of the following purposes:

Your personal data may be processed for the following purposes:

• Management of after-sales service processes

• Collection and evaluation of improvement suggestions regarding business processes

• Execution of customer relationship management processes

• Execution of customer satisfaction activities

• Execution of product/service marketing processes

• Execution of advertising/campaign/promotion processes

• Planning and execution of the Company’s commercial and/or business strategies

• Execution of finance and accounting processes

• Execution and follow-up of legal affairs

• Execution of logistics activities

• Execution of purchasing processes

• Execution of after-sales support services

• Execution of sales processes

• Execution of production and operational processes

• Execution of customer relations processes

• Execution of contract processes

• Execution of strategic planning activities

• Execution of marketing analysis activities

• Execution of customer satisfaction activities

• Execution of customer relationship management processes

• Execution of wage policy processes

Your personal data will be processed for the purposes stated above and within the personal data processing conditions and purposes outlined in Articles 5 and 6 of the Law to ensure the legal, technical, commercial, and operational security of our Company and the individuals with whom we have business relations.

In cases where explicit consent is required under the relevant legislation, your explicit consent is obtained. However, your personal data may be processed without consent if the conditions under Article 5/2 of the Law are met.

To ensure accuracy and up-to-date information, you may be requested to update your personal data periodically.

The following personal data is processed, limited to the Company’s operational activities:

Categories of Personal Data Processed

• Identity Information (ID number, name–surname, birth details, parental information, marital status, gender)

• Contact Information (phone numbers, address, email address)

• Financial Information (billing and payment details, bank account/IBAN, tax information, invoices, delivery documents, signature circulars, contracts)

• Marketing Information (purchase history, website visit data)

• Legal Transaction Information (legal correspondences, disputes, court/arbitration documents)

• Visual and Audio Data (photos, camera recordings, documents containing images)

• Physical Space Security Information (CCTV footage, entry/exit logs, vehicle plate data)

• Request and Complaint Data (requests received through digital/physical channels)

Retention Period

Your personal data will be retained for 10 years, not less than the statutory limitation period of the relevant legal relationship. Physical security data (CCTV) will be retained for 3 months. After the retention period expires, your personal data will be deleted, destroyed, or anonymized per the Law and related regulations.

You may withdraw your consent at any time for data processed based on explicit consent.

Article 5 – Conditions for Processing Personal Data

(1) Personal data cannot be processed without the explicit consent of the data subject.

(2) Personal data may be processed without explicit consent if one of the following conditions exists:

• Clearly prescribed by law

• Necessary to protect the life or bodily integrity of the data subject or another person when consent cannot be obtained

• Required for the conclusion or performance of a contract

• Necessary for the data controller to fulfill its legal obligations

• Made public by the data subject

• Necessary for the establishment, exercise, or protection of a right

• Necessary for the legitimate interests of the data controller, provided that it does not harm fundamental rights and freedoms

Article 6 – Processing of Special Categories of Personal Data

(1) Defines special categories such as race, political views, religious beliefs, health data, biometrics, etc.

(2) Processing special category data without explicit consent is prohibited.

(3) Exceptions apply only under legally defined circumstances.

(4) Adequate safeguards set by the Board must be implemented.

3. Transfer of Processed Personal Data

Your personal data may be transferred to:

• Real persons or private legal entities

• Business partners, subsidiaries, affiliates

• IT service providers

• Public authorities

Such transfers are made in compliance with Articles 8 and 9 of the Law.

4. Method and Legal Grounds for Collecting Personal Data

Your personal data may be collected through:

• Company headquarters, branches, offices

• Websites and digital platforms

• Social media and public channels

• Trainings, events, and conferences

• Contractual relationships

• Written, oral, video, or electronic means

Your personal data is collected to provide Company services, ensure contractual performance, and fulfill legal obligations.

Data may be processed without consent in cases such as:

• Legal necessity

• Vital interests

• Contract execution

• Public disclosure

• Legal claims

• Legitimate interests of the Company (without harming rights)

5. Rights of the Data Subject Under Article 11

Every individual has the right to:

• Learn whether personal data is being processed

• Request information regarding processing

• Learn the purpose of processing

• Know third parties to whom data is transferred

• Request correction of incorrect/incomplete data

• Request deletion or destruction under Article 7

• Request notification of corrections/deletions to third parties

• Object to decisions made solely by automated systems

• Claim compensation for damages due to unlawful processing

7. Exercising Rights (Right to Apply)

You may submit your requests under Article 11 to the Company by:

• Filling out the application form at https://alfemo.com

• Delivering the signed form in person with ID

• Sending via secure electronic signature or mobile signature

• Emailing from your registered email to avrasyataahhutlojistik@hs01.kep.tr

• Applying through a notary or via methods defined by the Authority

Under Article 13/1 of the Law, applications must be made in writing or via methods announced by the Authority.

The Company will respond within 30 days, free of charge unless an additional processing cost arises. Fees will apply for responses exceeding 10 pages or requiring specific digital formats.

Acknowledgment

I have read and understood the Clarification Text prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 and acknowledge that I have been informed in detail by the Company regarding the processing of my personal data.