Privacy Notice on the Protection and Processing of Personal Data

1. Identity of the data controller

Under Personal Data Protection Law No. 6698 (KVKK), your personal data may be processed, recorded, stored and, where permitted by law, transferred to third parties by KGS GLOBAL E-TİCARET SAN. LTD. ŞTİ. (the Company) in its capacity as data controller, within the scope described below and in accordance with the law and the principle of good faith.

Trade name

KGS GLOBAL E-TİCARET SAN. LTD. ŞTİ.

Tax / MERSİS no

5482192475

Address

Turgut Özal Mah. 55. Sk. A Blok No:47 A İç Kapı No:3 Esenyurt / İSTANBUL

Phone

0 (850) 242 0 822

Website

www.cargonet.com.tr

Email

operasyon@cargonet.com.tr

2. Purpose and scope of this notice

This Privacy Notice has been prepared under the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to provide unilateral and transparent information on the methods of collection, purposes of processing, legal grounds and recipient groups of the personal data of sender company representatives and contact persons, individual senders, consignees and users of our website, and on the statutory rights of data subjects, within the scope of the international express cargo transport, air and road logistics, customs brokerage and delivery activities carried out by our Company.

3. Categories of personal data processed, purposes and legal grounds

Personal data collected in the cross-border logistics and cargo operations carried out by our Company are processed, in accordance with Article 5(1)(h) of the Communiqué on the Obligation to Inform, under the data categories, specific processing purposes and legal grounds set out in Article 5 of the KVKK, as described below:

A. Identity data

• Data processed: First and last names of the sender and the recipient abroad; the Turkish ID number if the sender is an individual; where required for customs declarations and under international legislation, passport number or foreign ID number; signature.
• Purposes of processing: Creating the shipment record, issuing the transport document (bill of lading/AWB), verifying identity, making the legal declarations required under the customs legislation of the destination country and Türkiye, carrying out customs clearance.
• Legal grounds: KVKK Art. 5(2)(c) (directly related to the conclusion or performance of a contract), KVKK Art. 5(2)(ç) (necessary for the Company to fulfil its legal obligations), KVKK Art. 5(2)(e) (establishment, exercise or protection of a right).

B. Contact data

• Data processed: Delivery address, billing address, mobile phone number, landline number and email address of the sender and the recipient.
• Purposes of processing: Collecting the parcel from the sender, physically delivering it to the final recipient in the destination country, sending shipment movement and status notifications (tracking code, delivery appointment, delay or customs hold notices), resolving operational issues.
• Legal grounds: KVKK Art. 5(2)(c) (necessary for the performance of the contract), KVKK Art. 5(2)(f) (necessary for the legitimate interests of the Company, provided that the fundamental rights and freedoms of the data subject are not harmed).

C. Shipment and logistics transaction data

• Data processed: Tracking number, bill of lading details, package contents/description, gross and net weight, volume/dimensions, shipment value, delivery notes, name of the person receiving the delivery, signature and time stamp at delivery.
• Purposes of processing: Planning and routing the international transport operation, classifying goods in line with customs tariff schedules, providing shipment tracking, carrying out damage/loss assessment and compensation processes, generating proof of delivery.
• Legal grounds: KVKK Art. 5(2)(c) (performance of the contract of carriage), KVKK Art. 5(2)(ç) (legal obligations under Postal Services Law No. 6475 and customs legislation), KVKK Art. 5(2)(e) (proving delivery and protecting rights in possible disputes).

D. Financial and invoicing data

• Data processed: Bank account details, IBAN, payment and collection records, tax office and tax ID number (for sole proprietorships and individuals), invoice details.
• Purposes of processing: Accrual and collection of transport and customs clearance fees, issuing invoices, tracking current accounts, carrying out tax and accounting processes in compliance with the legislation.
• Legal grounds: KVKK Art. 5(2)(c) (performance of the contract), KVKK Art. 5(2)(ç) (fulfilment of legal obligations under Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102).

E. Customer transaction, complaint and call centre data

• Data processed: Call centre voice recordings, support requests, complaints and suggestions, shipment tracking query logs.
• Purposes of processing: Assessing and monitoring communication quality, resolving customer complaints, improving service quality, obtaining evidence in operational disputes.
• Legal grounds: KVKK Art. 5(2)(f) (legitimate interests of the Company), KVKK Art. 5(2)(e) (establishment, exercise or defence of a right).

F. Transaction security data

• Data processed: IP addresses, system login and logout records and cookie records relating to the use of the website and the online tracking integration.
• Purposes of processing: Carrying out information security processes, preventing cyber threats, keeping the system records required by legislation.
• Legal grounds: KVKK Art. 5(2)(ç) (legal obligations under Law No. 5651), KVKK Art. 5(2)(f) (legitimate interests of the Company and system security).

4. Methods of collecting personal data

Your personal data are collected orally, in writing or electronically through shipment acceptance centres, our website (www.cargonet.com.tr), API and integration systems, email correspondence, call centre conversations, shipping documents (bill of lading, transport document, pro forma invoice) and digital data files provided by our corporate customers, by fully or partly automated means, or by non-automated means provided that they form part of a data filing system.

5. Transfers of personal data within Türkiye and abroad

A. Transfers within Türkiye

In accordance with Article 8 of the KVKK and solely for the purposes set out above, your personal data may be transferred to:

• our solution partners providing customs brokerage and intermediary services;
• domestic logistics, warehousing, interim transport and courier service providers;
• our financial, legal and tax advisers and independent auditors;
• public institutions and organisations authorised by law (the Ministry of Trade, the Directorate General of Customs, the Revenue Administration, the Information and Communication Technologies Authority, judicial and administrative authorities) and private legal persons authorised by law.

B. Transfers abroad

Owing to the nature of international cargo and logistics activities, the personal data of the sender and the recipient must be transferred across borders so that the shipment can reach the recipient abroad, customs declarations can be filed and delivery can be completed.

Within the framework of the current provisions of Article 9 of the KVKK, your personal data are transferred:

1. where the Personal Data Protection Board (the Board) has issued an adequacy decision for the country of transfer, on the basis of that decision (KVKK Art. 9(1));
2. where there is no adequacy decision, by providing appropriate safeguards through the execution of the standard contract announced by the Board between our Company and the data recipient abroad and its notification to the Board within the statutory period (KVKK Art. 9(4)(c), 9(5));
3. in occasional, one-off and incidental shipments where neither an adequacy decision nor appropriate safeguards are available:
   • where the transfer is necessary for the performance of the international contract of carriage between the data subject (sender/recipient) and our Company (KVKK Art. 9(6)(b));
   • where the transfer is necessary for the conclusion or performance of a contract concluded between our Company and the sending customer for the benefit of the data subject (the recipient in the destination country) (KVKK Art. 9(6)(c));
   • where the transfer is necessary for the establishment, exercise or protection of a right (KVKK Art. 9(6)(d))

on these legal grounds, to local postal and distribution administrations in the destination country, foreign customs administrations and agents, international air and road logistics partners and global IT infrastructure providers.

6. Retention and destruction of personal data

Personal data processed by our Company are retained for the statutory retention periods set out in the relevant legislation or, where no period is set, for as long as the processing purposes require:

• commercial records and books relating to contracts of carriage, freight and bills of lading: 10 years under Turkish Commercial Code No. 6102;
• invoices and accounting records: 5 years under Tax Procedure Law No. 213;
• shipment records: for the minimum periods required under Postal Services Law No. 6475 and its secondary legislation;
• to serve as evidence in possible legal disputes: for the limitation periods under Turkish Code of Obligations No. 6098 and the Turkish Commercial Code.

When the retention period expires or the legal grounds requiring the processing cease to exist entirely, personal data are erased, destroyed or anonymised in the periodic destruction schedule in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7. Your statutory rights as a data subject (KVKK Art. 11)

As a data subject, by applying to our Company you have the right to:

• a) learn whether your personal data are processed,
• b) request information if your personal data have been processed,
• c) learn the purpose of the processing and whether the data are used in line with that purpose,
• ç) know the third parties in Türkiye or abroad to whom your personal data are transferred,
• d) request the rectification of incomplete or inaccurate personal data,
• e) request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
• f) request that the operations carried out under (d) and (e) be notified to the third parties to whom your personal data have been transferred,
• g) object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
• ğ) claim compensation for damage suffered due to the unlawful processing of your personal data.

8. How to apply

Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you may submit your requests regarding the rights listed above to our Company:

1. In writing: by delivering your wet-signed application, together with documents proving your identity, in person or through a notary public to our Company's address at Turgut Özal Mah. 55. Sk. A Blok No:47 A İç Kapı No:3 Esenyurt / İSTANBUL;
2. By registered email: by sending it from the email address registered in our Company's database to operasyon@cargonet.com.tr;
3. With an electronic signature: by signing it with a secure electronic signature or mobile signature and sending it to our Company's email address or, if available, our registered electronic mail (KEP) address.

You are not required to fill in any pre-printed form; however, your application must clearly state your name and surname, signature, Turkish ID number (or nationality and passport number for foreign nationals), the residential or business address for notifications, the email address or phone number for notifications and the subject of your request. Your requests will be concluded free of charge as soon as possible and within thirty days at the latest, depending on their nature.