CLARIFICATION TEXT ON PROTECTION OF PERSONAL DATA

• PURPOSE AND SCOPE

In the Personal Data Protection Law (“KVKK”) No. 6698, which entered into force on 07.04.2016, personal data are defined as any information related to an identified or identifiable natural person.

This Clarification Text has been prepared by BRS LOJİSTİK DIŞ TİCARET LİMİTED ŞİRKETİ (“BRS”) as the data responsible within the scope of the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Clarification Obligation and Article 10 of the Law No. 6698 on the Protection of Personal Data.

The target group of this text is all real persons, whose personal data are processed by our Companies, except for the employees of our Companies or employee candidates who have applied for a job in our Companies.

• METHOD OF COLLECTING PERSONAL DATA

BRS or authorized third parties, who process data on behalf of BRS, may collect and process your personal data in many ways, either fully or partially automated or not automated as part of any data recording system, in accordance with the Personal Data Protection Law No. 6698 and secondary regulations. The following methods are not counted conclusively.

• The forms filled in both electronic and physical media under the scope of business partnership / consultancy with BRS;

• Contact forms filled in on BRS website or third-party websites to contact BRS;

• Online shopping apps on the Internet, cookies used to recognize the user, mobile apps of websites;

• Electronic mail, fax and letter, miscellaneous texts sent to BRS through various contracts signed with BRS and all organically related organizations with BRS;

• Third parties who process data on behalf of BRS or provide professional support to BRS in this regard;

• Various internal and external units that communicate with BRS partners, customers and employees;

• Social media channels, search engines on the internet;

• Business / Consulting contracts and other contracts, applications, forms, offers, other written content;

• Other records within the scope of BRS,

• PURPOSE AND LEGAL REASONS OF PROCESSING PERSONAL DATA

Your collected personal data will be processed within the processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698 to provide logistics and consultancy services to BRS business partners within the trade rules, especially in order to fulfill the legal requirements and operate in accordance with the trade rules, to conduct human resources processes, to operate BRS computer systems, programs and / or database in the correct, safe and functional way to ensure the continuity and sustainability of business partners, employees and company, logistics and consultancy services, to update and run the computer programs, apps, mobile apps, websites used by the BRS business partners, the companies that BRS provide consultancy services and BRS staff, and to ensure use of the above mentioned persons, to perform, execute and develop the operations related to logistics and consultancy services, to carry out promotion, marketing and campaign activities for these services and products, to fulfill the requirements of the contracts signed by BRS, to conduct intelligence, information research, planning, statistics, business partners and personnel satisfaction studies, to provide the necessary security, to provide better and reliable service to business partners and to sustain them without interruption

The legal reason for the collection of Personal Data is that BRS is able to fulfill its legal and contractual obligations, to carry out its commercial and administrative activities within the framework of the laws regulating business and social life, to fulfill its legal obligations completely and correctly and within the scope of these activities, to ensure that the relations it establishes and / or will establish with business partners, service providers, employees, suppliers and subcontractors are maintained properly.

• TO WHOM AND FOR WHICH PURPOSE THE PERSONAL DATA PROCESSED CAN BE TRANSFERRED

In accordance with the abovementioned objectives and the procedures and principles in the current legislation, the personal data collected by BRS can be transferred to the Ministry of Commerce of the Republic of Turkey, SSI, Ministries, judicial authorities and other authorized public institutions and private institutions and third parties with which BRS has a contractual relationship. Service companies, catering agencies and other suppliers of BRS, legal, financial or other consultants, auditors, affiliated organizations with organic ties with BRS and their shareholders and members, and other third parties with your explicit consent. Personal data are also shared with relevant third parties provided that they are required for the data owners to be able to provide services under the contracts signed with BRS.

• TRANSFER OF PERSONAL DATA TO OVERSEAS

Your personal data can be transferred to third parties, from which BRS have received or plan to receive consultancy, support or legal services abroad directly or indirectly by taking adequate security measures subject to the explicit consent of the data owner and / or within the framework of security and confidentiality principles specified in KVKK, (including cloud computing service providers whose servers may be located in various countries) in accordance with the above-mentioned personal data processing conditions and purposes.

• CASE WHERE BRS CAN PROCESS THE PERSONAL DATA OF THE DATA OWNERS WITHOUT EXPLICIT CONSENT IN ACCORDANCE WITH KVKK:

Pursuant to the article 5 of KVKK, BRS may process the personal data taken as mentioned above and in accordance with the law without seeking explicit consent:

• In cases clearly stipulated by law;

• In cases where the data owner is unable to disclose his consent due to actual impossibility or where his consent is not legally valid, the processing of personal data is necessary in order to protect the life or body integrity of the data owner or someone else;

• In cases, where it is necessary to process personal data of the parties to the contract, provided that a contract is established with the BRS-related company, foundations and other related organizations or it is directly related to the performance of the contract;

• In cases where it is required for BRS to fulfill a legal obligation;

• In case personal data are publicized by the owner;

• In cases where data processing is mandatory for the establishment, use or protection of a right;

• In case where data processing is mandatory for the legitimate interests of BRS, provided that it does not harm the fundamental rights and freedoms of the data owner.

• DATA PROCESSING TIME

Personal data can be processed for certain periods stipulated in the applicable legislation or for the periods required to achieve the purposes set forth in this text. In the event that such legal periods or the purpose of collecting personal data expires, if there is no legally legitimate reason and time to store the data, this data will be deleted, destroyed or anonymized by BRS. Application rights for data owners to delete, destroy or anonymize their personal data are reserved.

• THE RIGHTS THAT DATA OWNERS HAVE IN ACCORDANCE WITH ARTICLE 11 OF KVKK ARE AS FOLLOWS:

• Finding out if their personal data are processed;

• Requesting information if their personal data have been processed;

• Learning the purpose of processing personal data and whether they are used in accordance with the purpose, requesting information;

• Knowing and learning the third parties to whom their personal data are transferred at home or abroad,

• Requesting correction in case of missing or incorrect processing of their personal data and requesting the correction made within this scope to be notified to third parties to whom personal data has been transferred;

• Despite having been processed in accordance with KVKK and related legislation, in case the reasons requiring their processing disappear, requesting the deletion or destruction of personal data and requesting notification of the transaction made within this scope to third parties to whom personal data are transferred.

• Objection to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems;

• Requesting elimination of the damage, in case the data owner is damaged due to the illegal processing of his personal data.

Data owners may personally submit their requests related to the rights mentioned above together with the information and documents that are useful to clearly their identify and the completed and signed “Data Owner Personal Information Form” or send via a notary channel to Ayazma Cad.No:37 Papirüs Plaza Kat: 9 No: 16 Kağıthane – İstanbul.

Applications can be made by the data owner personally or through an authorized proxy by giving a special power of attorney from the notary public. BRS will evaluate the application according to the nature of the request of the data owner and conclude it within thirty days at the latest.

Regards,

BRS LOJİSTİK DIŞ TİCARET LİMİTED ŞİRKETİ