Aras Legal Aras Privacy Notice on Pre-application Process of Self-employed Couriers

ARAS KARGO YURT İÇİ YURT DIŞI TAŞIMACILIK ANONİM ŞİRKETİ

PRIVACY NOTICE ON PRE-APPLICATION PROCESS OF SELF-EMPLOYED COURIERS

Data Controller

We, Aras Kargo Yurt İçi ve Yurt Dışı Taşımacılık A.Ş (“Aras Kargo”), respect your privacy and rights related to the protection of your personal data. We are committed to ensuring the security of your personal data by taking all necessary technical and administrative measures to provide high-standard protection.

As Aras Kargo, in line with Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, we act as the data controller during the pre-application process for self-employed couriers. We would like to inform our valued self-employed courier candidates regarding the categories of data processed, methods of data collection, purposes and legal reasons for processing, to whom and for what purposes personal data may be transferred, and your rights listed in Article 11 of the KVKK with this Privacy Notice on Pre-application Process (“Privacy Notice”).

Your Personal Data and Methods of Collection

Aras Kargo collects your limited personal data within the categories listed in the table below, either fully or partially automated or by non-automated means, provided it is part of a data recording system. This data is collected electronically and/or physically through Aras Kargo websites, mobile applications, email, phone, SMS, cargo/mail, printed forms (e.g., self-employed courier application form), interviews, online meeting/communication platforms, reception desks & turnstiles located at Aras Kargo premises, internal/external IT systems, integrated internal company systems, authorized public institutions, and other relevant third-party integrated systems.

Purposes and Legal Reasons for Processing Your Personal Data

The data categories processed in the context of the pre-application process for self-employed couriers, the purposes for processing and transfer of your personal data, and the legal reasons are detailed in the table below.

* For detailed information about data categories, you can review pages 74 and onward of the Data Controllers Registry Information System Guide published by the Personal Data Protection Authority. For detailed information on the types of personal data processed by Aras Kargo, you can apply as explained in Section 5.

Data Categories	Legal Reasons	Purposes of Processing
Identity	KVKK Article 5/2(c): Processing is necessary for the establishment or performance of a contract to which the data subject is a party; KVKK Article 5/2(f): Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.	Conducting Information Security Processes Conducting Audit/Ethical Activities Tracking and Conducting Legal Affairs Conducting Internal Audit/Investigation/Intelligence Activities Conducting Communication Activities Conducting/Controlling Business Activities Conducting Contract Processes Conducting Storage and Archiving Activities Providing Information to Authorized Persons, Institutions, and Organizations
Contact	KVKK Article 5/2(c): Processing is necessary for the establishment or performance of a contract to which the data subject is a party; KVKK Article 5/2(f): Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.	Conducting Information Security Processes Conducting Audit/Ethical Activities Tracking and Conducting Legal Affairs Conducting Internal Audit/Investigation/Intelligence Activities Conducting Communication Activities Conducting/Controlling Business Activities Conducting Contract Processes Conducting Storage and Archiving Activities Providing Information to Authorized Persons, Institutions, and Organizations
Professional Experience	KVKK Article 5/2(c): Processing is necessary for the establishment or performance of a contract to which the data subject is a party; KVKK Article 5/2(f): Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.	Conducting Audit/Ethical Activities Tracking and Conducting Legal Affairs Conducting Internal Audit/Investigation/Intelligence Activities Conducting Communication Activities Conducting/Controlling Business Activities Conducting Contract Processes Conducting Storage and Archiving Activities Providing Information to Authorized Persons, Institutions, and Organizations
Transaction Security	KVKK Article 5/2(f): Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.	Conducting Information Security Processes Conducting Audit/Ethical Activities Tracking and Conducting Legal Affairs Conducting Internal Audit/Investigation/Intelligence Activities Conducting/Controlling Business Activities Conducting Contract Processes Conducting Storage and Archiving Activities Providing Information to Authorized Persons, Institutions, and Organizations
Visual and Audio Records	KVKK Article 5/2(c): Processing is necessary for the establishment or performance of a contract to which the data subject is a party; KVKK Article 5/2(f): Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.	Conducting Audit/Ethical Activities Tracking and Conducting Legal Affairs Conducting Internal Audit/Investigation/Intelligence Activities Conducting/Controlling Business Activities Conducting Contract Processes Conducting Storage and Archiving Activities Providing Information to Authorized Persons, Institutions, and Organizations

Transfer of Your Personal Data

Within the scope of the selection, placement, and management processes for self-employed couriers, your personal data may be transferred to the following recipient groups if the conditions specified in Articles 8 and/or 9 of the KVKK are met:

Recipient Groups for Data Transfer	Data/Specific Personal Data Categories Transferred	Purpose of Transfer
Our Suppliers (e.g., parties providing products and services to our company in IT, accounting, legal processes, archiving, etc.)	Identity, Contact, Professional Experience, Transaction Security, Visual and Audio Records	To carry out transactions through suppliers and to conduct our corporate activities, to ensure the management of the pre-application process for self-employed couriers, to conduct the internal audit, intelligence, investigation, and control activities.
Authorized Public Institutions and Organizations (e.g., judicial authorities, public institutions, and organizations authorized to request your personal data)	Identity, Contact, Professional Experience, Transaction Security, Visual and Audio Records	Providing information to authorized public institutions and organizations within the framework of their legal authority and for the purpose of fulfilling legal obligations.
Other Relevant Third Parties	Identity, Contact, Professional Experience, Transaction Security, Visual and Audio Records	To conduct the processes of fulfilling information and document requests from third parties in accordance with the company's operations.

Your Rights Listed in Article 11 of KVKK

As the data subject, you have the right to:

Learn whether your personal data is processed,
Request information if your personal data has been processed,
Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
Know the third parties to whom your personal data is transferred domestically or abroad,
Request the rectification of incomplete or inaccurate data, if any,
Request the erasure or destruction of your personal data under the conditions specified in KVKK,
Request notification of rectification, erasure, or destruction to third parties to whom your personal data has been transferred,
Object to the processing of your data exclusively through automated systems that result in an unfavorable outcome for you,
Request compensation for the damages in case you incur damages due to unlawful processing of your personal data.

For detailed information and exercising your rights, you can apply using the Application Form at www.araskargo.com.tr.