PRIVACY NOTICE ON ETHICS VIOLATION REPORTING PROCEDURES

1. Data Controller and Introduction

Aras Kargo Yurt İçi Yurt Dışı Taşımacılık Anonim Şirketi

Rüzgarlıbahçe Mahallesi Yavuz Sultan Selim Caddesi Aras Plaza No:2, 34820 Kavacık

Beykoz / İstanbul

As Aras Kargo Yurt İçi Yurt Dışı Taşımacılık A.Ş. (“Aras Kargo”), we respect your privacy and your rights regarding the protection of personal data. In this context, we implement all necessary technical and administrative measures to ensure the security of your personal data and provide a high standard of protection.

Within this scope, this Privacy Notice on Ethics Violation Reporting Procedures (“the “Privacy Notice””) is intended to provide whistleblowers, with clarifications, in our capacity as the data controller, regarding which categories of your personal data are processed, the methods of and legal bases for the collection of your personal data, the purpose(s) for transfer and the recipient(s) of your personal data, and the exercise of your rights under article 11 of the LPPD, pursuant to article 10 of the Law No. 6698 on the Protection of Personal Data (“LPPD”) and the Communiqué on the Procedures and Principles to be Followed for the fulfilment of the Obligation to Inform, in relation to management of ethics, audit and investigation processes.

2. Purposes and Legal Grounds for Processing Your Personal Data

Aras Kargo collects your limited personal data in the personal data categories listed in the table below, through fully or partially automated means, or non-automated means that are part of a data recording system, from electronic and/or physical environments via Aras Kargo websites, primarly www.araskargo.com.tr , mobile application, call center, email, mobile phone, SMS, faximile, postal/parcel, various request / complaint / suggestion platforms, online / communication platforms, Aras Kargo headquarters and branch/agency information counters, Aras Kargo’s information technology systems and integrated systems belonging to authorised public institutions and organisations and other relevant third parties.

3.Purposes and Legal Reasons for Processing Your Personal Data

The personal data categories* processed within the scope of ethics, audit and investigation management processes, the purposes of processing and transfer, and the legal grounds for such processing are detailed in the tables below.

*For more information on data categories, please refer to pages 74 et seq. of theData Controllers’ Registry Information System Guide published by the Personal Data Protection Authority. You may also apply in accordance with Section 5 of this document to obtain further details about the types of personal data processed by Aras Kargo.

Veri Kategorileri

Hukuki Sebepler

İşlenme Amaçları

Identity

(e.g., name, surname, if shared)

  • Pursuant to Art. 5/2(ç) of the Law, it is mandatory for the data controller to fulfil its legal obligation
  • Pursuant to Art. 5/2(e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right
  • Pursuant to Art. 5/2(f) of the Law, provided that it does not harm the fundamental rights and freedoms of the data subject, for the legitimate interests of the data controller

• Execution of Audit / Ethics Activities

• Execution of Activities in Compliance with Legislation

• Follow-up and Execution of Legal Affairs

• Execution of Internal Audit / Investigation / Intelligence Activities

• Execution / Audit of Business Activities

• Follow-up of Requests / Complaints

• Providing Information to Authorized Persons, Institutions, and Organizations

Contact Details

(e.g., email address, if shared)

  • Pursuant to Art. 5/2(ç) of the Law, it is mandatory for the data controller to fulfil its legal obligation
  • Pursuant to Art. 5/2(e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right
  • Pursuant to Art. 5/2(f) of the Law, provided that it does not harm the fundamental rights and freedoms of the data subject, for the legitimate interests of the data controller

• Execution of Audit / Ethics Activities

• Execution of Activities in Compliance with Legislation

• Follow-up and Execution of Legal Affairs

• Execution of Internal Audit / Investigation / Intelligence Activities

• Execution / Audit of Business Activities

• Follow-up of Requests / Complaints

• Providing Information to Authorized Persons, Institutions, and Organizations

Professional Experience / Özlük

(e.g., job title, employing company, if shared)

  • Pursuant to Art. 5/2(ç) of the Law, it is mandatory for the data controller to fulfil its legal obligation
  • Pursuant to Art. 5/2(e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right
  • Pursuant to Art. 5/2(f) of the Law, provided that it does not harm the fundamental rights and freedoms of the data subject, for the legitimate interests of the data controller

• Execution of Audit / Ethics Activities

• Execution of Activities in Compliance with Legislation

• Follow-up and Execution of Legal Affairs

• Execution of Internal Audit / Investigation / Intelligence Activities

• Execution / Audit of Business Activities

• Follow-up of Requests / Complaints

• Providing Information to Authorized Persons, Institutions, and Organizations

Request / Complaint / Suggestion

(e.g., information and documents regarding the alleged violation)

  • Pursuant to Art. 5/2(ç) of the Law, it is mandatory for the data controller to fulfil its legal obligation
  • Pursuant to Art. 5/2(e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right
  • Pursuant to Art. 5/2(f) of the Law, provided that it does not harm the fundamental rights and freedoms of the data subject, for the legitimate interests of the data controller

• Execution of Audit / Ethics Activities

• Follow-up and Execution of Legal Affairs

• Execution of Internal Audit / Investigation / Intelligence Activities

• Execution / Audit of Business Activities

• Providing Information to Authorized Persons, Institutions, and Organizations

Auidovisual Data Records

(e.g., auidovisual records of the alleged infringement, if shared)

  • Pursuant to Art. 5/2(ç) of the Law, it is mandatory for the data controller to fulfil its legal obligation
  • Pursuant to Art. 5/2(e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right
  • Pursuant to Art. 5/2(f) of the Law, provided that it does not harm the fundamental rights and freedoms of the data subject, for the legitimate interests of the data controller

• Execution of Audit / Ethics Activities

• Execution of Activities in Compliance with Legislation

• Follow-up and Execution of Legal Affairs

• Execution of Internal Audit / Investigation / Intelligence Activities

• Execution / Audit of Business Activities

• Follow-up of Requests / Complaints

• Providing Information to Authorized Persons, Institutions, and Organizations

4. Transfer of Your Personal Data

Your personal data processed within the scope of ethics, audit and investigation management processes may be transferred to the following recipient groups, provided that the conditions for data transfer stipulated in Articles 8 and/or 9 of the Law are met:

Recipients

Data Categories

Purpose of Transfer

Suppliers

(e.g., parties that provide products and services to our company in areas such as information technologies, accounting, audit firms, legal processes, archiving)

Identity

Contact Details

Professional Experience

Request / Complaint / Suggestion

Auidovisual Data Records

For the purposes specified in each data category above, in particular to carry out transactions through the supplier and to carry out our corporate activities

Shareholdersand group companies

Identity

Contact Details

Professional Experience

Request / Complaint / Suggestion

For the purposes specified in each data category above, especially for the purposes of ensuring compliance with the policies and procedures of our shareholders and group companies, planning internal communication, audit and reporting activities

Authorized public institutions and organizations

(örn. mahkemeler, savcılık ve kolluk kuvvetleri)

Identity

Contact Details

Professional Experience

Request / Complaint / Suggestion

Auidovisual Data Records

For the purposes specified in each data category above, in particular for the fulfilment of our legal obligations and the establishment, use and protection of our rights in case of dispute

5. Your Rights as Data Subject

Pursuant to Article 11 of the Law, you have the following rights as a data subject:

  • To learn whether your personal data is being processed,
  • If your personal data has been processed, to request information regarding such processing,
  • To learn the purpose of processing and whether your personal data is used in accordance with that

purpose,

  • To know the third parties to whom your personal data has been transferred, within the country or

abroad,

  • To request the correction of incomplete or inaccurate personal data and to request notification of

such correction to third parties to whom the data has been transferred,

  • Despite being processed in accordance with the Law and other relevant legal provisions, to request

the deletion or destruction of personal data where the reasons requiring processing no longer exist,

and to request notification of such deletion or destruction to third parties to whom the data has been

transferred,

  • To object to any outcome that is to your detriment resulting from the exclusive analysis of your

personal data via automated systems,

  • To request compensation for damages incurred due to the unlawful processing of your personal data.

You may submit your requests concerning your rights mentioned above to our Company in accordance with the

provisions of the Communiqué on the Principles and Procedures for the Request to the Data Controller (either

in writing or electronically through registered electronic mail (KEP), secure electronic signature, mobile

signature, or via your email address previously provided to our Company and registered in our systems,

accompanied by information and documents verifying your identity).

As a data subject, you can follow the instructions in the Roadmap for Application to the Data Controller to guide you in exercising your rights.

Important Note: We kindly remind you not to include any sensitive personal data (e.g., religious beliefs or

blood type) in your applications.