KVKK Privacy Notice and Privacy Policy

1. Introduction

This Privacy Notice and Privacy Policy has been prepared by Akıllı Taşıma, which operates the akillitasima.com Platform (hereinafter the "COMPANY" or the "PLATFORM"), in its capacity as data controller under the Personal Data Protection Law No. 6698 ("KVKK"), to explain the procedures and principles regarding the processing of the personal data of Platform visitors and members (Shippers, Carriers and Referral Members).

2. Data Controller

3. Categories of Personal Data Processed

Owing to the nature of its activity, the Platform adopts the principle of minimum data. Within the scope of data minimization, IP address records, behavioural profiling data and tracking data for advertising/marketing purposes are not collected or processed by the COMPANY. The Platform processes only the following data categories:

3.1. Data processed from visitors (non-members)

• No personal data is processed from visitors. On pages that do not require membership, the visitor's identity is not determined, no session is opened and no behaviour tracking is carried out.

3.2. Data processed from the Shipper

• Identity: Name, surname, (if corporate) trade name and tax number, date of birth. The Turkish ID number is not collected or processed by the COMPANY.
• Contact: Phone, e-mail, street address, departure-arrival addresses.
• Customer Transaction: Listing contents, cargo details, shipment dates, past listings, messaging records.
• Transaction Security: Username, encrypted (hashed) password and the session cookie placed on your device solely for signing in. The plain text of the password cannot be known by the COMPANY.

3.3. Data processed from the Carrier

• Identity: Name, surname, (if corporate) trade name, tax number. The Turkish ID number is not collected or processed by the COMPANY.
• Contact: Phone, e-mail, address.
• Professional Data: Transport authorization certificates (K1, K2, etc.), vehicle details (plate, type, capacity), area of operation.
• Financial: Invoice details and payment transaction reference. Card details are not stored, viewed or processed by the Platform; payment details are processed only by PayTR Ödeme ve Elektronik Para Hizmetleri A.Ş. on PCI-DSS compliant infrastructure.
• Customer Transaction: Offer history, completed jobs, reviews, messaging records.
• Transaction Security: Username, encrypted (hashed) password and session cookie.

3.4. Data processed from the Referral Member (Member)

• Identity: Name, surname, (if corporate) trade name, tax number. The Turkish ID number is not collected or processed by the COMPANY.
• Contact: Phone, e-mail, address.
• Financial: Earnings and payment records. If the earnings/bonus payment is made by bank transfer, the bank account (IBAN) and account holder name requested for that payment — not stored permanently in the membership profile, processed only for the purpose of making that payment.
• Customer Transaction: Referral network records (sub-accounts that joined through their referral), membership level, earnings ledger, messaging records.
• Transaction Security: Username, encrypted (hashed) password and session cookie.

4. Purposes of Processing Personal Data

Your personal data is processed for the following purposes within the framework of the data processing conditions set out in Articles 5 and 6 of KVKK:

• Creating and managing the membership record.
• Fulfilling the core function of the Platform: Shipper-Carrier matching, listing and offer management.
• Carrying out commission collection and invoicing processes.
• Calculating earnings under the Referral Member programme, paying them to the relevant bank account and fulfilling the related legal record/reporting obligations.
• Establishing and performing the Membership Agreement and the Brokerage Service Agreement.
• Operating the mechanism whereby communication between users is opened only after an agreement (hiding/revealing information).
• Fulfilling legal obligations (tax, commercial law, electronic commerce law, transport legislation).
• Conducting legal processes, preventing abuse and fraud.
• Managing customer requests, complaints and disputes.
• Ensuring Platform security, preventing cyber attacks.
• Statistical analyses (in anonymized form) to improve service quality.
• Where explicit consent is given: marketing, campaigns, promotions and sending commercial electronic messages.

5. Legal Grounds for Processing Personal Data

Your personal data is processed on the basis of the following legal grounds:

• Being directly related to the establishment or performance of a contract (KVKK art. 5/2-c).
• Being mandatory for the data controller to fulfil its legal obligation (KVKK art. 5/2-ç).
• Data processing being mandatory for the establishment, exercise or protection of a right (KVKK art. 5/2-e).
• Being mandatory for the legitimate interests of the data controller, provided that this does not harm fundamental rights and freedoms (KVKK art. 5/2-f).
• Being expressly provided for by law (KVKK art. 5/2-a).
• Where the above conditions do not exist, the explicit consent of the data subject (KVKK art. 5/1).

6. The Platform's Specific Data Flow: Hiding and Revealing of Information

6.1. The core feature of the Platform is that the identity and contact details of the Shipper and the Carrier are kept hidden from the other party before an agreement is established.

6.2. After the match and once the Carrier completes the commission payment, the Shipper's identity and contact details are transferred to the Carrier for the purpose of performing the contract.

6.3. This sharing of information is mandatory for the establishment and performance of the transport contract between the parties (KVKK art. 5/2-c). Members are deemed to have accepted this flow when starting their membership.

6.4. The party to whom the information is revealed (in particular the Carrier) is obliged to use that information solely for the performance of the relevant transport contract. Using this information for other purposes (marketing, transfer to third parties, etc.) constitutes a breach of the Membership Agreement and of KVKK.

7. Third Parties to Whom Personal Data Is Transferred

The COMPANY does not sell, rent or share personal data with third parties for commercial purposes. Transfer is limited to the cases listed below that are mandatory for the performance of the service or a legal obligation:

• Platform Members (after matching): Identity and contact details are revealed to the other party to the agreement (Shipper/Carrier) solely for the performance of the transport contract, as necessarily required by the nature of the service (KVKK art. 5/2-c).
• Payment Service Provider: Transaction data necessarily arises with PayTR Ödeme ve Elektronik Para Hizmetleri A.Ş. and the relevant banks so that the commission can be collected.
• Authorized Public Institutions and Organizations: When requested within the framework of legislation by tax offices, courts, prosecutors' offices, law enforcement, BTK, the Personal Data Protection Authority or the Ministry of Trade (KVKK art. 5/2-a and 5/2-ç).
• Hosting Infrastructure Provider: Data is held with the server/cloud hosting service provider that is necessary for the Platform to operate technically. This provider does not access the data as a processor; it only provides storage infrastructure.

The COMPANY does not transfer data to any third party for advertising, marketing, profiling, data analytics, sales development or similar purposes. There is also no data sharing with business partners, dealers, call centres, SMS/e-mail delivery service providers or the like.

Transfer of data abroad is carried out in accordance with the provisions of KVKK art. 9 and Board decisions only if it arises within the technical requirements of the payment or hosting services listed above.

8. Methods of Collecting Personal Data

Your personal data is collected electronically, directly from the data subject, through Platform membership forms, listing/offer creation screens, the messaging infrastructure, customer service channels (e-mail, phone), the session cookie and application/contract processes. The COMPANY does not obtain personal data in any way from databases, data brokers or similar channels.

9. Retention Period of Personal Data

• Membership details: During the membership and, after it ends, for the applicable limitation periods (generally 10 years).
• Tax and financial records: 5 years under the Tax Procedure Law, 10 years under the Turkish Commercial Code.
• Data processed with explicit consent (if any): Until the consent is withdrawn.

At the end of the period, data is deleted, destroyed or anonymized.

10. Data Security Measures

Pursuant to KVKK art. 12, the Company has taken the following measures to prevent the unlawful processing of and access to personal data:

• Encrypted data transmission with an SSL certificate (HTTPS).
• Storing passwords with one-way hashing.
• Authorization matrix and access controls.
• Firewall, penetration tests, antivirus software.
• Confidentiality agreements and KVKK training for personnel.
• A procedure for notifying the Personal Data Protection Authority within 72 hours in the event of a data breach.
• Periodic backups and a disaster recovery plan.

11. Rights of the Data Subject (KVKK Article 11)

As a data subject, you have the following rights:

• To learn whether your personal data is processed.
• To request information if it has been processed.
• To learn the purpose of the processing and whether the data is used in accordance with that purpose.
• To know the third parties to whom the data is transferred, domestically or abroad.
• To request correction if the data is incomplete or inaccurately processed.
• To request the deletion or destruction of the data under the conditions of KVKK art. 7.
• To request that the correction, deletion or destruction be notified to the third parties to whom the data was transferred.
• To object to a result arising against you from analyses made exclusively by automated systems.
• To claim compensation for damage suffered due to the unlawful processing of the data.

12. Application Method

To exercise the above rights, in accordance with the conditions set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, you may apply in writing through the following channels:

Your application must contain documents identifying you and clear statements regarding your request. Your applications will be finalized within 30 (thirty) days at the latest. If your application is rejected, answered insufficiently or not answered in time, your right to lodge a complaint with the Personal Data Protection Board is reserved.

13. Changes to the Policy

The COMPANY reserves the right to amend this Policy. The current text is always published on the Platform.