Protection of Your Personal Data

The purpose of this Privacy Policy and Disclosure Notice (“Policy”) is to explain how WEX TEKNOLOJİ  (the “Company”), as operator of the website at wexkargo.com (the “Site”), processes personal data relating to the Site’s individual and corporate users and visitors (“User(s)”, “Customer(s)”, “Visitor(s)” or “You”) in connection with the services provided through the Site (the “Services”). It informs Users and Visitors of the terms and conditions governing the processing of personal data provided to the Company and/or obtained, during use of the Site, from individual Users and the employees and authorised representatives of corporate Users. Terms not defined in this Policy shall have the meanings given in the User Agreement published on the Site (the “Agreement”).

You may feel secure while using the Site; however, no system is completely secure. Even where we take all necessary steps to protect your data, a residual risk always remains. We therefore remind you to exercise great care when sharing personal data. Data that you send without a request from the Company, other than data requested by the Company, shall not be treated as personal data processed by the Company under this Policy. You are strongly advised not to send images or any other personal data not requested by the Company by email, message or any other communication channel.

Which of Your Data Is Processed?

This section groups the data collected and processed within the services offered by the Company that constitutes personal data under Law No. 6698 on the Protection of Personal Data (the “Law”), together with non-personal data and data collected through cookies. Unless expressly stated otherwise, “personal data” in this Policy includes the information listed below.

- Personal Data: - Data Collected for Membership Procedures: - Data Collected from Individual Users:

·         Identity Information: First name and surname

·         Contact Information: Email address, telephone number and address information

·         Financial Information: Bank IBAN and credit-card number (requested only when you decide to purchase a service)

·         Identity Verification, Security and Tracking Information: Turkish Republic Identity Number (TCKN)

·         Other Information: The company for which the person works

·         Data Collected from Authorised Representatives of Corporate Users:

·         Identity Information: First name

·         Contact Information: Email address, telephone number and address information

·         Data Collected for Invoice Information: First name and surname, trade name, Turkish Republic Identity Number, tax number, address, telephone number and email address

·         Data Relating to Third Parties: Personal data belonging to a third party and shared in connection with a third-party account during a Service used through the Site, such as an email address or username.

·         Other Data - **Special Categories of Personal Data:** The Personal Data Protection Authority defines special-category personal data as data which, if learned, may cause the person concerned to suffer discrimination or victimisation. The Company does not process special-category data of its Users.

·         Data Processed Through Cookies: Detailed information on data processed through cookies, including the IP address used to access the Site, device type, operating system and browser information, is available in the “Cookie Policy” published on the Site. Under Articles 3 and 7 of the Law, irreversibly anonymised data shall not be treated as personal data, and processing of such data may be carried out without being subject to this Policy.

The User undertakes that information covered by this Policy is complete, accurate and current and that it will be updated immediately if it changes. The Company shall have no liability for circumstances arising from the User’s failure to provide current information.

Which Collected Data Will We Anonymise?

Anonymisation means preventing identification of individuals or removing the ability to distinguish them within particular groups so that the data can no longer be associated with a natural person. Data used in anonymised form in this context includes: (i) the times at which Users and Visitors access the Site, (ii) products viewed and their features, (iii) frequency of Site use and service purchases, (iv) the cities from which Users use the Site or purchase services, and (v) countries searched on the Site and the frequency of those searches.

For What Purposes Do We Process Your Data?

The Company may share personal data collected from representatives of corporate Users with selected third-party companies for logistics operations required to perform the Services. The Company may process personal data supplied by Users and new data generated from it to: enable uninterrupted use of the Site; carry out operational processes required for service delivery, such as prompt access to Services, listing and viewing service providers reached through the Site, and preventing communication failures with selected providers; provide and improve Site services; protect User data; manage User relationships; coordinate Company units to ensure continuity of Services; keep Visitor records; inform Users and Visitors about marketing activities, promotions and benefits; produce statistics from Visitor data; comply with legal and regulatory obligations; and prevent existing or future legal disputes.

Cookies

The Company may obtain information about Users’ use of the Site through cookies, which are technical communication files, process data in that context and transfer it to third parties for processing within analytics services supplied by them, solely to the extent required for those services. Cookies are small text files sent by the Site to the User’s browser for storage. They make internet use easier by retaining status and preference settings. Cookies are designed and used to obtain statistical information including how many people use the Site over time, the purpose and frequency of visits and their duration, and to help generate dynamic advertising and content from User pages designed for Users. They are not designed to obtain other personal data from storage. Most browsers initially accept cookies, but Users may change browser settings to prevent cookies or provide a warning when one is sent. Details are available in the “Cookie Policy” on the Site. Where necessary to identify and quickly resolve system problems, the Company may identify and use User IP addresses. IP addresses may also be used to identify Users in general terms and collect broad demographic information.

Legal Basis for Collecting Data

The principal reason for collecting the data is compliance with applicable legal obligations. We also collect the personal data classified above on the basis of our contractual relationship with Users, our legitimate interests and the commercial principles we have adopted.

Who Can Access Your Data?

To conduct service operations, the Company shares personal data supplied by Users and Visitors, and new data generated from it, with the provider reached through the Site that will perform the service requested by the User, for the provision and/or improvement of Services, improvement of User experience and any purpose stated under “For What Purposes Do We Process Your Data?” in this Policy.

Under Articles 5 and 8 of the Law and/or where an exception in applicable legislation applies, the Company may also process and share data covered by this Policy without obtaining additional consent from Users. The principal circumstances are:

·         Where expressly provided by law;

·         Where processing is necessary to protect the life or physical integrity of a person, or another person, who cannot express consent due to practical impossibility or whose consent is not legally valid;

·         Where processing is necessary and directly related to establishing or performing a contract, including the Agreement;

·         Where necessary for the Company to comply with a legal obligation;

·         Where the data has been made public by the Users themselves, or processing is necessary to establish, exercise or protect a right;

·         Where processing is necessary for the Company’s legitimate interests, provided that it does not prejudice Users’ fundamental rights and freedoms.

Solely to fulfil the purposes stated above, the Company may transfer personal data collected for data-hosting services to service providers abroad only where:

·         You have given explicit consent;

·         A circumstance prescribed by the Law exists and the recipient country provides adequate protection; or

·         A circumstance prescribed by the Law exists and, although the recipient country does not provide adequate protection, the controller in that country undertakes to provide adequate protection and the Personal Data Protection Board (the “Board”) has granted permission. Such overseas service providers may belong to the Company, its affiliates or subcontractors, or may be internationally reputable service providers.

NOTICE TO USERS:

The User is responsible for data knowingly supplied to third parties, and the Company has no liability for such disclosure.

Your Right to Access Your Data and Request Corrections

Users may apply to the Company in relation to their personal data to:

·         Learn whether personal data is processed;

·         Learn whether personal data is processed;

·         Learn the purpose of processing and whether the data is used for that purpose;

·         Know the third parties to which personal data is transferred in Türkiye or abroad;

·         Request correction of incomplete or inaccurate personal data;

·         Request correction of incomplete or inaccurate personal data;

·         Request deletion or destruction of personal data under the conditions prescribed by applicable legislation;

·         Request notification to third parties to which personal data has been transferred of correction, deletion or destruction carried out under applicable legislation;

·         Object to a result arising against the person through analysis of processed data exclusively by automated systems;

·         Request compensation for loss suffered due to unlawful processing of personal data.

Users may exercise their statutory right of application in connection with the requests above by one of the methods set out below, in accordance with Article 13(1) of the Law and other applicable legislation, or by any other method determined by the Personal Data Protection Board. The methods currently specified by the Law are:

1. Complete the Application Form under the Law on the Protection of Personal Data available on the Site (the “Application Form”), sign it by hand and deliver it in person to the Company headquarters at Maltepe Mahallesi, Cevizlibağ Köprüsü No:8, Parima Plaza, Floor 14, Postal Code 34010, Zeytinburnu/Istanbul, together with a document identifying the applicant.

2.      Complete the Application Form, sign it with a “secure electronic signature” as defined by Electronic Signature Law No. 5070, and email the securely signed form to info@wexkargo.com, using “Information Request under the Law on the Protection of Personal Data” as the subject line.

3. Complete and hand-sign the Application Form and send it through a notary public to the Company headquarters at Merkez Mahallesi, Erenler Caddesi, Kuşçu Sokak No:3, Floor 3, Apartment 2, Çekmeköy/Istanbul, marking the notice envelope “Information Request within the Scope of the Law on the Protection of Personal Data”.

For a person other than the applicant to submit a request, that person must hold a special power of attorney issued by the personal-data owner for the relevant matter.

Personal Data Retention Period

The Company shall act in accordance with Law No. 6698 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (the “Regulation”). To fulfil obligations arising from the nature of the Services stated in this Policy and enable Users to benefit from the Site and Services, the Company shall retain personal data supplied by Users for ten years: for Customer data, from the last day on which the Service was provided; and for Visitor data, from the date on which communication permissions were withdrawn. The Company shall destroy personal data in the first periodic destruction operation following the date on which the obligation to destroy arises under the Regulation. The Company shall duly fulfil its obligations under Article 12 of the Regulation toward Users who request destruction of their personal data under Article 13 of the Law.

Our Data Security Measures and Commitments

Under the conditions prescribed by applicable legislation or stated in this Policy, the Company undertakes, in relation to data transmitted to it electronically through the Site, to:

·         Prevent unlawful processing of personal data;

·         Prevent unlawful access to personal data; and

·         Take the necessary technical and administrative measures and arrange the necessary audits to provide an appropriate level of security for retaining personal data.

The Company may not disclose personal data obtained about Users contrary to this Policy or Law No. 6698 and shall not use it outside the purpose of processing. Where the Site links to other applications, the Company has no responsibility for their privacy policies or content.

Communication Consent

You authorise the collection, storage, processing, use and transfer of personal data stated in this Policy that you have consented to share with us through electronic-communication consent, for purposes including providing benefits, sending personalised advertising, sales, marketing, survey and reservation communications and other messages. The Company may contact Users by email to verify an email address during registration, verify identity after a forgotten password, create, advertise or share a website, send security notifications and deliver e-invoices; and by telephone or SMS to verify a telephone number during registration, send two-factor authentication notices, verify identity after a forgotten password and deliver security notifications. Under Article 12 of the Law, the Company shall take all measures necessary to store the personal data securely and prevent unauthorised access and unlawful processing.

Privacy of Users in Relation to the Age Limit

The Company shall not knowingly collect or record data of persons under the age of 18. If you are under 18, you must not use the Platform or Services or share any personal data with the Company. If the Company learns that data of a person under 18 has been collected, it shall take reasonable steps to delete it.

Changes to the Policy

The Company may amend this Policy at any time by publishing the amendment on the Site. Amended provisions shall take effect on the date of publication. The Company shall provide Users with the necessary information so that they are aware of changes to this Policy.

Dispute Resolution

This Policy is governed by the laws of the Republic of Türkiye. All disputes arising from this Policy or relating to the Agreement shall be resolved by the Istanbul Central (Çağlayan) courts and enforcement offices.

Please note that Users who do not approve this Policy may not use the Services.