Data Privacy and Security (KVKK)

AFRİKA PLATFORMU CLARIFICATION TEXT Regarding the Processing of Personal Data Within the Scope of "Law" No. 6698

Information Text on Protection of Personal Data

Afrika Platform Organization Services Tic. Ltd. Ltd. respects your privacy and attaches importance to your personal data security. With this awareness, as the AFRİKA PLATFORMU; It is our priority to process and preserve all personal data of all persons associated with the AFRİKA PLATFORMU, including those who benefit from our products and services, in the best possible way and with care. With full awareness of this responsibility, we process your personal data as Data Controller within the scope of the Personal Data Protection "Law" No. 6698 ("Law") and the relevant legislation, as explained below and within the limits prescribed by the legislation. In this context, this text has been prepared to inform and enlighten you within the scope of the Personal Data Protection "Law" No. 6698 ("Law") and other relevant legislation.

To inform: "Law"; In the processing of personal data, especially the privacy of private life; It was adopted in order to protect the fundamental rights and freedoms of individuals and to regulate the obligations of real and legal persons processing personal data and the procedures and principles to be followed. For this reason, this text explains our obligation to inform arising from the "Law" and "Protection of Personal Data and Personal Data Sharing Permission" is presented for the information of individuals.

Personal Data: It refers to all kinds of information regarding an identified or identifiable natural person. In the justification, a person being identified or identifiable is defined as making that person identifiable by associating existing data with a real person in any way.

• Name, Surname,
• TR Identity Number,
• Passport Number
• Address,
• Telephone,
• System Entry-Exit Times,
• The areas/products they visited and the transactions they carried out,
• Digital data kept in databases or files regarding their locations,
• Documents such as job applications/resumes, order records, where information about people is kept by HR/sales or other units,
• Place/Date of Birth,
• Vehicle License Plate,
• E-Mail Address / IP Address,
• Image and Sound Recordings,
• Any similar data that makes a person identifiable.

Special Features: Special categories of personal data are data that, if learned, may cause discrimination or victimization of the relevant person. Therefore, they need to be protected much more strictly than other personal data. Special categories of personal data may be processed with the express consent of the relevant person or in limited cases listed in the "Law".

• race,
• Ethnicity,
• Political Thought,
• Philosophical Belief,
• Religious, Sectarian or other beliefs,
• Disguise and Outfit,
• Association, Foundation or Union Membership,
• health,
• Sexual Life,
• Criminal Conviction/Possession Data,
• Data Regarding Security Measures,
• Biometric and Genetic Data.

Collection and Processing of Your Personal Data

Processing of your personal data; It may vary depending on the service or commercial activity provided by the AFRİKA PLATFORMU; Provided that it is part of any data recording system; It refers to all kinds of operations performed on your personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of your personal data, whether fully or partially, by automatic or non-automatic means.

Your personal data collected through these methods will be processed by the AFRİKA PLATFORMU with your explicit consent and within the framework of KVKK's processing conditions of personal data and special categories of personal data; It is created and updated throughout the cooperation of its suppliers, throughout the period in which its customers receive service, and throughout the employment contract of its employees. In addition, in accordance with the legal regulations and the commercial activity interests of the AFRİKA PLATFORMU, personal data is stored and protected throughout the retention period. Your general and special personal data are processed by storing and protecting them for the following purposes, including but not limited to:

• Your name, surname, TR ID number, photograph, passport number or temporary TR ID number, place and date of birth, marital status, gender, registry number, criminal record, driver's license, SRC certificate, Psychotechnic and other identity data by which we can identify you,
• Professional qualification certificates,
• Your address, telephone number, e-mail address and other contact data,
• Data regarding your financial CV, your financial data such as your bank account number, IBAN number, credit card information, billing information,
• Data we obtain through our sales and rental services,
• Activity certificate, professional chamber registration, etc. obtained within the scope of the execution of the contract. Provide professional data and the signature circular provided if necessary and your signature,
• Your voice call records kept in accordance with facility security standards and your personal data obtained when you contact us via e-mail, letter or other means,
• If you visit our facilities and offices, your audio camera recordings,
• If you use the parking lot, provide your vehicle license plate.
• If you apply for a job at the AFRİKA PLATFORMU, your other personal data, including the CV provided in this regard, and if you are an employee of the AFRİKA PLATFORMU or a related employee, your data required for the creation of your personnel file, your association membership data, your service contract and all kinds of personal data regarding your aptitude for work, your educational status and certificates,
• Your other data, including your health data and military service information, obtained in order to determine whether you are competent to fulfill the requirements of the job on a permanent basis,
• Your data regarding the provision and financing of private health insurance and your Social Security Institution data, blood tests obtained to ensure registration with the BES insurance company, etc. Your health information, beneficiary letter regarding the legal heir and other necessary data,
• In accordance with the legitimate interest of AFRİKA PLATFORMU to monitor its business, through systems that control entry and exit times; In order to ensure workplace safety and fulfill our legal obligations, data regarding the tracking of your vehicle and gasoline usage supplied to you, tracking devices we place on vehicles belonging to the Company, and your information received from suppliers,
• Our data we collect through the cameras we placed in the workplace building and around our facility, in accordance with the legal obligation and legitimate interest of the AFRİKA PLATFORMU to ensure workplace security.

Our Reasons for Processing Your Data

Your personal data;

• Providing you with the products and services offered by our company,
• Carrying out operational activities,
• Recommending products and services to our customers that suit your consumption and purchasing motivation,
• Carrying out the necessary work with the relevant business unit and business partners,
• Ensuring the rights of real persons by providing human resources management by our company,
• Taking the necessary steps to enable our company to make, implement and realize commercial decisions,
• It is processed in accordance with Articles 5 and 6 of KVKK No. 6698 for the purposes of ensuring the legal security of the real persons with whom we have established business relationships and our company arising from these relationships, and for similar purposes, but not limited to these.

Your Personal Data may be processed by the AFRİKA PLATFORMU, as the Data Controller, without your explicit consent in the following cases:

• It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
• It is necessary to process personal data of the parties to the contract, provided that it is directly related to the performance of the contract,
• It is mandatory to fulfill our legal obligations as the data controller,
• It has been made public by the person concerned,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• It may be processed based on any of the conditions where data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Your personal data may be processed for the following purposes:

• Communicating with you and others as part of the job,
• To carry out and ensure the continuation of our commercial and operational activities,
• To send you important information about changes to our terms of service, changes to our electronic services and other administrative information,
• To provide quality, training and security improvement (for example, regarding recorded or monitored telephone calls to our contact numbers),
• To resolve complaints and process data access or correction requests,
• To comply with applicable laws and regulatory obligations (including those outside your country of residence), including Counter-Terrorism law, and to respond to requests from government and government authorities (including those outside your country of residence),
• To manage our infrastructure and business activities and comply with internal policies and procedures, including those in connection with auditing, finance and accounting, billing and collections, IT systems, data and website hosting, business continuity and records, document and print management,
• To establish and defend legal rights; to protect our activities or the activities of our business partners, our rights, privacy, security or property and/or your or others' assets and to exercise available remedies or limit our damages,
• Conducting market research and analysis, including satisfaction surveys,
• To facilitate the social media sharing function,
• To personalize your experience with electronic services by providing you with personalized information and advertisements.

To whom and for what purpose the processed personal data can be transferred

• Ensuring the legal and commercial security of your collected personal data, our Company and the people who have business relations with our Company,
• Carrying out the necessary work by our business units to benefit you from the products and services offered by our company,
• Customizing and recommending the products and services offered by our company according to your tastes, usage habits and needs,
• To our business partners, legally authorized public institutions and private individuals for the purposes of determining and implementing our company's commercial and business strategies and ensuring the execution of our company's human resources policies, pursuant to Article 8 of the KVK Law. and 9. It may be transferred within the framework of the personal data processing conditions and purposes specified in the articles.

Institutions and Organizations that are shared with within the country: Police Department, Turkish Ministry of Commerce, Customs Directorate, TOBB, SGK, Mediator, Expert, Insurance Agency, Banks, Court Files, Legal Consultant, Port Enterprises, Notary Publics, Customers, Supplier Companies, Ministry of Transport, Judicial Authorities, Administrative Authorities, ERP (Enterprise Resource Planning), Warehouses, Airline companies, Air and Sea agencies, Conciliation Office.

Institutions and Organizations shared abroad: Consulates, Customers, Business Partners, Insurance Agency, Overseas security, Overseas Customs, Overseas Customs agencies, Mail cloud solution, German Federal Protection Board.

Method and Legal Reason for Collecting Personal Data

Your personal data is collected by our Company from various institutions and organizations in order to carry out our commercial activities based on different legal reasons. Your personal data collected for this legal reason is subject to Article 5 of the KVK Law. and 6. Within the scope of the personal data processing conditions and purposes specified in the articles, it can also be processed and transferred for the purposes specified in articles (b) and (c) of this text.

The rights of the Personal Data Owner listed in Article 11 of the KVK Law

If you submit your requests regarding your rights as Personal Data Owners to our Company using the methods set out below in this Information Text, our Company will finalize the request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. In this context, personal data owners;

• Learning whether personal data is processed or not,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used for their intended purpose,
• Knowing the third parties to whom personal data is transferred at home or abroad,
• Requesting correction of personal data in case of incomplete or incorrect processing and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,
• Requesting the deletion or destruction of personal data in case the reasons requiring processing no longer exist, even though it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and requesting that the action taken in this context be notified to third parties to whom the personal data has been transferred,
• Objecting to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,
• In case of damage due to unlawful processing of personal data, they have the right to demand compensation for the damage.

In accordance with the 1st paragraph of Article 13 of the KVKK No. 6698, you can submit your request to exercise your above-mentioned rights to our Company in writing or by other methods determined by the Personal Data Protection Board.

Data Security

AFRİKA PLATFORMU; protects your personal data in full compliance with all required technical and administrative security measures within the framework of information security standards and procedures. These security measures are provided at a level appropriate to possible risks, taking into account technological possibilities.

A. Administrative Measures

• The security of our facilities is provided 24/7 by a private security company approved by the governorship.
• All office sections can be accessed with access authorization.
• A personal data processing inventory has been prepared.
• All policies, procedures and instructions for information security and data security have been published.
• Confidentiality commitments have been received from the relevant parties.
• Risk analyzes have been made and necessary precautions have been taken.
• Periodic and random audits are carried out through internal audits.
• The employment contract and the AFRİKA PLATFORMU code of ethics have been signed by the relevant parties. (ANNEX-2 CODE OF ETHICS AGREEMENT)
• The disciplinary regulation has been notified to the relevant parties. (ANNEX-3 DISCIPLINARY REGULATION)
• Corporate communication document has been prepared and put into effect.
• All AFRİKA PLATFORMU employees were provided with relevant training.
• Awareness activities are constantly carried out.

B. Technical Measures

• Firewall is used for internal and external threats.
• An up-to-date and licensed Anti-Virus program is used to protect against harmful software.
• For your personal data held on the AFRİKA PLATFORMU, authorization is made through the Authorization Matrix so that only relevant persons can access and process the data electronically.
• Authorization checks are carried out periodically by privileged account managers.
• User accounts are encrypted and managed in Active Directory.
• With IP and MAC identification on the AFRİKA PLATFORMU, movements in the network are prevented from unauthorized network access by any device.
• Guest control application is used for security in wireless networks.
• Penetration tests are performed once a year.
• FIREWALL with DDOS feature is used for internal and external attack detection and prevention.
• Log records in accordance with Law No. 5651 and SIEM solutions that alert the data controller in case of any movement while processing personal data that ensure traceability of all data are used.
• Data classification and data loss prevention software is used for personal data.
• To protect important data, daily backups are made automatically through the software.
• Data that needs to be deleted and destroyed is destroyed with the WIPE method.

Data Controller

Data Controller	Afrika Platform Organization Services Tic. Ltd. Ltd.
Address	Mimar Sinan District, Güney Yan Yol Caddesi No: 32 Gebze/Kocaeli Türkiye
Phone Number	0 262 654 13 15
E-Mail Address	info@afrikaplatformu.org

Exercise of Rights, Application and Communication

• Personal Data Protection "Law" No. 6698 ('KVKK') grants personal data owners the right to make certain requests regarding the processing of their personal data in Article 11 of this law. In this context, in accordance with the Communique No. 30356 on the Procedures and Principles of Application to the Data Controller, Afrika Platform Organizasyon Hizmetleri Tic. Ltd. Şti. has the obligation to respond to these requests.
• In accordance with the first paragraph of Article 13 of the KVK Law; Applications regarding these rights to our company, which is the data controller, must be submitted to us in writing or by the following methods determined by the Personal Data Protection Board ('Board').

Application Method	Explanation
Application Made in Person	In hand-delivered applications, the person's application is accepted only if his/her identity is confirmed. After completing the identity check, the AFRİKA PLATFORMU employee who receives the application indicates on the form that the identity has been confirmed. ('Information Request Within the Scope of the "Personal Data Protection" Law" will be written on the envelope.)
Application Made with E-Signature or Mobile Signature	By contact person AFRİKA PLATFORMU [info@afrikaplatformu.orgApplication can be made to the ] e-mail address with electronic signature and/or mobile signature. With the electronic signature secure electronic signature application on the submitted application form, it is checked whether the file is signed or not and the application is accepted after identity confirmation. If the signature cannot be verified with the secure electronic signature application or the form is sent with mobile signature, the relevant person is directed to written channels. (The subject of the e-mail will be 'Personal Data Protection "Law" Information Request.)
Application Sent Through Notary Public	Applications submitted by the relevant person to the AFRİKA PLATFORMU registered address via a notary are received by the AFRİKA PLATFORMU Customer Relations Department. ('Information Request Within the Scope of the Personal Data Protection "Law"' will be written on the notification envelope.)

Your applications submitted to us will be responded to within 30 days from the date your request reaches us, depending on the nature of the request, in accordance with the 2nd paragraph of Article 13 of the KVK Law. Our responses will be delivered to you in writing or electronically in accordance with the provision of Article 13 of the relevant KVK Law.