KVKK Disclosure (Personal Data Processing Notice)

Last updated: 2026-05-24 Effective: 2026-05-24 Version: 1.0 Legal basis: Articles 10 and 11 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and Articles 5 and 6 of the Communique on Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

Note: This is the English translation of the Turkish disclosure ("Aydinlatma Metni"). Turkish text takes precedence in case of conflict.

1. Identity of the Data Controller

This Disclosure Notice has been prepared by [TODO: Legal Company Name] ("Nakliye360", "Company", or "We"), in its capacity as Data Controller pursuant to Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communique on Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation.

Nakliye360 is a digital logistics intermediation (broker) platform. We do NOT hold an R1 carrier authorisation under the Road Transport Regulation — we only provide intermediation/matchmaking. Transportation contracts are concluded directly between shippers and carriers/drivers; Nakliye360 is not a party.

2. Categories of Personal Data Processed

2.1. Identity Data

• First and last name
• Date of birth (optional)
• Turkish National ID number (only when mandatory for e-invoicing — individual taxpayers)
• Signature (where contract is executed)

2.2. Contact Data

• Email address
• Mobile phone (E.164 format)
• Address (for pickup/delivery locations)

2.3. Transaction Data

• Cargo posting history (type, dimensions, weight, pickup/delivery point, requested date)
• Offer data (carrier, price, accepted/rejected)
• Shipment status (planned, in transit, delivered, cancelled)
• Reviews and ratings (if provided by user)

2.4. Location Data

• Pickup and delivery addresses (street and/or coordinates)
• Driver live GPS location (collected only during an active shipment and only when the driver's mobile app grants permission; collection stops when the shipment ends)
• Device IP address

2.5. Payment Data

• Subscription/payment token issued by Iyzico
• Iyzico transaction reference id
• Billing address
• Sensitive payment data such as card PAN, CVV, and expiration date are NOT stored on Nakliye360 systems; they are held by PCI-DSS Level 1 certified Iyzico.

2.6. Financial / E-Invoice Data

• Tax Identification Number (corporate users)
• Turkish National ID (individual e-invoice taxpayers)
• Tax office
• EDM Bilisim e-invoice integration record

2.7. Account / Authentication Data

• Username
• Password (Argon2id-hashed; never stored in plaintext)
• OAuth identifiers (Google sub claim, Apple sub claim, Facebook user id)
• Channel-based verification history (mobile OTP, email verification)
• 2FA status

2.8. Professional Document Data (drivers/carriers only)

• SRC / ADR document number
• Driver licence number and class
• Authorisation document (K1, K2, L1, etc.)
• Vehicle registration (plate, make, model, capacity, trailer type)

2.9. Device / Security Data

• IP address
• Device type, OS version, app version
• Expo Push Token
• Session identifiers
• Logs (login, logout, error, audit)

2.10. Marketing Data (with explicit consent)

• Newsletter subscription status
• Segment / interest data
• Ad interaction data (optional)

2.11. Cookie Data

See Cookie Policy.

3. Purposes of Processing

1. Service provision: account creation, cargo posting / offer matching, in-app messaging, notifications.
2. User verification: OTP, email verification, social sign-in (Google / Apple / Facebook).
3. KYC and operational control: verifying validity of driver / vehicle documents; restricting platform access for carriers without authorisation.
4. Payment processing: Iyzico subscriptions / one-off; refunds and disputes.
5. E-invoicing and accounting: issuing e-invoice / e-archive per tax law; retention of commercial books.
6. Location-based services: showing driver live location to shipper; ETA estimation; route optimisation.
7. Communication: operational notifications (password reset, security, shipment status), customer support.
8. Account security: anomaly detection, rate-limiting, brute-force protection.
9. Legal obligation: responding to KVKK Article 11 requests; court / prosecutor / administrative requests.
10. Dispute handling: preservation of rights in claims, complaints, lawsuits.
11. Marketing: newsletter, campaigns, announcements — only with explicit consent.
12. Analytics and statistics: aggregated/anonymous usage metrics; product development.
13. Improvement and error management: error tracking (Sentry) and technical support.

4. Legal Bases of Processing

Per KVKK Articles 5/2 and 6, our processing relies on:

5. Recipients of Personal Data and Purposes of Transfer

5.1. Domestic Transfers

5.2. International Transfers

Pursuant to KVKK Article 9, transfers to the following overseas recipients are made under data transfer agreements and/or Authority approval / Standard Contractual Clauses:

Legal basis for overseas transfers: Per KVKK m.9/2 (i) explicit consent of data subject (mandatory for social OAuth and push as part of service performance), (ii) country with adequate level of protection (GDPR/DSGVO for EU), or (iii) Authority-approved Standard Contract (for US transfers).

6. Method of Collection

Personal data is collected through automated or partially automated means via:

• Nakliye360 mobile app (iOS, Android)
• Nakliye360 web platform (customer and admin)
• API integrations (customer-specific)
• Call centre / email / KEP communication
• Social sign-in providers (Google / Apple / Facebook)
• Cookies and similar trackers (see Cookie Policy)
• Result data returned from Iyzico, EDM Bilisim and other business partners

7. Retention Periods

At end of retention, personal data is deleted, destroyed, or anonymised.

8. Your Rights under KVKK Article 11

As a data subject, you have the following rights:

1. Learn whether your personal data is being processed,
2. Request information about processed data,
3. Learn the purpose of processing and whether the data is used for that purpose,
4. Know the recipients to whom your data is transferred domestically or abroad,
5. Request rectification of incomplete or inaccurate processing,
6. Per Article 7 of KVKK, request erasure or destruction,
7. Request notification of (5) and (6) to recipients of data,
8. Object to results adverse to you arising from automated processing,
9. Claim compensation in case of damage due to unlawful processing.

9. How to Submit a Request

Per KVKK Article 13 and the Communique on Procedures and Principles for Application to Data Controller, you can apply via:

Application via the Application Form. We respond within a maximum of 30 days in writing or electronically, free of charge. Where the request is costly, a fee per Authority schedule may apply.

In case of unsatisfactory response, you may file a complaint with the KVKK Authority; however, prior application to Nakliye360 is required.

10. Cookies and Similar Technologies

For details, see Cookie Policy.

11. Privacy Policy

This notice fulfils our KVKK Article 10 disclosure obligation. For more, see Privacy Policy.

12. Changes

This notice may be revised in response to legal or operational changes. Significant changes:

• Notified via in-app notification and/or email.
• For changes requiring explicit consent, separate consent will be requested.
• Version and "Last updated" date are at the top of this page.

13. Contact

This notice has been prepared to fulfil our minimum disclosure obligation under KVKK and does not constitute legal advice.