Information Notice on the Protection of Personal Data

This Information Notice has been prepared by TURKISHIP ELEKTRONİK TİCARET HİZMETLERİ LİMİTED ŞİRKETİ (in short, “Kargobaz”), acting in the capacity of data controller, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”), to provide information regarding the procedures and principles applicable to the processing of personal data transmitted to us by electronic or physical means.

1. Identity of the Data Controller

Data Controller: TURKISHIP Elektronik Ticaret Hizmetleri Limited Şirketi
Trade Name: Kargobaz
Address: Giyim Sanatkarları Sitesi 4B No:19 İkitelli OSB Başakşehir 34490 İstanbul / TÜRKİYE
MERSIS Number: 0871-0952-4830-0001
Email: [email protected]

2. What Data Do We Process?

Due to the nature of our services, the following categories of your personal data are transmitted to us and processed:

Identity Information: Name, surname, Turkish ID number (for invoicing purposes), tax number, tax office
Contact Information: Email address, telephone number, sender and recipient addresses
Customer Transaction Information: Order information, shipment content information, payment history, invoice information
Shipment and Logistics Information: Package weight and dimensions, shipment content, customs declaration information, destination country, tracking number
Marketplace Integration Information: Order information and recipient (buyer) contact and address information transmitted to us through Amazon, Etsy, Shopify, eBay, and similar platforms with which the User has integrated
Marketing Information: Communication preferences, campaign participation (only with express consent)
Cookie and Usage Data: IP address, session information, device information, browser information, usage statistics
Transaction Security Data: Login records, log records, API access records

3. Principles of Personal Data Processing

Your personal data is processed by Kargobaz in accordance with the principles of lawfulness and fairness; accurately and, where necessary, kept up to date; for specified, explicit, and legitimate purposes; in a manner connected with, limited to, and proportionate to the processing purposes; and only for the duration necessary, in line with the purposes set out in Article 4 of this Information Notice.

4. Purposes of Personal Data Processing

Your personal data is processed for the following purposes:

Creating shipping labels, initiating shipments, and conducting tracking processes for shipments from Türkiye to other countries
Carrying out customs declaration and import/export processes
Coordinating orders and shipments with carriers (such as UPS, FedEx, etc.)
Completing payment transactions and carrying out invoicing activities
Synchronizing order information with marketplaces and shopping platforms (such as Amazon, Etsy, Shopify, eBay, etc.)
Managing membership creation and user/member activation processes (SMS or email activation)
Managing customer relationship processes and providing support services
Evaluating requests, complaints, and suggestions
Maintaining preliminary accounting records, executing e-invoicing processes, and fulfilling reporting obligations to the Turkish Revenue Administration
Performing analytics to improve the website and mobile application experience
Conducting information security, fraud prevention, and account security processes
Fulfilling obligations arising from applicable legislation
Conducting marketing analysis, advertising, campaigns, promotions, and communications for informational purposes (only with express consent)
Managing database storage processes

5. Data Processed Within the Scope of Marketplace Integrations

Where the User establishes an integration between Kargobaz and third-party marketplaces and shopping platforms such as Amazon, Etsy, Shopify, eBay, and the like, personal information of recipients (buyers/customers), such as name, address, telephone number, and email, may be transmitted to Kargobaz through such platforms. Such data is processed in accordance with the following principles:

Such data is processed solely for the purposes of creating shipping labels for the relevant shipment, conducting customs processes, tracking, delivery activities, and fulfilling legal obligations.
Such data may not be used for marketing, profiling, campaign distribution, or sharing with affiliates/third parties for marketing purposes without the written consent of the relevant marketplace platform.
Such data shall not be used for the development, training, or improvement of artificial intelligence or machine learning models without the express written consent of the relevant platform or the explicit consent of the user.
The retention period for such data shall be subject to the data protection policy of the relevant platform and, where required, may be shorter than the general retention periods specified in Article 10 of this notice. For example, personal data obtained through the Amazon Selling Partner API is deleted no later than 30 (thirty) days following completion of the transaction, in accordance with Amazon's Data Protection Policy requirements; data that must be retained due to legal obligations (such as tax/invoice records) is exempt from this period.
Kargobaz undertakes to comply with the developer/API terms of use, data protection policies, and acceptable use policies of the marketplaces and platforms with which it has integrated.

6. Transfer of Personal Data

As a rule, your personal data is not transferred to third parties without your express consent. However, in the exceptional cases set out below, your personal data may be shared with the relevant persons and institutions, with the necessary security measures taken in accordance with Article 8 of the KVKK:

For the fulfillment of legal obligations or the establishment, exercise, or protection of a right, in line with duly submitted requests of authorized public institutions and bodies;
For the provision of the products and services we offer, the conducting of after-sales processes, and the performance of technical support services, to our service providers, suppliers, and solution partners with which our company cooperates.

During data transfers, full compliance with confidentiality principles and the obligations stipulated under the KVKK is ensured at all times.

Your personal data, limited to the purposes set out in Article 4, may be transferred in accordance with Articles 8 and 9 of the KVKK to:

International carrier and logistics companies (carriers such as UPS, FedEx, DHL; this transfer is mandatory for the shipment to actually be delivered),
Customs authorities of destination countries and customs brokerage service providers,
Payment infrastructure providers,
E-invoicing integrators and the Turkish Revenue Administration,
Companies providing marketing and communication infrastructure (email/SMS service providers) — only with express consent,
Third-party providers of website analytics services (Google Analytics, Meta Pixel, etc.),
Cloud computing, server hosting, and cybersecurity service providers.

7. Method of Collection and Legal Basis

Your personal data is collected through our website, mobile application, API integrations, data flows received via marketplaces and shopping platforms, email communication, call center, and verbal or written communication channels, by automated or non-automated means, and is processed on the following legal bases:

It is necessary for the establishment or performance of a contract (KVKK art. 5/2-c)
It is necessary for the data controller to fulfill its legal obligations (KVKK art. 5/2-ç)
It is mandatory for the establishment, exercise, or protection of a right (KVKK art. 5/2-e)
It is mandatory for the legitimate interests of the data controller (KVKK art. 5/2-f)
Express consent of the data subject has been obtained (KVKK art. 5/1) — for purposes such as marketing communications, use of cookies (except for mandatory ones), and cross-border transfers

8. Cross-Border Transfer of Personal Data

Due to the nature of our services — shipping from Türkiye to other countries — some of your personal data must necessarily be transferred abroad. These mandatory transfers take place in the following contexts:

International carriers: For the shipment to be delivered, the recipient's name, address, and telephone information is transferred to the systems of the relevant international carrier (UPS, FedEx, DHL, etc.) located abroad. This transfer is mandatory for the performance of the contract and the provision of the service.
Customs authorities of destination countries: Sender/recipient information necessary for customs declarations is transmitted to the relevant authorities in accordance with the legislation of the destination country.
Marketplace platforms: Information such as order status and tracking numbers is transmitted to the relevant platform (Amazon, Etsy, Shopify, eBay, etc.); the majority of these platforms are based outside of Türkiye.
Cloud computing and technology infrastructure providers: In order to improve service quality and ensure system continuity, certain data may be shared with our service providers operating in the field of information technologies that may be based abroad (for example, cloud server and software services).

In this context, the transfer of your data is carried out with the necessary technical and administrative security measures in accordance with Article 9 of the KVKK, on the basis of your express consent or within the scope of the exceptions set out in Article 9/6 of the KVKK.

The companies to which data is transferred are required to have infrastructure that complies with international standards on data security; they have undertaken to operate in accordance with international data protection regulations, primarily the European Union General Data Protection Regulation (GDPR).

Your data transferred abroad through the cloud systems, software, or platform services used by Kargobaz is processed solely for the purpose of conducting the specified services, and is in no way shared with any other persons or institutions outside the knowledge and instruction of Kargobaz.

9. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to our data controller in respect of your personal data:

To learn whether your personal data is being processed;
To request information if your personal data has been processed;
To learn the purpose of processing and whether the data is used in accordance with such purpose;
To know the third parties, whether domestic or foreign, to whom the data has been transferred;
To request correction of your personal data if it has been processed incompletely or inaccurately;
To request deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK;
To request that the actions taken under the above two points be notified to third parties to whom the data has been transferred;
To object to a result against you arising from the analysis of processed data exclusively by automated systems;
To request compensation for damages suffered as a result of unlawful processing of your personal data.

Personal data subjects may submit their requests relating to the rights set out above through the Data Subject Application Form available on our website or in writing to the data controller.

10. Retention and Disposal of Personal Data

Kargobaz retains your personal data only for the period stipulated in the relevant legislation or required by the purposes of processing. Personal data whose retention period has expired or whose processing purpose has ceased is deleted, destroyed, or anonymized by us in our capacity as data controller, within the scope of periodic disposal processes or upon your request.

Personal information of recipients/customers transmitted to Kargobaz through marketplaces and shopping platforms may be deleted or retained for periods shorter than the general periods specified above, in accordance with the data protection policy of the relevant platform. For example, data obtained through the Amazon Selling Partner API is deleted no later than 30 (thirty) days after the completion of the transaction, in accordance with Amazon's Data Protection Policy requirements; data that must be retained due to legal obligations is exempt from this period.

For your requests regarding how long personal data is retained, in which environments it is kept, by which methods it is disposed of from such environments, and the technical and administrative security measures taken to protect the data, you may contact us at [email protected].

11. Application Method

You may submit your requests relating to your rights in writing addressed to the Data Controller or to [email protected]. Your applications will be concluded within 30 (thirty) days at the latest, in accordance with Article 13 of the KVKK.

pdfdata subject application form.pdf