One Core. Connect More.

AGENCY APPLICATION FORM PRIVACY NOTICE

WITHIN THE SCOPE OF THE PERSONAL DATA PROTECTION LAW NO. 6698

AGENCY APPLICATION FORM PRIVACY NOTICE

Effective Date: 28.08.2026 · Version: 1

Paximum Turizm Ticaret ve Taahhüt Anonim Şirketi (hereinafter referred to as “PAXIMUM”), acting as the data controller, collects, processes, records, stores and, where the conditions required by law are met, transfers the personal data you provide through the Agency Application Form available on the www.paximum.com website, within the limits necessary for the evaluation and establishment of a business partnership/agency relationship, in accordance with the Personal Data Protection Law No. 6698 (“KVKK”). All such processing activities are carried out in compliance with applicable legal requirements.

We may process, record, store, retain, classify and update your personal data within the scope of the purposes specified below, in a manner that is related, limited and proportionate to such purposes, in compliance with the law and the principles of good faith, while ensuring that the data is accurate and kept up to date. Where permitted by applicable legislation, your personal data may also be disclosed and/or transferred to third parties solely for purposes related to the purpose for which it is processed.

This Privacy Notice has been prepared solely to inform you about the relevant legal processes and to fulfil our statutory obligation to provide information. This Privacy Notice does not constitute an approval or consent document; it is provided for informational purposes only.

DEFINITIONS

Pursuant to the Personal Data Protection Law No. 6698:

Personal data means any information relating to an identified or identifiable natural person;

Special categories of personal data means data relating to individuals’ race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data;

Processing of personal data means any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that the operation forms part of a data filing system, including collection, recording, storage, retention, alteration, reorganisation, disclosure, transfer, acquisition, making available, classification or restriction of use;

Data subject means the natural person whose personal data is processed;

Data controller means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system;

Obligation to inform means the obligation of the data controller or the person authorised by the data controller to inform data subjects, at the time personal data is obtained, about the identity of the data controller, the purposes for which personal data will be processed, to whom and for what purposes the processed personal data may be transferred, the method and legal basis of personal data collection, and the other rights listed under Article 11 of the Law.

Data Subject (Applicant / Authorised Person): As the natural person completing the Agency Application Form (the authorised person/contact person of the applicant agency, or the owner where the agency is a natural person/sole proprietorship), you are defined as the data subject under the Law. This Privacy Notice also applies to personal data relating to third parties contained in documents uploaded to the form (such as signature circulars, tax certificates, etc.).

Data Controller (PAXIMUM): Paximum Turizm Ticaret ve Taahhüt Anonim Şirketi, which determines the purposes and means of processing personal data submitted through the Application Form and is responsible for establishing and managing the relevant data filing system, acts as the data controller.

PERSONAL DATA PROCESSED, PURPOSES OF PROCESSING AND LEGAL BASES

1) Receiving Your Agency Application and Managing Communication Processes;

a) Your Name-Surname, E-mail Address, Telephone Number and the Company Details (company name, country of operation) provided through the form;

i) For the Purpose of Conducting Goods / Services Sales Processes and Communication Activities

– KVKK Art. 5/2 (c): Processing personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

– KVKK Art. 5/2 (f): Processing is necessary for the legitimate interests pursued by the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

(We collect and retain the aforementioned personal data in order to create a record of your application, conduct a preliminary evaluation and communicate with you.)

ii) To Whom and for What Purposes Personal Data May Be Transferred;

Your personal data may be transferred, for the purposes of evaluating your application and carrying out communication activities, to PAXIMUM’s suppliers providing IT infrastructure and hosting services and to group companies, within the framework set out in the “Transfer of Personal Data Abroad” section of this Privacy Notice. Except for our statutory obligations for which there is no obligation to inform and where your explicit consent is not required, your personal data is not transferred.

iii) Methods of Obtaining Personal Data;

Your personal data is obtained electronically, through wholly or partly automated means, when you complete the Agency Application Form available on our website.

2) Establishment of the Business Partnership / Agency Relationship and Authorisation and Identity Verification Processes;

b) Your Invoice Information (company name, tax office and tax number, address), the TÜRSAB Certificate, Signature Circular and Tax Certificate uploaded through the form, together with the signature images and information relating to third-party authorised persons contained in such documents;

i) For the Purpose of Conducting Contractual Processes and Verifying Authority and Identity

– KVKK Art. 5/2 (c): Processing personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

– KVKK Art. 5/2 (ç): Processing is necessary for the data controller to fulfil its legal obligations.

(We collect and retain the aforementioned personal data in order to verify the applicant agency’s authority to operate (TÜRSAB certificate), representation and signature authority (signature circular) and taxpayer status (tax certificate), and to establish the agency relationship. Documents such as signature circulars and tax certificates may contain personal data relating to third parties, including company representatives. By uploading these documents, you declare that you are authorised to share such third-party personal data and that you have informed the relevant individuals about this processing activity. These documents are retained within our secure infrastructure.)

ii) To Whom and for What Purposes Personal Data May Be Transferred;

Your personal data may be transferred, for the purpose of establishing the contractual relationship, to PAXIMUM’s business/solution partners, IT and hosting service providers and group companies within the framework set out in the “Transfer of Personal Data Abroad” section. Furthermore, where expressly provided for by law, your personal data may be transferred, upon request, to authorised public institutions and organisations within the purposes and limitations prescribed by applicable legislation.

iii) Methods of Obtaining Personal Data;

Your personal data is obtained electronically, through wholly or partly automated means, when you enter information into and upload documents through the Agency Application Form.

3) Finance and Accounting / Invoicing Processes;

c) Your Company Name, Tax Identification Number, Tax Office, Address and Invoice Information;

i) For the Purpose of Conducting Finance and Accounting Activities

– KVKK Art. 5/2 (ç): Processing is necessary for the data controller to fulfil its legal obligations.

(Pursuant to the Tax Procedure Law No. 213, the Turkish Commercial Code No. 6102 and other applicable legislation, we are legally required to issue and retain invoices and financial documents. Therefore, certain personal data is generated and collected for invoicing purposes.)

ii) To Whom and for What Purposes Personal Data May Be Transferred;

Your personal data will be transferred, pursuant to KVKK Art. 8 by reference to Art. 5/2 (ç), to our financial advisor and to the Ministry of Treasury and Finance of the Republic of Türkiye (Revenue Administration) through e-invoice/e-archive and Digital Tax Office systems. Furthermore, pursuant to KVKK Art. 28, where requested by the relevant authorised authorities, your personal data may be transferred without any obligation to inform you and without obtaining your explicit consent.

iii) Methods of Obtaining / Collecting Personal Data;

Your personal data is obtained electronically, through wholly or partly automated means, via the form and through e-invoice/Digital Tax Office systems during accounting processes.

4) Information Security and Transaction Security Processes;

d) Your IP address, transaction/approval timestamps, logs and digital traffic records;

i) For the Purpose of Conducting Information Security Processes and Establishing/Proving a Right

– KVKK Art. 5/2 (ç): Processing is necessary for the data controller to fulfil its legal obligations.

(We collect and retain the aforementioned personal data in order to ensure the security of form submissions and approval records, prevent misuse and provide evidence where necessary.)

ii) Methods of Obtaining Personal Data;

Your personal data is obtained electronically through wholly automated means during your use of the website and the form.

5) Promotion, Marketing and Commercial Communication Activities;

e) The Name-Surname, E-mail Address and Telephone Number of the business partner/agency representative;

i) For the Purpose of Conducting Company / Product / Service Promotion and Marketing Activities

(Within the scope of the business partnership/agency relationship, we process the aforementioned personal data in order to carry out commercial communication activities such as campaigns, promotions, discounts, newsletters and events. Pursuant to the Law No. 6563 on the Regulation of Electronic Commerce and the relevant Regulation, prior consent is not required for sending commercial electronic communications to recipients acting as merchants or tradespersons; however, you may exercise your right to opt out at any time.)

ii) Management of Commercial Communications, Message Management System (İYS) and Operational Notifications;

Commercial electronic communications are managed through the Message Management System (İYS) pursuant to Law No. 6563. Within this scope, your contact information may be registered with İYS; you may exercise your right to opt out through the “unsubscribe” link included in each communication or through İYS. If you exercise your right to opt out, no further commercial electronic communications will be sent to you.

Operational notifications relating to an existing business relationship (such as collection notices, payment reminders, information updates, changes relating to services and similar notifications) are sent within the scope of performance of the contract (KVKK Art. 5/2-c). As such notifications do not constitute marketing/commercial electronic communications, they do not require separate consent or İYS procedures, and no goods or services are promoted through such notifications.

iii) Methods of Obtaining Personal Data;

Your personal data is obtained electronically, through wholly or partly automated means, from the contact information you provide through the application form and during the course of the business relationship.

TRANSFER OF YOUR PERSONAL DATA ABROAD

PAXIMUM’s IT infrastructure and hosting services are operated through cloud service providers (such as Amazon Web Services), and PAXIMUM also has group companies/offices abroad (London/United Kingdom, United Arab Emirates and Latin America). Accordingly, your personal data may be transferred abroad, limited to the purposes specified above.

Transfers abroad are carried out pursuant to Article 9 of the Personal Data Protection Law No. 6698, as amended by Law No. 7499. Accordingly, transfers may be made;

– Pursuant to KVKK Art. 9/1, to countries for which the Board has issued an adequacy decision; where no adequacy decision exists,

– Pursuant to KVKK Art. 9/2, provided that the data subject has the opportunity to exercise their rights and one of the appropriate safeguards (a standard contract announced by the Board, binding corporate rules, an undertaking or an agreement that does not have the nature of an international agreement) has been put in place,

– Where none of the above applies, pursuant to KVKK Art. 9/6, only on an occasional basis and where one of the exceptional circumstances stipulated under the Law exists (such as the existence of your explicit consent or where the transfer is necessary for the performance of a contract). [[The specific mechanism implemented by PAXIMUM for the transfer (standard contract / binding corporate rules) will be confirmed and specified here.

RETENTION PERIOD OF YOUR PERSONAL DATA

Your personal data is retained in accordance with the Personal Data Protection Law No. 6698 and applicable legislation only to the extent required for the purpose for which it is processed and for no longer than necessary to fulfil such purposes. Once the applicable retention period expires or the purpose of processing ceases to exist, your personal data will be deleted, destroyed or anonymised.

– Invoices and financial documents: Retained for 5 years pursuant to the Tax Procedure Law and for 10 years pursuant to the Turkish Commercial Code; where different retention periods apply, the longer period shall prevail.

– Data and uploaded documents relating to applications resulting in an agency/business partnership relationship (TÜRSAB certificate, signature circular, tax certificate): Retained throughout the duration of the relationship and for the applicable statutory limitation periods following termination of the relationship.

– Data relating to applications that do not result in a contractual relationship (rejected or withdrawn applications): Destroyed within [[6 months / 1 year]] following the conclusion of the application.

– Transaction security data (IP, logs, approval records): Retained for the period stipulated under applicable legislation and for as long as required for security purposes.

Deletion, destruction and anonymisation procedures are carried out in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Data subjects are required to first submit their requests regarding personal data to the data controller. Pursuant to Article 11 of the Law, you have the right to:

a) Learn whether your personal data is being processed,

b) Request information if your personal data has been processed,

c) Learn the purpose of processing your personal data and whether such data is used in accordance with that purpose,

ç) Know the third parties to whom your personal data is transferred domestically or abroad,

d) Request correction of your personal data if it has been processed incompletely or inaccurately,

e) Request deletion or destruction of your personal data within the framework of the conditions stipulated under Article 7 of the Law,

f) Request notification of the operations carried out pursuant to subparagraphs (d) and (e) to third parties to whom your personal data has been transferred,

g) Object to the occurrence of a result against you arising from the analysis of your processed data exclusively through automated systems,

ğ) Request compensation for damages where you suffer damage as a result of unlawful processing of your personal data.

APPLICATION TO THE DATA CONTROLLER

Data Controller: Paximum Turizm Ticaret ve Taahhüt Anonim Şirketi

MERSİS No: 0723042093800001
Tax Office / No: Antalya Kurumlar / 7230420938
Address: Pınarbaşı Mahallesi, Hürriyet Cad., Akdeniz Üniversitesi Antalya Teknokent Ar-Ge 5 Binası No: 3F/1, Konyaaltı/ANTALYA
Telephone: 0850 777 0729
E-mail / Application Channel: KVKK_BAŞVURU_EPOSTA — [email protected]

You may submit your application in writing to the address above or through other methods determined by the Personal Data Protection Authority. Your application must include:

– Your name, surname and, if the application is submitted in writing, your signature,

– Your Turkish Republic identification number if you are a Turkish citizen; if you are a foreign national, your nationality, passport number or identification number, if any,

– Your residential or workplace address for notification purposes,

– Your e-mail address, telephone number and fax number for notification purposes, if any,

– The subject matter of your request. Where applicable, information and documents relating to your request should also be attached to the application.

Your request will be concluded as soon as possible depending on its nature and, in any event, within a maximum of 30 days. Detailed information regarding the application procedure is available in the Personal Data Protection Authority’s “Communiqué on the Procedures and Principles of Application to the Data Controller”. If your application is rejected, if you find the response insufficient, or if no response is provided within the prescribed period, you may lodge a complaint with the Personal Data Protection Board.