PROTECTION OF PERSONAL DATA
PRIVACY AND CLARIFICATION POLICY

Company	:	CPM — Cube Procurement Management
Address	:	Istanbul, Türkiye
E-mail	:	info@cpm-procurement.com

Last updated: September 2026

As CPM — Cube Procurement Management (the “Company”), we attach the utmost importance to the security of your personal data. This privacy notice has been prepared in our capacity as data controller pursuant to Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), as amended by Law No. 7499, and reflects the legislation currently in force.

Our Principles for Processing Personal Data

Pursuant to Article 4 of the KVKK, your personal data is processed:
a) lawfully and fairly,
b) accurately and, where necessary, kept up to date,
c) for specified, explicit and legitimate purposes,
d) in a manner that is relevant, limited and proportionate to those purposes,
e) and retained only for the period required by the applicable legislation or by the purpose of the processing.

Which Data Do We Collect and Why?

Personal data is any information that identifies you or can be used, directly or indirectly, to identify you. Depending on the nature of your interaction with us, one or more of the following categories may be processed:

· Identity and Contact Data: Name and surname, data on identity documents, postal address, phone number, e-mail address and similar personal and/or business contact details.
· Customer Transaction Data: Requests and orders, invoicing details, call-centre and correspondence records.
· Financial Data: Bank account and billing information required to process payments and prevent fraud.
· Physical Premises Security Data: Entry-exit records and CCTV footage at our premises.
· Professional Experience and Employee/Candidate Data: Educational background, CV details, data relating to recruitment and HR processes.
· Transaction Security Data: IP address, website log-in/log-out records, log files.
· Marketing Data: Usage data obtained via cookies (see our Cookie Policy), survey and campaign information.
· Audio-Visual Records: Image and sound recordings made during events and promotional activities.

This data is processed, in a limited and proportionate manner, for the purposes of providing our services and performing our contractual obligations; customer support and satisfaction; communication; assessment of job applications and conduct of HR processes; management of supply-chain and business-partnership processes; ensuring information security and physical security; conduct of finance and accounting affairs; fulfilment of our legal obligations and responses to requests of competent authorities; development of our business activities; and, where you have given explicit consent, carrying out advertising and marketing activities and measuring their effectiveness.

Method of Collection and Legal Basis

Your personal data is collected through our website, e-mail, telephone, our social-media accounts, physical forms and contracts, cookies and similar automated means, and CCTV systems — by fully or partly automated means, or by non-automated means forming part of a data-filing system.

Processing is based on the legal grounds set out in Article 5 of the KVKK — being expressly provided for by law; being directly related to the conclusion or performance of a contract; being necessary for compliance with our legal obligations; or being necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed — and, where none of these applies, on your explicit consent. Special categories of personal data are processed only where one of the conditions listed in Article 6 of the KVKK, as amended, is met.

To Whom and For What Purposes Your Data May Be Transferred

We keep your personal data confidential; we do not sell, rent or trade it. Limited to the purposes above and within the framework of Article 8 of the KVKK, your data may be transferred to our suppliers and business partners (including providers of IT, hosting, security, analytics and advertising, logistics, audit, legal and financial-advisory services), to our subsidiaries and group companies, to banks and insurance companies, and to public institutions and judicial/administrative authorities legally authorised to receive it. Service providers acting as data processors are contractually obliged to protect the personal data they receive from us and are prohibited from using it for any other purpose. If you allow Marketing cookies in your cookie preferences, online advertising platforms (e.g. Google, Meta) may also process this data as independent data controllers under their own privacy policies; see our Cookie Policy for details.

International Transfers

Due to the hosting, e-mail, analytics, advertising and cloud services used, your personal data may be transferred abroad. International transfers are carried out in accordance with Article 9 of the KVKK, as amended by Law No. 7499, and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad: on the basis of adequacy decisions announced by the Turkish Personal Data Protection Board or, in their absence, of the appropriate safeguards listed in the Law (in particular standard contracts notified to the Authority), or of the incidental circumstances defined in the Law.

Retention Period

Your personal data is retained for the period required by the applicable legislation or by the purpose of the processing, after which it is erased, destroyed or anonymised in accordance with Article 7 of the KVKK and the relevant regulation.

How Do We Protect Your Data?

All technical and organisational measures required under Article 12 of the KVKK are taken to secure the personal data we collect, in line with the Personal Data Security Guide published by the Turkish Personal Data Protection Authority, against unauthorised access, misuse, disclosure or alteration.

Your Rights as a Data Subject

Under Article 11 of the KVKK you have the right to:
• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of the processing and whether the data is used in accordance with that purpose,
• know the third parties to whom your data is transferred, in Turkey or abroad,
• request the correction of incomplete or inaccurate data,
• request the erasure or destruction of your data under the conditions set out in the legislation,
• request that such correction, erasure or destruction be notified to the third parties to whom the data was transferred,
• object to a result arising to your detriment from the analysis of your data exclusively by automated systems, and
• claim compensation for damages arising from unlawful processing.

How to Exercise Your Rights

Pursuant to Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request, together with documents verifying your identity:
1. in writing, in person or via notary, to CPM — Cube Procurement Management (Istanbul, Türkiye), marking the envelope “Request for Information under the Law on the Protection of Personal Data”;
2. or from your e-mail address registered in our systems to info@cpm-procurement.com.
Your application must contain your name and surname, Turkish ID number (or nationality and passport/ID number for foreign nationals), address for service, e-mail/phone for notification, and the subject of your request. Applications are concluded free of charge as soon as possible and within 30 (thirty) days at the latest; where the transaction entails an additional cost, the fee set out in the applicable tariff may be charged.