Privacy Policy

Chapter One: Introduction, Objective, Scope of Enforcement, and Fundamental Principles of Personal Data Protection

Article 1- Objective, Philosophy, and Nature of the Privacy Policy

This Privacy Policy has been drafted to fully explain the legal, technical, and operational framework governing the collection, receipt, registration, recording, organization, classification, structuring, categorization, storage, maintenance, use, analysis, combination, retrieval, viewing, access, transfer, sharing, disclosure, restriction, automated processing, semi-automated processing, anonymization, pseudonymization, archiving, deletion, destruction, and any operations related to the personal data of users and other data subjects.

The objective of this policy is to guarantee the observance of fundamental rights of individuals regarding personal information, create complete transparency in data processing procedures, clarify the obligations of the platform and users, mitigate security and legal risks, comply with the legal requirements of the countries of operation, and establish sustainable trust between the platform and users.

• Note 1: The use of services implies awareness of this policy; however, in cases where applicable laws or the policies of software application stores mandate obtaining explicit consent, the necessary consent will be obtained prior to the respective processing.
• Note 2: This policy covers all data processing operations, regardless of the technology utilized, storage location, type of media, or processing method.
• Note 3: Any processing of personal information outside the scope of this policy shall only be possible in the event of a legal requirement or obtaining valid user consent.
• Note 4: Compliance with this policy is mandatory for all employees, directors, contractors, affiliates, business partners, and data processors who have access to users' information.

Article 2- Subject-Matter Scope of the Policy

This policy applies to all personal information, semi-personal information, technical information, transactional information, behavioral information, locational information, communication information, data generated by users, data generated by the system, analytical data, security data, financial data, and any information that, directly or indirectly, has the capability of being attributed to a natural or legal person.

This policy encompasses all current or future services of the platform, including the website, mobile application, web version, business panel, sellers' panel, APIs, SDKs, cloud services, messaging system, call services, advertising services, payment services, authentication system, location-based services, artificial intelligence services, and any dependent sub-system.

• Note 1: Alteration of the structure of services or development of new features shall not result in the exclusion of that service from the scope of this policy, unless it is explicitly declared to the contrary.
• Note 2: This policy shall be applicable to information processed by independent third parties outside the control of the platform only within the limits of the platform's role.
• Note 3: Any experimental service, beta version, or new service shall also be subject to this policy, unless other specific conditions are announced for it.
• Note 4: The platform may utilize SDKs or services of third parties for performance analysis, error reporting, security, payment, maps, notifications, or other services, wherein the processing of information will be conducted in accordance with data protection agreements and applicable laws.

Article 3- Scope of Covered Persons

This policy applies to all persons whose information is processed by the platform, including registered users, guest users, sellers, buyers, legal entities, legal representatives, business managers, advertisers, visitors, job applicants, message recipients, users' contacts, service providers, business partners, software developers, support representatives, dispute arbitrators, judicial representatives, and other persons whose information is processed in connection with the services.

• Note 1: The processing of information of persons who are not directly members of the platform but whose information is entered into the system by users within the framework of services shall also be subject to this policy within the limits of applicable laws.
• Note 2: The legal responsibility for uploading the information of third parties without legal authorization shall rest upon the publishing user.

Article 4- Geographical Scope of Processing

The platform may process or store users' information in their country of residence, member states of the Gulf Cooperation Council (GCC), countries where affiliates are located, international data centers, cloud service providers, or other countries where it is essential for providing services. In the event of transferring information to countries with a different level of protection, the platform will implement appropriate contractual, technical, or organizational measures to protect the information.

By using the services, the user acknowledges and agrees to the cross-border transfer of their information within the limits of applicable laws and with the observance of appropriate security measures.

• Note 1: The transfer of information will be carried out solely for legitimate, contractual, security, operational, or legal objectives.
• Note 2: The platform is committed to utilizing conventional data protection standards in the international transfer of information.
• Note 3: The transfer of information to third parties or service providers will be carried out solely within the limits of the necessity of providing services, executing the contract, complying with legal requirements, or other legitimate objectives, and on the basis of confidentiality and data protection agreements.

Article 5- Fundamental Principles of Data Processing

The platform performs all processing of personal information based on the principles of lawfulness, fairness, transparency, proportionality, necessity, data minimization, purpose limitation, storage limitation, data accuracy, confidentiality, integrity, security, accountability, auditability, traceability, privacy by default, privacy by design, risk management, and respect for users' rights.

• Note 1: No data shall be collected beyond the amount necessary for providing services or executing legal obligations, except with the valid consent of the user.
• Note 2: Any new processing outside the primary objectives shall require the existence of an independent legal basis or obtaining new consent.
• Note 3: The platform is committed to continuously reviewing and evaluating information processing procedures.

Article 6- Principle of Privacy by Design and Privacy by Default

The platform is committed to taking into consideration the protection of personal data from the stage of system architecture design, software design, database design, service design, business process design, and the development of new features, and to configure the default settings of services in such a manner that the minimum amount of personal information is subjected to processing or publication.

• Note 1: All new projects related to the processing of personal information must be evaluated from the perspective of security and privacy prior to exploitation.
• Note 2: The principle of least privilege and the principle of data minimization shall be observed in the design of systems.
• Note 3: Any fundamental change in the information processing architecture may necessitate a revision of this policy.

Article 7- General Obligations of the Platform

The platform is committed to protecting users' personal information by observing appropriate technical and managerial standards, preventing unauthorized access, documenting processing operations, controlling access rights, managing security incidents, addressing users' requests, training employees, conducting security audits, and preventing the misuse of information.

• Note 1: The platform does not sell users' personal information to third parties, and any transfer of information shall be carried out solely within the limits of providing services, executing the contract, complying with legal requirements, legal transfer of the business, or with the valid consent of the user.
• Note 2: The use of information for illegal objectives or objectives contrary to this policy is prohibited.
• Note 3: All employees having access to personal information shall be bound to comply with confidentiality obligations.

Article 8- Obligations of Users

Users are obligated to provide accurate, complete, and up-to-date information, refrain from publishing third-party information without legal authorization, maintain the security of their user account, avoid illegal use of services, and report any unauthorized access or potential misuse to the platform at the earliest opportunity.

• Note 1: The legal responsibility for information published by the user shall rest upon them.
• Note 2: The use of a fake identity or incorrect information can result in the suspension or deletion of the account.
• Note 3: Users are responsible for protecting their password, one-time passwords (OTP), security keys, and authentication tools.

Article 9- Amendment and Validity of the Policy

The platform may at any time, due to changes in laws, changes in services, technology development, security requirements, changes in the business model, or other operational necessities, proceed to amend this policy.

The version published on the website or official application is considered the valid version, and the continuation of using the services after the new version becomes effective shall imply acceptance thereof; unless the law has prescribed otherwise.

• Note 1: Fundamental changes will be notified, to the extent possible, via email, SMS, in-app notifications, or other communication methods.
• Note 2: In the event of a legal requirement, the renewed consent of users will be obtained for certain new processing operations.
• Note 3: The validity or invalidity of any clause of this policy shall have no effect on the validity of other clauses, unless their independent execution is impossible.
• Note 4: In cases where applicable laws mandate obtaining the renewed consent of users for new processing operations or fundamental changes, the platform will obtain the necessary consent prior to performing such processing.

Chapter Two: Definitions, Legal Terms, and Technical Concepts

Article 10- General Definitions

In this policy, unless another concept is inferred from the context or existing indications, the following terms shall have the meanings prescribed in this article.

• A) "Platform": consists of all websites, mobile phone applications, web versions, software systems, management panels, sellers' panels, business panels, APIs, SDKs, cloud infrastructures, communication services, payment services, authentication systems, advertising systems, location-based services, artificial intelligence-based services, and any service, product, or sub-system provided or managed by the company.
• B) "Company": refers to the legal entity that owns or operates the platform, including all its affiliates, subsidiaries, or companies under common control.
• C) "User": is any natural or legal person who in any manner utilizes the platform's services, visits the services, registers, or whose information is processed by the platform.
• D) "Services": includes all features, capabilities, services, products, tools, modules, and current or future facilities provided by the platform.
• Note 1: The headings used in this policy are solely for ease of reading and shall not be effective in the interpretation of the provisions of the document.
• Note 2: The use of the singular includes the plural and the use of the plural includes the singular, unless the contrary is specified.
• Note 3: The use of the word "including" is not concept-limiting and encompasses similar cases as well.

Article 11- Definition of Personal Information

Personal information applies to any data, information, identifier, record, image, voice, video, document, electronic identifier, digital data, or any other information that, alone or in combination with other information, provides the capability of directly or indirectly identifying a natural person.

Personal information can include identity information, contact information, financial information, locational information, behavioral information, technical information, transactional information, biometric information, occupational information, communication information, user-generated data, and any other related data.

• Note 1: Anonymous information, the attribution of which to a specific person is not possible, is not considered personal information, unless it becomes identifiable again.
• Note 2: The combination of several apparently non-personal data that leads to the identification of an individual shall be deemed personal information.
• Note 3: Online identifiers, device identifiers, IP addresses, Cookie IDs, and other similar identifiers are also considered personal information if they are capable of being attributed to a person.

Article 12- Definition of Sensitive Information

Sensitive information includes any information the disclosure, processing, or misuse of which can create serious impacts on the rights, freedoms, security, reputation, or economic, social, or personal status of an individual.

This information may include biometric data, health data, sensitive financial data, official identity information, authentication data, precise location data, criminal records, data related to children, data related to security accesses, passport information, residency information, visa information, tax information, or other sensitive information.

• Note 1: The processing of sensitive information will be performed solely in the event of the existence of a legal basis or valid consent.
• Note 2: Redoubled security measures will be applied to sensitive information.
• Note 3: The restrictions of this article shall not prevent the execution of legal requirements or orders of competent authorities.

Article 13- Definition of Information Processing

Information processing includes any operation performed on data, such as collection, receipt, registration, recording, organization, classification, structuring, storage, maintenance, modification, updating, retrieval, viewing, analysis, use, transfer, sharing, disclosure, combination, matching, evaluation, profiling, automated processing, semi-automated processing, anonymization, pseudonymization, archiving, restriction, deletion, or destruction of information.

• Note 1: Any internal or external access to information is also considered a type of processing.
• Note 2: Processing by systems based on artificial intelligence or machine learning is also subject to this definition.
• Note 3: The processing of information manually or electronically shall be subject to the provisions of this policy.

Article 14- Definition of Data Controller and Data Processor

The data controller is the natural or legal person who determines the objectives and methods of processing personal information. The data processor is the natural or legal person who processes personal information on behalf of the controller and based on their instruction.

• Note 1: The company may be considered a data controller in some services and a data processor in other services.
• Note 2: Data processors will be obligated to comply with security and confidentiality requirements.
• Note 3: Assigning the processing of information to a processor shall not result in the transfer of the legal responsibility of the controller, except within the limits of the law.

Article 15- Definition of Consent, Explicit Consent, and Valid Consent

Consent consists of the free, informed, specific, and verifiable declaration of will by the data subject indicating agreement with the processing of personal information. Explicit consent may be obtained through electronic signature, selecting a confirmation option, registering a request, electronic response, digital registration, or any other valid method.

• Note 1: Silence or inaction of the user shall not necessarily imply consent, unless the law or contract has prescribed otherwise.
• Note 2: The user can withdraw their consent within the limits of applicable laws.
• Note 3: The withdrawal of consent shall have no effect on processing operations performed prior to the declaration of withdrawal.
• Note 4: The user can manage settings related to optional consents, including personalized advertisements, marketing analyses, or similar processing operations through user account settings, within the limits of applicable laws.

Article 16- Definition of User Account and User Identifiers

A user account is the collection of information, settings, records, accesses, permissions, activities, and information allocated to each user in the platform. User identifier, username, phone number, email, internal ID, device ID, or any other identifier used for identifying the user is considered part of the user account information.

• Note 1: Each user will be responsible for all activities performed through their account, unless the contrary is proven.
• Note 2: The transfer of a user account without the authorization of the platform is prohibited.
• Note 3: The platform can proceed to restrict or suspend an account in the event of a violation of laws.

Article 17- Definition of Technical and System Data

Technical data includes information related to the device, browser, operating system, software version, device ID, IP address, advertising identifier, Session ID, Tokens, Logs, network information, security information, Cookies, software performance information, Crash Reports, Device Fingerprint, and other similar information. Any use of device technical information is performed solely for security, fraud prevention, risk management, and system protection, and will not be used for advertising tracking across third-party services, except with valid consent or a legal requirement.

• Note 1: Technical data can be used for security, analysis, service improvement, and prevention of misuse.
• Note 2: Certain technical data may be considered personal information.
• Note 3: Technical data can be collected automatically.
• Note 4: Technical identification information of the device is processed solely for security objectives, fraud prevention, user account protection, and maintaining system health, and will not be utilized for creating independent advertising identifiers, unless in accordance with laws and necessary consents.
• Note 5: Device technical information is utilized solely for security, fraud prevention, risk management, user account protection, and maintaining system health, and will not be used for creating an independent advertising identifier or tracking across third-party services, unless based on consent or legal requirements.

Article 18- Definition of User-Generated Information

User-generated information includes advertisements, images, videos, messages, files, descriptions, comments, ratings, price offers, correspondences, reports, uploaded documents, responses, complaints, requests, generated content, and any data created or uploaded by the user on the platform.

• Note 1: Legal ownership rights of the content shall be subject to relevant laws and the terms of service usage.
• Note 2: The user is responsible for the content published by themselves.
• Note 3: The platform can proceed to process this information for executing laws or maintaining security.

Article 19- Definition of Third Parties, Affiliates, and Business Partners

Third parties include any natural or legal person outside the direct structure of the company. An affiliate includes the parent company, subsidiary company, company under common control, or a company having a controlling relationship with the company. Business partners include providers of payment services, cloud services, authentication, transportation, data analysis, advertising, security, support, marketing, communications, SMS, email, maps, artificial intelligence, and other related services.

• Note 1: Cooperation with third parties shall not prevent the legal responsibilities of the platform within the limits of laws.
• Note 2: Third parties shall be obligated to comply with contractual data protection requirements.
• Note 3: The transfer of information to third parties will be performed solely within the limits of this policy, contracts, or legal requirements.

Chapter Three: Data Controller, Data Processor, Information Recipients, and Related Roles in Personal Data Processing

Article 20- Determination of Information Processing Roles

The platform, depending on the type of service, contractual structure, method of service delivery, and legal requirements, may operate in the position of Data Controller, Joint Controller, Data Processor, Sub-Processor, IT service provider, cloud infrastructure provider, or information processing facilitator. The determination of the platform's role in each service will be performed based on the actual nature of processing, determined objectives, decision-making authorities regarding the information, and contractual relationships between the parties.

• Note 1: The platform's role may differ with respect to different types of data or services, and the existence of a role in one part of the services does not imply its extension to other services.
• Note 2: In cases where several persons jointly determine the objectives or methods of processing, responsibilities will be divided between them in accordance with the contract or applicable laws.
• Note 3: The determination of the contractual title of the parties shall not prevent the review of the actual nature of information processing by competent authorities.

Article 21- Duties of the Data Controller

The data controller is responsible for determining the processing objectives, legal bases of processing, method of using information, selection of security measures, determination of data retention periods, responding to users' requests, selection of processors, supervision over information processing, compliance with data subject rights, and execution of legal requirements related to the protection of personal information.

The data controller is obligated to make all decisions related to information processing based on the principles of lawfulness, transparency, proportionality, security, accountability, and respect for users' rights.

• Note 1: The data controller will be responsible for adopting appropriate measures to prevent unauthorized processing of information.
• Note 2: The responsibility of the data controller shall not be waived merely by assigning processing operations to third parties, except within the limits of the law.
• Note 3: The data controller is duty-bound to provide the possibility of exercising the legal rights of users.

Article 22- Duties of the Data Processor

The data processor shall be authorized to process personal information solely within the limits of the data controller's instructions, concluded contracts, legal requirements, and specified objectives. The processor is obligated to implement appropriate security measures, protect the confidentiality of information, restrict employee access, maintain processing records, and refrain from independent use or use outside the authorized limits of the information.

• Note 1: The processor shall not have the right to use information for personal benefits or independent commercial interests, unless with legal or contractual authorization.
• Note 2: The processor is duty-bound to notify the data controller without delay in the event of the occurrence of a security incident or data breach.
• Note 3: The processor shall be responsible for the actions of employees, representatives, and contractors under their authority.

Article 23- Sub-Processors

The platform can utilize sub-processors for providing services, including technology companies, data centers, cloud service providers, cybersecurity companies, authentication companies, SMS providers, email providers, data analysis companies, advertising companies, transportation companies, financial service providers, or other third parties.

• Note 1: The selection of a sub-processor will be performed based on security, technical, contractual, and legal criteria.
• Note 2: The sub-processor shall be authorized to process information solely within the limits of granted authorities.
• Note 3: The platform can, in case of necessity, change or replace its sub-processors.

Article 24- Recipients of Information

Personal information may, depending on necessity and within the limits of announced objectives, be placed at the disposal of authorized recipients, including affiliates, technology service providers, data centers, payment companies, transportation companies, authentication service providers, information security companies, data analysis companies, communication service providers, cloud service providers, legal advisors, auditors, financial institutions, insurance companies, business partners, and legal authorities.

• Note 1: The transfer of information will be performed solely within the limits of operational needs or legal requirements.
• Note 2: Recipients of information are obligated to comply with confidentiality and information protection.
• Note 3: Providing information beyond the amount necessary for fulfilling the objective shall be prohibited, unless in the event of a legal requirement.

Article 25- Employees and Persons Having Internal Access

The access of employees, directors, support experts, the security team, financial team, technical team, legal team, quality control team, fraud-fighting team, and other internal persons to users' information is granted solely based on the principle of Least Privilege and on the basis of occupational necessity. The platform is authorized to record, control, restrict, suspend, or revoke internal accesses.

• Note 1: All persons having access are obligated to comply with information confidentiality.
• Note 2: Any unnecessary access or use outside authorized limits is prohibited.
• Note 3: Records of internal access may be maintained for security, auditing, or violation-handling objectives.

Article 26- Representatives, Contractors, and Consultants

The platform can utilize representatives, contractors, consultants, attorneys, auditors, security companies, software development companies, call centers, support service providers, marketing companies, or other specialized persons to provide services. These persons shall be authorized to process information solely within the limits of the contract, assigned duties, and legal requirements.

• Note 1: The conclusion of a confidentiality and data protection contract with the aforementioned persons is mandatory.
• Note 2: The access of these persons must be limited to the information required for performing duties.
• Note 3: Termination of cooperation shall not result in the termination of confidentiality obligations.

Article 27- Transfer of Responsibilities in Merger or Corporate Restructuring

In the event of a merger, acquisition, assignment of shares, transfer of business, transfer of assets, restructuring, dissolution, bankruptcy, or other organizational changes, personal information may be transferred to the legal successor, transferee, or replacement company, provided that the use of information continues within the framework of this policy and applicable laws.

• Note 1: The transfer of information in these cases is not considered an independent sale of personal information.
• Note 2: The successor company is obligated to comply with the requirements of this policy or a replacement policy with a similar level of protection.
• Note 3: In the event of a legal requirement, appropriate notification will be given to users.

Article 28- Data Protection Officer and Privacy Unit

The platform can establish a data protection unit, Data Protection Officer (DPO), privacy committee, information security committee, or other related organizational structures to supervise the execution of this policy. This unit will be responsible for supervising process compliance, handling users' requests, examining risks, coordinating audits, cooperating with regulatory authorities, and providing necessary recommendations in the field of data protection.

• Note 1: The Data Protection Officer must have the professional independence necessary for performing their duties.
• Note 2: Users can follow up on requests related to their personal data rights through the relevant unit.
• Note 3: The establishment of this unit shall not prevent the execution of other legal responsibilities of the company.

Article 29- Recording Information Processing History

The platform can record and maintain history related to personal information processing activities, processing objectives, classification of information, recipients of information, international transfers, security measures, information retention periods, users' requests, security incidents, and other related information for legal, security, auditing, risk management, and law compliance-proving objectives.

• Note 1: The aforementioned history may be maintained electronically or physically.
• Note 2: Access to this history will be restricted to authorized persons.
• Note 3: The period for maintaining the history will be determined based on legal, contractual requirements, or operational needs.

Chapter Four: Legal Bases of Personal Information Processing, Lawfulness of Processing, and User Consent Management

Article 30- Principle of Lawfulness of Personal Information Processing

The platform processes users' personal information solely in the event of the existence of a valid legal basis, contractual necessity, legal requirement, valid user consent, legitimate and conventional interests of the platform or third parties, protection of vital interests of individuals, execution of public duties, or other applicable legal bases. No processing of personal information shall be performed outside the limits of the legal bases predicted in this policy or applicable laws.

• Note 1: The existence of more than one legal basis for a processing operation shall not prevent simultaneous reliance on other legal bases.
• Note 2: Changing the legal basis of processing will be possible in the event of a legal authorization or operational necessity.
• Note 3: The burden of proving the lawfulness of information processing shall rest upon the platform or the person performing the processing.

Article 31- Processing Based on User Consent

In cases where the basis of processing is user consent, the consent must be obtained freely, knowingly, explicitly, specifically, verifiably, based on sufficient information, and without coercion. The platform can receive consent through electronic registration, digital signature, selecting a confirmation option, completing a form, registering a request, electronic response, user account settings, in-app notifications, or other valid methods.

• Note 1: Consent must be obtained in such a manner that the capability of relying on and proving it exists.
• Note 2: Consent obtained for a specific objective shall not be an authorization for use for unrelated objectives, unless by obtaining new consent or the existence of an independent legal basis.
• Note 3: Refusal of the user to provide consent in non-essential cases should not result in their deprivation from main services, unless providing that service is impossible without processing the information.

Article 32- Withdrawal of Consent

The user can at any time and within the limits of applicable laws, withdraw their consent regarding the processing of personal information. The withdrawal of consent shall have no effect on processing operations performed prior to the declaration of withdrawal and on the basis of valid consent. The platform, after receiving the withdrawal request, will perform necessary actions to stop the consent-based processing within a conventional time frame, unless the continuation of processing is authorized on another legal basis.

• Note 1: Withdrawal of consent may result in the restriction of certain services or capabilities of the platform.
• Note 2: Withdrawal of consent shall not prevent the maintenance of information within the limits of legal, contractual, or judicial requirements.
• Note 3: The process of withdrawing consent must be as simple as the process of granting consent.

Article 33- Processing Based on Contract Execution

The platform is authorized to process users' personal information to the extent necessary for concluding a contract, executing a contract, managing a user account, providing services, performing transactions, communicating with users, resolving disputes, providing support, collecting receivables, managing orders, executing contractual obligations, and performing preliminary actions prior to concluding a contract.

• Note 1: Information essential for contract execution may be processed without the need for separate consent.
• Note 2: Termination of a contract shall not prevent the continuation of information processing within the limits of legal or judicial requirements.
• Note 3: The scope of processing must be proportionate to the necessity of contract execution.

Article 34- Processing Based on Legal Requirements

The platform can process or maintain personal information within the limits of laws, regulations, orders of judicial authorities, tax requirements, financial regulations, anti-money laundering regulations, regulations combating the financing of terrorism, cybersecurity requirements, consumer protection requirements, or other legal obligations.

• Note 1: The execution of legal requirements shall take precedence over requests for data deletion within the limits of relevant laws.
• Note 2: Cooperation with competent authorities within the framework of laws shall not be deemed a violation of this policy.
• Note 3: Information will be disclosed solely within the limits of the legal request, unless the law has prescribed a broader scope.

Article 35- Processing Based on Legitimate Interests

The platform can process users' information in cases where it has legitimate, necessary, conventional, and legal interests; including for enhancing security, fraud prevention, analyzing system performance, improving services, risk management, product development, protecting legal rights, managing disputes, guaranteeing information security, preventing cyberattacks, and managing service quality. These processing operations are conditional upon the fact that the fundamental rights and freedoms of users are not disproportionately affected.

• Note 1: In the event of a conflict between the legitimate interests of the platform and the fundamental rights of the user, the fundamental rights of the user shall have priority within the limits of the law.
• Note 2: The platform can document the assessment of legitimate interests.
• Note 3: Users shall have the right to object to this type of processing within the limits of applicable laws.
• Note 4: Processing based on legitimate interests must not disproportionately restrict the fundamental rights and freedoms of users, and users shall have the right to object to such processing operations within the limits of applicable laws.

Article 36- Processing for the Protection of Vital Interests

In emergency conditions where protecting the life, health, security, property, or vital interests of users or other persons is necessary, the platform can process personal information to the extent necessary or place it at the disposal of competent persons.

• Note 1: This processing must be limited to emergency conditions.
• Note 2: After the removal of the emergency situation, additional processing operations must be stopped, unless another legal basis exists.
• Note 3: The platform can maintain records of such processing operations for auditing and accountability objectives.

Article 37- Processing of Children's Information and Persons Lacking Competence

In cases where processing of information related to children or persons lacking legal competence is performed, the platform will, depending on the case, obtain the consent of the guardian, custodian, or legal representative, or comply with other relevant legal requirements.

• Note 1: Children's information shall be subject to a higher level of protection.
• Note 2: Upon becoming aware of unauthorized processing of a child's information, the platform will perform appropriate actions to delete or restrict the processing.
• Note 3: Providing incorrect information regarding age or legal status by the user shall not restrict the responsibility of the platform within the limits of the law.

Article 38- Processing Information for Analysis, Research, and Development

The platform can process personal information or anonymized information for statistical, research, market analysis, service development, technology development, training artificial intelligence models, improving algorithms, service quality analysis, quality control, analyzing user behavior, and developing new products. Training, developing, or improving artificial intelligence systems will be performed solely based on valid legal bases, necessary consent in appropriate cases, or after anonymizing the information, and in case of using personal data, this processing will be solely within the limits of the objectives announced in this policy. Users can register an objection or request for processing restriction regarding certain artificial intelligence-based processing operations performed solely for unnecessary personalization, within the limits of applicable laws.

• Note 1: If possible, these processing operations will be performed based on anonymous or pseudonymized data.
• Note 2: Research use of information must not lead to the unnecessary identification of users.
• Note 3: This article shall not prevent the execution of legal restrictions related to sensitive data.
• Note 4: In the event of using personal information for training or improving artificial intelligence systems, this processing will be performed solely based on valid legal bases, necessary consent in appropriate cases, or after anonymizing the information.

Article 39- Principle of Proportionality and Minimization of Processing

The platform is committed to processing solely information that is required for fulfilling a specific, legitimate, and necessary objective, and to refrain from processing additional, unrelated, or disproportionate information. In the event of a change in processing objectives, the scope of processed information must also be revised proportionately to the new objective.

• Note 1: Excessive collection of information without legal or operational necessity shall not be authorized.
• Note 2: The processing of information must always be observed with the principle of proportionality between the objective and the amount of data.
• Note 3: Users can object to the processing of unnecessary information.

Article 40- Documenting Legal Bases of Processing

The platform can maintain history related to the legal bases of processing information, users' consent, contracts, legal requirements, assessment of legitimate interests, consent withdrawal history, users' requests, change of processing bases, and other related documents to prove compliance with laws, risk management, internal auditing, handling disputes, and responding to competent authorities.

• Note 1: The aforementioned documents may be maintained electronically or physically.
• Note 2: Access to these documents will be restricted to authorized persons.
• Note 3: The period for maintaining documents is subject to laws, contracts, operational needs, and internal policies of the platform.

Chapter Five: Categorization of Personal Information, Sensitive Information, Non-Personal Information, and Classification of Processed Data

Article 41- General Principles of Information Classification

The platform classifies all received, generated, or processed information based on its nature, degree of sensitivity, processing objectives, legal requirements, level of confidentiality, degree of risk, retention period, commercial value, security requirements, and potential impacts of disclosure or misuse of information.

The classification of information is performed with the aim of implementing proportionate security controls, access management, determining retention periods, risk management, determining the method of transferring information, determining the method of sharing, and executing legal requirements.

• Note 1: Classification of information may be revised throughout the data life cycle and based on changes in the nature of information or changes in legal requirements.
• Note 2: Information placed in more than one class shall be subject to the highest level of protection.
• Note 3: Changing the classification of information must not result in an unjustified reduction in the protection level of personal data.

در ادامه، ترجمه دقیق، روان و کلمه‌به‌کلمه (وفادار به متن اصلی) بخش‌های تکمیلی سند «سیاست حفظ حریم خصوصی» به زبان انگلیسی ارائه شده است:

Article 42- Identity Information

Identity information includes any information that assists in the direct or indirect identification of the user, including first name, last name, pseudonym, commercial name, profile picture, personal photo, date of birth, gender, nationality, identification number, passport number, residency number, tax identifier, national ID, corporate ID, electronic signature, legal representation information, commercial license information, and other similar identifiers.

• Note 1: The provision of certain identity information may be mandatory for using certain services.
• Note 2: Identity information may be utilized for authentication, fraud prevention, execution of legal requirements, or dispute resolution.
• Note 3: Identity information will be processed solely within the limits of necessity and legitimate objectives.

Article 43- Contact Information

Contact information includes telephone number, mobile number, landline number, email address, residential address, workplace address, delivery address, postal code, country, city, district, emergency communication information, business communication information, and other similar information.

• Note 1: Contact information may be utilized for sending notifications, providing services, authentication, support, contractual communications, and legal notices.
• Note 2: Any change in contact information must be registered in the system by the user at the earliest opportunity.
• Note 3: The platform can verify the validity of contact information through technical or legal methods.

Article 44- User Account Information

User account information includes user ID, username, encrypted password, security settings, privacy settings, authentication methods, account creation date, last login date, history of account changes, account status, notification settings, login information, devices utilized, active sessions, account recovery history, and other information related to account management.

• Note 1: Account security information will be maintained utilizing appropriate methods of encryption or technical protection.
• Note 2: Certain account information may be maintained for security objectives even after the deletion of the account.
• Note 3: The user shall be responsible for maintaining the confidentiality of their login information.

Article 45- Financial and Payment Information

Financial information includes payment records, transaction amount, currency, payment ID, billing information, order number, payment status, refund records, commissions, electronic wallet, credits, discount codes, tax records, settlement-related information, authorized banking information, business account-related information, and other information associated with financial operations.

• Note 1: The platform will refrain from storing the complete information of bank cards in the absence of operational necessity.
• Note 2: Financial information may be maintained for accounting, tax, fraud prevention, dispute resolution, and law compliance objectives.
• Note 3: The processing of financial information shall be subject to redoubled security requirements.
• Note 4: Users' payment information is processed by authorized payment service providers in accordance with payment industry security standards, and the platform will not store complete bank card information in the absence of operational necessity.

Article 46- Information Related to Advertisements and Transactions

Advertisement-related information includes advertisement title, description, images, videos, price, item condition, category, brand, model, technical specifications, geographical location, editing records, publication status, seller's information, buyer's information, price offers, transaction records, order status, dispatch status, delivery status, and other information associated with transactional activities.

• Note 1: This information may be utilized for public display, search, ranking, and market analysis.
• Note 2: Deletion of an advertisement shall not necessarily result in the deletion of all records associated with it.
• Note 3: The platform can maintain transactional information for security, legal, or statistical objectives.

Article 47- Communication Information and Correspondences

Communication information includes private messages, system messages, support correspondences, emails, online chats, transmitted files, user reports, service requests, complaints, objections, registered calls, recorded conversations, voice messages, video messages, and other communications conducted through the platform.

• Note 1: This information may be processed for quality control, training, security, dispute resolution, fraud prevention, and compliance with legal requirements.
• Note 2: Recording of calls or correspondences will be performed in case of necessity and with appropriate notification to users, or in legally authorized cases.
• Note 3: Users must refrain from sending confidential information of third parties without legal authorization.

Article 48- Technical and Security Information

Technical information includes IP address, Device ID, advertising identifier, Cookie ID, Session ID, User Agent, browser type, operating system, software version, device model, hardware ID, network information, connection information, system logs, error reports, security information, intrusion detection information, Device Fingerprint, API information, and other technical information related to the use of services.

• Note 1: Technical information may be collected automatically.
• Note 2: Technical information is utilized for security, performance improvement, analysis, personalization, and prevention of misuse.
• Note 3: Certain technical information may be considered personal information in combination with other data.

Article 49- Behavioral and Analytical Information

Behavioral information includes search history, clicks, visits, duration of use, interaction with advertisements, preferences, purchase records, sales records, payment records, usage patterns, login records, logout records, navigation behavior, interaction with notifications, interaction with advertisements, campaign information, response rates, violation report records, user ratings, comments, rankings, and other behavioral information. Operating system advertising identifiers and related data will be utilized solely in accordance with the user's selected settings, granted permissions, and applicable laws.

• Note 1: Behavioral information may be utilized for personalizing services, market analysis, risk analysis, advertising, algorithm development, or providing personalized recommendations or interest-based advertisements to users, within the limits of applicable laws and users' selected settings.
• Note 2: Analysis of user behavior may be performed automatically.
• Note 3: If possible, statistical analyses will be performed based on anonymous data.
• Note 4: Users can proceed to deactivate personalized advertisements or certain unnecessary analytical processing operations within the limits of the system's features.

Article 50- Sensitive Information, Non-Personal Information, and Anonymous Data

Sensitive information includes data the disclosure of which can cause serious damage to the rights or freedoms of individuals, and non-personal information includes data that lacks the capability of direct or indirect attribution to a specific person.

Anonymous data, pseudonymized data, aggregated data, statistical data, and unidentifiable data may be utilized for research, statistical, analytical, service development, training artificial intelligence models, improving algorithms, market analysis, service quality analysis, and other legitimate objectives. The use of anonymous or aggregated data must not provide the capability of re-identifying users, and in the event that re-identification becomes possible, the information will be subject to personal information protections.

• Note 1: In the event that re-identification of individuals becomes possible, anonymous data shall again be subject to personal information requirements.
• Note 2: The platform can anonymize or pseudonymize personal information prior to statistical use.
• Note 3: The use of anonymous data for commercial, analytical, or research objectives shall be authorized within the limits of laws and this policy.

Chapter Six: Information Directly Provided by Users, Methods of Receipt, Registration, and Management Thereof

Article 51- Principle of Information Provision by the User

The user may place personal information or information related to third parties at the disposal of the platform in the course of registration, completion of user account, authentication, publishing advertisements, creating a store, registering an order, payment, sending messages, communicating with support, registering a complaint, participating in surveys, using special services, registering cooperation requests, registering employment requests, using location-based services, participating in advertising campaigns, using financial services, using artificial intelligence services, or other services of the platform.

The platform will process the aforementioned information solely within the limits of the objectives stipulated in this policy, relevant contracts, legal requirements, and operational needs.

• Note 1: The user shall be responsible for the accuracy, validity, lawfulness, and up-to-date status of the provided information.
• Note 2: The provision of untruthful, incomplete, misleading information, or information belonging to third parties without legal authorization can result in the restriction of services, account suspension, or legal actions.
• Note 3: The platform can utilize technical, contractual, or legal methods to verify the provided information.

Article 52- Information Provided Upon User Account Creation

At the time of creating a user account, the platform may receive information including first name and last name, display name, mobile phone number, email address, password, preferred language, country, city, business information, agency information, occupational information, tax information, residency information, profile picture, and other information required for account creation. Information that is not mandatory for account creation will be received from users strictly on an optional basis.

The platform may also receive supplementary information required for enhancing security, authentication, or providing new services throughout the duration of using the services.

• Note 1: Certain information will be mandatory for account creation, and certain information will be optional.
• Note 2: Failure to provide essential information may result in the impossibility of providing certain services.
• Note 3: The platform can amend or complete the structure of information required for registration at any time.

Article 53- Information Provided for Authentication and Legal Compliance

The user may provide supplementary information, including images of identity documents, passport images, residency cards, business licenses, activity permits, company registration, tax information, banking information, legal representative information, selfie images, authentication videos, electronic signatures, authorized biometric information, or other necessary documents to use certain services or comply with legal requirements. Biometric information or selfie images are processed strictly for authentication, fraud prevention, or compliance with legal requirements, and will not be utilized for advertising or marketing objectives. Biometric information will be maintained strictly for the duration necessary for authentication, and after the removal of necessity, it will be deleted, anonymized, or destroyed in accordance with applicable laws.

The platform will process this information solely for authentication, fraud prevention, compliance with anti-money laundering regulations, compliance with financial, security, and regulatory requirements, and other legal objectives.

• Note 1: Authentication information may be maintained for a longer duration compared to standard information.
• Note 2: The platform can verify the validity of the provided documents through third parties or competent authorities.
• Note 3: The use of forged documents or documents belonging to other individuals is prohibited, and the responsibility for it shall rest upon the user.

Article 54- Information Related to Publishing Advertisements and Creating a Store

The user can provide information including title, description, images, videos, product or service specifications, price, discount, brand, model, location, working hours, sales conditions, contact information, shipping information, warranty terms, return conditions, payment terms, and other related information to publish an advertisement or create a store.

This information may be processed for public display, search, ranking, smart recommendations, market analysis, quality control, prevention of violations, and other operational objectives.

• Note 1: The user shall be legally responsible for the published content.
• Note 2: The platform can edit, restrict, delete, or withhold the publication of the published information based on internal rules or legal requirements.
• Note 3: Deletion of an advertisement shall not prevent the maintenance of its records for legal or security objectives.

Article 55- Information Provided in Internal Messenger and User Communications

Users may communicate with each other or with support through the internal messenger system, transmitting files, sending images, sending videos, voice messages, text messages, location sharing, document sharing, or other communication tools of the platform.

The platform may process this information to provide services, manage disputes, control quality, prevent fraud, address violations, respond to legal requests, develop services, and maintain system security. The platform does not continuously monitor the content of users' private correspondences, except within the limits of legal requirements, user reports, maintaining system security, or handling violations.

• Note 1: Users shall be responsible for the content transmitted by themselves.
• Note 2: Transmission of confidential information of third parties without legal authorization is prohibited.
• Note 3: In the event of the existence of a legal or contractual basis, correspondences may be registered or maintained.

Article 56- Information Provided in Relation to Support and Customer Services

At the time of contacting support, registering a ticket, email correspondence, online chat, telephone call, video call, registering a complaint, registering a report, requesting guidance, requesting a refund, objecting to decisions, or other similar interactions, the user may place personal information, documents, images, files, transaction records, or other related information at the disposal of the platform. Support calls may be recorded for quality control, security, training, or dispute resolution with appropriate notification to users or in legally authorized cases.

This information may be utilized for responding, examining requests, dispute resolution, improving service quality, employee training, risk management, documentation, and compliance with legal requirements.

• Note 1: Support calls may be recorded for quality control or security objectives.
• Note 2: The platform can maintain a copy of the correspondences for a conventional duration.
• Note 3: Information provided to support may be matched with other user account information in case of necessity.

Article 57- Information Provided in Surveys, Competitions, and Advertising Campaigns

Users may voluntarily participate in surveys, advertising campaigns, loyalty programs, competitions, lotteries, events, experimental programs, product testing, or research programs, and provide their personal information or behavioral information.

The platform can process this information for executing the respective program, analyzing results, service development, marketing, granting prizes, analyzing consumer behavior, and other related objectives. Participation in advertising campaigns, surveys, or marketing programs that require the processing of additional information will be carried out based on users' consent where necessary.

• Note 1: Participation in these programs will be optional in prescribed cases.
• Note 2: The specific conditions of each program can include supplementary provisions regarding information processing.
• Note 3: Information collected in these programs may also be utilized in an aggregated and anonymous manner.
• Note 4: Participation in advertising campaigns, surveys, or marketing programs that necessitate the processing of additional information shall be conducted based on users' consent in necessary cases.

Article 58- Information Related to Employment, Cooperation, and Commercial Participation

Persons who apply for employment, cooperation, agency, commercial participation, sales, service provision, investment, or other professional collaborations with the platform may provide information including resumes, occupational history, educational documents, professional records, tax information, identity information, contact information, licenses, certificates, portfolios, banking information, company information, and other related information.

This information will be processed for evaluating competence, concluding contracts, executing obligations, complying with legal requirements, managing cooperation, and other related objectives.

• Note 1: Failure to conclude a contract shall not necessarily result in the immediate deletion of information.
• Note 2: The platform can maintain information for future cooperation opportunities within the limits of laws.
• Note 3: Employment information may be reviewed by the human resources unit or authorized consultants.

Article 59- Information Provided About Third Parties

The user may register information related to buyers, sellers, representatives, employees, goods recipients, contacts, family members, drivers, customers, business partners, or other third parties in the system in the course of using the services.

The user is committed to obtaining the necessary legal authorization prior to providing third-party information, and to assume full responsibility for respecting the rights of those persons.

• Note 1: The platform shall not be responsible for the acquisition of third-party consent by the user, except within the limits of applicable laws.
• Note 2: In the event of receiving a valid complaint from a third party, the platform can restrict, delete, or block the relevant information.
• Note 3: The processing of third-party information shall be subject to this very policy.

Article 60- Updating, Amending, and Completing Information Provided by Users

Users are obligated to amend or complete their information in the event of a change, and the platform can request users to update information or provide supplementary documents in case of necessity.

The platform can match the provided information with internal sources, authorized third parties, legal databases, transaction records, security records, or previously provided information, and in the event of observing discrepancies, perform necessary actions, including suspension of services, requesting supplementary documents, account restriction, or referral of the matter to competent authorities.

• Note 1: Responsibility for the failure to update information shall rest upon the user.

• Note 2: The platform can maintain records of information changes for security, auditing, dispute resolution, and law compliance objectives.
• Note 3: The amendment of information by the user shall not prevent the maintenance of previous versions within the limits of legal, security, contractual, or judicial requirements.

Chapter Seven: Information Created Through the Use of Services, User Interactions, and Activities Performed on the Platform

Article 61- Principle of Automatic Creation of Information in the Process of Using Services

The mere use of the platform's services, without the user directly entering any information, may result in the creation, registration, analysis, or processing of a collection of technical, operational, behavioral, statistical, security, and analytical information.

This information may be automatically created or collected by software systems, cloud infrastructures, network equipment, security services, event logging systems, behavior analysis systems, anti-fraud systems, advertising systems, machine learning algorithms, or other technologies utilized in the platform. Automatic collection of information will be performed strictly to the extent necessary for providing services, security, performance analysis, and other legitimate objectives.

• Note 1: Automatic creation of information is considered a part of the natural process of providing electronic services.
• Note 2: Created information may be considered personal information on its own or in combination with other data.
• Note 3: The creation of system information shall not prevent the exercise of users' legal rights over their personal data.

Article 62- Information Related to User Activities on the Platform

The platform may register and process information related to user activities, including login time, logout time, duration of presence, pages viewed, categories visited, advertisements viewed, items searched, services utilized, order history, payment history, order cancellation history, refund history, chat history, call history, violation report history, rating history, interest history, advertisement saving history, content sharing history, and other similar interactions.

• Note 1: Information under this article may be utilized for personalizing services and improving user experience.
• Note 2: Registration of activities can also be performed for security, legal, or auditing objectives.
• Note 3: Deletion of a user account shall not necessarily result in the immediate deletion of all activity records.
• Note 4: Users' activity information will be processed strictly within the limits of the objectives declared in this policy and proportionate to the type of service.

Article 63- Information Related to Users' Searches and Preferences

The platform may process information related to searches performed, keywords entered, filters selected, categories of interest, results viewed, clicks, browsing history, wishlists, product comparison records, search saving records, active notification records, recommendations viewed records, and other user preferences.

• Note 1: Information under this article can be used for improving the search engine, personalizing results, and service development.
• Note 2: Preferences information may be utilized anonymously for market analysis.
• Note 3: The user can manage certain personalization settings within the limits of the platform's features.

Article 64- Information Related to Social Interactions and Communications Among Users

The platform may process information related to user interactions, including following sellers, following stores, sharing advertisements, submitting comments, registering ratings, replying to comments, sending price offers, inviting other users, introducing friends, link sharing, interacting with advertising content, and other social activities.

• Note 1: Some of this information may be visible to other users.
• Note 2: The platform can analyze unusual or suspicious interactions for security objectives.
• Note 3: Information under this article may be utilized in ranking and content recommendation algorithms.

Article 65- Information Related to the Performance of Sellers and Businesses

The platform may process information related to the performance of sellers, stores, businesses, and service providers, including response rate, response time, order completion rate, order cancellation rate, user satisfaction level, quality of services, violation records, complaint records, refund records, delay records, rating records, performance indicators, sales volume, conversion rate, and other operational indicators.

• Note 1: This information may be used for ranking sellers or improving service quality.
• Note 2: A portion of performance indicators may be displayed to other users.
• Note 3: The platform can amend the method of calculating indicators at any time.

Article 66- Information Related to Transactions and Financial Interactions

The platform may register and analyze information related to orders, purchases, sales, financial transactions, payments, refunds, commissions, settlements, wallet, gift credit, use of discount codes, loyalty points, tax records, accounting records, and other financial interactions.

• Note 1: Information under this article may be used for risk management, fraud detection, and compliance with legal requirements.
• Note 2: Certain financial information may be maintained for long periods in accordance with laws.
• Note 3: Analysis of financial information may be performed automatically.

Article 67- Information Related to Notifications, Messages, and System Communications

The platform may register information related to sending, receiving, viewing, opening, replying to, or interacting with SMS, emails, in-app notifications, Push Notifications, security notifications, marketing notifications, system notifications, service messages, and other electronic communications.

• Note 1: Information under this article can be used for evaluating communication quality and improving services.
• Note 2: Registration of notification viewing status may be utilized to prove legal notices.
• Note 3: The user can deactivate certain optional notifications within the limits of the platform's features.
• Note 4: Users can manage or deactivate the receipt of advertising or personalized notifications through user account settings or operating system settings; however, security, transactional, or essential notifications of services may still be transmitted.

Article 68- Information Derived from the Analysis of User Behavior

The platform may analyze the behavioral information of users through analytical systems, statistical models, artificial intelligence algorithms, anti-fraud systems, risk discovery systems, personalization systems, and other similar technologies, and extract indicators such as usage patterns, fraud probability, interests, purchase patterns, sales patterns, search patterns, user return probability, order completion probability, order cancellation probability, interaction level, and other similar indicators. Behavioral analyses must not lead to entirely automated decision-making with legal effects or similarly significant effects on users, except within the limits of applicable laws and with the possibility of human review in appropriate cases.

• Note 1: These analyses may be performed in an entirely automated manner or with human intervention.
• Note 2: Performed analyses must not lead to unjustified discrimination, unfair exclusion of users, or purely automated decision-making with significant legal effects, except within the limits of applicable laws.
• Note 3: The platform can utilize anonymous or pseudonymized data to develop analytical models.
• Note 4: Users can register objections or requests for processing restriction against certain unnecessary analytical or personalization processing operations within the limits of applicable laws.

Article 69- Information Related to Security, Risk Management, and Fraud Detection

The platform may register and analyze information related to unsuccessful login attempts, unusual account changes, suspicious behaviors, unusual transactions, simultaneous use of multiple devices, sudden changes in geographical location, bot activities, automated attacks, API misuse, identity theft, VPN use, Proxy use, use of automated tools, advertising misuse, content violations, user reports, and other security indicators. This information will not be utilized for creating an independent advertising profile or tracking across third-party services, marketing objectives, personalized advertising, or tracking across applications, except based on the valid consent of the user.

• Note 1: Information under this article may result in the temporary restriction of services until the completion of security investigations.
• Note 2: The platform can utilize artificial intelligence or risk analysis systems to prevent fraud.
• Note 3: Registration of this information does not imply the attribution of a violation to the user and is used solely for risk assessment.
• Note 4: Information related to VPN, Proxy, or other communication tools is processed strictly for security, fraud prevention, platform protection, and risk management objectives.

Article 70- Creation of Derived, Aggregated, and Analytical Data

The platform can produce derived data, statistical indicators, management reports, aggregated data, prediction models, market analyses, performance analyses, economic indicators, behavioral indicators, service quality indicators, training data for artificial intelligence algorithms, and other processed data based on existing information.

These data may be utilized for service development, market analysis, business decision-making, risk management, performance optimization, research, training artificial intelligence models, producing management reports, economic analysis, and other legitimate objectives.

• Note 1: If possible, derived data will be produced in an anonymous manner or non-attributable to individuals.
• Note 2: The use of aggregated data for statistical or commercial objectives will be authorized, provided that it does not lead to the identification of users.
• Note 3: The production of derived data shall not change the legal nature of users' rights over the original personal information, and the rights prescribed in this policy over attributable data shall remain reserved.

Chapter Eight: Technical, System, Security, Network Information, and Data Derived from Information Technology Infrastructures

Article 71- General Principles of Collecting Technical and System Information

In order to provide services, maintain security, manage infrastructure, improve performance, manage capacity, analyze errors, prevent misuse, manage risk, detect intrusion, control service quality, develop new capabilities, comply with legal requirements, and maintain system stability, the platform automatically or semi-automatically collects, registers, processes, and maintains technical and system information related to users' use of services.

This information may be produced or collected by the website, application, browser, operating system, network equipment, cloud services, security services, APIs, SDKs, event management systems, log registration systems, performance analysis tools, monitoring tools, and other components of the information technology infrastructure.

• Note 1: Collection of technical information does not necessarily imply direct identification of the user and may be performed solely for operational objectives.
• Note 2: Technical information will be considered personal information in the event of its capability of attribution to a person, and will be subject to the protections of this policy.
• Note 3: The platform can change the methods of collecting technical information in accordance with technology development or security requirements.
• Note 4: Technical and system information is processed strictly for providing services, security, performance analysis, error resolution, infrastructure management, and other legitimate objectives, and will not be utilized for tracking across third-party applications or websites without necessary consent.

Article 72- Information Related to the User's Device

The platform may process information related to the device utilized by the user, including device type, device model, manufacturer, operating system version, browser version, application version, processor architecture, memory, screen resolution, system language, time zone, authorized hardware identifiers, device security status, Root or Jailbreak status, regional settings, display settings, hardware capabilities, advertising identifiers, and other related technical information. Advertising identifiers will be utilized strictly in accordance with operating system settings, user choices, and applicable laws for measuring or personalizing advertisements.

• Note 1: This information may be utilized for optimizing service display or increasing security.
• Note 2: Certain device information may create the capability of identifying the user in combination with other information.
• Note 3: Processing of device information will be limited to legitimate and proportionate objectives.

Article 73- Network and Electronic Communications Information

The platform may register and process information related to network and communications, including IP address, IPv6 address, port number, DNS information, ISP information, Carrier information, internet connection type, communication speed, connection status, network ID, Wi-Fi ID, Cell Tower information, VPN information, Proxy information, Gateway information, NAT information, API communication information, server response time, request transmission time, response receipt time, volume of data exchange, and other related information.

• Note 1: Network information will be usable for performance analysis, security, and detection of misuse.
• Note 2: Unusual changes in network information may be analyzed as a security risk indicator.
• Note 3: Information under this article may be integrated with other security information.

Article 74- Event Logging Information and System Logs

The platform can register and maintain all important events of the system, including login, logout, password change, security settings change, account information change, advertisement creation, advertisement deletion, information editing, transaction creation, transaction cancellation, system errors, security errors, administrative changes, internal accesses, API accesses, network requests, security events, and other related activities in the form of Log.

• Note 1: System logs may be maintained for security analysis, dispute resolution, or compliance with legal requirements.
• Note 2: Access to logs will be restricted to authorized persons.
• Note 3: Logs may be maintained in an encrypted manner or utilizing anti-tampering mechanisms.

Article 75- Information Related to User Sessions and Session Management

The platform may register and process information related to user sessions, including session creation time, session end time, session duration, session ID, security Tokens, active devices, active browsers, approximate location, activities performed in the session, session errors, session renewal, session termination, and other related information.

• Note 1: Session information is utilized for security management and preventing unauthorized access.
• Note 2: The platform can terminate or restrict suspicious sessions.
• Note 3: Registration of session information shall not prevent the execution of other security controls.

Article 76- Information Related to Software Performance and Error Reports

The platform may collect information related to the performance of the application or website, including Crash Report, Stack Trace, Exception Log, Performance Log, memory consumption information, processor consumption, status of services, page loading time, status of APIs, user errors, system errors, connection status, and other performance information.

• Note 1: Information under this article will be used for resolving software bugs and improving service quality.
• Note 2: If possible, personal information will be deleted or anonymized prior to technical analysis.
• Note 3: Performance information may also be processed by technology service providers.

Article 77- Cybersecurity Information and Threat Management

The platform can register and analyze information related to cyber attacks, intrusion attempts, DDoS attacks, Brute Force attacks, Credential Stuffing attacks, SQL Injection attacks, XSS attacks, CSRF attacks, Bot attacks, API misuse, port scanning, unauthorized access attempts, suspicious changes, malware activities, unusual behaviors, indicators of compromise, security alerts, and other security events.

• Note 1: Information under this article may be exchanged with internal or external security systems.
• Note 2: Registration of security information does not imply the attribution of a violation to the user.
• Note 3: The platform can adopt preventative or restrictive actions to counter cyber threats.

Article 78- Information Related to APIs, SDKs, and Software Communications

The platform may register and process information related to calling APIs, access keys, Tokens, program ID, developer ID, request time, data volume, responses received, request rates, API errors, authentication status, permissions status, SDK version, API version, and other information related to software communications.

• Note 1: This information is utilized for security, capacity management, auditing, and service development.
• Note 2: Misuse of APIs can result in the restriction or termination of access.
• Note 3: Information under this article may also be utilized for analyzing usage patterns.

Article 79- Information Related to Technical Identifiers and Identification Technologies

The platform may utilize technical identifiers, including Cookie ID, Session ID, Device ID, Advertising ID, Push Token, Installation ID, Browser Fingerprint, Device Fingerprint, notification identifier, installation identifier, campaign identifier, analytical identifier, security identifier, authentication identifier, transaction identifier, request identifier, and other similar identifiers for providing services, security management, behavior analysis, service personalization, session management, and fraud prevention.

• Note 1: Some identifiers may be produced randomly or temporarily.
• Note 2: Deletion of certain identifiers may cause disruption in the performance of services.
• Note 3: The use of technical identifiers shall be subject to the provisions of this policy and the cookies policy.

Article 80- Processing, Maintenance, and Use of Technical Information

The platform is authorized to process technical, system, security, and network information for objectives including ensuring information security, maintaining service stability, infrastructure management, performance analysis, software development, capacity analysis, security event management, fraud detection, responding to cyber attacks, complying with legal requirements, service quality management, training security algorithms, risk analysis, internal auditing, operations documentation, and other legitimate objectives.

The platform can also utilize technical information in the form of anonymous, pseudonymized, or aggregated data for statistical analyses, technology development, scientific research, training artificial intelligence systems, quality management, and managerial decision-making; provided that the fundamental rights and freedoms of users are not violated.

• Note 1: The duration of maintaining technical information will be determined based on security, legal, contractual, and operational requirements.
• Note 2: Access to technical information will be restricted to authorized persons and based on the principle of least privilege.
• Note 3: The platform can utilize encryption, access control, event logging, monitoring systems, intrusion detection systems, backups, alternative data centers, anonymization technologies, and other appropriate technical and managerial measures to protect technical information.

Chapter Nine: Location Information, Location-Based Services, Geographical Data, and Spatial Information Processing

Article 81- General Principles of Spatial Information Processing

The platform may collect, register, process, store, analyze, transmit, and maintain information related to the location of users, devices, orders, advertisements, stores, businesses, vehicles, consignments, drivers, couriers, customers, and other associated individuals within the limits of provided services, user consent, contractual necessity, legal requirements, or other valid legal grounds.

Spatial information may be processed in real-time, periodically, approximately, precisely, statically, or dynamically, and utilized for providing services, increasing security, operations management, market analysis, improving user experience, personalizing services, logistics management, fraud prevention, risk analysis, and other legitimate objectives.

• Note 1: Processing of location information shall be limited to the extent necessary for the realization of legitimate objectives.
• Note 2: The accuracy level of spatial information may vary in accordance with the type of service.
• Note 3: Deactivation of access to the location may result in the restriction of certain services.

Article 82- Sources of Location Information

The platform may receive location information from various sources, including GPS, GNSS, mobile network, Wi-Fi, Bluetooth, Beacons, IP address, browser information, operating system information, digital maps, information provided by the user, data registered in orders, transportation data, device information, satellite data, localization APIs, map service providers, cloud service providers, and other authorized sources.

• Note 1: The accuracy of location information may vary depending on the technology utilized.
• Note 2: The use of different localization sources can be performed simultaneously.
• Note 3: The platform shall not be responsible for errors derived from localization technologies outside its control.

Article 83- Location Information Provided by the User

The user may directly register information such as residential address, workplace address, store address, delivery address, advertisement location, business location, geographical coordinates, district name, city name, country name, postal code, movement route, delivery point, receipt point, travel information, goods transportation information, or other geographical information in the system.

The platform can process this information for providing services, public display, search, smart recommendations, order management, routing, market analysis, and other related objectives.

• Note 1: The responsibility for the accuracy of spatial information registered by the user shall rest upon them.
• Note 2: Provision of incorrect information may cause disruption in providing services.
• Note 3: The platform can match the registered information with other valid sources.

Article 84- Automatic Location Information

In the event that the relevant permissions are active, the platform may automatically receive the location information of the device.

This information may include geographical coordinates, altitude, movement speed, movement direction, location accuracy, location registration time, location registration date, movement route, stop points, geographical boundary, time zone, distance from specified points, district identifier, and other associated information.

• Note 1: Automatic collection of spatial information shall be subject to device settings and permissions granted by the user.
• Note 2: The platform may utilize alternative methods such as IP Location in the event that the localization permission is deactivated.
• Note 3: Certain capabilities will not be provideable without access to spatial information.

Article 85- Use of Spatial Information for Providing Services

The platform can utilize location information for providing services including displaying nearby advertisements, suggesting adjacent stores, calculating shipping costs, determining service boundaries, routing, determining approximate delivery time, transportation fleet management, order management, determining the appropriate driver, displaying local results, providing personalized recommendations, local market analysis, service area management, and other location-based services.

• Note 1: The use of spatial information must be proportionate to the type of service.
• Note 2: Spatial information may be combined with other user information.
• Note 3: Providing certain services shall be conditional upon localization being active.

Article 86- Location History and Geographical Records

The platform may register and maintain location history, routes traversed, points registered, geographical boundaries, travel records, goods delivery records, presence records in specified areas, drivers' activity records, couriers' activity records, order position records, and other historical spatial data for operational, security, contractual, statistical, managerial, or legal objectives.

• Note 1: The duration of maintaining location history will be determined based on the type of service and legal requirements.
• Note 2: Spatial history may be utilized for dispute resolution or handling complaints.
• Note 3: A portion of historical information may be anonymized after the termination of operational necessity.

Article 87- Spatial Information Related to Transportation and Logistics

In goods transportation services, consignment dispatch, order delivery, goods relocation, drivers' services, couriers' services, logistics services, or other similar services, the platform may process information related to the driver's location, vehicle location, consignment location, movement time, stop time, delivery time, movement route, distance traversed, traffic status, approximate arrival time, transportation status, and other associated information.

• Note 1: This information may be displayed to beneficiary users.
• Note 2: Transportation information can be used for analyzing service quality and fleet management.
• Note 3: The processing of information under this article shall be subject to security and contractual requirements.

Article 88- Analysis of Geographical Information and Service Personalization

The platform can utilize spatial information independently or together with other information for consumer behavior analysis, market analysis, geographical areas analysis, demand analysis, supply analysis, order density analysis, pricing management, service development, product recommendation, store recommendation, advertisement recommendation, local advertising, economic analysis, and training artificial intelligence models.

• Note 1: If possible, macro-analyses will be performed based on anonymous or aggregated data.
• Note 2: Spatial analyses must not lead to illegal discrimination among users.
• Note 3: Spatial information can be integrated with other statistical information.

Article 89- Sharing Spatial Information

The platform may share spatial information within the limits of the objectives of this policy and applicable laws with affiliates, map service providers, transportation service providers, cloud service providers, positioning service providers, data analysis companies, business partners, legal authorities, or other authorized persons.

Sharing information will be performed strictly within the limits of operational necessity, legal requirements, or valid contracts.

• Note 1: Persons receiving information shall be obligated to respect confidentiality requirements.
• Note 2: Cross-border transfer of spatial information shall be subject to international data transfer regulations.
• Note 3: The platform can anonymize or pseudonymize spatial information prior to transfer.

Article 90- Protection, Maintenance, and Deletion of Location Information

The platform is committed to protecting location information utilizing proportionate security measures including encryption, access control, event logging, security monitoring, access restriction, information segregation, anonymization, pseudonymization, backups, key management systems, managerial controls, and other conventional methods.

Spatial information will be maintained strictly until the duration necessary for the realization of processing objectives, contract execution, compliance with legal requirements, dispute resolution, security management, fraud prevention, conducting audits, or other legitimate objectives, and after the expiration of the maintenance period, it will be deleted, destroyed, or anonymized as the case may be.

• Note 1: Certain spatial information may be maintained for longer durations due to legal or judicial requirements.
• Note 2: Users can proceed to manage certain localization settings within the limits of laws and technical features of the platform.
• Note 3: Deletion of spatial information shall not prevent the maintenance of anonymous, aggregated, or statistical records that lack the capability of attribution to a specific person.

Chapter Ten: Financial Information, Payment, Invoicing, Electronic Wallet, Settlement, and Records of Financial Transactions

Article 91- General Principles of Financial Information Processing

In order to provide services, perform financial transactions, manage payments, settlements, execute contracts, comply with tax requirements, comply with anti-money laundering regulations, prevent fraud, manage risk, resolve disputes, provide support services, manage refunds, manage electronic wallet, manage commissions, manage credits, and other legitimate objectives, the platform collects, registers, processes, stores, transmits, and maintains financial information associated with users.

The processing of financial information will always be performed respecting the principles of necessity, proportionality, security, confidentiality, and purpose limitation.

• Note 1: Financial information will be processed strictly within the limits of operational need or legal requirements.
• Note 2: The platform is committed to protecting users' financial information against unauthorized access.
• Note 3: The processing of financial information shall be subject to the requirements of this policy, relevant contracts, and applicable laws.

Article 92- Types of Processable Financial Information

The platform may process information including transaction amount, currency utilized, transaction ID, order number, payment status, payment time, payment method, settlement ID, invoice number, tax information, refund information, wallet records, credit records, commission records, discount records, coupon records, gift records, value-added tax-related information, shipping cost, service fee, commissions, payment identifier, payment gateway-related information, merchant-related information, seller-related information, and other associated information.

• Note 1: Financial information may be integrated with other transactional or contractual information.
• Note 2: Certain financial information will be maintained for compliance with accounting and tax requirements.
• Note 3: Information under this article may also be utilized for analyzing the financial performance of the platform.

Article 93- Information Related to Payment Methods

The platform may register and process information related to the payment method selected by the user, including online payment, payment through electronic wallet, payment through internal credit, installment payment, in-person payment, payment through bank gateways, payment through payment companies, corporate payment, or other authorized methods.

• Note 1: The choice of payment method may vary based on the type of service or geographical location.
• Note 2: Information related to the payment method may be analyzed to prevent fraud.
• Note 3: The platform can add new payment methods or discontinue certain methods at any time.

Article 94- Bank Card Information and Payment Tools

In the event that bank card information or payment tools are provided by the user, the platform will refrain to the extent possible from storing complete bank card information, CVV, secondary password, PIN, or other sensitive payment information, and will utilize tokenization, encryption, masking, or other conventional security methods.

• Note 1: The major portion of payment operations may be performed by authorized payment service providers.
• Note 2: The platform shall not be responsible for maintaining information that is directly processed by the payment provider, except within the limits of the law or contract.
• Note 3: Users must not send their confidential bank card information through chat or other communication tools of the platform.

Article 95- Electronic Wallet and Internal Credit

In the event of providing electronic wallet services, the platform may register and process information related to the balance, credit increase, credit decrease, credit transfer, gifts, prizes, promotional credit, incentive credit, returned credit, loyalty points, expiration date, credit consumption history, credit transfer history, and other associated information.

• Note 1: The electronic wallet will be usable strictly within the framework of conditions declared by the platform.
• Note 2: Incentive credits may not be transferable or convertible to cash.
• Note 3: The platform can apply restrictions on the use of the wallet to prevent misuse.

Article 96- Invoices, Financial Documents, and Accounting Records

The platform may issue, store, and process invoices, bills, financial documents, receipts, payment documents, settlement documents, credit documents, refund documents, financial reports, tax reports, accounting reports, commission records, expense records, and other documents associated with financial operations.

• Note 1: Financial documents may be issued and maintained electronically.
• Note 2: Financial documents will be maintained within the limits of tax and accounting laws.
• Note 3: The platform can prepare backup copies of financial documents.

Article 97- Refund, Return of Funds, and Modification of Transactions

The platform may register and process information related to refund requests, return of funds, transaction modification, order cancellation, payment reversal, financial disputes, user objections, financial examinations, arbitration decisions, dispute settlements, and other associated information.

• Note 1: Refunds shall be subject to the laws, contracts, and financial policies of the platform.
• Note 2: Refund information may be used for risk analysis and fraud prevention.
• Note 3: Some refunds may necessitate re-authentication of the user.

Article 98- Financial Analysis, Risk Management, and Fraud Prevention

The platform can process financial and transactional information for analyzing payment patterns, discovering unusual transactions, detecting money laundering, countering illegal financing, detecting misuse, risk management, credit scoring, quality control, claims management, economic analysis, market analysis, financial behavior analysis, and developing financial artificial intelligence systems.

• Note 1: Analyses under this article may be performed in an automated or semi-automated manner.
• Note 2: The existence of a risk indicator shall not imply the commission of a violation by the user.
• Note 3: The platform can utilize information from other chapters of this policy to complete financial analyses.

Article 99- Sharing Financial Information

The platform can share financial information within the limits of necessity with payment service providers, banks, financial institutions, electronic wallet companies, tax service providers, auditors, financial consultants, affiliates, business partners, regulatory authorities, tax authorities, judicial authorities, anti-money laundering authorities, countering financing of terrorism authorities, and other persons possessing legal authorization.

• Note 1: Sharing information will be limited to the information required for the realization of the purpose.
• Note 2: Persons receiving information shall be obligated to respect information confidentiality.
• Note 3: Cross-border transfer of financial information shall be subject to international data transfer regulations.

Article 100- Security, Maintenance, and Deletion of Financial Information

The platform protects users' financial information employing appropriate security controls including encryption, access control, key management, event logging, intrusion detection systems, risk management systems, backups, auditing controls, segregation of operational environments, security audits, change control, tokenization technologies, and other appropriate technical and managerial measures.

Financial information will be maintained strictly until the duration necessary for providing services, contract execution, compliance with accounting, tax, judicial, anti-money laundering requirements, dispute management, responding to competent authorities, or other legitimate objectives, and after the expiration of the maintenance period, it will be deleted, destroyed, or anonymized as the case may be.

• Note 1: Deletion of financial information shall not prevent the maintenance of records the maintenance of which is mandated by law.
• Note 2: Access to financial information will be possible strictly for authorized persons and based on the principle of least privilege.
• Note 3: The platform can utilize anonymous or aggregated financial information for statistical analysis, financial planning, service development, business management, and training analytical models, provided that the possibility of its attribution to a specific person does not exist.

Chapter Eleven: Sources of Information Collection from Third Parties, Public Sources, Business Partners, Service Providers, and Other Authorized Sources

Article 101- General Principles of Receiving Information from Third Sources

In addition to information directly provided by users or automatically created in the course of using services, the platform may receive and process information from third parties, public sources, affiliates, business partners, service providers, legal authorities, authentication systems, financial systems, payment systems, transportation systems, advertising systems, data analysis systems, social networks, authorized databases, or other legal sources.

Receiving information from third parties will be performed strictly within the limits of legitimate objectives, legal requirements, valid contracts, user consent, or other authorized legal grounds.

• Note 1: Receiving information from third parties shall not reduce the responsibility of the platform in protecting information.
• Note 2: Information received from third parties may be matched with existing information in the system.
• Note 3: The platform will perform necessary actions to evaluate the accuracy of information proportionate to the type of information, level of certainty, and source of receipt.

Article 102- Information Received from Affiliates and Subsidiaries

The platform can receive users' information from the parent company, subsidiaries, affiliates, companies under common control, corporate branches, corporate brands, or other persons associated with the corporate group; provided that the transfer of information is necessary for providing services, joint account management, service integration, compliance with legal requirements, information security, product development, or other legitimate objectives.

• Note 1: Transfer of information among affiliates must be performed in accordance with this policy and internal contracts.
• Note 2: Affiliates shall be obligated to respect an appropriate level of information protection.
• Note 3: In the event of cross-border transfer of information, international data transfer regulations will also be respected.

Article 103- Information Received from Payment Service Providers and Financial Institutions

The platform may receive information associated with payment status, transaction status, payment ID, refund status, settlement status, financial credit, account status, anti-fraud information, financial authentication-related information, compliance with anti-money laundering regulations-related information, and other associated information from banks, financial institutions, payment service providers, electronic wallet providers, or other authorized financial institutions.

• Note 1: Received information will be utilized strictly for financial, security, contractual, or legal objectives.
• Note 2: The platform can utilize the aforementioned information for validating transactions.
• Note 3: Receiving financial information shall be subject to banking laws and applicable financial regulations.

Article 104- Information Received from Authentication Service Providers

The platform can utilize the services of specialized authentication providers to perform authentication processes, document validation, identity control, residency control, license checks, legal representation checks, identity fraud detection, document authenticity control, company validation, or other similar processes.

Information received may include validation result, authentication status, risk level, document status, residency status, license status, or other associated information.

• Note 1: The platform will not necessarily receive all baseline information existing with the authentication provider.
• Note 2: Authentication information will be used strictly within the limits of operational and legal need.
• Note 3: The use of authentication services may necessitate limited transfer of information to third parties.

Article 105- Information Received from Business Partners and Service Providers

The platform may receive information associated with users from transportation service providers, logistics companies, insurance companies, map service providers, cloud service providers, cybersecurity companies, SMS service providers, email service providers, data analysis providers, advertising companies, artificial intelligence providers, call centers, quality control companies, marketing service providers, or other business partners.

• Note 1: Information received must be proportionate to the objective of cooperation.
• Note 2: The platform can apply contractual restrictions to prevent receiving unnecessary information.
• Note 3: Cooperation with third parties shall not prevent the legal responsibilities of the platform in protecting information.

Article 106- Information Received from Public Sources

The platform can collect and process information published in public sources, legal databases, company registration systems, trademark registration systems, business license systems, government systems, public websites, public social networks, public information systems, search engines, advertisement publication systems, judicial information systems, tender and auction systems, or other authorized public sources within the limits of respective laws.

• Note 1: The public nature of information shall not necessarily imply the authorization of unrestricted use thereof.
• Note 2: Public information may also be considered personal information in the event of its capability of attribution to a person.
• Note 3: The platform will respect the legal restrictions of using public information proportionate to the type of information.

Article 107- Information Received from Other Users

In the course of using services, users may register information about other users including contact information, delivery information, representatives' information, drivers' information, goods recipients' information, contacts' information, complaints' information, violation report information, dispute-related information, payment information, or other associated information in the system.

The platform can process this information for executing services, resolving disputes, handling complaints, complying with legal requirements, preventing fraud, or other legitimate objectives.

• Note 1: Legal responsibility for providing third-party information shall rest upon the providing user.
• Note 2: The platform can perform necessary investigations in the event of receiving a valid objection regarding registered information.
• Note 3: Processing of this information shall be subject to other provisions of this policy.

Article 108- Information Received from Legal Authorities and Regulatory Bodies

The platform may receive users' information from judicial authorities, law enforcement authorities, regulatory bodies, tax organizations, anti-money laundering authorities, consumer protection organizations, regulatory entities, licensing organizations, company registration authorities, customs organizations, or other competent authorities.

• Note 1: Receiving information from legal authorities will be performed within the limits of the legal powers of those authorities.
• Note 2: Received information will be utilized strictly for legal, contractual, or security objectives.
• Note 3: The platform can maintain records of legal requests for auditing and accountability objectives.

Article 109- Matching, Completing, and Validating Information

The platform can match information received from different sources with existing information in the system, complete, validate, amend, or analyze it to ensure information accuracy, prevent fraud, comply with legal requirements, manage risk, enhance security, improve service quality, develop data analysis algorithms, train artificial intelligence models, or other legitimate objectives.

• Note 1: In the event of observing a fundamental discrepancy, the platform can request the user to provide supplementary documents.
• Note 2: Contradictory information may result in the restriction of certain services until the completion of investigations.
• Note 3: Decisions based on information validation must be proportionate, documented, and reviewable.

Article 110- Restrictions and Requirements for Processing Third-Source Information

The platform is committed to processing information received from third parties strictly within the limits of declared objectives, legal requirements, valid contracts, users' consent, or other valid legal grounds, and to refrain from unnecessary collection, maintenance, or use of information.

The platform is also committed to deleting, anonymizing, or pseudonymizing unnecessary information if possible, and to applying appropriate technical and organizational measures to protect information received from third sources.

• Note 1: Access to third-source information will be possible strictly for authorized persons.
• Note 2: Transfer of third-source information to other persons will be authorized strictly within the limits of this policy and applicable laws.
• Note 3: Processing of information received from third sources shall be subject to all fundamental principles of data protection, including lawfulness, transparency, proportionality, security, purpose limitation, data minimization, and maintenance duration limitation.

Chapter Twelve: Objectives of Personal Information Processing, Methods of Using Information, and Legitimate Purposes of Data Processing

Article 111- Principle of Purpose Limitation and Lawfulness of Information Use

The platform will process personal information, technical information, financial information, behavioral information, location information, transactional information, communication information, security information, user-generated information, and other associated data strictly for specified, legitimate, transparent, proportionate objectives aligned with applicable laws.

No use of information outside the objectives declared in this policy or outside the limits of user consent, contract, legal requirements, or other valid legal grounds will be performed unless a new legal basis is created.

• Note 1: Amendment of processing purpose must not lead to the violation of fundamental rights of users.
• Note 2: In the event of a fundamental change in processing objectives, the platform will proceed to notify or obtain new consent as the case may be.
• Note 3: Processing objectives may be revised in accordance with service development, change of laws, or security requirements.

Article 112- Providing, Managing, and Executing Platform Services

The platform processes users' information for creating user accounts, account management, authentication, providing services, publishing advertisements, creating stores, order management, performing transactions, payment management, transportation management, providing financial services, providing communication services, providing location-based services, providing artificial intelligence services, contract management, subscription management, providing special services, providing corporate services, and executing other current or future services.

• Note 1: Processing of information under this article will be performed to the extent necessary for executing services.
• Note 2: Failure to provide certain information may prevent providing certain services.
• Note 3: Development of new services can necessitate processing supplementary information.

Article 113- Managing Contractual Relationships and Executing Obligations

Users' information may be utilized for contract conclusion, contract execution, obligation management, management of parties' rights, providing after-sales services, subscription management, warranty management, commission management, sellers management, buyers management, refund management, contractual dispute management, debt collection, settlements, executing service terms of use, and other contractual objectives.

• Note 1: Processing of information under this article will require proportionality with contract provisions.
• Note 2: Termination of contract shall not prevent information maintenance within the limits of legal requirements.
• Note 3: Contractual documents may be maintained as documentation for information processing.

Article 114- Information Security, System Security, and Risk Management

The platform will process users' information for maintaining system security, managing security risks, intrusion detection, preventing cyber attacks, security event management, preventing unauthorized access, identity fraud detection, discovering suspicious activities, threat analysis, preventing misuse, crisis management, infrastructure protection, vulnerability analysis, event logging, security auditing, and other security objectives.

• Note 1: Processing of security information may be performed continuously.
• Note 2: Security information can be integrated with threat analysis systems.
• Note 3: Security measures must be proportionate to the risk level of information.

Article 115- Countering Fraud, Money Laundering, and Misuse

The platform can process users' information for preventing, discovering, investigating, and documenting fraud, money laundering, financing of illegal activities, service misuse, nominal transactions, identity theft, advertising misuse, financial misuse, wallet misuse, API misuse, bot activities, organized illegal activities, bypassing platform rules, or other similar activities.

• Note 1: Processing of information for risk management may be performed automatically.
• Note 2: Risk indicators on their own shall not be considered definitive proof of committing a violation.
• Note 3: The platform can share risk analysis results with competent authorities or authorized persons.

Article 116- Communication with Users and Providing Support Services

Users' information may be utilized for responding to requests, handling complaints, resolving disputes, sending service notifications, sending security messages, sending contractual messages, sending important notices, providing guidance, providing support services, tracking orders, managing tickets, telephone calls, communication through email, SMS, internal messenger, in-app notifications, or other communication methods.

• Note 1: Some communications are mandatory for contract execution or law compliance and will not be deactivatable.
• Note 2: The platform can maintain communication records for legal and security objectives.
• Note 3: Marketing communications shall be subject to user settings and respective laws.

Article 117- Data Analysis, Service Development, and Innovation

The platform can process users' information for market analysis, consumer behavior analysis, service quality analysis, system performance analysis, developing new products, developing new services, improving user interface, algorithm development, training artificial intelligence models, developing recommender systems, developing search systems, developing anti-fraud systems, economic analysis, business planning, capacity management, and other research and development objectives.

• Note 1: If possible, analyses will be performed based on anonymous or pseudonymized data.
• Note 2: Research use of information must not lead to the violation of users' rights.
• Note 3: Analytical data may be utilized in an aggregated manner for management reports.

Article 118- Personalization of Services and User Experience

The platform may process users' information for personalizing the homepage, search results, advertisements, product or service recommendations, stores, notifications, discounts, content, marketing campaigns, user interface, smart suggestions, and other similar features.

• Note 1: Users may manage certain personalization features within the limits of the platform's capabilities.
• Note 2: Personalization shall not lead to illegal discrimination or unfair restriction of users.
• Note 3: Certain personalization features will be based on automated information analysis.

Article 119- Compliance with Legal, Regulatory, and Judicial Requirements

The platform shall process users' information for legal enforcement, compliance with tax regulations, anti-money laundering regulations, consumer protection regulations, e-commerce regulations, data protection regulations, execution of judicial orders, cooperation with regulatory authorities, responding to legal requests, litigation management, defending the company's legal rights, enforcement of judgments, and other legal requirements.

• Note 1: Legal requirements may take precedence over requests for information deletion.
• Note 2: Information will be disclosed strictly within the limits of the legal request unless the law stipulates otherwise.
• Note 3: Records of cooperation with legal authorities may be maintained for auditing purposes.

Article 120- Statistical, Research, Managerial, and Commercial Objectives

The platform may utilize anonymous, pseudonymized, aggregated, or personal information—within the limits of valid legal grounds—for preparing statistical reports, analyzing economic indicators, analyzing market trends, analyzing consumer behavior, strategic management, demand forecasting, development planning, business intelligence development, training machine learning models, competitive analysis, operational performance analysis, quality management, scientific research, technology development, and other legitimate commercial or managerial objectives.

• Note 1: Where possible, information used for macro-analyses will be processed in an anonymous or non-attributable manner.
• Note 2: Statistical use of information must not enable the direct identification of users.
• Note 3: None of the objectives mentioned in this article shall create a license to use information contrary to the principles of lawfulness, proportionality, transparency, security, data minimization, purpose limitation, or other fundamental principles of this policy.

Chapter Thirteen: Data Analysis, Profiling, Automated Decision-Making, Service Personalization, Algorithms, Machine Learning, and Artificial Intelligence

Article 121- General Principles of Data Analysis and Intelligent Information Processing

The platform may process, analyze, and model users' information manually, semi-automatically, or fully automatically for the purposes of providing services, improving user experience, enhancing security, technology development, risk management, fraud prevention, analyzing user behavior, market analysis, product development, system performance optimization, capacity management, service personalization, providing smart suggestions, economic analysis, quality management, conducting research, training machine learning models, and other legitimate objectives.

These processes may be conducted using statistical algorithms, artificial intelligence systems, machine learning models, recommender systems, intelligent search engines, predictive models, behavior analysis systems, anomaly detection systems, fraud detection systems, natural language processing systems, machine vision systems, ranking models, and other similar technologies.

• Note 1: The use of intelligent technologies must be performed observing the principles of lawfulness, transparency, proportionality, security, and respect for users' rights.
• Note 2: The use of intelligent algorithms must not lead to illegal discrimination, unfair treatment, or violation of users' fundamental rights.
• Note 3: The platform may modify the technologies utilized in accordance with technological progress or operational needs.

Article 122- User Behavior Analysis

The platform may analyze information related to how users utilize services, search history, browsing records, click records, duration of use, interaction with advertisements, interaction with sellers, interaction with marketing, purchase records, sales records, payment records, order cancellation records, complaint records, violation report records, temporal patterns of use, spatial patterns of use, interaction with the user interface, and other behavioral indicators.

The purpose of these analyses includes improving services, product development, enhancing security, service personalization, quality management, market analysis, demand analysis, supply analysis, algorithm development, and other legitimate objectives.

• Note 1: User behavior analysis may be performed continuously.
• Note 2: Behavioral analyses may also be performed based on anonymous or pseudonymized data.
• Note 3: The platform is committed to refraining from unnecessary or disproportionate use of behavioral information.

Article 123- User Profiling

The platform may create analytical, commercial, security, operational, or behavioral profiles for users based on available information.

These profiles may include probable interests, preferred categories, purchase patterns, sales patterns, engagement level, activity history, loyalty indicators, risk indicators, security indicators, service quality indicators, responsiveness indicators, credit indicators, performance indicators, probability of order completion, probability of user return, probability of order cancellation, probability of fraud, or other analytical indicators.

• Note 1: Created profiles may be used strictly for the platform's internal use.
• Note 2: Profiling must not lead to the unfair deprivation of users' rights.
• Note 3: Users may object to certain processing based on profiling within the limits of applicable laws.

Article 124- Automated Decision-Making

The platform may use automated or semi-automated decision-making in certain processes for fraud detection, risk management, content ranking, seller ranking, product ranking, order prioritization, abnormal activity detection, advertisement management, recommendation management, quality control, inappropriate content detection, security management, request processing, account management, or other similar processes.

• Note 1: Fully automated decisions must be reviewable by human personnel to the extent possible.
• Note 2: Automated decisions must not be based on incorrect or discriminatory information.
• Note 3: Where the law stipulates, users shall have the right to request human review of automated decisions.

Article 125- Service and Content Personalization

The platform may process users' information to personalize the user interface, homepage, search results, categories, stores, product recommendations, service recommendations, notifications, advertisements, marketing campaigns, discounts, smart results, and other similar services.

• Note 1: Service personalization will be performed based on the analysis of available data and user settings.
• Note 2: Users may manage certain personalization features within the limits of technical capabilities.
• Note 3: Personalization must not lead to unjustified discrimination among users.

Article 126- Training Artificial Intelligence and Machine Learning Models

The platform may use anonymous, pseudonymized, aggregated information, or—in cases with a valid legal basis—personal information for training, testing, validating, tuning, optimizing, and developing artificial intelligence models, machine learning models, natural language processing models, image analysis models, recommender models, predictive models, fraud detection models, risk management models, market analysis models, and other similar models.

• Note 1: Where possible, training of models will be performed based on anonymous or non-attributable data.
• Note 2: Use of sensitive information for training models shall be subject to legal limitations and heightened security requirements.
• Note 3: The platform may use specialized service providers to develop artificial intelligence models.

Article 127- Statistical Analysis, Market Analysis, and Business Intelligence

The platform may process users' information for analyzing market trends, supply and demand analysis, price analysis, consumer behavior analysis, seller performance analysis, advertisement performance analysis, geographical area analysis, campaign analysis, economic analysis, financial analysis, service quality analysis, competitor analysis, capacity management, development planning, budgeting, and other objectives related to business intelligence.

• Note 1: Macro-analyses will be performed based on aggregated data to the extent possible.
• Note 2: Statistical data may be used in managerial or research reports.
• Note 3: The use of statistical information must not lead to user identification, unless within the limits of the law.

Article 128- Security Analysis and Anomaly Detection Systems

The platform may use security analysis algorithms, anomaly detection systems, fraud detection models, abnormal behavior analysis systems, risk analysis systems, cyberattack analysis systems, user session analysis systems, network analysis systems, financial transaction analysis systems, and other similar technologies to protect the infrastructure and users.

• Note 1: Security analyses may be performed without prior notice and on a continuous basis.
• Note 2: Results of security analysis may be the basis for temporary restriction of certain services.
• Note 3: Applied restrictions must be proportionate to the level of risk identified.

Article 129- Processing Anonymous, Pseudonymized, and Aggregated Data

The platform may convert users' information into non-attributable data through anonymization, pseudonymization, aggregation, or other technical methods, and utilize such data for research, technology development, training artificial intelligence models, market analysis, service development, managerial reports, research collaborations, economic analysis, statistical analysis, product development, and other legitimate objectives.

• Note 1: The platform is committed to using anonymous data in macro-analyses to the extent possible.
• Note 2: Anonymization must be performed such that the possibility of re-identification of individuals is minimized.
• Note 3: In the event of the possibility of re-identification, the data shall again be subject to personal information requirements.

Article 130- Ethical Principles, Transparency, and Accountability in Artificial Intelligence Use

The platform is committed to observing the principles of transparency, accountability, security, justice, non-discrimination, auditability, explainability, protection of personal data, data minimization, purpose limitation, organizational responsibility, and respect for users' fundamental rights in the development and use of artificial intelligence systems, machine learning, data analysis, and automated decision-making.

The platform is also committed to managing the use of artificial intelligence systems such that users' interests, information security, public trust, and legal requirements are considered in all stages of design, training, deployment, operation, and updating of these systems.

• Note 1: The platform may periodically evaluate artificial intelligence models and algorithms used from the perspectives of security, accuracy, justice, and quality.
• Note 2: The use of artificial intelligence systems shall not preclude the platform's legal responsibility regarding information processing.
• Note 3: Any development or use of new data processing technologies must be performed observing the fundamental principles of this policy, users' rights, and applicable laws.

Chapter Fourteen: Authentication, Know Your Customer (KYC), Anti-Money Laundering (AML), Countering the Financing of Illegal Activities, Risk Management, and Fraud Prevention

Article 131- General Principles of Authentication and Legal Compliance

In order to maintain service security, create a reliable environment for transactions, prevent identity theft, counter fraud, comply with legal requirements, enforce anti-money laundering regulations, counter the financing of illegal activities, comply with tax requirements, comply with e-commerce regulations, protect users, manage risk, comply with financial partners' requirements, and other legitimate objectives, the platform may execute processes of authentication, validation, Know Your Customer (KYC), background checks, risk assessment, and compliance controls.

These processes may be executed before account creation, during service use, before performing transactions, when changing information, when increasing access levels, when using financial services, when creating a store, when registering a company, when withdrawing funds, when transferring credit, or at any other time the platform deems necessary.

• Note 1: The level of authentication shall be determined in proportion to the type of service, risk level, transaction amount, legal requirements, and internal policies.
• Note 2: The platform may repeat authentication processes throughout the duration of service use.
• Note 3: Execution of authentication processes shall not preclude the application of other security controls.

Article 132- Information Receivable for Authentication

The platform may, as the case may be, receive and process information including full name, date of birth, nationality, phone number, email address, personal image, selfie image, image of identity documents, passport image, residence card, national ID card, driver's license, residency information, company information, activity licenses, tax information, banking information, legal representative information, electronic signature, authorized biometric information, video information, audio information, spatial information, device information, network information, transaction information, and other necessary information.

• Note 1: The platform will demand information strictly proportionate to the level of authentication.
• Note 2: Information received for authentication may also be used for other security and legal objectives.
• Note 3: Provision of incorrect, forged, or information belonging to other persons is prohibited and may result in legal actions or restriction of services.

Article 133- Authentication Methods

The platform may use various authentication methods including phone number-based authentication, email-based authentication, one-time password (OTP) authentication, two-factor authentication (2FA), biometric authentication, image matching, video matching, document matching, bank information matching, tax information matching, corporate information matching, artificial intelligence-based authentication, government service-based authentication, specialized provider-based authentication, or other valid methods.

• Note 1: The platform may execute more than one authentication method simultaneously.
• Note 2: Authentication methods may vary based on country, service type, or risk level.
• Note 3: The platform may request supplementary authentication if it detects risk.

Article 134- Know Your Customer (KYC)

The platform may execute KYC processes to identify users, sellers, businesses, legal entities, legal representatives, account owners, fund recipients, beneficial owners, company directors, store owners, and other associated individuals.

These processes may include identity verification, ownership structure verification, residency status verification, license verification, economic activity verification, source of funds verification, business relationship verification, public record verification, sanctions verification, regulatory watchlist verification, geographical risk verification, and other similar controls.

• Note 1: The level of KYC shall be determined in proportion to the risk level.
• Note 2: The platform may demand supplementary documents to complete the KYC process.
• Note 3: Completion of KYC may be a condition for using certain services.

Article 135- Anti-Money Laundering (AML) and Countering the Financing of Illegal Activities

The platform may process, analyze, and monitor users' information and their transactions to comply with anti-money laundering regulations, counter the financing of illegal activities, prevent the misuse of financial services, prevent the use of intermediary accounts, prevent nominal transactions, prevent suspicious transactions, manage financial risk, and comply with regulatory bodies' requirements.

• Note 1: Abnormal transactions may be subjected to supplementary investigation.
• Note 2: The platform may restrict the provision of financial services until investigations are completed.
• Note 3: Execution of this article shall be subject to anti-money laundering laws and regulations of competent bodies.

Article 136- Risk Assessment of Users and Transactions

The platform may proceed to assess the risk level of users, accounts, transactions, stores, orders, or other associated activities based on identity information, financial information, spatial information, behavioral information, device information, network information, security information, transactional information, activity records, complaint records, violation records, anti-fraud indicators, artificial intelligence analyses, public source information, and other authorized information.

• Note 1: Risk assessment models may change dynamically.
• Note 2: A risk indicator is merely one factor in decision-making and shall not be considered evidence of a violation on its own.
• Note 3: Results of risk assessment may be used for determining access levels or applying security controls.

Article 137- Fraud Detection, Identity Theft, and Misuse of Services

The platform may use analytical systems, artificial intelligence algorithms, anomaly detection systems, behavior analysis, network analysis, device analysis, spatial location analysis, and other similar technologies to detect identity theft, use of rented accounts, creation of multiple accounts, bot activities, advertisement misuse, discount misuse, wallet misuse, gift code misuse, API misuse, nominal transactions, fake orders, manipulation of scores, manipulation of rankings, loyalty program misuse, money laundering, unauthorized transfer of funds, bypassing restrictions, or other similar activities.

• Note 1: Anti-fraud analyses may be performed fully automatically.
• Note 2: The platform may temporarily restrict a user account or transaction in the event of high risk.
• Note 3: Restriction of services until the completion of investigations shall not constitute proof of violation.

Article 138- Cooperation with Competent Authorities and Regulatory Bodies

The platform may, within the limits of applicable laws, provide necessary information to competent authorities for the enforcement of anti-money laundering regulations, countering the financing of illegal activities, enforcement of judicial orders, execution of regulatory bodies' orders, enforcement of tax regulations, enforcement of banking regulations, enforcement of e-commerce regulations, or other legal requirements.

• Note 1: Transfer of information will be performed strictly within the limits of the requesting authority's legal powers.
• Note 2: Records of cooperation with legal authorities may be maintained for auditing and accountability objectives.
• Note 3: Execution of this article shall not be considered a breach of the platform's confidentiality obligations.

Article 139- Maintenance of Authentication Records and Compliance Controls

The platform may maintain information and records related to authentication, documents provided, validation results, KYC records, AML records, risk analysis records, security control records, records of communication with legal authorities, compliance decision records, violation investigation records, and other associated information for the duration necessary for compliance with legal, contractual, security, tax, auditing, or dispute management requirements.

• Note 1: The duration of information maintenance shall be subject to applicable laws and internal policies.
• Note 2: Access to information under this article shall be limited to authorized persons.
• Note 3: Expired information will be deleted, destroyed, or anonymized as the case may be, unless the law mandates their maintenance.

Article 140- User Rights, Proportionality of Processing, and Protection of KYC and AML Information

The platform is committed to processing all information collected in processes of authentication, KYC, AML, risk assessment, and fraud prevention observing the principles of lawfulness, proportionality, data minimization, purpose limitation, security, confidentiality, accountability, access control, and other fundamental principles of data protection.

Users may exercise requests for access, correction, or other rights stipulated in this policy regarding their information within the limits of applicable laws, provided that the exercise of these rights does not conflict with legal, security, judicial, tax, or anti-money laundering requirements.

• Note 1: Request for deletion of information may not be executable regarding records whose maintenance is mandated by law.
• Note 2: The platform may maintain a portion of authentication information even after the termination of the contractual relationship for the purpose of maintaining system security and compliance with regulations.
• Note 3: Processing of information under this chapter must always be proportionate to the risk level, legitimate objectives, and legal requirements, and unnecessary collection or maintenance of information must be avoided.

Chapter Fifteen: Service Communications, Marketing, Advertising, Notification, Commercial Messages, Personalization of Communications, and Management of User Consent

Article 141- General Principles of Electronic Communications and Notification

In order to provide services, execute contracts, maintain security, manage user accounts, provide support, notify service changes, notify contract changes, notify internal policy changes, notify order status, notify payment status, notify security events, notify account changes, provide commercial offers, execute loyalty programs, execute marketing campaigns, develop user relations, and other legitimate objectives, the platform may use various communication methods to send messages to users.

These communications may be performed through SMS, telephone calls, email, internal messenger, in-app notifications, Push Notifications, website messages, user panel messages, social media messages, automated messages, intelligent chat systems, service bots, automated response systems, or other authorized communication methods.

• Note 1: The communication method used shall be determined based on service type, user settings, legal requirements, and operational necessity.
• Note 2: Certain messages have a mandatory nature and it will not be possible to deactivate them.
• Note 3: The platform may maintain communication records for security, contractual, legal, and managerial objectives.

Article 142- Service and Operational Messages

The platform may send service messages related to account creation, account login, authentication, password change, account information change, order status, payment status, shipping status, delivery status, refund, change in terms of use, change in internal policies, security notifications, security warnings, complaint status, request status, ticket status, system notifications, technical announcements, and other necessary communications to users.

• Note 1: Sending service messages is considered part of the service provision process.
• Note 2: These messages may be sent even if marketing communications are deactivated.
• Note 3: Failure to receive service messages due to incorrect contact information or disruptions outside the platform's control shall not create liability for the platform.

Article 143- Marketing and Advertising Messages

The platform may send information related to products, services, stores, advertisements, special offers, discounts, festivals, marketing campaigns, new services, supplementary services, loyalty programs, friend referral programs, personalized offers, location-based offers, user behavior-based offers, past purchase-based offers, previous search-based offers, or other commercial offers to users.

• Note 1: Sending marketing messages shall be subject to the user's consent or communication settings in applicable cases.
• Note 2: Users may deactivate the receipt of a portion of advertising messages within the limits of the platform's capabilities.
• Note 3: Deactivation of advertising messages shall not affect the receipt of service messages.

Article 144- Personalization of Communications and Advertising

The platform may process information related to user behavior, purchase records, sales records, search records, geographical location, interests, preferred categories, followed stores, interaction history with advertisements, device information, campaign information, loyalty information, statistical analyses, and other authorized information to personalize communications and advertisements for increasing the relevance of messages to users' needs.

• Note 1: Personalization must be performed observing the principles of proportionality, lawfulness, and transparency.
• Note 2: Personalization must not lead to unfair discrimination or illegal restriction of users.
• Note 3: Users may manage certain personalization settings within the limits of the system's capabilities.

Article 145- Loyalty Programs, Scoring, and Incentive Campaigns

The platform may process users' information for executing loyalty programs, scoring, gift credits, discount codes, prizes, competitions, raffles, cashback programs, promotional credit, incentive credit, customer clubs, friend referral programs, and other incentive programs.

This information may be used for calculating points, assessing conditions for using benefits, allocating rewards, analyzing campaign effectiveness, preventing misuse, risk management, and other related objectives.

• Note 1: Specific conditions of each program may be announced in separate regulations.
• Note 2: The platform may proceed to cancel points or benefits in the event of detecting misuse.
• Note 3: Certain benefits may be limited to geographical areas or specific groups of users.

Article 146- Telephone, Audio, and Video Communications

The platform may establish telephone, audio, or video contact with users for providing services, support, authentication, handling complaints, quality control, training staff, dispute resolution, security management, tracking orders, managing financial services, or other legitimate objectives.

• Note 1: Calls may be recorded in accordance with applicable laws.
• Note 2: Call recording will be performed strictly for legitimate, security, or training objectives.
• Note 3: Information resulting from calls shall be subject to all regulations of this policy.

Article 147- Artificial Intelligence-Based and Automated System Communications

The platform may use intelligent response systems, chatbots, virtual assistants, natural language processing systems, automated response systems, smart recommendation systems, ticket management systems, sentiment analysis systems, automatic translation systems, or other technologies based on artificial intelligence for communicating with users.

• Note 1: Users may interact with automated systems in some communications.
• Note 2: Referral of requests to human personnel will be provided where necessary.
• Note 3: Use of intelligent systems shall not preclude the platform's responsibility regarding information protection.

Article 148- Consent Management, Communication Preferences, and Unsubscription

The platform may provide users the capability to manage communication settings, select communication channels, select message types, manage notifications, manage personalized advertising, unsubscribe from newsletters, cancel receipt of advertising messages, manage marketing messages, and other related settings.

• Note 1: Implementation of changes in settings may require a reasonable duration.
• Note 2: Canceling receipt of advertising messages shall not prevent receipt of security or contractual messages.
• Note 3: Certain settings may affect user experience or access to certain services.

Article 149- Analysis of Communication Effectiveness and Marketing Campaigns

The platform may analyze information related to sending, delivery, opening, viewing, clicking, response, engagement rate, conversion rate, unsubscription rate, return rate, participation rate, viewing time, advertisement performance, campaign performance, message performance, user behavior after receiving messages, and other similar indicators.

The purpose of these analyses includes improving communication quality, optimizing campaigns, content personalization, increasing advertising efficiency, service development, and user experience management.

• Note 1: Analyses under this article may be performed using automated technologies.
• Note 2: Analytical data may be used in an anonymous or aggregated manner.
• Note 3: Communication analysis must not lead to the violation of users' information confidentiality.

Article 150- Protection of Communication Information and Limitation on Their Use

The platform is committed to processing information related to communications, messages, notifications, calls, communication settings, campaign records, marketing records, user consent records, unsubscription records, message interaction records, and other information under this chapter observing the principles of security, confidentiality, purpose limitation, data minimization, access control, proportionality, and accountability.

This information will be maintained strictly until the duration necessary for the realization of legitimate objectives, contract execution, compliance with legal requirements, dispute resolution, security management, service quality analysis, auditing, or other objectives mentioned in this policy, and after the expiration of the maintenance period, it will be deleted, destroyed, or anonymized as the case may be.

• Note 1: Access to communication information shall be limited to authorized persons and within the limits of professional duties.
• Note 2: Transfer of communication information to third parties shall be authorized strictly within the limits of this policy, user consent, valid contracts, or legal requirements.
• Note 3: None of the provisions of this chapter shall create a license for sending unsolicited communications, unauthorized use of contact information, or violation of users' rights regarding their personal data.

Chapter Sixteen: Cookies, Tracking Technologies, Digital Identifiers, SDKs, APIs, Local Storage, Session Storage, Pixels, Tags, Web Beacons, and Similar Technologies

Article 151- General Principles of Using Tracking Technologies

In order to provide services, manage user sessions, enhance security, authentication, maintain system stability, personalize user experience, analyze service performance, analyze user behavior, manage advertising, measure campaign effectiveness, prevent misuse, product development, risk management, service quality analysis, infrastructure management, and other legitimate objectives, the platform may use cookies, digital identifiers, local storage technologies, tracking technologies, SDKs, APIs, Pixels, Web Beacons, Tags, Fingerprints, Tokens, and other similar technologies.

Use of these technologies shall be subject to the principles of lawfulness, transparency, proportionality, security, data minimization, purpose limitation, and respect for users' rights.

• Note 1: Use of tracking technologies will be limited to legitimate objectives and proportionate to the type of service.
• Note 2: The platform may use new tracking technologies in the event of technology development or change in technical requirements.
• Note 3: Technologies used must not act to process information beyond the declared objectives unless based on a valid legal basis.

Article 152- Cookies

The platform may use temporary cookies, persistent cookies, security cookies, functional cookies, analytical cookies, personalization cookies, advertising cookies, authentication cookies, session management cookies, settings storage cookies, performance measurement cookies, anti-fraud cookies, and other types of cookies.

These cookies may be used for maintaining user login status, storing settings, facilitating service use, content personalization, behavior analysis, fraud prevention, security management, performance measurement, or other similar objectives.

• Note 1: The duration of validity of cookies will be determined in proportion to the objective of use.
• Note 2: Deletion of cookies may lead to disruption in the performance of certain services.
• Note 3: Certain cookies are necessary for providing services, and their deactivation may restrict the possibility of using a portion of services.

Article 153- Local Storage, Session Storage, and Other Local Storage Technologies

The platform may use Local Storage, Session Storage, IndexedDB, Cache Storage, Application Cache, Secure Storage, Storage APIs, or other user-side storage technologies to store setting information, session status, temporary information, users' preferences, security information, cache data, functional data, personalization data, and other necessary information.

• Note 1: Stored information may be deleted with the deletion of browser data or device settings.
• Note 2: Stored information will be used strictly within the limits of legitimate objectives.
• Note 3: Use of local storage technologies shall be subject to appropriate security requirements.

Article 154- Pixels, Web Beacons, Tags, and Similar Technologies

The platform may use Pixels, Web Beacons, Invisible Pixels, Tracking Pixels, JavaScript Tags, HTML Tags, Conversion Tags, Measurement Tags, Event Tags, Tracking Scripts, or other similar technologies to measure service performance, analyze campaigns, analyze user interaction, analyze advertisements, analyze visits, analyze conversion rates, analyze user behavior, and other legitimate objectives.

• Note 1: These technologies may register information related to page viewing, interaction with content, or interaction with advertisements.
• Note 2: Use of these technologies must not lead to the violation of users' information confidentiality.
• Note 3: Information resulting from these technologies may be integrated with other analytical information.

Article 155- Digital Identifiers and Identification Technologies

The platform may use technical identifiers including Device ID, Browser ID, Advertising ID, Installation ID, Session ID, Push Token, API Token, Authentication Token, Cookie ID, Fingerprint, Browser Fingerprint, Device Fingerprint, Installation Fingerprint, UUID, campaign ID, analysis ID, transaction ID, and other similar identifiers for providing services, managing security, behavior analysis, session management, service personalization, fraud prevention, and other legitimate objectives.

• Note 1: Certain identifiers may be generated temporarily or randomly.
• Note 2: Deletion of certain identifiers may lead to disruption in providing services.
• Note 3: Technical identifiers, in the event of their capability of attribution to a person, shall be considered personal information.

Article 156- SDKs, Software Libraries, and Third-Party Services

The platform may use SDKs, software libraries, APIs, or services provided by third parties for providing services, performance analysis, notification dispatch, maps, payment, security, data analysis, authentication, advertising, image processing, video processing, communications, cloud services, machine learning, or other similar services.

These services may, depending on the type of service, process certain technical information or information related to software performance.

• Note 1: Selection of service providers will be performed based on security, technical, and contractual criteria.
• Note 2: Third parties shall be obligated to respect contractual data protection requirements.
• Note 3: Use of third-party SDKs shall not preclude the platform's responsibility within the limits of applicable laws.

Article 157- APIs, System Communications, and Data Exchange

The platform may use internal or external APIs for exchanging information among systems, communicating with service providers, communicating with payment systems, communicating with authentication systems, communicating with transportation systems, communicating with data analysis systems, communicating with artificial intelligence systems, or other related systems.

These communications may include the transfer of technical data, security data, operational data, transactional data, managerial data, or other information necessary for providing services.

• Note 1: Exchange of information through APIs must be performed using appropriate security methods.
• Note 2: Access to APIs may be restricted, controlled, or logged.
• Note 3: Misuse of APIs may result in suspension or termination of access.

Article 158- Service Performance Analysis and Quality Measurement

The platform may use information resulting from tracking technologies to analyze page load speed, service quality analysis, error rate analysis, server performance analysis, user experience analysis, infrastructure capacity analysis, API performance analysis, user interaction analysis, key performance indicator (KPI) analysis, advertisement analysis, campaign analysis, and other managerial or technical objectives.

• Note 1: Analyses under this article may be performed in real-time or periodically.
• Note 2: Analytical data will be used in an anonymous or aggregated manner to the extent possible.
• Note 3: Results of analyses may be used for developing new versions of services.

Article 158- Service Performance Analysis and Quality Measurement

The platform may utilize information obtained from tracking technologies to analyze page load speed, service quality analysis, error rate analysis, server performance analysis, user experience analysis, infrastructure capacity analysis, API performance analysis, user interaction analysis, key performance indicator (KPI) analysis, advertisement analysis, campaign analysis, and other managerial or technical objectives.

• Note 1: Analyses under this article may be performed in real-time or periodically.
• Note 2: Analytical data will be used in an anonymous or aggregated manner to the extent possible.
• Note 3: Results of analyses may be used for developing new versions of services.

Article 159- Management of Tracking Settings and User Control

The platform may provide users with the capability to manage cookies, advertising identifiers, personalization, notifications, interest-based advertising, certain tracking technologies, browser settings, application settings, or other related settings within the limits of technical capabilities. Users may also restrict or deactivate certain tracking technologies via browser, operating system, device settings, or other similar tools as appropriate.

• Note 1: Restricting tracking technologies may lead to disruption in a portion of services.
• Note 2: Certain technologies essential for security or service provision will not be deactivatable.
• Note 3: Implementation of new settings may take effect in the system with a standard delay.

Article 160- Protection, Maintenance, and Responsible Use of Information Obtained from Tracking Technologies

The platform is committed to processing information obtained from cookies, digital identifiers, local storage technologies, Pixels, Web Beacons, SDKs, APIs, Tags, Fingerprints, and other tracking technologies strictly within the limits of legitimate objectives, valid legal grounds, contractual requirements, user consent, or other legal bases, and to refrain from using these technologies for unnecessary data collection or violation of users' rights.

The platform is also committed to protecting information obtained from these technologies using appropriate security controls, encryption, access control, logging, security auditing, anonymization, pseudonymization, access limitation, and other technical and organizational measures, and to delete, destroy, or anonymize such information upon expiration of the retention period or resolution of operational needs.

• Note 1: The retention period for information obtained from tracking technologies will be determined in proportion to the processing objective, legal requirements, and operational needs.
• Note 2: Transfer of information obtained from tracking technologies to third parties shall be authorized strictly within the limits of this policy, user consent, valid contracts, or legal requirements.
• Note 3: Use of tracking technologies must not lead to bypassing users' privacy settings, compromising information security, or reducing the level of personal data protection.

Chapter Seventeen: Sharing, Disclosure, Transfer, Access, Assignment, and Publication of Personal Information to Third Parties, Affiliated Companies, Service Providers, and Legal Authorities

Article 161- General Principles of Sharing and Disclosure of Information

The platform shall share or transfer personal information, financial information, technical information, behavioral information, spatial information, transactional information, communication information, security information, commercial information, and other data related to users to third parties strictly within the limits of legitimate objectives, valid contracts, user consent, legal requirements, operational necessity, or other valid legal grounds.

The principle is non-disclosure of personal information, and any transfer or sharing must be conducted based on the principle of data minimization, proportionality, purpose limitation, security, confidentiality, accountability, and respect for users' rights.

• Note 1: Sharing of information shall be authorized strictly to the extent necessary for the realization of the relevant objective.
• Note 2: Receiving parties are obligated to observe confidentiality and data protection requirements.
• Note 3: Transfer of information must not lead to a reduction in the level of personal data protection.

Article 162- Sharing Information with Affiliated Companies and Corporate Group

The platform may share users' information with the parent company, subsidiaries, affiliates, jointly owned companies, companies under common control, branches, regional offices, affiliated brands, dependent operational units, or other members of the corporate group, provided that such transfer is necessary for service provision, operational management, product development, security management, financial management, human resource management, technology development, provision of shared services, data analysis, compliance with legal requirements, or other legitimate objectives.

• Note 1: Transfer of information among corporate group members shall be subject to internal data protection contracts.
• Note 2: Affiliated companies are obligated to observe appropriate information protection standards.
• Note 3: Transfer of information to affiliated companies abroad shall be subject to international data transfer regulations.

Article 163- Sharing Information with Service Providers

The platform may share users' information within the limits of necessity with cloud service providers, data centers, payment service providers, banks, electronic wallet companies, transportation companies, logistics companies, map service providers, authentication service providers, cybersecurity service providers, SMS service providers, email service providers, call centers, data analysis service providers, artificial intelligence service providers, marketing companies, advertising service providers, storage service providers, backup service providers, accounting service providers, auditors, or other specialized service providers.

• Note 1: Service providing parties shall be authorized to use information strictly within the limits of the contract.
• Note 2: The platform may supervise and audit the performance of data processors.
• Note 3: Termination of cooperation with a processor shall not preclude their obligation to maintain information confidentiality.

Article 164- Sharing Information Between Users

In certain services, the platform may make a portion of users' information available to other users for the execution of a transaction or service provision, including store name, display name, profile image, contact number, delivery address, store location, order status, shipping status, driver information, courier information, payment information, or other necessary information.

• Note 1: Displayable information shall be determined based on service type and platform settings.
• Note 2: Users shall be authorized to use the received information strictly for the execution of the relevant service.
• Note 3: Promotional, commercial, or unauthorized use of other users' information shall be prohibited.

Article 165- Sharing Information with Business Partners

The platform may share necessary information within the limits of contractual collaborations with business partners, insurance companies, financial service providers, transportation companies, warranty service providers, after-sales service companies, installation service providers, support service providers, advertising companies, market research companies, data analysis companies, or other business partners.

• Note 1: Transfer of information shall be conducted strictly to the extent necessary for the execution of the relevant collaboration.
• Note 2: Business partners are obligated to observe confidentiality requirements.
• Note 3: The platform may impose specific contractual obligations for information protection on business partners.

Article 166- Disclosure of Information Based on Legal Requirements

The platform may disclose users' information in response to judicial orders, legal requests, tax requirements, banking requirements, anti-money laundering requirements, consumer protection requirements, national security requirements, regulatory bodies' requirements, law enforcement requirements, administrative authority requirements, enforcement of judicial judgments, execution of competent authorities' orders, or other legal obligations.

• Note 1: Disclosure of information shall be limited to the scope of the legal request unless the law stipulates otherwise.
• Note 2: The platform may verify the authenticity of legal requests.
• Note 3: Records of information disclosure may be maintained for auditing and accountability objectives.

Article 167- Disclosure of Information for Protection of Rights and Security

The platform may, in necessary cases, provide users' information to competent parties for the protection of life, health, security, property, users' legal rights, company's legal rights, third parties' legal rights, prevention of crime, prevention of damage, prevention of cyberattacks, prevention of fraud, prevention of misuse, or other emergency conditions.

• Note 1: Disclosure of information must be proportionate to the emergency conditions.
• Note 2: Upon resolution of emergency conditions, additional processing shall be ceased unless another legal ground exists.
• Note 3: Documentation of performed disclosures shall be authorized for accountability objectives.

Article 168- Transfer of Information in Corporate Processes

In the event of merger, acquisition, investment, share assignment, business transfer, asset sale, restructuring, bankruptcy, liquidation, change of control, joint venture, strategic partnership, or other structural changes, the platform may transfer users' information to parties related to the transfer process, provided that such transfer is conducted in accordance with laws and observing data protection requirements.

• Note 1: Transfer of information must not lead to a reduction in users' rights.
• Note 2: The transferee is obligated to observe the provisions of this policy or a policy with a similar level of protection.
• Note 3: In the event of legal necessity, users shall be informed regarding the transfer of information.

Article 169- Sharing Anonymous, Pseudonymized, and Aggregated Information

The platform may provide anonymous, pseudonymized, statistical, or aggregated information to third parties for market analysis, research, technology development, artificial intelligence development, managerial reports, economic reports, research collaborations, business collaborations, product development, performance analysis, consumer behavior analysis, advertisement analysis, or other legitimate objectives, provided that direct or indirect identification of users is not possible.

• Note 1: Anonymous data must not be published in a manner that creates the possibility of re-identification of individuals.
• Note 2: The platform may use anonymization and pseudonymization technologies to reduce risk.
• Note 3: Aggregated data may be used in public or commercial reports.

Article 170- Security, Contractual, and Managerial Requirements for Information Transfer

The platform is committed to performing all transfers, sharing, and disclosures of information using appropriate technical, legal, and managerial measures, including confidentiality agreements, data processing agreements, encryption, access control, logging, security auditing, authentication, permission control, access limitation, monitoring systems, key management systems, anonymization technologies, and other proportionate controls.

The platform is also committed to granting access to information to receiving parties strictly to the extent necessary and, upon termination of cooperation, to proceed with returning, deleting, destroying, or anonymizing the information as the case may be.

• Note 1: Transfer of information must be performed based on the principle of least privilege and the principle of data minimization.
• Note 2: The platform may periodically evaluate the observance of data protection requirements by information recipients.
• Note 3: None of the provisions of this chapter shall be interpreted as creating a license for transfer or disclosure of information contrary to mandatory laws, users' rights, or fundamental principles of this policy.

Chapter Eighteen: International Data Transfer, Cross-Border Data Processing, Data Centers, Cloud Computing, Foreign Processors, and Requirements for International Data Transfer

Article 171- General Principles of International Data Transfer

Given the international nature of the platform's services, the possibility of providing services to users of various countries, use of global cloud infrastructures, collaboration with international companies, use of foreign data processors, use of technology service providers, use of multi-regional data centers, use of distributed systems, and development of cross-border services, the platform may transfer, store, process, or manage users' information across different countries or jurisdictions within the framework of applicable laws and this policy.

These transfers shall be conducted strictly within the limits of legitimate objectives, operational necessities, valid contracts, user consent, legal requirements, or other valid legal grounds.

• Note 1: International transfer of information must not lead to an unconventional reduction in the level of protection of users' information.
• Note 2: The platform shall apply appropriate protective measures proportionate to the destination of transfer, risk level, and type of information.
• Note 3: Data transfer may be performed temporarily, permanently, directly, indirectly, automatically, or through data processors.

Article 172- Destination Countries and Information Processing Jurisdictions

Users' information may be processed or stored in the user's country of residence, the country of the platform's establishment, countries hosting data centers, countries hosting affiliated companies, countries hosting data processors, countries hosting cloud service providers, countries hosting cybersecurity service providers, countries hosting financial service providers, countries hosting map service providers, countries hosting artificial intelligence service providers, or other countries necessary for service provision.

• Note 1: The place of information processing may change over time.
• Note 2: Use of cloud infrastructures may lead to distribution of information among several countries.
• Note 3: The storage location of backup copies may also differ from the main processing location.

Article 173- Transfer of Information to Foreign Processors

The platform may delegate a portion of information processing operations to foreign processors, cloud service providers, data analysis service providers, security service providers, messaging service providers, authentication service providers, financial service providers, map service providers, artificial intelligence service providers, storage service providers, infrastructure service providers, or other specialized processors.

• Note 1: Data processors shall be authorized to process information strictly within the limits of concluded contracts.
• Note 2: The platform may impose special contractual obligations for data protection on processors.
• Note 3: Termination of cooperation with a processor shall not preclude their obligations regarding information confidentiality.

Article 174- Use of Cloud Computing Services and Distributed Infrastructures

The platform may use public, private, hybrid, or multi-cloud cloud computing services for increasing stability, security, scalability, availability, speed of service provision, disaster recovery, backup management, capacity management, load balancing, global service provision, and technology development.

As a result, users' information may be processed or stored in infrastructures belonging to cloud service providers or distributed data centers.

• Note 1: Cloud service providers are obligated to observe contractual data protection obligations.
• Note 2: The platform may use encryption, anonymization, or other security methods prior to transferring information to the cloud.
• Note 3: Use of cloud services shall not preclude the platform's responsibility regarding information protection.

Article 175- Transfer of Information in the Context of International Services

In the event that a user utilizes international services, multi-country services, international transportation services, international payment services, foreign market services, foreign seller services, international artificial intelligence services, international advertising services, or other cross-border services, necessary information for the execution of the service may be transferred among related countries.

• Note 1: Transfer of information shall be limited to the information required for the execution of the service.
• Note 2: Use of international services may necessitate processing information outside the user's country of residence.
• Note 3: By using cross-border services, users accept the transfer of necessary information for the execution of the service within the limits of this policy.

Article 176- Protective Standards for International Transfer

For the transfer of information among different countries or jurisdictions, the platform may use data transfer agreements, data processing agreements, confidentiality obligations, security controls, encryption, key management, secure communication tunnels, Tokenization technologies, anonymization technologies, pseudonymization technologies, access control, security auditing, managerial controls, and other appropriate technical and organizational measures.

• Note 1: The applied level of protection must be proportionate to the sensitivity of the information.
• Note 2: The platform may observe international information security standards in data transfer.
• Note 3: Protective measures may be reviewed based on technological changes or legal changes.

Article 177- Transfer of Information Resulting from Structural or Commercial Changes

In the event of merger, acquisition, investment, strategic partnership, asset transfer, business assignment, share transfer, joint venture creation, corporate restructuring, change of control, or other similar processes that are international in nature, users' information may be transferred to parties or entities established in other countries.

• Note 1: Transfer of information must not lead to a reduction in the level of information protection.
• Note 2: The transferee is obligated to observe data protection obligations.
• Note 3: In the event of legal requirement, appropriate notification shall be provided to users.

Article 178- Users' Rights in International Transfer of Information

Users, within the limits of applicable laws, may submit requests for information, access, or exercise other rights stipulated in this policy regarding the manner of international information transfer, grounds for transfer, objectives of transfer, receiving parties, protection methods, their rights regarding transferred information, or other related subjects.

• Note 1: Exercise of these rights may be restricted in the event of conflict with legal or security requirements.
• Note 2: The platform may proceed to authenticate the requester prior to responding.
• Note 3: Responding to requests shall be conducted within the limits of laws and technical capabilities.

Article 179- Transfer of Anonymous, Pseudonymized, and Aggregated Information Abroad

The platform may transfer anonymous data, pseudonymized data, aggregated data, statistical data, research data, training data for artificial intelligence models, managerial data, market analysis data, or other data that does not have the capability of direct or indirect identification of users to abroad for research, scientific, commercial, managerial, technology development, service development, economic analysis, academic collaborations, or international collaborations.

• Note 1: Transferred data must not enable user identification.
• Note 2: The platform may use advanced anonymization technologies prior to transfer.
• Note 3: Transfer of anonymous data shall be subject to applicable legal limitations.

Article 180- Platform's Obligations in Cross-Border Data Transfer

The platform is committed to performing all international transfers of information observing the principles of lawfulness, transparency, proportionality, security, data minimization, purpose limitation, storage limitation, accountability, access control, confidentiality, organizational responsibility, and respect for users' rights.

The platform is also committed to considering appropriate security, contractual, technical, legal, and managerial criteria in the selection of foreign processors, cloud service providers, data centers, international partners, and other information recipients, and to proceed with auditing, assessment, continuous monitoring, or application of supplementary controls where necessary.

• Note 1: International transfer of information shall be performed strictly to the extent necessary for the realization of legitimate objectives.
• Note 2: The platform may modify or update international data transfer mechanisms in the event of legal changes or change in risk level.
• Note 3: None of the provisions of this chapter shall be interpreted as creating a license for transfer of information contrary to mandatory laws, fundamental rights of users, or fundamental principles of data protection.

Article 181- Fundamental Principles of Information Security

The platform is committed to protecting users' information throughout all stages of collection, transfer, processing, storage, sharing, archiving, retrieval, and deletion, by observing the principles of confidentiality, integrity, availability, reliability, accountability, traceability, resilience, least privilege, defense in depth, security by design, security by default, data minimization, separation of duties, risk management, information lifecycle management, and other recognized information security principles.

The implementation of security measures must be proportionate to the nature of the information, the level of data sensitivity, the risk level, the technologies used, legal requirements, industry standards, and the operational conditions of the platform.

• Note 1: Security measures shall be continuously reviewed and improved.
• Note 2: Technology development or changes in security threats may lead to the modification of security controls.
• Note 3: No system has absolute security, and the platform does not guarantee complete immunity against all cyber threats, but it is committed to adopting reasonable and proportionate measures.

Article 182- Technical Information Protection Controls

To protect users' information, the platform may utilize security technologies and controls, including encryption of data in transit and at rest, cryptographic key management, access control, multi-factor authentication, Tokenization, Hashing, Salt, Masking, Pseudonymization, Anonymization, identity management systems, session management, permission management, firewalls, Intrusion Prevention Systems (IPS), Intrusion Detection Systems (IDS), anti-malware systems, anti-ransomware systems, anti-DDoS systems, anti-bot systems, anti-fraud systems, security information and event management (SIEM) systems, threat analysis systems, vulnerability management systems, EDR, XDR, Zero Trust systems, Virtual Private Networks (VPNs), isolation technologies, role-based access controls, and other appropriate technologies.

• Note 1: The type of technical controls shall be determined based on the level of information sensitivity.
• Note 2: The platform may replace or complement new security technologies as needed.
• Note 3: Certain security controls will be implemented without prior notice to users.

Article 183- Organizational and Managerial Information Security Controls

The platform may implement information security policies, internal guidelines, access management processes, change management processes, risk management processes, vulnerability management processes, incident management processes, information asset management processes, information security training programs, human resource controls, contractual controls, internal audits, security assessments, security awareness programs, supplier assessments, data processor assessments, and other managerial controls.

• Note 1: Employees shall have access to information strictly within the limits of their organizational duties.
• Note 2: All persons with access to information may be subject to confidentiality obligations.
• Note 3: Managerial controls may be modified in proportion to changes in organizational structure.

Article 184- Access Management and Permission Control

Access to users' information shall be managed based on the principle of least privilege, the need-to-know principle, the principle of separation of duties, the accountability principle, and the platform's security policies. The platform may use identity management systems, privileged access management systems, permission control systems, multi-factor authentication systems, access logging systems, session management systems, key management systems, and other similar technologies to manage access.

• Note 1: Granting access to information shall require appropriate organizational authorization.
• Note 2: Unnecessary or expired accesses must be removed as soon as possible.
• Note 3: All sensitive accesses may be logged, monitored, and audited.

Article 185- Logging, Security Monitoring, and Auditing

The platform may log, store, analyze, and audit security events, system events, management events, accesses, data changes, user activity, system administrator activity, network events, infrastructure events, API events, financial events, authentication events, anti-fraud events, artificial intelligence system events, and other related activities.

• Note 1: Logging shall be performed for security, legal, auditing, and risk management objectives.
• Note 2: Security logs may be retained for longer periods.
• Note 3: Access to logs shall be limited to authorized personnel.

Article 186- Security Incident Management and Incident Response

For the purpose of identifying, logging, analyzing, containing, controlling, eliminating, recovering, documenting, investigating, reporting, responding, managing crises, and preventing the recurrence of security incidents, the platform may implement Incident Management processes, cyber incident management, data breach management, cyberattack management, vulnerability management, threat management, IT crisis management, and other similar processes.

• Note 1: In case of necessity, the platform may temporarily restrict services or user accounts.
• Note 2: Significant security incidents may be reported to competent authorities.
• Note 3: Documentation of incidents shall be authorized for legal, managerial, or educational objectives.
• Note 4: In the event of a breach of information security or incidents affecting users' personal information, the platform shall take necessary measures to manage the incident, mitigate effects, document, and notify users or competent authorities in accordance with applicable laws.

Article 187- Backup, Data Recovery, and Business Continuity

To maintain service availability, the platform may use backups, alternative data centers, disaster recovery systems, data replication systems, redundant infrastructures, load balancing systems, High Availability systems, Disaster Recovery systems, Business Continuity systems, and other related technologies. Users' information may be stored in backup environments, alternative data centers, or recovery systems to achieve these objectives.

• Note 1: Backups shall also be subject to confidentiality and security requirements.
• Note 2: Deletion of information from the primary system may not immediately result in its deletion from backups.
• Note 3: The retention period for backups shall be determined based on security and operational requirements.

Article 188- Security Assessment, Penetration Testing, and Vulnerability Management

The platform may periodically or on an ad-hoc basis perform security assessments, penetration tests, vulnerability scans, risk assessments, security audits, code reviews, security architecture assessments, infrastructure security assessments, API security assessments, application security assessments, network security assessments, data processor security assessments, and other similar assessments.

• Note 1: The results of security assessments shall be considered confidential.
• Note 2: Identified vulnerabilities shall be managed as soon as possible based on the risk level.
• Note 3: The platform may use specialized information security companies to perform assessments.

Article 189- Users' Responsibility for Maintaining Information Security

Users are obligated to protect their login information, passwords, one-time codes, authentication information, devices used, financial information, personal information, security information, and other sensitive information with appropriate care and to refrain from disclosing them to third parties. Users are also obligated to notify the platform as soon as possible in the event of observing unauthorized access, suspicious activity, account theft, security information disclosure, device loss, unauthorized changes, or other similar incidents.

• Note 1: The use of strong passwords and two-factor authentication is recommended.
• Note 2: Responsibility for actions resulting from intentional disclosure of security information by the user shall lie with the user.
• Note 3: The platform may temporarily restrict an account if a security risk is observed.

Article 190- Security Obligations, Accountability, and Continuous Improvement

The platform is committed to continuously reviewing, evaluating, and improving the level of information security, technical controls, managerial controls, incident response processes, risk management systems, business continuity plans, access controls, threat analysis systems, security infrastructures, information security training, awareness programs, and other protective measures in proportion to technological advancements, changes in threats, changes in laws, changes in the business model, and changes in the risk level.

The platform is also committed to adopting reasonable and proportionate measures to protect users' information and to foster an information security culture at all organizational levels within the limits of technical capabilities, industry standards, legal requirements, and operational resources.

• Note 1: None of the security measures shall absolve users of their responsibility to protect their login information and personal equipment.
• Note 2: Security measures may be changed without prior notice to maintain system security.
• Note 3: None of the provisions of this chapter shall be construed as a guarantee against the occurrence of a security incident; however, the platform is committed to applying reasonable, professional, and proportionate measures to prevent, manage, and mitigate the effects of such incidents.
• Note 4: The platform uses technical device information, security identifiers, or security signals strictly for account protection, fraud prevention, risk management, system security, and combating misuse, and will not use them for independent advertising tracking outside the limits of applicable laws.

Chapter Twenty: Information Retention Period, Archiving, Deletion, Destruction, Anonymization, Pseudonymization, Restriction of Processing, and Data Lifecycle End

Article 191- General Principles of Information Lifecycle

The platform shall retain users' information strictly for the duration necessary to achieve the objectives of processing, executing contracts, providing services, complying with legal requirements, performing tax obligations, observing anti-money laundering regulations, security management, risk management, dispute management, complaint handling, responding to competent authorities, auditing, maintaining business records, service development, statistical analysis, research, artificial intelligence system training, protecting the platform's legal rights, or other legitimate objectives. Upon expiration of the retention period or the resolution of the necessity for processing, information shall be deleted, destroyed, anonymized, pseudonymized, restricted, or archived, as the case may be.

• Note 1: Determination of the information retention period is done based on the type of information, data sensitivity, processing objective, legal requirements, contractual requirements, and operational needs.
• Note 2: Retention periods may differ for different types of information.
• Note 3: Termination of the user's relationship with the platform shall not necessarily result in the immediate deletion of all information.

Article 192- Information Retention During the User Relationship

As long as the user account is active or a contractual relationship exists between the user and the platform, the necessary information for providing services, account management, transaction management, providing support, contract execution, security management, communication management, advertising management, financial management, transportation management, complaint management, dispute management, and other related objectives shall be retained.

• Note 1: A portion of the information may be retained even if the user does not use the services.
• Note 2: Inactivity of a user account shall not, by itself, constitute a request for deletion of information.
• Note 3: The platform may manage inactive accounts in accordance with internal policies.

Article 193- Information Retention After Account Deletion

In the event of account deletion by the user or the platform, related information may be retained for the period necessary to comply with legal, tax, accounting, anti-money laundering, information security, fraud prevention, litigation, dispute management, contract execution, maintenance of business records, protection of the platform's legal rights, or other legitimate objectives.

• Note 1: Account deletion shall not mean the immediate deletion of all versions of information.
• Note 2: Retained information after account deletion shall be used strictly for limited and specific objectives.
• Note 3: Access to archived information shall be limited to authorized personnel.

Article 194- Archiving Information and Long-Term Retention

The platform may retain information for which daily operational use has ended in archival environments for legal, financial, tax, security, statistical, research, historical, managerial, auditing, regulatory, market analysis, technology development, or other legitimate objectives. Archiving of information may be conducted in primary data centers, alternative data centers, cold storage systems, long-term storage systems, encrypted environments, or other secure environments.

• Note 1: Archived information shall also be subject to security and confidentiality requirements.
• Note 2: Access to the archive shall be possible strictly for authorized objectives.
• Note 3: Transfer of information to the archive shall not preclude the exercise of users' legal rights within the limits of applicable laws.

Article 195- Deletion of Information

The platform may delete users' information at the end of the retention period, based on a valid user request, based on legal requirements, based on internal policies, based on contract termination, based on account deletion, or in other appropriate cases. Deletion of information may be conducted logically, physically, via software, encrypted, incrementally, or based on the technologies used.

• Note 1: Deletion of information may not be performed simultaneously in all systems.
• Note 2: Information existing in backups may remain until the end of the backup cycle.
• Note 3: Deletion of information shall not preclude the retention of information that is required by law to be kept.

Article 196- Destruction of Information

The platform may destroy information after the end of operational and legal needs through methods such as physical destruction, logical destruction, secure deletion, multi-stage cleaning, destruction of storage media, destruction of cryptographic keys, overwriting information, shredding media, physical destruction of equipment, or other appropriate technical methods.

• Note 1: The destruction method shall be chosen in proportion to the type of information and storage media.
• Note 2: The destruction process may be documented.
• Note 3: The platform may use specialized information destruction service providers.

Article 197- Anonymization and Pseudonymization of Information

The platform may, prior to complete deletion, convert information into non-attributable data through technologies such as anonymization, pseudonymization, removal of identifiers, replacement of identifiers, data aggregation, removal of identifying features, Tokenization, Masking, or other similar technologies. This data may be used for statistical analysis, research, technology development, artificial intelligence development, service development, market analysis, quality management, managerial reports, or other legitimate objectives.

• Note 1: Anonymization shall be performed in a manner that minimizes the probability of re-identification of individuals.
• Note 2: In the event of the possibility of re-identification, the data shall still be considered personal information.
• Note 3: The platform may use various anonymization methods in proportion to modern technology.

Article 198- Restriction of Information Processing

In cases where deletion of information is not possible or retention of information is mandatory by law, the platform may restrict the processing of information and retain the information strictly for legal, security, contractual, judicial, tax, auditing, or other necessary objectives.

• Note 1: Restricted information shall not be used for marketing or service development objectives unless based on an independent legal ground.
• Note 2: Restriction of processing may be applied technically or managerially.
• Note 3: Users may submit a request for restriction of information processing within the limits of applicable laws.

Article 199- Backups and Residual Information

Users' information may remain in backups, disaster recovery systems, distributed storage systems, archive systems, monitoring systems, security logs, incident analysis systems, auditing systems, or other backup infrastructures. This information shall be used strictly for recovery, security, auditing, compliance with legal requirements, or crisis management objectives.

• Note 1: Deletion of information from the primary system shall not necessarily result in the immediate deletion of information from backups.
• Note 2: Backups shall also be subject to appropriate security controls.
• Note 3: Information in backups shall be deleted or destroyed after the end of the retention cycle.

Article 200- Management of Information Lifecycle End and Platform Obligations

The platform is committed to managing all users' information at the end of the information lifecycle in accordance with the principles of lawfulness, purpose limitation, data minimization, retention period limitation, security, confidentiality, accountability, transparency, organizational responsibility, and other fundamental data protection principles. The platform is also committed to continuously reviewing and improving processes for deletion, destruction, archiving, anonymization, pseudonymization, restriction of processing, recovery, backup management, storage media management, obsolete equipment management, data transfer management, and information lifecycle end management, in proportion to technological advancements, changes in laws, changes in security requirements, and service development.

• Note 1: Execution of information lifecycle end processes may be performed automatically, semi-automatically, or manually.
• Note 2: The platform may retain records of the execution of deletion, destruction, or anonymization processes for auditing objectives.
• Note 3: None of the provisions of this chapter shall be construed as requiring the platform to delete information for which retention is mandatory by law, contract, order of a competent authority, or security and legal necessities.
• Note 4: Users' personal information shall not be retained longer than necessary to achieve the objectives of processing, contract execution, compliance with legal requirements, protection of the platform's legitimate rights, or other authorized objectives, and upon resolution of the necessity, shall be deleted, anonymized, pseudonymized, or destroyed as the case may be, unless a law or order of a competent authority has made longer retention mandatory.

Chapter Twenty-One: Users' Rights, Data Subjects' Rights, Requests Related to Personal Information, Method of Exercising Rights, and Request Handling Process

Article 201- General Principles of Users' Rights Regarding Personal Information

The platform, by observing applicable laws, fundamental data protection principles, contractual requirements, and the provisions of this policy, recognizes users' rights regarding their personal information and is committed to providing the possibility of exercising these rights within the limits of legal requirements, technical capabilities, security limitations, contractual limitations, and regulatory requirements.

The exercise of users' rights must not lead to the violation of other individuals' rights, disclosure of third parties' confidential information, disruption of system security, violation of legal requirements, undermining of anti-fraud processes, violation of anti-money laundering requirements, weakening of security controls, or the creation of serious disruption in service provision.

• Note 1: Rights mentioned in this chapter may differ based on the laws of the user's country of residence or the place of service provision.
• Note 2: Exercise of users' rights shall be subject to appropriate authentication.
• Note 3: The platform may use security, legal, or managerial processes to manage requests.

Article 202- Right to Information and Transparency

Users have the right to be informed, within the limits of applicable laws, of the type of information collected, processing objectives, legal grounds for processing, data categorization, information collection sources, methods of information use, parties receiving information, information retention period, their legal rights, how to exercise rights, general security policies, international data transfers, and other issues related to personal information processing.

• Note 1: Notification may be performed through this policy, terms of use, system announcements, or other communication tools.
• Note 2: The platform may not provide information whose disclosure would endanger system security or the rights of third parties.
• Note 3: Provided information must be proportionate, understandable, and within the limits of applicable laws.

Article 203- Right to Access Personal Information

The user may submit a request for access to personal information processed related to them within the limits of applicable laws. After authentication and review of the request, the platform shall provide, as the case may be, the possibility of viewing, receiving, or being informed of the personal information available for disclosure.

• Note 1: Access to information may be restricted in the event of conflict with the rights of third parties or legal requirements.
• Note 2: Internal security information, trade secrets, algorithms, or information related to internal investigations shall not necessarily be subject to the right of access.
• Note 3: The platform may determine the format of providing information based on technical capabilities.

Article 204- Right to Rectification and Completion of Information

Users may submit a request for rectification, update, or completion of their incorrect, incomplete, or outdated personal information. After reviewing the request and, if necessary, receiving supplementary documents, the platform shall proceed to rectify the information.

• Note 1: Rectification of information may require the submission of valid documents.
• Note 2: Records of information changes may be retained for security or legal objectives.
• Note 3: Rectification of information shall not preclude the retention of previous versions within the limits of legal requirements.

Article 205- Right to Deletion of Information and Right to be Forgotten

Users may submit a request for deletion of their personal information within the limits of applicable laws. The platform shall proceed to delete, destroy, anonymize, or restrict the processing of information if legally and technically possible.

• Note 1: Deletion of information may not be possible if there is a legal requirement to retain the information.
• Note 2: Information existing in backups may remain until the end of the backup cycle.
• Note 3: Deletion of information may result in the impossibility of using certain services.
• Note 4: Users may register a request for account deletion or deletion of their personal information within the limits of applicable laws. The platform shall proceed to delete, restrict processing, or anonymize information after reviewing the request and observing legal requirements.

Article 206- Right to Restriction of Information Processing

Users may submit a request for restriction of processing of their personal information within the limits of applicable laws; including in cases where there is a dispute regarding the accuracy of information, an objection has been raised regarding the legitimacy of processing, or information is required strictly for maintaining legal rights.

• Note 1: Restriction of processing shall not preclude the retention of information within the limits of legal requirements.
• Note 2: Restricted information shall be processed strictly for authorized objectives.
• Note 3: The platform may proceed to review legal conditions prior to applying the restriction.

Article 207- Right to Object to Information Processing

Users may object to certain processing based on legitimate interests, direct marketing, personalization of advertisements, behavioral analysis, profiling, automated decision-making, or other processing for which the law allows objection. After reviewing the request and in the presence of legal conditions, the platform shall proceed to stop or restrict the relevant processing.

• Note 1: Objections to processing that are necessary for contract execution or compliance with the law may not be accepted.
• Note 2: The user's objection shall not preclude the retention of information for security or legal objectives.
• Note 3: The result of the objection review shall be notified to the user within the limits of technical capabilities and applicable laws.

Article 208- Right to Data Portability

In cases where the law stipulates or it is technically possible, users may submit a request to receive a copy of their personal information or transfer it to another service provider. The platform may provide the information in a common, structured, machine-readable format, or other appropriate formats.

• Note 1: Transfer of information must not lead to the violation of third parties' rights.
• Note 2: Transfer of information may be limited to information provided by the user themselves.
• Note 3: The platform may apply necessary technical or security limitations.
• Note 4: If technically possible and within the limits of applicable laws, users may receive a copy of their personal information in a common and usable format or submit a request for its transfer in accordance with relevant laws.

Article 209- Method of Registering, Reviewing, and Handling Users' Requests

Users may register requests related to their personal information rights through the user panel, support system, email, electronic forms, official communication channels, or other methods announced by the platform. After authentication, review of documents, review of legal grounds, review of security impacts, review of contractual impacts, and review of legal impacts, the platform shall proceed to respond or execute the request.

• Note 1: The platform may request additional information or documents to prevent misuse.
• Note 2: Repetitive, unreasonable, abusive, or illegal requests may be rejected.
• Note 3: Records of requests and provided responses may be retained for auditing, security, and legal objectives.

Article 210- Limitations, Exceptions, and Balance Between Users' Rights and Legal Requirements

The rights stipulated in this chapter shall be executed within the limits of applicable laws, national security requirements, judicial requirements, tax requirements, anti-money laundering requirements, anti-financing of illegal activities requirements, electronic commerce requirements, consumer protection requirements, accounting requirements, contractual requirements, intellectual property rights, trade secrets, information security, third-party rights, risk management, fraud prevention, maintenance of system integrity, and other applicable legal limitations.

The platform is committed to establishing a reasonable balance between users' rights, legal requirements, legitimate business interests, information security, other individuals' rights, and operational requirements, and to take decisions regarding users' requests based on the principles of lawfulness, proportionality, transparency, accountability, data minimization, purpose limitation, and respect for fundamental rights of individuals.

• Note 1: Rejection or restriction of users' requests must be documented, proportionate, and within the limits of applicable laws.
• Note 2: The platform may accept a portion of the request and reject another portion for legal reasons, if necessary.
• Note 3: None of the provisions of this chapter shall be construed as violating legal requirements, undermining system security, disclosing third parties' confidential information, or creating an obligation for the platform beyond mandatory laws.

Article 211- Fundamental Principles of Users' Responsibility Regarding Personal Information

Users undertake to observe applicable laws, third-party rights, principles of good faith, requirements of this policy, terms of service, and other internal regulations of the platform in all stages of registration, service utilization, account creation, ad publishing, store creation, transaction execution, use of financial services, use of transportation services, use of communication services, use of location-based services, use of artificial intelligence services, content uploading, information sharing, communication with other users, and use of other platform services.

Users shall be responsible for all information, data, documents, images, files, messages, transactions, communications, and other content created, uploaded, sent, processed, or published through their user accounts.

• Note 1: Responsibility for the use of the user account shall lie with the account holder unless otherwise proven by law.
• Note 2: Transferring a user account to other individuals without the platform's authorization may lead to service restriction.
• Note 3: Responsibility for the use of third-party information without legal authorization shall lie with the user.

Article 212- Accuracy, Validity, and Updating of Information

Users undertake to keep identity information, contact information, financial information, business information, store information, license information, payment information, transportation information, agency information, tax information, and other information registered in the system accurate, valid, complete, and up-to-date, and to take action to correct it in case of any changes.

• Note 1: Providing incorrect, incomplete, misleading, or fraudulent information may result in account suspension or deletion.
• Note 2: The platform may verify the accuracy of information through authorized sources.
• Note 3: Responsibility for damages resulting from providing incorrect information shall lie with the user.

Article 213- Use of Third-Party Information

Users are permitted to register, upload, send, or process third-party personal information only if they have obtained the necessary legal, contractual authorization, or valid consent from the relevant person.

Users undertake to refrain from registering third-party information without a legal basis, publishing private information, publishing confidential information, publishing identity documents, publishing banking information, publishing medical information, publishing information of children, or other sensitive information of individuals without legal authorization.

• Note 1: The platform may take action to delete or restrict information upon receiving a valid complaint.
• Note 2: Responsibility for all third-party claims resulting from uploaded information shall lie with the user.
• Note 3: The platform may request supplementary documents from the user to verify the legitimacy of the information.

Article 214- Confidentiality of Other Users' Information

Users undertake to use the information of other users, sellers, buyers, drivers, couriers, representatives, employees, businesses, or other persons obtained during the use of services strictly for the execution of the same service, and to refrain from storage, reproduction, publication, sale, transfer, advertising use, business analysis, independent processing, or any use outside of authorized objectives.

• Note 1: Using other users' contact information for advertising without their consent is prohibited.
• Note 2: Systematic collection of users' information to create an independent database is prohibited.
• Note 3: Violation of the confidentiality of other users' information may lead to civil, contractual, or criminal liability.

Article 215- Protection of Login Information and Account Security

Users are obliged to keep their user ID, password, one-time codes, security keys, authentication information, devices used, security tokens, payment information, wallet information, and other security information related to their account confidential and to refrain from disclosing them to other persons.

Users are also obliged to notify the platform as soon as possible in case of observing any unauthorized access, account theft, account abuse, disclosure of security information, or any suspicious activity.

• Note 1: The use of two-factor authentication is recommended to users.
• Note 2: Responsibility for the use of the account until the official report of abuse shall lie with the account holder unless the law provides otherwise.
• Note 3: The platform may temporarily restrict the account if a security risk is detected.

Article 216- Prohibition of Unauthorized Extraction, Collection, and Processing of Information

Users are not permitted to engage in mass extraction of information, Scraping, Crawling, Harvesting, unauthorized Data Mining, use of Bots, use of Spiders, use of automated tools, use of unauthorized APIs, use of artificial intelligence tools for mass data extraction, reverse engineering of databases, creating mirror versions of information, unauthorized analysis of users' data, or any systematic collection of platform information without written permission.

• Note 1: Research or commercial use of platform information without permission is prohibited.
• Note 2: The platform may apply necessary technical or legal measures to prevent unauthorized information extraction.
• Note 3: Violations of this article may lead to legal, criminal, or contractual pursuit.

Article 217- Users' Responsibility in Communications and Messages

Users undertake to refrain from sending unlawful information, fake information, misleading information, third-party confidential information, offensive content, criminal content, content violating intellectual property rights, content containing malware, content containing malicious links, other persons' banking information, other persons' identity information, or other prohibited information through the platform's communication systems.

• Note 1: The platform may monitor or restrict certain communications to maintain system security.
• Note 2: Users shall be responsible for messages sent from their accounts.
• Note 3: Using the platform's communication systems to send spam or unauthorized advertisements is prohibited.

Article 218- Users' Responsibility in Using Information Generated by Artificial Intelligence

In the event that the platform provides artificial intelligence-based services, intelligent recommendations, automatic translation, text generation, image analysis, data analysis, or other similar services, users shall be responsible for reviewing, evaluating, and using the generated outputs appropriately.

Users should not base sensitive legal, medical, financial, investment, security, or other important decisions on the generated outputs without necessary review, unless the necessary expert review has been conducted.

• Note 1: Outputs of artificial intelligence systems may contain errors or inaccuracies.
• Note 2: Responsibility for the improper use of artificial intelligence outputs shall lie with the user.
• Note 3: The platform may impose restrictions on the use of artificial intelligence services.

Article 219- Cooperation of Users in Maintaining Security and Protecting Information

Users undertake to report any observed security vulnerability, information abuse, data breach, suspicious activity, cyber attacks, identity theft, bot activity, advertising abuse, wallet abuse, unauthorized access, or other security threats to the platform through official channels as soon as possible.

• Note 1: Users shall not exploit discovered vulnerabilities.
• Note 2: The platform may implement responsible vulnerability disclosure programs.
• Note 3: Good-faith reporting by users shall not absolve them of liability in the event of exploiting a vulnerability.

Article 220- Civil, Contractual, and Legal Liability of Users

Users shall be responsible for all direct or indirect damages resulting from the breach of obligations in this chapter, violation of data protection laws, violation of information confidentiality, violation of third-party rights, unauthorized use of information, illegal dissemination of information, abuse of services, unauthorized access, illegal data collection, unauthorized data processing, or other related violations.

The platform may, as the case may be, take action to restrict services, suspend accounts, delete accounts, remove content, claim damages, refer the matter to competent authorities, cooperate with judicial authorities, enforce contract provisions, or take other legal and contractual actions.

• Note 1: The application of disciplinary measures shall not preclude the claiming of damages or legal pursuit.
• Note 2: Responsibilities stipulated in this chapter shall continue to apply to information received from the platform even after the termination of service use.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that reduces the platform's legal responsibility in observing data protection requirements or results in the transfer of the platform's legal obligations to users.

Chapter Twenty-Three: Information of Children, Incapacitated Persons, Persons with Limited Legal Capacity, Legal Guardianship, Parental Consent, and Special Protection for Vulnerable Groups

Article 221- General Principles of Protecting Children and Persons under Legal Protection

The platform is committed to observing the highest level of care proportionate to applicable laws, child rights protection principles, data protection principles, and related international standards in the collection, use, processing, storage, transfer, sharing, and deletion of information related to children, adolescents, incapacitated persons, persons lacking legal capacity, persons with limited legal capacity, individuals under guardianship, individuals under legal custody, and other vulnerable persons.

Processing of these individuals' information shall be performed strictly within the scope of necessity, legitimate objectives, necessary legal consent or authorization, execution of authorized contracts, preservation of the best interests of the relevant person, or other valid legal bases.

• Note 1: Special protection for children shall be applied to all stages of their information lifecycle.
• Note 2: In the event of a conflict between commercial interests and the best interests of the child, the best interests of the child shall take precedence.
• Note 3: The platform may formulate special internal policies for the protection of children's information.

Article 222- Restriction on Account Creation by Children

In cases where applicable laws have specified a minimum age for account creation, performing transactions, using financial services, publishing ads, creating stores, using electronic wallets, using transportation services, using artificial intelligence-based services, or other services, account creation or independent use of services by individuals not meeting the age requirement shall not be permitted unless with the consent or supervision of parents, guardians, or legal representatives, as the case may be.

• Note 1: The platform may request supplementary documents to verify users' age.
• Note 2: In case of discovering non-compliance with age requirements, the platform may restrict or deactivate the account.
• Note 3: Providing incorrect information regarding age may result in the application of contractual restrictions.
• Note 4: The platform will not knowingly collect or process personal information of children under the minimum legal age specified in applicable laws without valid consent from their parents, guardians, or legal representatives.

Article 223- Consent of Parents or Legal Representatives

In cases where processing the information of a child or a person with limited legal capacity requires legal consent, the platform may receive, register, validate, or document the consent of parents, guardians, legal custodians, or legal representatives through appropriate methods.

This consent may be obtained through written documents, electronic tools, digital signatures, parental authentication, legal identity verification, or other valid methods.

• Note 1: The platform may request supplementary documents if there is doubt regarding the validity of the consent.
• Note 2: Parents or legal representatives may modify or revoke their consent within the limits of applicable laws.
• Note 3: Revocation of consent may lead to the cessation of certain services.

Article 224- Information Collectable from Children and Persons under Protection

The platform shall only collect information from children or persons under legal protection that is required for providing services, executing authorized contracts, maintaining security, observing legal requirements, providing educational services, providing authorized medical services, providing support services, or other legitimate and necessary objectives.

Collection of unnecessary information, unrelated sensitive information, or information that has no reasonable connection to the provided service shall be prohibited unless based on a legal requirement.

• Note 1: The data minimization principle shall be applied more strictly to children's information.
• Note 2: Sensitive information of children shall be processed only in necessary cases and in compliance with legal requirements.
• Note 3: The platform may use anonymization or pseudonymization technologies to reduce the amount of collected information.

Article 225- Use of Children's Information for Advertising and Personalization

The platform will not use the information of children or persons under legal protection for behavioral advertising, commercial profiling, interest analysis, behavior-based marketing, targeted advertising, selling information, or other similar activities that are incompatible with the best interests of the child, unless explicitly permitted by law.

• Note 1: Personalization of services for children should be solely for the purpose of improving user experience and maintaining their security.
• Note 2: Advertisements displayed to children must be consistent with child protection laws.
• Note 3: The platform may apply additional restrictions on the processing of children's information.

Article 226- Information of Persons with Limited Capacity and Incapacitated Persons

In the event that users are persons with limited capacity, incapacitated, persons with mental disabilities, persons under guardianship, or other persons for whom the law has provided special protection, the platform may also receive and process information related to the legal representative, guardian, custodian, supervisor, or authorized person.

Processing of these persons' information must be performed proportionate to their legal status, legal requirements, and the legitimate interests of the person under protection.

• Note 1: The platform may request legal representation documents.
• Note 2: The legal representative shall be obliged to provide accurate information.
• Note 3: Any change in the status of representation must be announced to the platform as soon as possible.

Article 227- Security of Information of Children and Vulnerable Persons

The platform is committed to applying reinforced security measures for information of children, adolescents, persons under legal protection, and other vulnerable groups, including limited access control, encryption, logging, processing restriction, anonymization, pseudonymization, data transfer control, security audits, sharing restriction, and other proportionate controls.

• Note 1: Employee access to children's information shall be possible only within the scope of necessity.
• Note 2: Children's information shall not be made available to third parties without a valid legal basis.
• Note 3: The platform may formulate dedicated internal policies for the security of children's information.

Article 228- Rights of Parents, Guardians, and Legal Representatives

Parents, guardians, or legal representatives may submit requests for access, rectification, completion, restriction of processing, deletion of information, revocation of consent, receipt of information related to processing, objection to certain processing, or the exercise of other legal rights regarding the personal information of the child or the person under their guardianship within the limits of applicable laws.

• Note 1: The platform shall verify the legal capacity of the requester prior to responding.
• Note 2: The exercise of rights must not be contrary to the best interests of the child or legal requirements.
• Note 3: Certain rights may be restricted in the presence of legal requirements.

Article 229- Reporting Violations Related to Children's Information

Any person who becomes aware of unauthorized collection of children's information, abuse of their information, publication of children's private information, unauthorized advertising use, unauthorized access, identity theft, security threats, data breaches, or other related violations may report the matter through the platform's official channels.

The platform may take action to investigate, restrict services, remove content, suspend accounts, cooperate with competent authorities, adopt security measures, or take other necessary actions.

• Note 1: Received reports may require the provision of supplementary documentation.
• Note 2: The platform may keep the reporter's identity confidential within the limits of the law.
• Note 3: False reporting may result in legal liability for the reporter.

Article 230- Obligations of the Platform in Supporting Vulnerable Groups

The platform is committed to considering the best interests of children and other vulnerable groups in service design, user interface design, artificial intelligence system development, personalization algorithm development, advertising system development, registration process design, authentication process design, communication system design, financial process design, transportation system design, and all processes related to personal information, and to avoid any unnecessary, discriminatory, or contrary processing to their fundamental rights.

The platform is also committed to reviewing and updating its internal policies for the support of children and persons under legal protection in proportion to changes in laws, technological development, service changes, and security risk changes.

• Note 1: These obligations shall not absolve parents or legal representatives of their responsibility in supervising children's use of services.
• Note 2: The platform may apply special age or control restrictions for certain services.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that reduces the level of legal protection established for children, incapacitated persons, or other vulnerable groups.

Chapter Twenty-Four: Complaints, Disputes, Privacy Requests, Internal Handling, Dispute Resolution, Cooperation with Competent Authorities, and Enforcement of Legal Rights

Article 231- General Principles for Handling Complaints and Privacy-Related Requests

The platform is committed to reviewing all complaints, requests, objections, reports, claims, notices, requests for the exercise of rights, security breach reports, information abuse reports, unauthorized access reports, data disclosure reports, confidentiality breach reports, data protection regulation violation reports, and other requests related to personal information by observing the principles of impartiality, confidentiality, transparency, proportionality, accountability, fairness, reasonable speed, and compliance with applicable laws.

• Note 1: Filing a complaint shall not preclude the simultaneous use of other legal rights by the user.
• Note 2: Handling a complaint shall be subject to the possibility of verifying the identity or legal capacity of the requester.
• Note 3: The platform may establish dedicated internal processes for managing complaints.

Article 232- Methods for Filing Complaints and Requests

Users, sellers, buyers, drivers, legal representatives, data subjects, interested third parties, or other persons having legal rights may file complaints or requests related to personal information through the user panel, support system, electronic forms, official email, official correspondence, communication systems introduced by the platform, or other announced methods.

• Note 1: The platform may request supplementary information necessary for reviewing the complaint.
• Note 2: Incomplete requests may not be reviewed until the information is completed.
• Note 3: The platform may determine standard templates for filing requests.

Article 233- Identity Verification and Verification of Requester's Competence

Prior to handling any request related to personal information, the platform may proceed to verify the identity of the applicant, verify representation status, verify account ownership, verify legal relationship, examine documents, examine representation documents, examine electronic signatures, or other identity verification methods.

• Note 1: The purpose of identity verification is to prevent information disclosure to unauthorized persons.
• Note 2: Failure to provide necessary documents may lead to the rejection or suspension of the review process.
• Note 3: Information provided for identity verification shall be used solely for this purpose unless there is another legal basis.

Article 234- Internal Review and Handling Process

The platform may involve internal committees, the data protection unit, information security unit, legal unit, compliance unit, anti-fraud unit, support unit, IT unit, or other specialized units in the handling process, depending on the subject.

If necessary, reviews may include system history analysis, log review, transaction review, document review, communication history review, technical information review, authentication history review, or other related investigations.

• Note 1: Access of internal units to information shall be limited to the need for review.
• Note 2: All persons participating in the review shall be subject to confidentiality obligations.
• Note 3: The platform may retain records of reviews for legal or auditing objectives.

Article 235- Handling Requests Related to Information Security Breaches

In the event of reporting data breaches, unauthorized access, information disclosure, account theft, identity theft, information abuse, cyber attacks, abuse of personal data, or other security incidents, the platform may perform the necessary security, technical, legal, and managerial reviews and, as the case may be, implement necessary actions for containment, mitigation of effects, data recovery, notification, documentation, cooperation with competent authorities, or other necessary actions.

• Note 1: The priority of handling security incidents shall be determined based on the risk level.
• Note 2: Notification to users shall be performed according to legal requirements or risk level.
• Note 3: Reviewing security incidents may require the temporary restriction of certain services.

Article 236- Cooperation with Judicial, Regulatory, and Administrative Authorities

The platform may cooperate with courts, public prosecutor's offices, law enforcement authorities, regulatory authorities, data protection authorities, anti-money laundering authorities, tax organizations, security entities, consumer protection organizations, licensing authorities, supervisory organizations, and other competent authorities within the framework of applicable laws.

This cooperation may include providing information, providing documents, providing logs, providing transaction history, responding to inquiries, executing legal orders, enforcing judgments, or other legal actions.

• Note 1: Cooperation with authorities shall be performed strictly within the scope of their legal powers.
• Note 2: The platform may verify the authenticity of legal requests.
• Note 3: Records of cooperation with authorities may be retained for auditing or legal objectives.

Article 237- Resolution of Disputes Between Users

In cases where a dispute arises between users, sellers, buyers, drivers, service providers, or other persons related to personal information processing, system communications, transactions, or service utilization, the platform may, as the case may be, implement mediation services, preliminary review, document assessment, offer dispute resolution proposals, temporarily restrict services, or other managerial actions.

• Note 1: The platform's role in dispute resolution may be solely a facilitating role depending on the type of service.
• Note 2: Internal decisions of the platform shall not preclude the parties from referring to competent authorities.
• Note 3: The platform may retain records of disputes for security or legal objectives.

Article 238- Documentation, Record Keeping, and Confidentiality of Proceedings

The platform may retain all requests, complaints, objections, correspondence, documents, review records, decision records, response records, security records, legal records, technical records, meeting records, communication records, authentication records, and other information related to the handling process within the limits of legal requirements and legitimate objectives.

• Note 1: Records of proceedings shall be considered confidential.
• Note 2: Access to records shall be limited to authorized persons.
• Note 3: The retention period for records shall be subject to legal, security, or contractual requirements.

در ادامه، ترجمه تخصصی مواد ۲۳۹ تا ۲۷۱ به زبان انگلیسی ارائه شده است:

Article 239- Misuse of the Complaint Handling Process

Registering a complaint or request with fake information, providing forged documents, using the identity of others, repeatedly registering irrational requests, disrupting the handling process, abusing personal information rights, using the complaint process for unauthorized access to information, or any misuse of the mechanisms in this chapter is prohibited. The platform may take action to reject the request, restrict services, suspend the account, claim damages, or pursue legal action.

• Note 1: The rejection of a request shall not prevent the re-registration of a valid request.
• Note 2: The platform may document abusive requests.
• Note 3: The responsibility for the accuracy of provided information shall lie with the requester.

Article 240- Final Principles of Handling, Fairness, and Protection of Rights

The platform is committed to observing the principles of fairness, impartiality, transparency, proportionality, confidentiality, accountability, security, protection of fundamental rights of individuals, protection of third-party rights, compliance with legal requirements, compliance with data protection principles, compliance with contractual requirements, and observance of the legitimate interests of the parties when handling all requests and complaints related to personal information.

The platform is also committed to continuously reviewing and improving internal handling processes in proportion to changes in laws, service development, technological development, increased cyber risks, organizational restructuring, development of artificial intelligence systems, and international data protection standards.

• Note 1: None of the provisions of this chapter shall prevent individuals from referring to competent judicial or administrative authorities.
• Note 2: The implementation of internal complaint handling processes shall not be construed as the platform accepting legal liability unless the law or a ruling by a competent authority stipulates otherwise.
• Note 3: All processes in this chapter must be executed in compliance with the principles of confidentiality, data minimization, information security, respect for individual rights, and international data protection requirements.

Chapter Twenty-Five: Amendment, Updating, Change, Interpretation, Privacy Policy Versions, Validity Continuity, Severability of Regulations, and Final General Provisions

Article 241- Right to Amend and Update the Privacy Policy

The platform may, at any time and based on technical, operational, security, contractual, commercial, organizational, judicial, regulatory, legislative necessities, changes in business model, service development, technology development, artificial intelligence development, financial service development, international service development, cloud service development, data-based service development, analytical service development, corporate group restructuring, mergers, acquisitions, transfer of assets, or other legitimate necessities, take action to amend, complete, delete, rewrite, replace, or update all or part of the provisions of this policy.

• Note 1: Amendments may include the addition of new chapters, articles, notes, or annexes.
• Note 2: Policy updates may also result from changes in the laws of various countries or international requirements.
• Note 3: No amendment shall lead to a reduction in the binding rights of users against mandatory laws.

Article 242- Notification of Changes

The platform may notify users of changes to this policy through the website, application, user panel, email, SMS, in-app notification, login page notification, notification center, message center, public announcement, official social networks, contractual documents, or other appropriate communication methods.

• Note 1: The selection of the notification method shall be based on the nature of the change and the platform's technical capabilities.
• Note 2: Public notification may be made for all users or a specific group of users.
• Note 3: Failure of the user to see the notice, provided that the notification was performed according to standard procedures, shall not prevent the implementation of the changes unless the law stipulates otherwise.

Article 243- Effective Date of New Versions

The new version of the privacy policy shall be effective from the date announced by the platform unless the law or the relevant notice determines another time.

Continued use of services after the new version becomes effective shall be considered as acceptance of the new version within the limits of applicable laws.

• Note 1: In cases where the law requires re-obtaining consent, the platform will take the necessary action to obtain such consent.
• Note 2: Some changes may apply solely to new services.
• Note 3: Previous versions may be retained for legal or auditing purposes according to internal policies.

Article 244- Relationship of this Policy with Other Legal Documents

This policy shall be interpreted alongside terms of service, specific contracts, vendor contracts, business partner contracts, cookie policy, information security policy, anti-money laundering policy, content policy, advertising regulations, electronic wallet regulations, artificial intelligence policy, financial service terms, international service terms, transportation service terms, loyalty program terms, API terms, and other related legal documents.

In case of conflict between this policy and specific documents related to a service, the specific document shall take priority regarding that service within the scope of its subject matter, unless the law stipulates otherwise.

• Note 1: Specific documents may create supplementary protections for personal information.
• Note 2: Conflicts between documents must be interpreted in compliance with the principle of greater protection of personal information.
• Note 3: The silence of a document regarding a specific matter shall not prevent the application of other related documents.

Article 245- Interpretation of Policy Provisions

The provisions of this policy must be interpreted based on the principles of good faith, legitimacy, transparency, proportionality, security, data minimization, purpose limitation, storage limitation, accountability, respect for fundamental rights, consumer protection, privacy protection, protection of fair competition, cyber security protection, and other recognized data protection principles.

• Note 1: The titles of chapters and articles are solely for ease of reading and shall not limit the provisions.
• Note 2: The examples mentioned in this policy are illustrative and not limited to those cases.
• Note 3: The use of words such as "including," "such as," "includes," "may," or similar phrases shall not be exhaustive unless explicitly stated otherwise.

Article 246- Severability of Regulations

In the event that any article, note, clause, or section of this policy is deemed unenforceable, void, or invalid by law, a ruling of a competent authority, a decision of a regulatory body, or changes in regulations, the validity of other provisions of this policy shall be maintained to the extent possible.

The platform may replace invalid provisions with new regulations that have the highest compliance with the original objective.

• Note 1: The invalidity of a part of the policy shall not cause the invalidity of the entire policy unless the execution of other parts becomes impossible.
• Note 2: The alternative interpretation must be consistent with the original objective of the provision as much as possible.
• Note 3: Users shall not have the right to rely on partial invalidity to invalidate the entire policy unless the law explicitly stipulates such an effect.

Article 247- Continuity of Obligations after Termination of Service Use

Termination of membership, deletion of user account, account suspension, contract termination, end of service use, business transfer, store dissolution, application deletion, subscription end, or any termination of the contractual relationship between the user and the platform shall not cause the termination of obligations related to information confidentiality, data protection, information security, record keeping, legal requirements, tax requirements, anti-money laundering requirements, dispute resolution, liabilities arising from past violations, or other obligations that by nature must remain after the termination of the relationship.

• Note 1: Confidentiality obligations shall continue until the legal basis for confidentiality is removed.
• Note 2: Archival information may be retained after the termination of service use.
• Note 3: The continuity of obligations shall be subject to applicable laws.

Article 248- Compliance with Multi-Country Laws and International Regulations

Given the international nature of the platform, this policy is prepared taking into account recognized principles of data protection, electronic commerce, cyber security, consumer protection, anti-money laundering, child protection, digital rights, international data transfer, and other related regulations, and may be adapted to the laws of various countries, regional regulations, requirements of regulatory bodies, and international standards as needed.

• Note 1: In case of legal requirement, the platform may formulate dedicated local policies for certain countries.
• Note 2: Compliance with local laws may result in differences in how users' information is processed in different countries.
• Note 3: The existence of a local version shall not prevent the application of other provisions of this policy within the scope of applicable laws.

Article 249- Language Versions and Validity of Texts

The platform may publish this policy in different languages to facilitate access by users in various countries.

In case of discrepancy between language versions, the version designated as the official version by the platform or the version consistent with the laws of the place where service is provided shall be the basis for interpretation, unless mandatory law stipulates otherwise.

• Note 1: Unofficial translations shall have no legal validity.
• Note 2: Disputes arising from translation must be interpreted based on the primary objective of the provision.
• Note 3: The platform may update language versions independently.

Article 250- Final Principles, Good Faith, Privacy Protection, and Continuous Improvement

The platform is committed to performing all activities related to personal information based on the principles of good faith, transparency, legitimacy, proportionality, security, accountability, data minimization, purpose limitation, storage limitation, fairness, non-discrimination, organizational responsibility, respect for user rights, respect for third-party rights, compliance with legal requirements, compliance with international standards, and continuous improvement of the data protection system.

The platform is also committed to continuously evaluating, reviewing, and improving the data protection system, internal policies, security controls, compliance processes, risk management processes, and mechanisms for protecting user rights in line with technology development, service development, expansion of international activities, development of artificial intelligence services, cloud services, financial services, regulatory changes, and evolution of global standards.

• Note 1: The provisions of this policy must always be interpreted with an approach of maximum protection of user privacy unless mandatory law stipulates otherwise.
• Note 2: None of the provisions of this policy shall be interpreted in a way that deprives users of inalienable rights or reduces the legal protections established in applicable laws.
• Note 3: This policy shall be interpreted and executed as a comprehensive framework governing the protection of users' personal information alongside other legal documents of the platform and applicable laws.

Chapter Twenty-Six: Regulatory Compliance, Data Governance, Data Protection Officer, Auditing, Data Protection Impact Assessment, Risk Management, and Organizational Compliance Programs

Article 251- General Principles of Data Governance and Regulatory Compliance

The platform is committed to designing, implementing, monitoring, and improving the data governance system, information management, regulatory compliance, information risk management, organizational accountability, information security, personal data protection, information lifecycle management, access management, data transfer management, data processor management, cloud service management, artificial intelligence management, data analysis management, international service management, and other related processes based on applicable laws, international standards, contractual requirements, and recognized data protection principles.

• Note 1: The data governance system may be developed in proportion to the size of the organization and the type of services.
• Note 2: All organizational units shall be obliged to comply with data protection policies.
• Note 3: The ultimate responsibility for compliance with legal requirements shall lie with the platform.

Article 252- Data Protection Officer and Governance Structure

The platform may, according to legal requirements, organizational structure, or operational needs, appoint a Data Protection Officer, Data Protection Committee, Information Security Committee, Compliance Committee, Risk Management Committee, Artificial Intelligence Committee, Data Ethics Committee, Information Security Officer, Compliance Manager, Cyber Security Manager, or other specialized structures to manage processes related to personal information.

• Note 1: The duties of the Data Protection Officer may include supervision, consulting, training, auditing, and responding to requests.
• Note 2: The Data Protection Officer may cooperate with legal, IT, information security, and risk management units.
• Note 3: The creation or non-creation of a specific organizational position shall be subject to applicable laws and the internal structure of the platform.

Article 253- Organizational Compliance Programs

The platform may formulate and implement comprehensive compliance programs including internal policies, operational guidelines, information security standards, risk management programs, data processor management programs, international data transfer management programs, incident management programs, complaint management programs, user consent management programs, employee training programs, internal control programs, and other related programs.

• Note 1: Compliance programs shall be reviewed periodically.
• Note 2: The implementation of compliance programs may be performed in stages.
• Note 3: Compliance documents may be updated or replaced as needed.

Article 254- Data Protection Impact Assessment (DPIA)

The platform may perform a data protection impact assessment prior to the launch of new services, new technologies, artificial intelligence systems, data analysis systems, financial systems, authentication systems, international systems, cloud services, automated decision-making systems, profiling systems, or other high-risk processing.

This assessment may include examining the necessity of processing, proportionality of processing, potential risks, impacts on user rights, security controls, risk reduction measures, impacts of international data transfer, and other related factors.

• Note 1: The conduct of the impact assessment shall be proportionate to the risk level of the processing.
• Note 2: The results of the assessment may be the basis for modifying the design of services.
• Note 3: Assessments performed may be considered confidential.

Article 255- Personal Information Risk Management

The platform may identify, analyze, evaluate, monitor, and manage risks related to personal information, including the risk of data breaches, cyber attacks, international data transfer, artificial intelligence, data processors, cloud services, third parties, human error, system failure, internal abuse, fraud, non-compliance, breach of confidentiality, and other related risks.

• Note 1: Risk management must be a continuous process.
• Note 2: Risk reduction measures shall be determined in proportion to the probability of occurrence and the severity of its effects.
• Note 3: Risk assessment models may be updated based on new technologies.

Article 256- Auditing, Inspection, and Compliance Monitoring

The platform may, internally or through independent third parties, perform information security audits, data protection audits, compliance audits, data processor audits, cloud infrastructure audits, artificial intelligence system audits, financial system audits, cyber security audits, data transfer audits, access audits, security control audits, and other similar evaluations.

• Note 1: The results of audits may be the basis for modifying processes.
• Note 2: Persons performing the audit shall be subject to confidentiality obligations.
• Note 3: The platform may formulate an annual or periodic audit program.

Article 257- Management of Data Processors and Third Parties

The platform may, prior to delegating information processing to third parties, proceed to perform security assessment, technical assessment, legal assessment, contractual assessment, compliance assessment, financial assessment, background check, assessment of data protection capabilities, and other necessary reviews.

The platform may also monitor the continuous performance of data processors during the collaboration.

• Note 1: Data processors shall process information solely based on the platform's instructions.
• Note 2: Data processing contracts may include security, confidentiality, and auditing obligations.
• Note 3: The end of collaboration may entail the deletion or return of information.

Article 258- Training, Culture Building, and Employee Awareness

The platform may implement training programs, specialized courses, security tests, data protection training, cyber security training, social engineering defense training, incident management training, responsible AI training, information management training, compliance training, and other awareness development programs for employees, managers, contractors, and other persons with access.

• Note 1: Training may be held in-person, online, or in a hybrid format.
• Note 2: The platform may evaluate the effectiveness of training.
• Note 3: Participation in certain training may be mandatory for accessing information.

Article 259- Documentation, Record Keeping, and Organizational Accountability

The platform may retain records of information processing, user consent records, data transfer records, user request records, security incident records, audit records, risk assessment records, data protection impact assessment records, management decision records, records of cooperation with legal authorities, employee training records, data processing contract records, and other related records for the purposes of compliance, accountability, auditing, risk management, or legal requirements.

• Note 1: Access to records shall be limited to authorized persons.
• Note 2: The retention period for records shall be subject to legal, contractual, and managerial requirements.
• Note 3: Documentation of processes shall not prevent the application of other security controls.

Article 260- Continuous Improvement of Data Governance and Compliance

The platform is committed to continuously reviewing and upgrading the data governance system, personal information protection framework, security controls, internal policies, compliance programs, risk management processes, incident management systems, artificial intelligence systems, international data transfer management mechanisms, data processor management mechanisms, user response processes, training programs, and other components of the data protection system based on technological changes, business changes, changes in laws, cyber threat changes, service development, international market development, and global standards.

• Note 1: Continuous improvement may be achieved through digital transformation projects, periodic audits, or technology development programs.
• Note 2: The platform may use recognized international standards and frameworks in developing the data governance system.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that limits the platform's legal responsibility in observing data protection requirements or transfers it to third parties.

Chapter Twenty-Seven: Third-Party Services, External Links, Plugins, Social Networks, Software Stores, Payment Services, Location-Based Services, and Responsibility for Information Processing by Third Parties

Article 261- General Principles of Using Third-Party Services

The platform may use services, infrastructure, systems, software, APIs, SDKs, cloud services, financial services, payment services, map services, transportation services, messaging services, artificial intelligence services, data analysis services, cyber security services, authentication services, storage services, advertising services, marketing services, support services, communication services, or other services belonging to third parties for the purpose of providing, developing, completing, supporting, securing, analyzing, optimizing, personalizing, and expanding its services.

Use of these services shall be performed strictly within the scope of legitimate objectives, contractual requirements, legal requirements, and operational needs.

• Note 1: The use of third-party services shall not mean the transfer of the platform's overall responsibilities regarding data protection.
• Note 2: The platform may use one or more third-party service providers depending on the type of service.
• Note 3: The list of third-party services may change in proportion to service development.
• Note 4: The platform may use Software Development Kits (SDKs), analytical tools, or other services belonging to third parties for providing services, analyzing performance, reporting software errors, statistical analysis, security, improving service quality, or enhancing user experience, where information processing in them is performed according to data protection contracts and applicable laws.

Article 262- External Links and Websites

The platform may contain links, references, buttons, Banners, QR Codes, URLs, APIs, Widgets, or other connection tools to websites, applications, or systems belonging to third parties.

Users' access to external systems, use of their services, or provision of information on those systems shall be subject to the independent privacy policies, terms of use, and regulations of those parties.

• Note 1: The platform shall not be responsible for the privacy policies of external websites.
• Note 2: Users are obliged to study the relevant policies before using third-party services.
• Note 3: The existence of an external link shall not be considered as an endorsement of all activities of the third party.

Article 263- Payment Services, Banks, and Financial Institutions

In case of using payment services, fund transfer, electronic wallet, payment gateway, installment payment, settlement, refund, or other financial services, part of the users' information may be processed by banks, financial institutions, payment companies, electronic wallet providers, credit rating institutions, or other financial service providers.

• Note 1: Information processing by financial institutions shall also be subject to the specific regulations of those institutions.
• Note 2: The platform may exchange information necessary for performing transactions with financial service providers.
• Note 3: Sensitive payment information shall be processed directly by authorized payment service providers as much as possible.

Article 264- Software Stores and Operating Systems

In case of downloading or using the platform's application through software stores, digital markets, mobile operating systems, computer operating systems, or other software distribution platforms, information may be processed according to the policies of those platforms.

Also, some device capabilities including notifications, location, camera, microphone, memory, Bluetooth, NFC, or other capabilities may be provided to the application based on permissions granted by the user.

• Note 1: Users can manage some device permissions through operating system settings.
• Note 2: Restricting some permissions may disrupt parts of the services.
• Note 3: Software store policies shall be independent of this policy.

Article 265- Social Networks and Integrated Login Services

The platform may provide the possibility of logging in through social network accounts, integrated authentication services, digital identity providers, or other similar systems.

In case of using these features, some user information will be received from the service provider based on permissions granted by the user.

• Note 1: The scope of received information shall be subject to user settings and the service provider's policies.
• Note 2: Users can manage granted access through their account with the service provider.
• Note 3: The platform shall not be responsible for changes in social network privacy policies.
• Note 4: The platform will not use users' information for Cross-App Tracking or similar purposes without obtaining necessary authorization or consent in accordance with applicable laws.

Article 266- Location-Based Services, Maps, and Navigation

In case of using location-based services, map systems, navigation services, transportation services, goods delivery services, nearby store services, local search services, or other services dependent on geographical location, users' location information may be exchanged with map service providers or location-based services.

• Note 1: The transfer of location information shall be limited to the information required for providing the service.
• Note 2: Users can manage some location permissions through device settings.
• Note 3: Disabling location access may limit some services.
• Note 4: Users' precise location information shall be processed solely with obtaining necessary authorization from the operating system or user consent and to the extent necessary for providing related services, and users can manage relevant permissions through device settings.

Article 267- Advertising Services, Data Analysis, and Marketing

The platform may use services of advertising companies, data analysis companies, marketing companies, advertising networks, or other specialized service providers for performance analysis, campaign measurement, user behavior analysis, advertisement personalization, statistical analysis, user interaction analysis, advertisement management, loyalty program management, advertising campaign management, or other legitimate objectives.

• Note 1: The use of these services shall be subject to data protection requirements and contractual restrictions.
• Note 2: Information used shall be processed in an anonymous or aggregated form as much as possible.
• Note 3: Users can manage some personalized advertisement settings within the system's capabilities.
• Note 4: The platform may use data analysis services for performance analysis of services, quality measurement, statistical analysis, user usage analysis, Crash Reporting, or service improvement.

Article 268- Plugins, APIs, and Integration with External Systems

The platform may provide the possibility of connecting to external services, organizational systems, ERP, CRM, accounting software, warehouse systems, transportation systems, store management systems, artificial intelligence systems, data analysis systems, proprietary or public APIs, and other similar systems.

These integrations may require the exchange of information between systems.

• Note 1: The exchange of information shall be performed solely within the scope of granted access.
• Note 2: The platform may impose security, rate limiting, or access control restrictions on APIs.
• Note 3: Third parties shall be obliged to observe contractual information protection obligations.
• Note 4: Users can manage permissions related to the camera, microphone, location, memory, Bluetooth, contacts, or other device permissions through operating system settings; however, restricting some permissions may result in loss of access to parts of the services.

Article 269- Users' Responsibility in Using Third-Party Services

Users shall be responsible for reviewing privacy policies, terms of use, access permissions, security settings, account settings, permissions granted to third parties, device settings, social network settings, browser settings, and other settings related to the external services they use.

Users shall also be responsible for canceling unnecessary access and managing permissions granted to third-party services.

• Note 1: The platform shall not be responsible for users' actions in independent third-party systems.
• Note 2: Users should refrain from providing sensitive information to untrustworthy third parties.
• Note 3: Responsibility for using external services lacking legal authorization shall lie with the user.

Article 270- Obligations of the Platform in Cooperation with Third Parties

The platform is committed to considering criteria of information security, confidentiality, regulatory compliance, data protection, accountability, access control, data minimization, purpose limitation, and other proportionate standards in selecting, evaluating, contracting, monitoring, and collaborating with third parties, service providers, data processors, business partners, technology companies, cloud service providers, financial service providers, advertising service providers, security service providers, artificial intelligence service providers, and its other collaborators.

The platform is also committed to reviewing contractual relationships, security controls, compliance assessments, and information transfer mechanisms in case of changes in risk level, changes in laws, changes in services, changes in technology, or changes in collaboration status, and to avoid, as much as possible, collaborating with third parties who do not observe an appropriate level of data protection.

• Note 1: Collaboration with third parties shall not prevent the application of the platform's legal responsibilities within the scope of applicable laws.
• Note 2: The platform may periodically evaluate the security and compliance status of third parties.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that results in the complete transfer of responsibility for protecting users' information from the platform to third parties.

Chapter Twenty-Eight: Artificial Intelligence, Machine Learning, Automated Decision-Making, Profiling, Data Analysis, Intelligent Algorithms, Recommender Systems, and Advanced Information Processing

Article 271- General Principles of Using Artificial Intelligence Technologies

The platform may use artificial intelligence, machine learning, deep learning, natural language processing, computer vision, large language models, predictive models, expert systems, recommender systems, or other similar technologies for service development, improving user experience, enhancing security, risk management, user behavior analysis, service personalization, advertising management, search management, recommendation management, image analysis, text analysis, audio analysis, video analysis, fraud detection, content management, complaint management, support management, automatic translation, content generation, information classification, market analysis, transaction analysis, service quality analysis, demand forecasting, trend analysis, operational data analysis, statistical data analysis, process automation, and other legitimate objectives.

The use of these technologies must be performed based on the principles of legitimacy, transparency, accountability, proportionality, security, fairness, non-discrimination, controllability, respect for user rights, and compliance with applicable laws.

• Note 1: The type of technologies used may change over time.
• Note 2: The development of artificial intelligence technologies may lead to the development of new information processing processes.
• Note 3: The use of artificial intelligence technologies must not result in a reduction of the level of legal protection for personal information.

در ادامه، ترجمه تخصصی مواد ۲۷۲ تا ۳۰۰ به زبان انگلیسی ارائه شده است:

Article 272- Data Sources Used for Training and Improving Models

The platform may use anonymized data, pseudonymized data, aggregated data, statistical data, operational data, public data, system-generated data, authorized training data, licensed data, data derived from user interaction, or other authorized data sources to train, tune, evaluate, test, validate, improve, monitor, or develop artificial intelligence systems.

• Note 1: Personal information shall be anonymized or pseudonymized as much as possible before being used for training models.
• Note 2: Training data must be selected in proportion to the processing objective.
• Note 3: The use of training data must be performed in compliance with intellectual property rights and data protection laws.

Article 273- Automated Decision-Making and Algorithmic Processing

The platform may use algorithm-based decisions, automated processing, or intelligent systems to manage transactions, security, fraud, advertising, content, ranking, recommendations, searches, orders, risks, credit, pricing, transportation, support, or other operational processes.

• Note 1: Automated decisions may be made based on historical data, current data, or predictive analytics.
• Note 2: Where appropriate, the possibility of human review of decisions shall be provided.
• Note 3: The use of automated decision-making shall not cause unjustified discrimination or violation of users' fundamental rights.
• Note 4: Decisions with legal or similar significant effects on users shall not be made solely on the basis of fully automated processing, except within the limits of applicable laws or in cases where human review or other legal safeguards are provided.

Article 274- Profiling and User Behavior Analysis

The platform may analyze user behavior or create user profiles based on search history, purchase history, sales history, interaction with content, interaction with advertisements, interaction with notifications, registered interests, preferred categories, device information, location information, transaction information, behavioral patterns, service usage time, activity history, user preferences, and other authorized data. These processes may be used for service personalization, product recommendations, store recommendations, advertisement recommendations, security management, risk management, service quality analysis, product development, or other legitimate objectives.

• Note 1: Profiling must be proportionate to the processing objectives and the principle of data minimization.
• Note 2: Users may manage some personalization settings within the system's capabilities.
• Note 3: Created profiles may be periodically updated or deleted.

Article 275- Recommender Systems and Content Personalization

The platform may use artificial intelligence-based recommender systems or data analysis for displaying ads, products, stores, purchase recommendations, sales recommendations, advertising recommendations, content recommendations, search recommendations, service recommendations, transportation recommendations, financial recommendations, loyalty recommendations, or other relevant recommendations.

• Note 1: The provided recommendations will not necessarily be the most complete or the best available option.
• Note 2: Recommender algorithms may change based on user behavior.
• Note 3: Users may disable some personalization settings within the system's capabilities.
• Note 4: Users may take action to disable personalized advertisements or limit some behavioral advertising processes within the system's capabilities.

Article 276- Use of Artificial Intelligence in Security and Fraud Management

The platform may use artificial intelligence and machine learning systems for identifying cyber attacks, suspicious activities, fraud, fake accounts, bots, abnormal transactions, service abuse, threat analysis, risk management, security incident analysis, and other security objectives.

• Note 1: Results of intelligent systems may be reviewed by human experts.
• Note 2: The platform may use multiple analytical models simultaneously to reduce error.
• Note 3: Security decisions may lead to the temporary restriction of some services.

Article 277- Use of Artificial Intelligence in Support and Communication with Users

The platform may use chatbots, virtual assistants, automated response systems, natural language processing systems, automated translation systems, response generation systems, summarization systems, sentiment analysis systems, request classification systems, ticket management systems, or other artificial intelligence-based systems to provide support services.

• Note 1: Users may communicate with non-human systems in some interactions.
• Note 2: In necessary cases, the possibility of referring the matter to human personnel shall be provided.
• Note 3: Conducted conversations may be processed for training or improving systems in compliance with this policy.

Article 278- Use of Anonymized Data for AI Development

The platform may use anonymized data, aggregated data, statistical data, pseudonymized data, data without direct identifiers, data resulting from macro-analysis, data resulting from non-personal interactions, or other data that does not allow for direct identification of users, for the development of artificial intelligence systems, machine learning models, analytical services, security systems, recommender systems, or other research and technological objectives.

• Note 1: The use of anonymized data shall not lead to the possibility of re-identifying users.
• Note 2: The platform may use advanced anonymization technologies.
• Note 3: Anonymized data may be combined with other anonymized data.

Article 279- Users' Responsibility in Using AI-Based Services

Users undertake to utilize artificial intelligence-based services for legal and legitimate purposes consistent with the terms of use, and to refrain from using them for producing illegal content, disseminating false information, identity theft, malware production, bypassing security controls, infringing intellectual property rights, violating third-party rights, disseminating confidential information, producing deceptive content, or other prohibited uses.

• Note 1: Users shall be responsible for content produced or published by their user account.
• Note 2: The platform may limit, suspend, or stop the use of artificial intelligence services.
• Note 3: The use of AI outputs shall not replace professional advice in sensitive matters.
• Note 4: Outputs produced by artificial intelligence systems are for auxiliary purposes only and shall not replace professional, legal, medical, financial, or other sensitive decision-making unless relevant laws stipulate otherwise.

Article 280- Ethical Principles, Transparency, and Continuous Improvement of AI Systems

The platform is committed to carrying out the development, training, deployment, operation, evaluation, and improvement of artificial intelligence systems based on the principles of transparency, accountability, security, fairness, non-discrimination, respect for human rights, respect for privacy, explainability, auditability, human control, data minimization, child protection, protection of vulnerable groups, compliance with legal requirements, and compliance with related international standards. The platform is also committed to continuously evaluating artificial intelligence models, recommender systems, data analysis systems, automated decision-making systems, and other intelligent technologies in terms of accuracy, security, quality, bias, discrimination, reliability, legal effects, social effects, and privacy effects, and taking action to modify, retrain, limit, or replace them if necessary.

• Note 1: The development of artificial intelligence systems must always be carried out with a "Privacy by Design" and "Security by Design" approach.
• Note 2: The platform may use independent experts or specialized entities to evaluate artificial intelligence systems.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that waives the platform's responsibility in observing data protection laws, user rights, or legal requirements related to the use of artificial intelligence technologies.

Chapter Twenty-Nine: Specific Requirements for Marketplaces, Sellers, Buyers, Stores, Service Providers, Business Agents, Advertisements, Transactions, and Information Processing in the Multiparty Ecosystem

Article 281- General Principles of Information Processing in the Marketplace Ecosystem

As a multiparty electronic marketplace, the platform provides an environment for interaction between buyers, sellers, stores, service providers, transportation companies, payment companies, insurance companies, business agents, advertisers, business partners, contractors, software developers, providers of auxiliary services, and other related persons. To create, manage, execute, monitor, support, develop, and secure this ecosystem, personal information, business information, transaction information, communication information, location information, financial information, technical information, advertising information, logistics information, behavioral information, and other related information may be processed in accordance with this policy.

• Note 1: Information processing shall be performed solely within the scope of legitimate objectives and in proportion to the type of service.
• Note 2: Each ecosystem participant shall have access solely to the information required to perform their duties.
• Note 3: Information processing in various services may have additional specific requirements.

Article 282- Information Related to Sellers, Stores, and Businesses

The platform may collect and process identity information, registration information, contact information, license information, tax information, banking information, payment information, agent information, business location information, advertisement information, product information, service information, warehouse information, transportation information, financial information, rating information, complaint information, transaction information, ranking information, response information, contract information, and other information related to sellers and stores.

• Note 1: A portion of store information may be displayed publicly to users.
• Note 2: Confidential business information shall be processed solely to the extent necessary.
• Note 3: Sellers shall be responsible for the accuracy of the provided information.

Article 283- Information Related to Buyers and Service Applicants

The platform may process identity information, contact information, order information, payment information, address information, delivery information, location information, communication with sellers information, complaint information, product return information, scoring information, search information, interests information, transaction information, loyalty information, wallet information, advertising information, interaction information, and other information related to buyers.

• Note 1: Buyer information shall be made available to the seller solely to the extent necessary for executing the transaction.
• Note 2: Sellers shall not be permitted to use buyer information for advertising purposes without their consent.
• Note 3: A portion of the information may be retained for legal purposes after the transaction is completed.

Article 284- Processing Information Related to Advertisements and Commercial Content

The platform may process information related to advertisements, images, videos, descriptions, prices, geographical locations, categories, tags, publication history, editing history, deletion history, user report history, content review history, violation history, advertising history, visit history, user interaction history, call history, message history, and other information related to advertisements.

• Note 1: The platform may use artificial intelligence systems to review advertisement content.
• Note 2: Advertisements contrary to laws or internal policies may be deleted or restricted.
• Note 3: History of deleted advertisements may be retained for security or legal purposes.

Article 285- Information Related to Negotiations, Messages, and Transactional Communications

In case of using internal messaging, secure calling, negotiation systems, price requests, purchase offers, sales offers, store chat, support systems, or other communication tools of the platform, communication information, time of communication, message content, sent files, call history, interaction history, negotiation history, initial agreement history, and other related information may be processed for service execution, security, dispute resolution, fraud prevention, quality control, or other legitimate objectives.

• Note 1: Users shall be obliged to observe laws when sending messages.
• Note 2: The platform may review suspicious communications.
• Note 3: Confidential communications shall also be subject to the security controls of this policy.

Article 286- Information Related to Transportation, Goods Delivery, and Logistics

In case of using transportation services, goods delivery, courier services, logistics services, warehousing services, or other related services, information related to order, address, location, delivery time, recipient information, sender information, driver information, vehicle information, route information, shipment status information, delivery information, delay information, delivery signature information, or other information necessary for service execution shall be processed.

• Note 1: Logistics information shall be used solely for service execution.
• Note 2: Transportation service providers shall be obliged to observe confidentiality obligations.
• Note 3: Location information may be processed in real-time.

Article 287- Information Related to Scoring, Comments, and Rankings

The platform may process information related to scores, comments, feedback, user reports, service quality evaluation, seller ranking, buyer ranking, response history, complaint history, product return history, delay history, order cancellation history, collaboration history, and other performance indicators to improve service quality.

• Note 1: The platform may delete comments contrary to laws or internal policies.
• Note 2: Rankings may be analyzed by intelligent algorithms.
• Note 3: Misuse of the scoring system shall be prohibited.

Article 288- Information Related to Transactional Disputes and Consumer Protection

The platform may process information related to disputes between buyers and sellers, complaints, documentation, images, correspondence, payment documents, transportation history, delivery history, conversation history, transaction history, internal decision history, arbitration history, mediation history, or other information necessary for handling disputes.

• Note 1: Dispute information shall be made available solely to authorized persons.
• Note 2: Documentation may be retained for cooperation with legal authorities.
• Note 3: Internal handling shall not prevent parties from referring to competent authorities.

Article 289- Information Related to Commercial, Advertising, and Market Development Programs

The platform may process information related to store performance, advertising performance, conversion rate, visit rate, interaction rate, campaign performance, category performance, sales indicators, loyalty indicators, customer satisfaction indicators, market indicators, geographical indicators, seasonal indicators, business analysis indicators, and other statistical or aggregated information for market development, economic analysis, service development, artificial intelligence development, search algorithm improvement, advertising system improvement, or other legitimate objectives.

• Note 1: Statistical information shall be used in an anonymized or aggregated form as much as possible.
• Note 2: Analytical information shall not lead to the disclosure of users' confidential information.
• Note 3: The platform may publish non-personal analytical reports.
• Note 4: The platform shall not sell users' personal information to third parties, and any information sharing shall be performed solely within the scope of providing services, executing contracts, observing legal requirements, maintaining system security, or with users' valid consent.

Article 290- Platform's Specific Obligations in Protecting Marketplace Ecosystem Information

The platform is committed to processing all information related to buyers, sellers, stores, service providers, business partners, agents, advertisers, transportation companies, payment companies, insurance companies, contractors, data processors, and other marketplace ecosystem members in accordance with the principles of legitimacy, transparency, security, confidentiality, data minimization, purpose limitation, storage limitation, accountability, regulatory compliance, risk management, cyber security, data governance, and international data protection standards. The platform is also committed to continuously reviewing, auditing, evaluating, and improving information protection processes in the marketplace ecosystem in proportion to service development, e-commerce development, artificial intelligence technology development, international service development, financial service development, cloud service development, regulatory changes, increased cyber threats, and business model development, and preventing any unnecessary processing or processing contrary to users' rights.

• Note 1: Collaboration between ecosystem participants shall not cause a reduction in the level of personal information protection.
• Note 2: All data processors and business partners shall be obliged to observe data protection obligations.
• Note 3: None of the provisions of this chapter shall be interpreted in a way that waives the platform's legal responsibility or reduces the protections established for users and data owners.

Chapter Thirty: Final Comprehensive Regulations, Cross-Border Data Protection, Dynamic Interpretation, Technology Evolution, Survival of Obligations, Priority of Privacy Protection, and Strategic Principles Governing the Privacy Policy

Article 291- Principle of Continuous Privacy Protection

The platform is committed to observing the protection of users' privacy as one of the fundamental principles governing its organizational, technical, legal, and managerial decisions in all stages of design, development, operation, maintenance, upgrade, integration, internationalization, intellectualization, automation, data analysis, infrastructure development, digital service development, financial service development, advertising service development, transportation service development, cloud service development, artificial intelligence-based service development, cross-border service development, and the development of any new service. This principle shall include all personal information, sensitive information, technical information, transaction information, behavioral information, location information, financial information, identity information, business information, and other information related to users.

• Note 1: Observance of the principle of privacy protection must be applied throughout the entire information lifecycle.
• Note 2: No new service shall be developed without evaluating its effects on users' privacy, except in legal emergency cases.
• Note 3: Technology development shall not cause the weakening of protections established in this policy.

Article 292- Privacy by Design and Security by Design

The platform is committed to observing the principles of "Privacy by Design," "Privacy by Default," "Security by Design," and "Security by Default" in the design of products, services, applications, websites, cloud infrastructures, artificial intelligence systems, advertising systems, payment systems, transportation systems, analytical systems, communication systems, authentication systems, financial systems, APIs, SDKs, and other components of its information technology.

• Note 1: The minimum necessary information must be collected as the default for each service.
• Note 2: Default settings must be in the direction of greater protection of users' information as much as possible.
• Note 3: Service design must facilitate the exercise of users' rights regarding personal information.

Article 293- Principle of Organizational Accountability

The platform shall be responsible for the design, deployment, execution, management, monitoring, supervision, documentation, evaluation, review, and continuous improvement of all processes related to personal information protection, and is committed to obliging all organizational units, managers, employees, contractors, business partners, data processors, affiliated companies, and other persons having access to information to observe the requirements of this policy and applicable laws.

• Note 1: Organizational accountability shall also include responsiveness to users and competent authorities.
• Note 2: Delegating a portion of data processing operations to third parties shall not cause the transfer of the platform's legal responsibility, unless the law stipulates otherwise.
• Note 3: The platform may create necessary internal structures for monitoring compliance.

Article 294- Principle of Processing Minimization and Purpose Limitation

The platform is committed to collecting, processing, retaining, transferring, and using users' personal information solely within the scope of specified, legitimate, transparent, proportionate, and necessary objectives, and to avoiding unnecessary information collection or processing. Any new use of information must have an independent legal basis, a legitimate objective, and a logical connection to the platform's activities.

• Note 1: Processing beyond the primary objectives shall require the existence of an appropriate legal basis.
• Note 2: Unnecessary information shall be deleted, anonymized, or restricted as soon as possible.
• Note 3: The principle of minimization shall also govern all third-party collaborators.

Article 295- Principle of Transparency and Continuous Notification

The platform is committed to providing users with necessary information about the manner of collection, processing, transfer, retention, sharing, deletion, anonymization, security, user rights, policy changes, service development, artificial intelligence use, third-party service use, cloud service use, tracking technology use, international data transfer, and other related topics in a proportionate, understandable, and accessible manner.

• Note 1: Transparency shall not lead to the disclosure of trade secrets or the reduction of system security.
• Note 2: Notification may be performed in stages or in proportion to the type of service.
• Note 3: Historical versions of policies may be retained for auditing purposes.

Article 296- Principle of International Cooperation and Cross-Border Compliance

Given its activities in international markets and various countries, the platform is committed to observing the laws of the country where the service is provided, requirements of regulatory bodies, international standards, and globally accepted data protection principles as much as possible in personal information processing, data transfer, collaboration with foreign processors, use of cloud services, use of international financial services, collaboration with international transportation companies, collaboration with technology service providers, and development of cross-border services.

• Note 1: Differences in country laws may result in differences in the manner of service provision.
• Note 2: The platform may formulate supplementary policies for different jurisdictions.
• Note 3: Cross-border collaboration shall not cause a reduction in the level of personal data protection.

Article 297- Principle of Technology Evolution and Adaptability to Innovation

The platform is committed to reviewing and improving data protection processes in proportion to new risks by developing emerging technologies, including generative artificial intelligence, cloud computing, edge computing, Internet of Things, augmented reality, virtual reality, blockchain, smart contracts, confidential computing, advanced encryption, decentralized identity technologies, automated systems, intelligent agents, biometrics, big data analysis, and other future technologies.

• Note 1: Utilizing new technologies shall not cause the violation of users' rights.
• Note 2: Privacy impact assessment must be performed prior to the deployment of high-risk technologies.
• Note 3: The platform may formulate specific policies for new technologies.

Article 298- Principle of Continuity of Information Protection after Termination of Contractual Relationship

Obligations related to personal information protection, confidentiality, information security, use limitation, transfer limitation, disclosure limitation, record keeping, accountability, observance of legal requirements, observance of judicial orders, observance of tax requirements, observance of anti-money laundering requirements, observance of cyber security requirements, and other obligations that by nature must also continue after the termination of the contractual relationship, shall continue after account deletion, termination of service use, contract termination, business transfer, or any termination of the relationship between the user and the platform.

• Note 1: Continuity of obligations shall be subject to applicable laws.
• Note 2: Retention of archival information shall be permitted in accordance with this policy.
• Note 3: Termination of service use shall not cause the automatic deletion of all legal records.

Article 299- Principle of Protective Interpretation and Observance of Users' Fundamental Rights

In interpreting the provisions of this policy, the interpretation that provides the greatest legitimate protection of personal information, users' fundamental rights, legitimate freedoms, communication confidentiality, information security, human dignity, consumer rights, digital justice, transparency, accountability, fairness, non-discrimination, and public trust shall always take precedence over other interpretations, unless mandatory law or a final ruling of a competent authority stipulates otherwise.

• Note 1: The silence of this policy regarding a specific matter shall not be considered as the permissibility of such processing.
• Note 2: In cases of ambiguity, the principle of greater protection of personal information shall be the basis for action.
• Note 3: Users' fundamental rights shall not be limited solely due to technology development, unless based on law.

Article 300- Final Charter of Personal Data Protection and Strategic Commitment of the Platform

The platform declares that the protection of personal information, cyber security, respect for privacy, observance of users' digital rights, observance of responsible e-commerce principles, observance of data governance principles, observance of international data protection requirements, observance of information security requirements, observance of responsible artificial intelligence principles, observance of international data transfer requirements, observance of transparency principles, accountability, data minimization, purpose limitation, storage limitation, fairness, responsibility, regulatory compliance, and continuous improvement are considered an integral part of the organizational strategy and culture governing the platform's activities. The platform is committed to always pursuing the highest conventional level of user information protection within the framework of applicable laws, professional standards, and ethical principles by developing international markets, digital services, the marketplace ecosystem, emerging technologies, artificial intelligence systems, financial services, cloud services, data-based services, and global collaborations, and to continuously upgrading the data protection system.

• Note 1: This policy is considered the comprehensive framework governing personal information protection in all current and future platform services, unless a specific policy with a higher level of protection is published for a specific service.
• Note 2: In case of conflict between commercial interests and legal data protection requirements, the platform is committed to adopting an approach based on observing users' rights and responsible information management within the limits of applicable laws.
• Note 3: All provisions of this policy must be interpreted and executed in an integrated, harmonious, and dynamic manner with the goal of guaranteeing maximum personal information protection, user trust, and the sustainability of the international marketplace ecosystem.