AYTEMİZ AKARYAKIT DAĞITIM A.Ş. - AYTONLINE MOBILE APPLICATION PRIVACY POLICY AND PRIVACY NOTICE

Last updated: 5 October 2026

Aytemiz Akaryakıt Dağıtım A.Ş. (“Aytemiz”), acting as the data controller, is located at Kozyatağı Mah. Kaya Sultan Sok. No:80/2 Kadıköy/İstanbul. This notice explains how the personal data of users of the “Aytemiz AytOnline” mobile application (the “Application”), published for iOS and Android, is processed under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and related legislation.

1. Application and Accounts

The Application is the mobile interface of the AytOnline fleet and fuel management service that Aytemiz offers to its corporate customers. Corporate customers are fleet-owning companies, distributors and financial intermediaries.

The Application does not offer self sign-up (registration). Accounts are created through the AytOnline system or the user management screen in the Application by users with user management authority at Aytemiz, the distributor, the financial intermediary or the company you are affiliated with.

2. Your Personal Data Processed

• Identity Information: First name, last name, username, user number.

• Contact Information: E-mail address, phone number.

• Customer Transaction Information: The company you are affiliated with and its current account (financial) details, vehicle plates and vehicle information, fuel purchase and consumption records, invoices, account transactions, limit definitions, notifications.

• Transaction Security Information: Session tokens, login dates, authorization information, the IP address transmitted during connection.

• Device and Technical Information: Device model, operating system and version, application version, error and crash logs, anonymous device and application identifier, the security status of the device (root, jailbreak, emulator or tampering tool use).

The Application does not collect location, camera, photo and gallery, contacts, microphone or advertising identifier data. During use, the Application does not ask you for location, camera, microphone, contacts or photo permissions.

In the Android version, libraries included in the Application declare the following technical permissions: internet, network and Wi-Fi state, device boot notification, biometric hardware access and, on Android 12 and earlier, storage read access. These permissions are used for application security and for opening invoice PDFs. The Application does not collect biometric data (fingerprint, face).

The Application contains no advertising, marketing tracking or analytics tools. Your data is not sold and is not shared for advertising purposes.

3. Purposes of Processing Your Personal Data

• Secure login to your account, authentication and authorization,

• Providing fleet, fuel, invoice, limit, account transaction and reporting services,

• Carrying out user management operations by authorized users,

• Enabling Aytemiz's authorized personnel to view your account as you see it in support and audit requests,

• Detecting and fixing errors in the Application,

• Ensuring information security; preventing unauthorized access, fraud and risks arising from modified devices,

• Fulfilling legal obligations and responding to requests from authorized authorities,

• Retaining records to serve as evidence in potential legal disputes.

4. Method and Legal Grounds for Collecting Your Personal Data

Your account information is entered into the AytOnline system by the authorized person who creates your account. Your other data is collected electronically by automated means while you use the Application. Your personal data is processed on the basis of the following legal grounds set out in Article 5(2) of the KVKK:

• (c) Direct relation to the establishment or performance of a contract: Necessary for providing the AytOnline service.

• (ç) Legal obligation of the data controller: Retention and notification obligations arising from legislation, and responding to requests from authorized authorities.

• (f) Legitimate interest of the data controller: Error tracking, ensuring information security and preventing fraud, provided that this does not harm your fundamental rights and freedoms.

5. Transfer of Your Personal Data

The Application uses the following service providers only for the stated purposes:

• Sentry (Functional Software, Inc.): For error and crash tracking, the following are transferred: error logs, device and application information, user number and username. E-mail and phone number are not sent; passwords and session tokens are masked. Server location: European Union (Germany).

• Talsec freeRASP (Lynx SFT s.r.o., Czech Republic): For application and device security, the anonymous device and application identifier, device model and the security status of the device are transferred. Server location: United States of America.

• Google Fonts (Google): Your device's IP address is transmitted when the Application's font is downloaded. Server location: Google servers (abroad).

These transfers constitute transfers abroad and are carried out in accordance with the procedures and principles set out in Article 9 of the KVKK. Your personal data may also be shared with the following recipients:

• Users with user management authority at the parties managing your account: the company you are affiliated with and, if your account is linked to a distributor or financial intermediary, that distributor or financial intermediary (name, username, e-mail, phone and authorization information),

• Public institutions and organizations and judicial authorities authorized by law.

6. Data Stored on Your Device

• Session Information: Session tokens and user information belonging to the session are stored in the device's encrypted secure storage (iOS Keychain, Android Keystore). They are deleted when you log out.

• Username: Kept on the device only if you select the “Remember me” option.

• Preferences: Theme, language and notification preferences, and the “Remember me” selection.

• Invoice PDFs: Invoices you view are downloaded to the device's temporary folder.

Your password is not stored on the device.

7. Retention Periods

Your personal data is retained for the period required by the purpose of processing and for the retention periods set out in the relevant legislation. Transaction records such as invoices and fuel purchase records are retained for the periods required by commercial and tax legislation. Error logs are automatically deleted at the end of the service provider's retention period.

Data whose retention period has expired is deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

8. Security Measures

• All communication between the Application and the servers is encrypted with TLS.

• When communicating with the AytOnline servers, the Application accepts only Aytemiz's server certificate (certificate pinning). No connection is established with fake servers attempting to intercept the communication.

• Session tokens are stored in the device's encrypted secure storage and are issued with a limited validity period. Sessions that remain unused for a long time expire and a new login is required.

• The Application is disabled on rooted or jailbroken devices or devices running tampering tools.

• Passwords and session tokens are masked in data sent to error logs.

• Each user can access only the data they are authorized to access.

• The Application has undergone penetration testing by an independent security firm.

9. Account and Data Deletion

Because accounts are created by users with user management authority, there is no button in the Application for deleting your own account. You can request the deletion of your account and the personal data linked to your account in two ways:

• You can contact the AytOnline user with user management authority at the company, distributor or financial intermediary that manages your account. This user can delete your account through the Application or the AytOnline system.

• You can send an e-mail with the subject “AytOnline hesap silme talebi” (AytOnline account deletion request) to info@aytemiz.com.tr. Please state your username and the name of the company you are affiliated with in the e-mail.

Your request will be concluded within 30 days at the latest. When your account is deleted, your account record containing your first name, last name, username, e-mail and phone information is permanently deleted. Transaction records subject to a legal retention obligation continue to be retained until the end of the period set out in the legislation. To delete the data on your device, you can log out and uninstall the Application.

10. Your Rights under Article 11 of the KVKK

Pursuant to Article 11 of the Law, by applying to Aytemiz, you have the right to: a) learn whether your personal data is processed, b) request information if it has been processed, c) learn the purpose of processing and whether it is used in accordance with that purpose, d) know the parties to whom it is transferred domestically / abroad, e) request its correction if it is incomplete / inaccurately processed, f) request its erasure / destruction within the framework of the conditions set out in Article 7 of the Law, g) request that the operations carried out under paragraphs (e) and (f) above be notified to third parties to whom it has been transferred, h) object to a result arising against you through analysis exclusively by automated systems, i) claim compensation for damages if you suffer damage due to unlawful processing.

You may submit your applications regarding the rights listed above by filling in the Application Form and sending it by post to Kozyatağı Mah. Kaya Sultan Sok. No:80/2 Kadıköy/İstanbul, or by sending an e-mail to info@aytemiz.com.tr.

Aytemiz will conclude your requests free of charge as soon as possible, depending on the nature of the request, and within thirty days at the latest. However, if the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

If your application is rejected, the response given is found insufficient, or the application is not answered in due time, you have the right to file a complaint with the Personal Data Protection Board within thirty days following notification of the response, and in any case within sixty days from the date of application.

11. Other Matters

The Application is intended for corporate users; it is not intended for persons under the age of 18. This notice may be updated in line with changes to the Application or the legislation. The current notice is always published on this page, and the last update date appears at the beginning of the notice.

12. Contact

Aytemiz Akaryakıt Dağıtım A.Ş.
Kozyatağı Mah. Kaya Sultan Sok. No:80/2 Kadıköy/İstanbul
KVKK applications: info@aytemiz.com.tr
Head Office: +90 216 418 20 20
Customer Information Line: 444 22 98 (07.00-24.00)