Notice Regarding the International Transfer of Personal Data

Data Controller (Employer): your employer, acting as data controller

Data Processor: Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi (Rota)

Effective Date: July 10, 2026

This notice is prepared on behalf of and on the instructions of your employer, acting as data controller ("Employer" / "Data Controller"), through the infrastructure of Luminis Lojistik Teknoloji Ticaret Danışmanlık Hizmetleri Limited Şirketi (hereinafter referred to as "Luminis" / "Data Processor"), which operates the Rota platform, in accordance with Article 9 of Law No. 6698 on the Protection of Personal Data (hereinafter the "Law"), to inform you of the legal safeguard under which your personal data processed through the Rota platform is transferred abroad.

Scope and Location of the Transfer

Rota's primary database and file storage infrastructure is hosted in the European Union in the Frankfurt (eu-central-1) region. Although the Frankfurt region is located within the European Union, it is outside the borders of Turkey; therefore, this hosting also constitutes a transfer abroad within the meaning of the Law. In addition, certain sub-processors used to provide technical services such as email delivery, error monitoring, analytics, and application distribution may process your data in countries outside Turkey and/or the European Economic Area (EEA), including the United States. These transfers are systematic and continuous in nature, as they are necessary for the provision of the service.

Legal Safeguard for the Transfer (Article 9 of the Law)

The transfer of your personal data abroad is based not on explicit consent, but on the appropriate safeguards set out in Article 9 of the Law:

Between Luminis and its overseas cloud service providers/sub-processors, the standard contract (SCC) published by the Personal Data Protection Authority, or equivalent appropriate-safeguard mechanisms, are applied. Executed standard contracts are notified to the Authority within 5 (five) business days following completion of the signatures.
The data processing agreement concluded between the Employer (Data Controller) and Luminis (Data Processor) ensures that personal data is processed solely in accordance with the Employer's written instructions and, in addition, expressly authorizes Luminis, on behalf of the Employer, to engage sub-processors and to establish the appropriate safeguards (including the standard contract) under Article 9 of the Law in respect of transfers abroad.
These providers act, under written agreements, as sub-processors designated by Luminis.

Where the transfer is made to a country subject to an adequacy decision, the relevant provisions of Article 9 of the Law apply.

Nature of This Document

This document is a notice (information text) explaining that the international transfer is based on appropriate safeguards, and it does not require separate explicit consent. You may exercise your rights under the Law at any time through the application channels specified in the privacy notices provided by the Employer via the Rota platform and in the Privacy Policy.

Final Provisions

This notice has been prepared within the framework of Law No. 6698 on the Protection of Personal Data and should be read together with the Privacy Policy and the KVKK Privacy Notice accessible through the Rota platform.

This document is provided for informational purposes only. The legally binding version is the Turkish original.