YILPORT TRUCK POSITIONING APPLICATION (TPAPP) PRIVACY NOTICE

Effective Date: 08.09.2026

Version: 1.0

1. INTRODUCTION

For the purposes of this Privacy Notice, “YILPORT” refers collectively to YILPORT Holding A.Ş. (“YILPORT Holding”) and the relevant YILPORT entities involved in the processing of personal data through TPAPP. Where necessary, specific YILPORT Holding entities are identified by their full legal names. YILPORT Holding is committed to protecting the privacy and personal data of individuals whose information is processed in connection with its terminal operations. This Privacy Notice explains how personal data is collected, used, shared, stored, retained and protected through the Truck Positioning Application ("TPAPP"). TPAPP is a mobile application designed to support truck operations within YILPORT Holding terminals by facilitating truck positioning, operational routing, traffic coordination and queue management.

The application is intended to improve operational efficiency, support the safe movement of vehicles within terminal facilities and enhance coordination between drivers, terminal systems and operational teams.

This Privacy Notice applies to all individuals whose personal data may be processed through TPAPP.

This Notice should be read together with the CoreX Global Data Privacy Policy and complements the CoreX Holding Privacy Policy applicable to the relevant controllers. While that Policy provides general information regarding personal data processing within the CoreX Holding, this Notice provides additional information specifically related to TPAPP and its operation. In the event of inconsistency, this Notice should prevail regarding TPAPP processing.

2. ABOUT THE PROCESSING OF YOUR PERSONAL DATA

TPAPP is used within YILPORT terminal operations, including but not limited to:

• YILPORT HOLDING A.Ş.

  Dilovaşı OSB, Sanayi Cd. No:14, 41455, 41455 Dilovaşı/Kocaeli/Türkiye

Relevant YILPORT terminal entities:

• LISCONT-OPERADORES DE CONTENTORES S.A.

  Edifício Liscont - Terminal de Contentores de Alcântara Sul, 1349-026 Lisboa/Portugal

• TCL - TERMINAL DE CONTENTORES DE LEIXÕES S.A

  Edifício Yilport, Porto de Leixões, Terminal de Contentores Sul Matosinhos, 4450-110 Matosinhos Portugal

• YILPORT Gävle AB - 559007-6898

  Fredriksskans, 806 47 Gävle, Sweden

• YILPORT KONTETNER TERMİNALİ VE LİMAN İŞLETMELERİ A.Ş.

  Dilovaşı OSB, Sanayi Cd. No:14, 41455, 41455 Dilovaşı/Kocaeli/Türkiye

The application forms part of the operational systems used by the relevant YILPORT Holding terminal entities to support truck positioning, routing, queue management and related operational activities.

Joint Controller Arrangement

Personal data processed through TPAPP is jointly processed by the relevant YILPORT terminal entities operating the terminals where the application is used and YILPORT Holding.

The terminal entities determine the operational purposes for which the application is used, including truck positioning, routing, queue management, traffic coordination and the efficient management of terminal operations.

YILPORT Holding determines and administers relevant processing activities in connection with TPAPP through its responsibilities relating to project governance, system administration, information security, reporting, operational oversight, management of user access rights and the overall management of the TPAPP platform.

Accordingly, the relevant terminal entities and YILPORT Holding act as joint controllers in relation to the personal data processing activities carried out through TPAPP.

The terminal entities are primarily responsible for determining the operational purposes of processing in connection with terminal activities, while YILPORT Holding participates in the governance and administration of the TPAPP processing activities, including system administration, information security, reporting, operational oversight and access governance.

The joint controllers have allocated their respective responsibilities for compliance with applicable data protection requirements. The essence of this allocation is reflected in this Privacy Notice. Individuals may use the contact details provided below to exercise their data protection rights in relation to TPAPP processing.

Contact Details

Privacy Contact: Compliance Department

Email Address: dataprivacy@yilport.com

Postal Address: YILDIRIM Tower, Maslak Mahallesi, Taşyoncası Sok. No:1C B2 Blok, 34485 Sarıyer / İstanbul

3. CATEGORIES OF PERSONAL DATA

Depending on the activities carried out through TPAPP, we collect and process various categories of personal data.

3.1 Operational Information

The application may process information necessary for terminal operations, including:

• Truck registration number;

• Visit information;

• Job assignment information;

• Operational status information;

• Queue management information;

• Information relating to assigned truck jobs and terminal movements;

• Terminal activity information;

• Time and event records related to operational activities.

This information is used to facilitate operational processes within the terminal environment.

3.2 Location Information

During an active terminal visit, TPAPP may process location information to determine whether the truck is at the location assigned to the relevant job and, where applicable, to trigger the corresponding operational process in the terminal system.

Location information is processed for the following operational purpose:

Verification of whether the truck is at the location assigned to the relevant job and, where applicable, triggering the corresponding process in the terminal operating system.

The location information processed through TPAPP is intended solely for terminal-related operational purposes.

The application is not designed to track individuals outside terminal operations and location information is not used for marketing, behavioral profiling or advertising purposes. Location information is not used to assess the performance of drivers or of any other individual.

3.3 Technical Information

In order to maintain service reliability and security, TPAPP may process certain technical information regarding the device and application environment.

Such information may include:

• Device ID;

• Device model;

• Operating system information;

• Network and connectivity-related technical information;

• Application version information;

• Technical log records;

• Error records;

• Diagnostic information.

3.4 System Generated Information

The application may automatically create operational and technical records relating to:

• Registration events;

• Job completion events;

• System activity logs necessary for system operation, security and troubleshooting;

• Operational status updates;

• Security monitoring activities;

• Application performance monitoring.

These records assist in maintaining the integrity and security of the application environment.

4. PURPOSES OF PROCESSING

Personal data processed through TPAPP is used solely for legitimate operational and business purposes.

4.1 Terminal Operations

Personal data may be processed to:

• Manage truck movements within terminal facilities;

• Coordinate loading and unloading activities;

• Support the positioning and movement of trucks in connection with assigned jobs;

• Support operational planning;

• Improve operational efficiency.

4.2 Customer Services

Personal data may be used to:

• Support customer service activities;

• Respond to operational inquiries;

• Resolve operational issues;

• Facilitate communications regarding terminal operations.

4.3 System Administration

Personal data may also be processed to:

• Operate the application;

• Maintain system functionality;

• Investigate technical issues;

• Monitor application performance;

• Provide technical support services.

4.4 Information Security

Processing activities may also be necessary to:

• Maintain system security;

• Prevent misuse of systems;

• Detect unauthorized access;

• Monitor security incidents;

• Protect IT infrastructure.

4.5 Governance and Business Management

Personal data may also be processed for:

• Reporting activities;

• Governance processes;

• Internal controls;

• Business continuity planning;

• Project management activities;

• Compliance with applicable legal and regulatory requirements.

5. LEGAL BASIS FOR PROCESSING

The primary legal basis for processing personal data through TPAPP is Article 6(1)(f) of the GDPR, where applicable, namely YILPORT's legitimate interests. Other legal bases may apply to specific processing activities where required by applicable law.

5.1 Legitimate Interests

The primary legal basis for processing personal data through TPAPP is YILPORT's legitimate interests in:

• Managing terminal operations;

• Coordinating vehicle movements;

• Maintaining efficient logistics services;

• Ensuring security of facilities and systems;

• Supporting operational continuity;

• Maintaining reliable technological infrastructure.

YILPORT considers these interests to be necessary and proportionate and has taken appropriate measures to balance such interests against the rights and freedoms of individuals.

6. ACCESS TO PERSONAL DATA

Access to personal data is restricted to authorized personnel.

6.1 Terminal Personnel

Access may be granted to:

• Operations teams;

• Planning teams;

• Customer service personnel.

Such access is limited to operational needs.

6.2 Technical Personnel

Access may be granted to:

• IT administrators;

• CoreX IT teams;

• Authorized internal technical personnel.

These users access information solely for technical administration, maintenance and support purposes.

6.3 Corporate Personnel

Authorized personnel at YILPORT including personnel located in Türkiye, may access personal data where necessary for:

• Project management;

• Governance activities;

• Reporting;

• System administration;

• Information security;

• Operational oversight.

Access is granted strictly on a need-to-know basis.

Depending on their role and responsibilities, such access may include viewing personal data and carrying out administrative activities necessary for the purposes described above.

7. THIRD-PARTY SERVICE PROVIDERS

YILPORT engages carefully selected service providers to support the operation of TPAPP.

These service providers may process personal data only under YILPORT's instructions and only where necessary to provide contracted services.

Current service providers may include:

Hosting Infrastructure
Amazon Web Services (AWS)

Technical Support and Development
KC / Unikie

Monitoring and Diagnostics
Sentry

Personal data is not sold, rented or otherwise made available for commercial advertising purposes.

Each service provider is engaged under a written data processing agreement that restricts the use of personal data, including location information, to the provision of the contracted services, and access to location information is logged.

8. INTERNATIONAL DATA TRANSFERS

The primary TPAPP infrastructure is hosted within the European Economic Area (EEA).

Based on the current TPAPP architecture:

• AWS infrastructure is hosted in the Frankfurt Region;

• Sentry services are configured within an EU environment; and

• Expo does not process personal data associated with TPAPP operations.

In addition, certain authorized personnel within YILPORT Holding may access the system for purposes including governance, reporting, project management, information security, operational oversight and system administration.

Any such access is managed in accordance with applicable data protection requirements and the safeguards implemented by YILPORT.

Authorized YILPORT personnel located outside the EEA, including personnel located in Türkiye, may access TPAPP personal data where necessary for the purposes described in this Notice. Where such access constitutes a restricted transfer under applicable data protection law, YILPORT relies on the European Commission's Standard Contractual Clauses, supplemented by additional technical and organisational measures where required. A copy of the relevant safeguards may be obtained using the contact details provided in this Notice.

9. DATA RETENTION

Personal data is retained only for the period necessary to achieve the purposes described in this Notice.

Current retention periods are:

Category	Retention Period
Operational logs	Maximum 7 days
Technical logs	Maximum 7 days
Diagnostic and crash logs	Maximum 7 days

Longer retention periods may apply where necessary to:

• comply with legal obligations;

• protect YILPORT's legal rights;

• respond to disputes, investigations or claims;

• support information security investigations.

Following expiration of the applicable retention period, personal data will be securely deleted, anonymized or otherwise rendered inaccessible.

10. YOUR RIGHTS

Under applicable data protection laws, individuals may exercise various rights regarding their personal data.

These rights may include:

• Right of access;

• Right to rectification;

• Right to erasure;

• Right to restriction of processing;

• Right to object to processing based on legitimate interests;

• Right to data portability;

• Right to lodge a complaint with a supervisory authority.

Because personal data processed through TPAPP is processed on the basis of YILPORT's legitimate interests, individuals have the right to object at any time to that processing. An objection may be submitted using the contact details provided in this Notice, and YILPORT will consider the objection and inform the individual of the outcome.

Requests may be submitted using the contact details provided in this Notice.

11. SECURITY

YILPORT implements appropriate technical and organizational security measures to protect personal data.

Such measures may include:

• User access controls;

• Authentication mechanisms;

• Network security protections;

• Security monitoring and audit logging;

• Security governance procedures;

• Incident management processes.

Only authorized individuals are permitted to access personal data.

12. COMPLAINTS

Individuals have the right to submit a complaint to the competent supervisory authority.

Examples include:

Portugal
Comissão Nacional de Proteção de Dados (CNPD)
https://www.cnpd.pt/cnpd/atendimento-ao-publico/

Sweden
Integritetsskyddsmyndigheten (IMY)
https://www.imy.se/en/individuals/forms-and-e-services/

Individuals may also lodge a complaint with the supervisory authority of the Member State in which they habitually reside, in which they work, or in which the alleged infringement took place.

We nevertheless encourage individuals to contact YILPORT first, so that concerns can be investigated and addressed directly where possible.

13. CHANGES TO THIS PRIVACY NOTICE

YILPORT may amend this Privacy Notice from time to time to reflect legal, regulatory, operational or technological developments.

Updated versions will be published through appropriate channels and will become effective upon publication.

Individuals are encouraged to review this Notice periodically to remain informed about how their personal data is processed.