SASAHUB Data and Document Retention and Account Deletion Policy

1 How to request account deletion

Email privacy@sasahub.com.tr with the subject ‘SASAHUB account deletion’. Where possible, use the email registered to the account. Provide your name, account phone number in international format and/or account email, a reply address and a request to delete the account and associated personal data. Both identifiers are not required where one is sufficient to locate the account.

If you registered only by phone or lost access to the registered email, explain this. The Company must offer a proportionate ownership check. Reinstalling the app, purchasing a service or attending in person is not required for an ordinary request. Opening an email link does not send a request: complete sending in your email application.

Do not include passwords, SMS codes, full card details or a passport copy in the initial email. If delivery fails, contact support@sasahub.com.tr or send a written application to the operator’s address in section 2. Legally formal KVKK applications are also subject to section 5.

Keep a copy of your application. An open order, debt or seller status does not prevent submission; any consequences for fulfilment are assessed separately. The Company must not substitute a sign-out or indefinite suspension for deletion.

2 Operator and scope of responsibility

The platform operator and controller determining the purposes and means of the relevant personal data processing is SHAMUS E-TİCARET LOJİSTİK VE GIDA TİCARET LİMİTED ŞİRKETİ. Address: Cevizli Mah. Mustafa Kemal Cad. Hukukçular Towers Sitesi A Blok No: 66A İç Kapı No: 111 Kartal / İstanbul, Türkiye. MERSİS: 0768110028600001. Trade Registry: 1114861. Tax number: 7681100286; tax office Kartal.

Personal data: privacy@sasahub.com.tr. Legal matters: legal@sasahub.com.tr. Support: support@sasahub.com.tr. Security contact: security@sasahub.com.tr. These addresses do not imply appointment of an independent data protection officer or an EU representative.

The Policy protects natural persons, including buyers, sole traders, seller representatives and organisational contacts. Corporate information is covered insofar as it relates to an identifiable individual. This Policy does not replace the Company’s internal retention rules for employment and corporate records.

Independent sellers, banks, payment and logistics organisations may determine processing of their own records independently. The Company is responsible for its processing and for instructions to its processors; allocation of roles does not remove its own obligations.

3 Legal framework and international application

Application of this Policy takes account of the privacy and personal data rights under Article 20 of the Constitution of the Republic of Türkiye, Law No. 6698 (KVKK), the rules on data destruction and applications to controllers, and applicable commercial, tax, consumer and electronic commerce law. A restriction of a right requires a genuine legal basis and must remain necessary in scope.

The GDPR applies in the circumstances set out in its Article 3, including relevant offers of goods or services to people in the EU or monitoring their behaviour there. Website language and nationality alone do not determine applicability. Mandatory rules of other jurisdictions are taken into account where their conditions are met.

This Policy is not consent to unrestricted processing or international transfers. It does not limit mandatory statutory rights, waive access to courts or impose exclusive jurisdiction depriving consumers or data subjects of legal protection.

In an international conflict, GDPR bases and exceptions must be assessed independently. An obligation under third-country law is not automatically treated as a sufficient GDPR basis. The Company must determine the permissible scope of preservation, safeguards and remedies for the particular processing.

4 Processing principles and retention

The Company must ensure lawfulness, fairness, transparency, accuracy, specified purposes, data minimisation, storage limitation and appropriate security. Each retained dataset must have a recorded purpose, legal basis, owner, retention period, starting event and disposal method.

A basis may be contract performance, a specific statutory obligation, necessity to establish, exercise or defend a right, a legitimate interest subject to a proportionality assessment, or valid separate consent. Accepting this Policy does not replace the appropriate basis. Consent withdrawal ends future processing relying on it but does not remove independent retention duties.

Statutory periods in the schedule apply only to records within their scope. Internal maximum periods are rules established by this Policy, not statements that the law prescribes those numbers. Data must be erased before an internal maximum where the need has ended and no other basis remains.

5 Identity verification and formal applications

Verification must prevent deletion of another person’s account and unauthorised disclosure while keeping the process accessible. Existing identifiers and secure confirmation of control over a communication channel must be considered first. Additional information is permitted only when reasonably necessary. Loss of access to an old email is not, by itself, grounds for refusal.

For a formal application under Article 13 KVKK and the applicable Communiqué, required particulars include name and surname, signature for written applications, Turkish identity number for Turkish citizens or nationality and passport number or available identity number for foreign nationals, residence or workplace address for service, available contact details and the request. These are formal application requirements, not a demand for a document scan for every service request.

Written submission to the operator’s address and use of the previously registered email remain available. Other statutory methods may be used to the extent actually available; an unestablished registered electronic mail (KEP) address or unconnected form must not be advertised as a working channel. Where identification details are required, the Company must provide a secure means of submission and restrict access.

A representative must establish authority to the necessary extent. For a minor, age, capacity to exercise rights and the legal representative’s authority are assessed under applicable law. Unnecessary family information must not be collected.

6 Handling and communicating the outcome

Under KVKK, applications must be resolved as soon as possible and within 30 days of receipt. Where all processing grounds have ceased, an accepted erasure request must be fulfilled and communicated within the period under Article 12 of the relevant Regulation. Identity clarification must not be used to restart the clock arbitrarily.

Under the GDPR, the Company acts without undue delay and responds within one month. An extension of up to two further months is permitted only where justified by the statutory conditions of complexity or number of requests, with notice and reasons during the first month. It does not extend a simultaneously applicable shorter KVKK deadline. Where both regimes apply, the earlier applicable limit must be met.

The decision must be communicated in writing or electronically, stating actions taken, categories retained, their specific basis and period or end criterion, the status of processor copies and, for full or partial refusals, reasons and remedies. Receipt of a request or access revocation must not be described as complete destruction of all data.

Account deletion is free of charge. Other rights requests are ordinarily free; a fee or refusal is permitted only in cases allowed by the applicable law and with an explanation. Fees must not be retained for correcting the Company’s error. The presence of another person’s data does not justify withholding an entire accessible record where appropriate redaction can protect their rights.

7 Fulfilment and continuing obligations

Following verification, the Company must prevent unauthorised account use, revoke active tokens and codes, stop unnecessary processing and locate associated data across its systems. Scope includes profile details, photographs and derivatives, carts, favourites, activity, comments, messages, attachments and other data actually collected.

Each category must be erased, destroyed or effectively anonymised unless an independent retention basis exists. Merely marking an account inactive, hiding a row or removing a name while retaining a link to an individual does not establish completed erasure or anonymity.

Shared files and conversations require assessment of participants’ rights. Another participant’s presence is not an automatic basis for indefinite retention of the entire conversation: removal of identifiers, separation of necessary evidence and other proportionate measures must be considered. Data needed for a transaction or dispute may be moved to a restricted archive without restoring the profile for ordinary use.

Account deletion alone does not cancel an order, payment obligation, refund, warranty or seller agreement. Their performance must be arranged through an alternative channel. The entire account must not be retained merely until every debt is settled. Use after completed deletion requires new registration; retained legal archives must not be used to rebuild the old profile.

8 Data and document retention schedule

The schedule covers information held by the Company. Where the same record is subject to several current duties, only the necessary content is retained until the last duty expires. A longer period does not extend to every dataset about the same person.

9 Legal preservation and restricted archives

A court, administrative or tax requirement, or a specific ongoing dispute, may justify preserving necessary records until that basis ends. Each exception must record its legal provision or requirement, scope, starting date, end criterion, owner and access rules. A generic possibility of future disputes does not justify indefinite retention.

The responsible person must review additional preservation at least every three months. Once its basis ends, disposal must take place by the next applicable deadline. Restricted archives must not be used for advertising, recommendations, re-engagement or other incompatible purposes. Access is limited to authorised persons who need it.

A retention duty does not invariably require every field: phone numbers, addresses, comments and attachments must be assessed separately against the mandatory contents of the original record. Authenticity of an invoice or other legally significant document must not be compromised by arbitrary editing.

10 Backups and periodic disposal

This Policy establishes an internal maximum retention cycle of 30 calendar days from creation for ordinary recoverable backups. Mandatory legal archives must be managed separately and must not be disguised as indefinite backups. Where an earlier erasure deadline applies, a method ensuring compliance must be used.

Data subject to erasure must be excluded from ordinary access and reuse within the applicable fulfilment deadline. Media remnants must be destroyed through a controlled cycle; backup rotation does not postpone mandatory erasure. On restoration, the deletion register must be reapplied before access is given to users and application services.

Internal periodic disposal must occur at least monthly. This cycle does not defer the deadline to answer or fulfil an individual request. Results must be recorded without retaining the full erased content in the register.

11 Disposal methods and result verification

Depending on the medium, the Company must use removal from production databases and indexes, deletion of files and derived images, secure media destruction or cryptographic destruction where key recovery is demonstrably impossible. Paper must be destroyed so its contents cannot be reconstructed.

Anonymisation is complete only when information can no longer be associated with an individual considering reasonably available means and linkage with other datasets. A pseudonym, phone hash, account number or reversible name replacement does not, on its own, make data anonymous.

Verification covers copies, caches, search indexes, thumbnails, delivery queues and processor-held data. The Company must check the outcome, record failures and remedy them; it must not confirm complete destruction without sufficient evidence.

12 Recipients and international transfers

Processors, including hosting, messaging and storage providers, must receive binding instructions on erasure, correction or restriction and provide fulfilment evidence. The Company must supervise compliance and engage processors under terms ensuring confidentiality, security and assistance with individual rights.

Independent controllers must be notified of the relevant request where and to the extent required by law. Their own retention duties must be explained and do not remove the Company’s duty to erase its unnecessary copies. Requests concerning an independent seller must be routed with appropriate assistance and without unnecessary disclosure.

International transfers require an applicable basis and a lawful mechanism under Article 9 KVKK and, where relevant, Chapter V GDPR. Choosing a foreign cloud provider is not itself a transfer mechanism. This Policy does not assert the existence of specific standard contracts, adequacy decisions or an overseas representative where these have not actually been established.

13 Rights under Turkish law

An individual may ask whether their data is processed; obtain information about processing, purposes and use consistent with those purposes; identify recipients in Türkiye and abroad; and request correction, erasure or destruction where the statutory conditions are met.

Individuals also retain rights to request notification of recipients of correction or erasure, object to adverse results produced solely by automated analysis and seek compensation for harm caused by unlawful processing. A B2B account does not remove an individual’s rights in their own data.

A request may concern a particular category without account closure. Partial fulfilment must explain remaining processing. Legal exceptions are confined to their scope; a contract, acceptance of terms or language choice does not waive mandatory rights.

14 Additional rights where the GDPR applies

Where the GDPR conditions are met, rights include access and a copy, rectification, erasure, restriction, objection, portability of provided data processed automatically on consent or contract grounds, and withdrawal of consent without affecting lawfulness of earlier processing.

Objections to direct marketing must be honoured, including related profiling. Decisions based solely on automated processing that have legal or similarly significant effects are subject to Article 22 restrictions and safeguards, including human intervention, expressing a view and contesting the decision where applicable.

The Company must observe Articles 12–22 GDPR and lawful exceptions, explain refusals and remedies, and preserve rights to complain to the competent supervisory authority, seek judicial protection and receive compensation where the statutory conditions are satisfied. These rights are not unconditional in every case or confined to EU citizens.

15 Complaints and remedies

Under the KVKK procedure, an application must first be made to the Company. If it is rejected, answered inadequately or not answered on time, a complaint may be submitted to the Kişisel Verileri Koruma Kurulu within 30 days of learning of the response and in any event within 60 days of the application, in accordance with Article 14 KVKK. Official information and complaint channel: www.kvkk.gov.tr and sikayet.kvkk.gov.tr.

Individuals may use courts and other statutory remedies; compensation claims are not excluded. Where the GDPR applies, complaints may be lodged with a competent authority, in particular in the place of habitual residence, work or the alleged infringement. The Company must not impose a waiver of courts, arbitration replacing mandatory procedures or penalties for good-faith requests.

16 Security and responsibilities

Company management is responsible for approval, resources and oversight. The designated requests coordinator handles registration, identity checks and deadlines; legal and finance functions determine mandatory retention grounds; the technical function handles access revocation, disposal and copy verification. Processors perform instructions within their remit.

Access must follow need-to-know rules, include action logging and protect transfer channels. Sensitive data is subject to additional statutory safeguards and must not be requested unnecessarily for ordinary account deletion. Identity-check information must not be used for advertising or profile enrichment.

Security breaches must be notified to competent authorities and affected people in the circumstances and timeframes required by applicable law. The Company must train staff, supervise processors and review the Policy at least annually and when law, services or data flows change.

17 Related policies and entry into force

This Policy supplements the SASAHUB Privacy Policy, terms and transaction policies. It does not replace legally required information on a particular processing operation. Mandatory law prevails over inconsistent platform documents.

EN, TR and RU versions must provide equivalent rights, periods and exceptions. Where they diverge, Turkish is used for interpretation to the extent permitted by law; this does not remove mandatory protection or excuse a misleading translation. Material changes must carry a new version and date, without backdating or arbitrarily reviving expired retention periods.

Version 1.0 was prepared on 27 October 2026 and takes effect after approval by an authorised SHAMUS representative and official publication. Its internal periods then become binding rules for organising processing. The text does not confirm fulfilment of any individual request. The Company records approval and publication dates.

Annex A Example request

To: privacy@sasahub.com.tr. Subject: SASAHUB account deletion. ‘Please delete my SASAHUB account and associated personal data. Account identifier: phone or email. Name: … Reply address: … If any information must be retained, please explain its categories, grounds and periods. Please notify me of fulfilment and legally required action concerning recipients.’ Additional formal particulars are supplied under section 5.