Personal Data Processing Policy

1. General Provisions

1.1. This Personal Data Processing Policy ("Policy") is drafted in accordance with the EU General Data Protection Regulation (GDPR) and defines the procedure for processing personal data and the measures taken to ensure its security.

1.2. Data Controllers. Personal data is processed by two joint controllers:

1.2.1. Primary Data Controller (Republic of Türkiye):
ORBİS GLOBAL TRADE DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ
Legal Address: Cevizli Mah. Tugay Yolu Cad. Ofisim İstanbul, A Blok No: 20 A / 41, Maltepe / İstanbul / Türkiye
Phone / WhatsApp: +90 533 085 91 88
Email: info@orbis-global-trade.com
Website: orbis-global-trade.com
Tax Number (Vergi No): 74804760
Trade Registration Number (Istanbul Chamber of Commerce): 1136098

1.2.2. Localizing Data Controller in the Russian Federation:
ORBIS TRADE GROUP LLC (ООО «ОРБИС ТРЕЙД ГРУПП»)
INN (Tax ID): 6154171286, Russian Federation.
Email: info@orbis-global-trade.com

1.3. This Policy applies to all information that the Data Controller may receive about visitors to the website orbis-global-trade.com (hereinafter referred to as the "Website"), located on the Internet at https://orbis-global-trade.com.

1.4. Use of the Website constitutes the user's unqualified consent to this Policy and the terms of processing of their personal data. If the user does not agree to these terms, they must refrain from using the Website.

2. Personal Data Collected by the Data Controller

2.1. The Data Controller collects the following categories of personal data:

2.1.1. Automatically collected data (server logs):

• User's IP address;
• Browser information (User-Agent);
• Date and time of access to the Website;
• Addresses of visited pages;
• Cookie files (see Cookie Policy);
• Device and operating system information;
• Referrer (address of the page from which the transition was made).

2.1.2. Data provided voluntarily by the user when contacting via communication channels:

• Name and/or pseudonym;
• Email address;
• Phone number;
• Messenger identifiers (WhatsApp, Telegram);
• Content of requests and messages sent to the Data Controller;
• Other data that the user voluntarily reports to the Data Controller.

3. Purposes of Processing Personal Data

3.1. The Data Controller processes personal data exclusively for the following purposes:

3.2. The processing of personal data is limited to the achievement of specific, predetermined, and legitimate purposes. The Data Controller does not process personal data for purposes incompatible with those specified above.

3.3. The Data Controller does not carry out advertising mailings, marketing communications, or promotion of goods/services without obtaining separate explicit consent from the user.

4. Legal Bases for Processing

4.1. Personal data is processed on the following legal bases (GDPR Article 6):

• Consent of the data subject (Article 6(1)(a) GDPR);
• Processing necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR);
• Processing necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) GDPR);
• Processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party (Article 6(1)(f) GDPR).

5. Cross-Border Transfer of Personal Data

5.1. Cross-border transfer to the Republic of Turkey:

• Recipient country: Republic of Turkey;
• Transferred data: email, phone, name, content of requests;
• Basis: Turkey is a party to the Council of Europe Convention No. 108 and has adopted Law No. 6698 (KVKK), ensuring an adequate level of protection;
• Protection measures: The Data Controller ensures the confidentiality and security of data in accordance with GDPR and Turkish legislation.

5.2. Web analytics and data localization (no cross-border transfer):

• Yandex.Metrica (Yandex LLC, Russian Federation):
  • The counter ID is available upon request.
  • Transferred data: IP address (anonymized), cookie identifiers, browser information, behavior on the Website.
  • Basis: User consent (provided via cookie banner).
  • Storage: All data collected by Yandex.Metrica is stored on servers physically located in the Russian Federation; no cross-border transfer is performed through analytics systems.

5.2.1. Embedded map: The Website may use an embedded Google Maps widget (iframe) solely to visually display the office location. This element is not configured to collect, transfer, or process visitors' personal data through the controllers' infrastructure.

5.3. Cross-border transfer via the WhatsApp messenger:

• Messenger operator: Meta Platforms Ireland Ltd. (Ireland) / Meta Platforms, Inc. (USA).
• Controller's contact: https://wa.me/905330859188 (number +90 533 085 91 88).
• Recipient countries: Ireland (headquarters of Meta Platforms Ireland Ltd.), USA (servers of Meta Platforms, Inc.), and Turkey (Controller's manager).
• Transferred data: user's phone number, profile name, avatar, message content, metadata (time, IP address, device identifier).
• Legal basis: User's consent, expressed by the fact of sending a message to the Controller via WhatsApp.
• Protection measures: End-to-end encryption for message content; Standard Contractual Clauses (SCCs) for cross-border transfers within the Meta infrastructure.
• WhatsApp Privacy Policy: https://www.whatsapp.com/legal/privacy-policy

5.4. Cross-border transfer via the Telegram messenger:

• Messenger operator: Telegram Messenger Inc. (USA) / Telegram Messenger LLP (UK).
• Controller's contact: https://t.me/+905330859188 (number +90 533 085 91 88).
• Recipient countries: UK (legal entity Telegram Messenger LLP), USA (Telegram Messenger Inc.), Netherlands, Singapore (Telegram server infrastructure), and Turkey (Controller's manager).
• Transferred data: user's phone number, username, profile name, avatar, message content (client-server encryption for regular chats; end-to-end encryption for secret chats), metadata.
• Legal basis: User's consent, expressed by the fact of sending a message to the Controller via Telegram.
• Protection measures: Traffic encryption (MTProto 2.0); optional end-to-end encryption for secret chats.
• Telegram Privacy Policy: https://telegram.org/privacy

5.5. The user, by sending a request to the Data Controller via email, WhatsApp (wa.me/905330859188), Telegram (t.me/+905330859188), or other communication channels, explicitly consents to the cross-border transfer of their personal data to Turkey, the USA, the UK, Ireland, the Netherlands, Singapore, and other countries specified in this Policy.

6. Social Media Accounts and Third-Party Platforms

6.1. Official accounts of the Data Controller:

• Instagram:
  • ORBIS Global Trade (main account): https://www.instagram.com/orbis.global.trade
  • ORBIS Wellness (medical coordination): https://www.instagram.com/orbis_wellness
  • ORBIS Consult (consulting): https://www.instagram.com/orbis_consult
• Facebook:
  • ORBIS Global Trade: https://www.facebook.com/share/1BmB3Xgvg5/

6.2. Legal consequences of transitioning to social media:

• 6.2.1. When you click on links leading to social media platforms (Instagram, Facebook) from the Website, you leave the Data Controller's Website and enter platforms owned by third parties — Meta Platforms Ireland Ltd. (the data controller for Instagram and Facebook).
• 6.2.2. From the moment you transition to a social media platform, the processing of your personal data is carried out not by the Data Controller, but by the respective platform (Meta Platforms Ireland Ltd.) in accordance with its own privacy policy.
• 6.2.3. The Data Controller is not responsible for:
  • the processing, storage, and protection of the user's personal data on social media platforms;
  • the actions of social media platforms regarding the collection and use of data;
  • the content and privacy policies of social media platforms.
• 6.2.4. By transitioning to social media platforms, the user independently agrees to the terms of use and privacy policies of the respective platforms:
  • Meta Privacy Policy: https://www.meta.com/privacy/
  • Instagram Privacy Policy: https://help.instagram.com/519522125107875
  • Facebook Data Policy: https://www.facebook.com/policy.php
• 6.2.5. The Data Controller uses social media exclusively for the purpose of informing users about its activities and communication. Data collected via social media platforms (likes, comments, follower information, Direct Messages) is stored on the platforms' servers and processed according to their privacy policies.
• 6.2.6. When a user interacts with the Data Controller's accounts on social media (sending a Direct Message, leaving a comment, subscribing), the user's personal data (name, profile, message content) is processed simultaneously by two controllers:
  • Meta Platforms Ireland Ltd. — in accordance with Meta's policy;
  • ORBİS GLOBAL TRADE DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ — in accordance with this Policy.
• 6.2.7. The Data Controller processes data obtained through social media exclusively for the purpose of responding to inquiries and communicating with the user.

6.3. Recommendations for users:

• Before interacting with the Data Controller's accounts on social media, the user is advised to:
• read the privacy policy of the respective platform;
• review the privacy settings of their account;
• refrain from transmitting information belonging to special categories of personal data (medical diagnoses, religious beliefs, etc.) via social media.

7. Retention Period for Personal Data

7.1. Personal data is processed for the period necessary to achieve the processing purposes specified in Section 3 of this Policy.

7.2. Server logs (IP addresses, cookie files) are stored for 12 months, after which they are destroyed.

7.3. Correspondence via email and messengers (WhatsApp, Telegram) is stored for the period necessary to fulfill obligations to the user, but no more than 3 years from the last request.

7.4. After the specified periods, personal data is destroyed, unless otherwise provided by law.

8. Rights of the Data Subject

8.1. Under the GDPR, the user has the following rights:

• Right of access (Article 15 GDPR);
• Right to rectification (Article 16 GDPR);
• Right to erasure ("right to be forgotten") (Article 17 GDPR);
• Right to restriction of processing (Article 18 GDPR);
• Right to data portability (Article 20 GDPR);
• Right to object (Article 21 GDPR);
• Right to withdraw consent at any time (Article 7(3) GDPR);
• Right to lodge a complaint with a supervisory authority (Article 77 GDPR).

8.2. To exercise your rights, you can send a request to the Data Controller:

• Email: info@orbis-global-trade.com
• Address: Cevizli Mah. Tugay Yolu Cad. Ofisim İstanbul, A Blok No: 20 A / 41, Maltepe / İstanbul / Türkiye

8.3. The Data Controller must consider the request within 30 days and provide a motivated response.

8.4. The user can withdraw consent to the processing of personal data by sending a notification to the Data Controller. In this case, the Data Controller must stop processing and destroy personal data within 30 days, unless otherwise provided by law.

9. Data Security Measures

9.1. The Data Controller takes necessary and sufficient organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, as well as from other illegal actions of third parties (Article 32 GDPR).

9.2. Technical measures include: use of encryption when transferring data (HTTPS, TLS 1.3); access restriction to personal data; regular backup; antivirus protection and firewalls; logging of actions with personal data; protection against DDoS attacks and unauthorized access.

9.3. Organizational measures include: appointment of responsible persons for processing personal data; training of employees on rules for working with personal data; internal regulations and policies for processing personal data; non-disclosure agreements for employees; regular audits and checks.

10. Use of Cookie Files

10.1. The Website uses cookie files to ensure the functioning of the Website, remember settings (e.g., the selected language), and collect anonymized traffic statistics via Yandex.Metrica (Yandex LLC, Russian Federation); data is stored on servers located in the Russian Federation.

10.2. Detailed information about cookie files is contained in the Cookie Policy, posted on the Website.

10.3. The user can manage cookie files through browser settings or the cookie banner on the Website.

11. Changes to the Policy

11.1. The Data Controller reserves the right to make changes to this Policy at any time.

11.2. The new version of the Policy comes into force from the moment of its publication on the Website, unless otherwise provided by the new version of the Policy.

11.3. The current version of the Policy is available at: https://orbis-global-trade.com/en/privacy

11.4. The Data Controller recommends that users periodically check this Policy for changes.

12. Contact Information

12.1. All questions related to the processing of personal data can be sent to the Data Controller:

• Primary Data Controller (Türkiye): ORBİS GLOBAL TRADE DANIŞMANLIK VE DIŞ TİCARET LİMİTED ŞİRKETİ
• Localizing Data Controller (RF): ORBIS TRADE GROUP LLC (ООО «ОРБИС ТРЕЙД ГРУПП»), INN 6154171286
• Legal Address: Cevizli Mah. Tugay Yolu Cad. Ofisim İstanbul, A Blok No: 20 A / 41, Maltepe / İstanbul / Türkiye
• Phone: +90 533 085 91 88
• WhatsApp: https://wa.me/905330859188
• Telegram: https://t.me/+905330859188
• Email: info@orbis-global-trade.com
• Website: https://orbis-global-trade.com
• Tax Number (Vergi No): 74804760
• Trade Registration Number: 1136098

12.2. Supervisory Authority:

• EU/UK: Users have the right to lodge a complaint with their local Data Protection Authority (e.g., ICO in the UK or relevant national authority in the EU).