Personal Data Protection Policy

ARCANUS SORGUN HOTELS

PERSONAL DATA PROCESSING POLICY

(KVKK POLICY)

TABLE OF CONTENTS

1. PURPOSE

2. SCOPE

3. TERMS AND CONCEPTS

4. ROLES AND RESPONSIBILITIES

5. FUNDAMENTAL PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA

6. LEGAL CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

7. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

8. ERASURE, DESTRUCTION OR ANONYMISATION OF PERSONAL DATA

9. TRANSFER OF PERSONAL DATA

10. OBLIGATIONS OF THE DATA CONTROLLER REGARDING DATA SECURITY

11. THE DATA CONTROLLER'S DUTY TO INFORM

12. OBLIGATION TO RESPOND TO APPLICATIONS MADE BY DATA SUBJECTS AND TO IMPLEMENT DECISIONS

13. OBLIGATION TO REGISTER WITH THE DATA CONTROLLERS' REGISTRY

14. NOTIFICATION OBLIGATION

15. RIGHTS OF THE DATA SUBJECT

16. PROCEDURE FOR THE DATA SUBJECT TO SEEK REMEDIES

17. UPDATING

18. ENTRY INTO FORCE AND REPEAL

1. PURPOSE

The purpose of this policy is to determine, within the framework of the rules required by national and international legal regulations, primarily the Personal Data Protection Law (KVK Law), the undertakings, obligations and responsibilities of the DATA CONTROLLER processing personal data and of all private or public institutions and organisations and natural and legal persons that enter into legal, commercial and financial relations with the DATA CONTROLLER, as well as the procedural and substantive rules and policies to be complied with, in order to protect the fundamental rights and freedoms of individuals, and in particular the privacy of private life, during the processing of personal data belonging to data subjects.

2. SCOPE

This policy applies, within the framework of national and international laws, statutes, regulations, circulars, decisions of regulatory and supervisory institutions and organisations, directives, international agreements and conventions, and primarily the KVK Law, and within the framework of all legal, commercial and financial contracts and contract annexes concluded or to be concluded with all persons, institutions and organisations - official, natural or legal - which are in communication, interaction, cooperation or a solution-partner relationship with the DATA CONTROLLER under any name whatsoever, as well as with the partners, customers, employees and suppliers of the DATA CONTROLLER, to natural persons whose personal data are processed and to the DATA CONTROLLER which processes such data wholly or partly by automated means or by non-automated means provided that they form part of a data recording system.

3. TERMS AND CONCEPTS

In this policy;

Convention No. 108; refers to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, prepared and signed by the Council of Europe and entered into force on 01.10.1985,

Directive 95/46/EC; refers to the Directive of the European Parliament and of the Council on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data, adopted in 1995 by the European Parliament and the Council,

Explicit consent; refers to consent relating to a specific subject, based on information and declared with free will,

ECHR; refers to the European Convention on Human Rights, prepared by the Council of Europe and entered into force on 03.09.1953,

Recipient group; refers to the category of natural or legal persons to whom personal data are transferred by the DATA CONTROLLER,

Anonymisation; refers to rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching them with other data,

Communiqué on the Fulfilment of the Duty to Inform; refers to the "Communiqué on the Procedures and Principles to be Complied with in Fulfilling the Duty to Inform" published in the Official Gazette dated 10.03.2018 by the Personal Data Protection Authority,

Law on the Exercise of the Right to Petition; refers to the Law on the Exercise of the Right to Petition,

Interaction and communication; refers to any kind of relationship of the DATA CONTROLLER, written or verbal, at a distance or in person, giving rise to responsibility and obligation in legal, commercial, financial, contractual and similar respects,

GDPR; refers to Regulation (EU) 2016/679, the General Data Protection Regulation of the European Union, which repealed Directive 95/46/EC on 25.05.2018,

Data subject; refers to the natural person who owns the data and whose personal data are processed by the data controller,

Contact person; refers to the natural person who is notified during registration with the Registry in order to ensure communication with the Authority regarding obligations under the Law and secondary regulations to be issued based on this Law - by the data controller for natural and legal persons resident in Türkiye, and by the data controller representative for natural and legal persons not resident in Türkiye - and who has no authority to represent the data controller,

Personal data; refers to any information relating to an identified or identifiable natural person,

Data controller; refers, in this policy, to the companies within ARCANUS SORGUN HOTELS MANAGEMENT (ASBETON İNŞAAT TAAH GIDA TUR.SAN. VE TİC.A.Ş.) located in Türkiye and abroad and to the management and operation of the company; the person and hotel group referred to in this policy text as ARCANUS SORGUN HOTELS MANAGEMENT,

Processing of personal data; refers to any operation performed on data such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means or by non-automated means provided that they form part of a data recording system,

Personal data processing inventory; refers to the inventory in which data controllers detail the personal data processing activities they carry out depending on their business processes, by associating them with the purposes and legal grounds of personal data processing, the data category, the recipient group to which data are transferred and the group of data subjects, and in which they explain the maximum retention period necessary for the purposes for which the personal data are processed, the personal data envisaged to be transferred abroad and the measures taken regarding data security,

PDPA; refers to the Personal Data Protection Authority,

KVK Law; refers to Law No. 6698 on the Protection of Personal Data, adopted on 24.03.2016 and published in the Official Gazette No. 29677 dated 07.04.2016,

PDP Board; refers to the competent board within the Personal Data Protection Authority,

KVK Policy; refers to this Personal Data Protection Policy adopted and implemented by the DATA CONTROLLER,

KVSI Policy; refers to the Personal Data Retention and Destruction Policy prepared within the scope of the Regulation on the Erasure, Destruction or Anonymisation of Personal Data,

Regulation on Erasure; refers to the Regulation on the Erasure, Destruction or Anonymisation of Personal Data issued under the KVK Law,

Regulation on Transfer Abroad; refers to the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad,

Automated processing; refers to the personal data processing activity carried out by an interconnected and interactive electrical or electronic system that minimises the need for human intervention or assistance,

Non-automated processing; refers to the personal data processing activity carried out manually, i.e. through human intervention or assistance,

Special categories of personal data; refers to data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data (special categories of personal data are determined in the Law by exhaustive enumeration and cannot be extended by analogy),

Summary text; refers to texts, writings and directives serving the same service, purpose and objective, containing a short summary of the detailed texts, books and booklets prepared and issued by the DATA CONTROLLER, and valid in place of them,

Periodic destruction; refers to the erasure, destruction or anonymisation process to be carried out ex officio at recurring intervals specified in the personal data retention and destruction policy in the event that all of the conditions for processing personal data set out in the Law cease to exist,

OG; refers to the Official Gazette,

Registry; refers to the registry of data controllers kept by the Presidency of the Personal Data Protection Authority,

Erasure; refers to the process of rendering personal data inaccessible and unusable in any way for the relevant users,

TPC; refers to the Turkish Penal Code No. 5237,

TCC; refers to the Turkish Civil Code No. 4721,

VERBIS; refers to the information system known as the data controllers registry information system, created and managed by the Presidency of the Personal Data Protection Authority and accessible over the internet, which data controllers use for registry applications and other related registry transactions,

Data transferor; refers to the natural or legal person who transfers personal data from its own system to another data controller,

Data recipient; refers to the natural or legal person to whose system personal data are transferred by another data controller,

Data inventory; refers to the inventory, also called the personal data processing inventory, in which the DATA CONTROLLER details the personal data processing activities it carries out depending on its business processes, by associating them with the purposes of personal data processing, the data category, the recipient group to which data are transferred and the group of data subjects, and in which it explains the maximum period necessary for the purposes for which the personal data are processed, the personal data envisaged to be transferred to foreign countries and the measures taken regarding data security,

Data processor; refers to the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by it,

Data recording system; refers to the recording system that may be created in electronic or physical media in which personal data are processed by being structured according to certain criteria,

Data controller representative; refers to the legal person resident in Türkiye or the natural person who is a citizen of the Republic of Türkiye appointed as a representative with at least the authority to (a) receive or accept notifications or correspondence made by the Authority on behalf of the data controller, (b) convey requests directed by the Authority to the data controller and convey the data controller's response to the Authority, (c) where no other principle has been determined by the Board, receive on behalf of the data controller and convey to the data controller the applications that data subjects will direct to the data controller pursuant to Article 13(1) of the KVK Law, (d) where no other principle has been determined by the Board, convey the data controller's response to data subjects pursuant to Article 13(3) of the KVK Law, and (e) carry out work and transactions relating to the Registry on behalf of the data controller,

Communiqué on Application to the Data Controller; refers to the Communiqué on the Procedures and Principles of Application to the Data Controller issued by the Personal Data Protection Authority and published in the Official Gazette dated 10.03.2018,

Regulation on the Data Controllers' Registry; refers to the Regulation on the Data Controllers' Registry issued under the KVK Law,

Adequacy decision; refers to the decision given by the PDP Board, where certain conditions are met, stating that a country, one or more sectors within a country, or an international organisation provides an adequate level of protection in relation to the transfer of personal data abroad,

Destruction; refers to the process of rendering personal data inaccessible, irretrievable and unusable by anyone in any way,

shall have the meanings set out above.

For terms and concepts not included in this article, the definitions of terms and concepts in the relevant legislation shall apply.

4. ROLES AND RESPONSIBILITIES

Board of Directors

This Policy has been approved by the Board of Directors of ASBETON İNŞAAT TAAH GIDA TUR.SAN. VE TİC.A.Ş. It is the competent approval mechanism for ensuring the creation, implementation and, where necessary, updating of the Policy.

Legal Counsel

The Legal Counsel, together with the IT Directorate, is responsible for the preparation, development, implementation and updating of this Policy. The Legal Counsel evaluates this Policy, where necessary, in terms of its currency and development needs.

IT Directorate

The IT Directorate, together with the Legal Counsel, is responsible for the preparation, development, implementation and updating of this Policy. The IT Directorate evaluates this Policy, where necessary, in terms of its currency and development needs. Publication of the prepared document is the responsibility of the IT Department Manager.

5. FUNDAMENTAL PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA

In General

The DATA CONTROLLER accepts as the fundamental principles of its Personal Data Protection Policy: to process all kinds of personal data at its workplaces or businesses transparently, in accordance with morality and national and international rules of law, within the rules of good faith, adopting the principles of openness, accessibility and accountability; while doing so, to act in a manner appropriate to the purpose, limited, proportionate and impartial, and in accordance with objective criteria; to protect and maintain the accuracy, currency and integrity of the personal data of data subjects with whom the data controller is in interaction and communication; to protect and retain such personal data securely, for periods appropriate to the processing purpose and the legislation and under current technological conditions, within the framework of commercial and professional ethics and of respect for fundamental human rights and freedoms guaranteed by international and national rules of law, and in particular personal privacy and the confidentiality of private life; and, after retaining them for the period provided for in the legislation or necessary for the purpose for which they are processed, to erase, destroy or anonymise them.

Legal Principles

Principle of Compliance with the Law and Rules of Good Faith

Within the framework of the KVK Law, the DATA CONTROLLER acts with the awareness that it is a requirement and an obligation to comply, during the processing of personal data, with the legislation in force nationally and internationally and with the rule of good faith set out in Article 2 of the Turkish Civil Code within the legal order.

Pursuant to the principle of compliance with the rule of good faith, the DATA CONTROLLER accepts, undertakes and declares that, while seeking to achieve its data processing objectives, the interests and reasonable expectations of data subjects must be taken into account; that it must act in a manner that prevents outcomes which the person whose personal data are processed does not expect or could not be expected to anticipate; and that, in addition to the data processing activity being clear and comprehensible, it must act in accordance with its obligations to inform and warn the data subject.

The DATA CONTROLLER also accepts as a duty and responsibility that, while acting in accordance with the rules of good faith, it shall exercise its rights regarding the processing of personal data in accordance with the rules of trust, in the manner expected of a reasonable person, within the limits of the right granted to it and in accordance with its purpose.

Principle of Being Accurate and, Where Necessary, Up to Date

The DATA CONTROLLER, which pursues a policy respectful of the data subject's right to have their own data corrected - a right also protected by the Constitution and the KVK Law - declares, accepts and undertakes, in compliance with this policy, to act consciously, diligently and carefully in keeping the personal data it processes accurate and up to date, in ensuring that they are up to date at every stage of the processing and where necessary, in keeping open the channels that will ensure the accuracy and currency of the data subject's information, and in recognising that compensation will be payable where the data subject suffers pecuniary or non-pecuniary damage due to personal data that are not up to date or are inaccurately kept.

On the other hand, the DATA CONTROLLER believes that acting in line with this principle is necessary for the protection of the data subject's fundamental rights and freedoms, and in particular the confidentiality of private life.

Knowing and foreseeing that acting with such an approach protects not only the rights of the personal data owner but also its own interests, the DATA CONTROLLER has adopted as a principle, in order to ensure that personal data can be kept accurate and up to date, taking reasonable measures within the scope of this policy and the legislation - by paying attention to ensuring that the sources from which personal data are obtained are identified or identifiable and that the accuracy and reliability of these sources are tested and confirmed - while taking into consideration requests arising from the inaccuracy of personal data.

Principle of Being Processed for Specific, Explicit and Legitimate Purposes

Within the scope of the KVK Policy, and in accordance with the purpose for which this principle was established, the DATA CONTROLLER declares and accepts that it will create the conditions enabling:

that data processing activities are clearly comprehensible by the data subject,

that it can easily be determined on which legal processing condition the data processing activities are based,

that the details ensuring the specificity of the data processing activity and the purpose of carrying out that activity are set out.

In line with this principle, the DATA CONTROLLER declares and accepts as a policy that the personal data of the data subject are and will be processed for specific, definite and legitimate purposes which comply with the rules laid down in the law and which form the basis of this policy, which are connected with the works and services it provides and which have been determined because they are required for them.

Again, as a requirement of the principle of specificity and clarity, the DATA CONTROLLER has adopted and accepted as its KVK Policy that appropriate arrangements have been made in the legal acts, transactions and texts concerning the persons with whom it is in interaction and communication and in which the purposes of personal data processing are explained (explicit consent, disclosure notice, responses to data subject applications, application to the data controllers' registry, contracts and similar documents); that care has been taken not to use technical and legal terminology that cannot be understood by everyone when making such arrangements, and that these are kept up to date; that no data shall be processed without consent or permission for purposes other than those declared to the data subject; and that, in the event of data being processed for other purposes, legal and criminal liability shall arise from such acts.

Principle of Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed

The DATA CONTROLLER acts with the awareness that the data of the persons with whom it is in interaction and communication must be suitable for achieving the purposes previously determined and explained, that the processing of personal data which are unrelated to or not required for the achievement of the purpose must be avoided, and that data may not be processed with a view to meeting needs that may arise subsequently.

In parallel with this, the DATA CONTROLLER regards it as a requirement of the KVK Policy that processing data for possible future needs would constitute a new data processing activity, that in such a case one of the conditions for the processing of personal data set out in Article 5 of the KVK Law must be met, that the data processed shall be limited solely to the personal data necessary for achieving the purpose, and that processing data beyond what is necessary for the purpose would constitute a breach of the principle of being limited.

The DATA CONTROLLER knows and acts accordingly that the principle of proportionality addressed within the framework of this article also means establishing a reasonable balance between the data processing and the purpose sought to be achieved; in other words, that the data processing must take place to an extent appropriate to and compatible with the purpose of the processing.

Principle of Being Retained for the Period Provided for in the Legislation or Necessary for the Purpose for Which They Are Processed

As a requirement of the "principle of purpose limitation", one of the most important principles of the KVK Policy, the DATA CONTROLLER has taken and continues to take the necessary legal and administrative measures to retain personal data for a period appropriate to the purpose for which they are processed, within the framework of the provisions of national or international legislation and taking into account limitation and forfeiture periods; where no such statutory period is provided for, to retain them for the reasonable period necessary for the purpose for which they are processed; and, where there is no valid reason for retaining the data any longer, to erase, destroy or anonymise such data.

While fulfilling the requirements of this principle of retention for the relevant periods, the DATA CONTROLLER also maintains an appropriate physical and technological security level in a secure and up-to-date state, within the framework of the provision set out in Article 12 of the KVK Law, in order to prevent the unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the retention of personal data.

For the purpose referred to in this article and within the scope of this policy, the DATA CONTROLLER has established a personal data retention and destruction policy and principles, has determined the retention periods and the technical and administrative measures required for their retention, and has implemented the necessary legal, administrative, physical and technological measures to ensure that personal data are retained in accordance with these principles.

Pursuant to Article 16 of the KVK Law, when applying for registration with the registry, the DATA CONTROLLER determines the maximum period necessary for the purpose of processing personal data, taking into account Article 9 of the Regulation on the Data Controllers' Registry, declares this period, and notifies the registry of the processing purposes of the data categories reported to the registry and the maximum retention periods necessary for their processing based on these purposes - providing that, since these periods may differ from those provided for in the legislation or since limitation periods may be involved, the limitation periods or the longest period shall be taken as the basis for retention.

Finally, where the retention periods determined and notified by the DATA CONTROLLER expire - taking into account both the periods provided for under the legislation to which the DATA CONTROLLER is subject by virtue of its legal obligations and the limitation periods - the personal data are erased, destroyed or anonymised by the DATA CONTROLLER.

6. LEGAL CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

Explicit Consent

Within the framework of Article 5 of the KVK Law, before commencing the processing of the data of the persons with whom it is in interaction and communication, the DATA CONTROLLER makes an assessment as to whether it may rely on one of the data processing conditions set out below and in the legislation; where, as a result of this assessment, none of the other conditions relating to data processing exists, it obtains the explicit consent of the data subject.

For this purpose, arrangements have been made in the physical and electronic media containing the data of the persons with whom the DATA CONTROLLER is in interaction and communication and in all legal acts, transactions and texts (explicit consent, disclosure notice, responses to data subject applications, application to the data controllers' registry, forms, declarations, contracts and similar documents), and the entire process has been brought into conformity and compliance with the legislation.

Expressly Provided for by Law

As in every field, within the scope of the KVK Policy the DATA CONTROLLER is a law-abiding institution that acts in accordance with the provisions and rules laid down in national and international legislation.

Within the scope of the KVK Law, where one of the data processing conditions expressly provided for in the legislation arises or where there is a mandatory rule for the processing of personal data, the DATA CONTROLLER carries out personal data processing activities without the need for the explicit consent of the data subject.

Actual Impossibility

Where it is compulsory for the protection of the life or bodily integrity of the person concerned or of another person, the DATA CONTROLLER may process the personal data of a person who, due to actual impossibility, is unable to express their consent, or who has the capacity to have rights but for any reason does not or cannot have the capacity to act, or whose consent is not recognised as legally valid for other reasons, without obtaining the explicit consent of that person.

Necessity for the Establishment and Performance of a Contract

In order to carry out activities relating to the services and products required by the sector in which it operates, the DATA CONTROLLER concludes contracts with the natural or legal persons with whom it is in interaction and communication and assumes mutual obligations and responsibilities under these contracts.

Where it is necessary to process the personal data of the parties to such contracts, provided that this is directly related to the establishment or performance of the contract, it processes the data of the data subjects limited to that purpose. Due to the data processing activity carried out within this scope, the DATA CONTROLLER does not require the explicit consent of the data subject.

Necessity for the DATA CONTROLLER to Fulfil its Legal Obligation

The DATA CONTROLLER may process the personal data of a data subject without applying for their explicit consent, as a requirement of a legal responsibility or obligation within the framework of the KVK Law in particular and of other legislative provisions provided for by national or international legislation, or in line with the requests of official institutions and organisations, prosecutors' offices, courts or other state bodies. It may share such data with these institutions.

Personal Data Having Been Made Public by the Data Subject

The DATA CONTROLLER may subject to data processing activities, within the framework of the envisaged purpose, the personal data which the data subject with whom it is in interaction and communication has disclosed to the public, announced, shared in a manner open to the access of third parties, or made public with their own clear and free will. In such a case, it does not need to apply for the explicit consent of the data subject.

Necessity of Processing Personal Data for the Establishment, Exercise or Protection of a Right

The DATA CONTROLLER processes the personal data of the data subject where it is compulsory for the establishment, exercise or protection of a right - such as documenting an investigation conducted in its favour or against it, proving a case, or retaining invoices relating to legal proceedings and contracts for use in official transactions throughout the limitation period. In such a case, it does not need to apply for the explicit consent of the data subject.

Necessity of Data Processing for the Legitimate Interests of the DATA CONTROLLER, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Subject

Within the framework of the KVK Law, where data processing is necessary for the legitimate interests of the DATA CONTROLLER, provided that it does not harm the fundamental rights and freedoms of the data subject, the personal data of the data subject may be processed. In such a case, the explicit consent of the data subject is not sought.

In other words, where - as against the protection of the data subject's fundamental rights and freedoms - the DATA CONTROLLER has a legitimate, sufficiently effective and currently existing interest, where this interest is in accordance with the spirit and purpose of the legislation, and where the personal data processing activity is necessary for the performance of current activities, there is no legal obstacle to the DATA CONTROLLER processing the personal data of the data subject.

7. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

The DATA CONTROLLER regards as special categories of personal data the data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.

As a rule, the processing of special categories of personal data is prohibited under the legislation. However, the processing of such data is possible where:

a) the data subject has given explicit consent,

b) it is expressly provided for by law,

c) it is compulsory for the protection of the life or bodily integrity of the person concerned or of another person who, due to actual impossibility, is unable to express their consent or whose consent is not recognised as legally valid,

ç) it relates to personal data made public by the data subject and is in accordance with their intention to make them public,

d) it is compulsory for the establishment, exercise or protection of a right,

e) it is necessary for the purposes of the protection of public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning, management and financing of health services, by persons under an obligation of secrecy or by authorised institutions and organisations,

f) it is compulsory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

g) it is directed at current or former members and affiliates of foundations, associations and other non-profit organisations or formations established for political, philosophical, religious or trade-union purposes, or at persons in regular contact with such organisations and formations, provided that it complies with the legislation to which they are subject and with their purposes, is limited to their fields of activity and is not disclosed to third parties.

Where, in the processing of special categories of personal data, the taking of adequate measures determined by the Board is also required, these Board decisions are likewise complied with.

8. ERASURE, DESTRUCTION OR ANONYMISATION OF PERSONAL DATA

The DATA CONTROLLER has separately and expressly established a KVSI (Personal Data Retention and Destruction) Policy in order to determine its operating policies regarding the erasure, destruction or anonymisation of personal data. Nevertheless, to explain briefly:

Pursuant to the provision on the erasure, destruction or anonymisation of personal data set out in Article 7 of the KVK Law, where the reasons requiring the processing of personal data cease to exist even though the personal data have been lawfully processed, such data are erased, destroyed or anonymised by the DATA CONTROLLER ex officio or upon the request of the data subject.

Accordingly, the DATA CONTROLLER may erase, destroy or anonymise personal data in cases such as:

amendment or repeal of the relevant legislative provisions forming the basis for the processing of personal data,

expiry of the limitation period running after the stages in which the contract between the DATA CONTROLLER and the natural or legal persons with whom it is in interaction and communication was never concluded, was invalid, terminated automatically, was terminated or was withdrawn from,

disappearance of the purpose requiring the processing of personal data,

a determination that the processing of personal data is contrary to the law or to the rule of good faith,

withdrawal of consent by the data subject in cases where the processing of personal data is carried out solely on the basis of the explicit consent condition,

acceptance by the DATA CONTROLLER of the application made by the data subject concerning the personal data processing activity within the framework of the rights set out in subparagraphs (e) and (f) of Article 11(1) of the KVK Law entitled "Rights of the data subject",

where the DATA CONTROLLER rejects the application made to it by the data subject requesting the erasure or destruction of their personal data, where its response is found inadequate, or where it fails to respond within the period provided for in the KVK Law; a complaint being made to the PDP Board and this request being found appropriate by the PDP Board,

the absence of any condition justifying the retention of personal data for a longer period, despite the expiry of the maximum retention period or the limitation period,

the disappearance of the conditions requiring the processing of personal data set out in Articles 5 and 6 of the KVK Law.

Where one of the conditions listed above exists, erasing, destroying or anonymising the personal data is the obligation and responsibility of the DATA CONTROLLER without any need for an application by the data subject. However, where the conditions have arisen, the data subject also has the right to request the DATA CONTROLLER to erase, destroy or anonymise their personal data.

Furthermore, the DATA CONTROLLER has issued a KVSI Policy within the framework of the provisions set out in Article 7 et seq. of the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. The retention, erasure, destruction or anonymisation of the personal data processed by the DATA CONTROLLER is carried out within the framework of the principles set out in the KVSI Policy associated with this policy.

The principles set out in the KVSI Policy also apply to situations relating to bringing into conformity with the law and up to date - and, where necessary, erasing, destroying or anonymising - data processed by the DATA CONTROLLER before the entry into force of the KVK Law or, if applicable, before any amendment to the law.

9. TRANSFER OF PERSONAL DATA

As a rule, personal data may not be transferred without the explicit consent of the data subject.

However, the DATA CONTROLLER may transfer personal data where:

it is expressly provided for by law;

it is compulsory for the protection of the life or bodily integrity of a person who, due to actual impossibility, is unable to express their consent or whose consent is not recognised as legally valid, or of another person;

it is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of the contract;

it is compulsory for the data controller to fulfil its legal obligation;

it has been made public by the data subject;

data processing is compulsory for the establishment, exercise or protection of a right;

data processing is compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject;

and where one of these conditions exists, it may transfer personal data without obtaining the explicit consent of the data subject.

Likewise, provided that adequate measures are taken, the DATA CONTROLLER may transfer special categories of personal data without obtaining the explicit consent of the data subject where one of the following conditions exists:

the data subject has given explicit consent,

it is expressly provided for by law,

it is compulsory for the protection of the life or bodily integrity of the person concerned or of another person who, due to actual impossibility, is unable to express their consent or whose consent is not recognised as legally valid,

it relates to personal data made public by the data subject and is in accordance with their intention to make them public,

it is compulsory for the establishment, exercise or protection of a right,

it is necessary for the purposes of the protection of public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning, management and financing of health services, by persons under an obligation of secrecy or by authorised institutions and organisations,

it is compulsory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

it is directed at current or former members and affiliates of foundations, associations and other non-profit organisations or formations established for political, philosophical, religious or trade-union purposes, or at persons in regular contact with such organisations and formations, provided that it complies with the legislation to which they are subject and with their purposes, is limited to their fields of activity and is not disclosed to third parties.

The DATA CONTROLLER is furthermore aware that, in transferring such special categories of personal data, it is obliged and responsible for taking the adequate measures determined by the PDP Board.

The transfer of personal data abroad is also possible under the following conditions.

Personal data may be transferred abroad by the DATA CONTROLLER and by data processors where one of the conditions set out above and within the scope of this Article exists and where there is an adequacy decision issued by the PDP Board and published in the Official Gazette concerning the country, the sectors within that country or the international organisations to which the transfer will be made.

Where the above-mentioned adequacy decision does not exist, provided that one of the conditions set out above in this Article exists and that the data subject has the opportunity to exercise their rights and to apply to effective legal remedies in the country to which the transfer will be made, personal data may be transferred abroad by the DATA CONTROLLER or by data processors where one of the following appropriate safeguards is provided by the parties:

the existence of an agreement that is not in the nature of an international convention, concluded between public institutions and organisations or international organisations abroad and public institutions and organisations or professional organisations having the status of public institutions in Türkiye, and the granting of permission for the transfer by the PDP Board;

the existence of binding corporate rules containing provisions on the protection of personal data, approved by the PDP Board, with which the companies within a group of undertakings engaged in joint economic activity are obliged to comply;

the existence of the standard contract announced by the PDP Board, containing matters such as data categories, the purposes of the data transfer, recipients and recipient groups, the technical and administrative measures to be taken by the data recipient, and additional measures taken for special categories of personal data;

the existence of a written undertaking containing provisions ensuring adequate protection, and the granting of permission for the transfer by the PDP Board.

Where a standard contract is involved, this contract is notified by the DATA CONTROLLER to the Personal Data Protection Authority within five business days of its signature.

Where there is no adequacy decision and none of the appropriate safeguards can be provided, the DATA CONTROLLER and data processors may transfer personal data abroad, on an incidental and necessary basis only, where one of the following cases exists. These incidental conditions are as follows:

the data subject gives explicit consent to the transfer, provided that they have been informed of the potential risks;

the transfer is necessary for the performance of a contract between the data subject and the data controller, or for the implementation of pre-contractual measures taken upon the data subject's request;

the transfer is necessary for the establishment or performance of a contract to be concluded, in the interest of the data subject, between the data controller and another natural or legal person;

the transfer is necessary for an overriding public interest;

the transfer of personal data is necessary for the establishment, exercise or protection of a right;

the transfer of personal data is necessary for the protection of the life or bodily integrity of a person who, due to actual impossibility, is unable to express their consent or whose consent is not recognised as legally valid, or of another person;

the transfer is made from a registry open to the public or to persons with a legitimate interest, provided that the conditions required to access the registry under the relevant legislation are met and that the person with a legitimate interest so requests.

10. OBLIGATIONS OF THE DATA CONTROLLER REGARDING DATA SECURITY

Within the framework of Article 12 of Law No. 6698, the DATA CONTROLLER is obliged to take all necessary technical and administrative measures in order to:

prevent the unlawful processing of your personal data,

prevent unlawful access to your personal data,

ensure the retention of your personal data,

and it has taken and continues to take the administrative and technical measures set out herein in order to ensure an appropriate level of security.

On the other hand, the DATA CONTROLLER accepts that, where personal data are processed on its behalf by another natural or legal person, it is jointly responsible with such persons for taking the administrative and technical measures referred to above; that it is obliged to carry out or have carried out the necessary audits within its own institution or organisation in order to ensure the implementation of the provisions of the legislation; that the DATA CONTROLLER and data processors may not disclose to others, contrary to the provisions of the legislation, the personal data they have learned, nor use them for purposes other than those of processing, and that these obligations continue even after they leave office; that, in the event that processed personal data are obtained by others through unlawful means, it is obliged to notify the data subject and the Board of this situation as soon as possible; and that the PDP Board may, where necessary, announce this situation on its own website or by another method it deems appropriate.

In addition, it complies with the requirements of the regulatory acts issued by the Personal Data Protection Authority in order to determine obligations relating to data security. The details of the technical and administrative measures, together with the personal data processed and classified on a sectoral basis taking into account the minimum criteria determined by the PDP Board, are shown in the tables, diagrams and charts prepared within the scope of the KVK Policy.

The DATA CONTROLLER knows and accepts that, where personal data are processed on its behalf by another natural or legal person - that is, where a data processor is involved - it is jointly responsible with such persons for taking the measures referred to above.

The DATA CONTROLLER is obliged to carry out or have carried out, itself, through its representative or through a third party it appoints, the necessary audits within its own institution or organisation in order to ensure the implementation of the provisions of the KVK Law. In addition, data processors shall not disclose to others, contrary to the provisions of the KVK Law, the personal data they have learned, and shall not use them for purposes other than those of processing. This continues even after they leave office.

11. THE DATA CONTROLLER'S DUTY TO INFORM

Within the framework of Article 10 of the KVK Law, the DATA CONTROLLER is obliged to provide the data subject, itself or through a person it authorises, with the following information at the time personal data are obtained:

the identity of the DATA CONTROLLER and, optionally, of its representative, if any,

the purpose for which the personal data will be processed,

to whom and for what purpose the personal data may be transferred,

the method and legal grounds for collecting the personal data,

what the other rights relating to the exercise of the rights concerning personal data granted to the data subject under Article 11 of the KVK Law are.

On the other hand, within the scope of Articles 5 and 6 of the Communiqué on the Fulfilment of the Duty to Inform, published by the Personal Data Protection Authority regarding the procedures and principles with which data controllers must comply, the DATA CONTROLLER has adopted as a principle compliance with the following obligations.

The DATA CONTROLLER has accepted the following procedures and principles when fulfilling the duty to inform, whether by the DATA CONTROLLER or a person it authorises, verbally, in writing, by voice recording, through a call centre or by using any other physical or electronic medium:

The DATA CONTROLLER fulfils the duty to inform in every case in which personal data are processed, whether based on the explicit consent of the data subject or on the other processing conditions set out in the KVK Law.

Where the purpose of processing personal data changes, the DATA CONTROLLER fulfils the duty to inform for that purpose before the data processing activity.

Where personal data are processed in different units for different purposes, the DATA CONTROLLER fulfils the duty to inform separately for each unit.

Where there is an obligation to register with the Registry, the information to be provided to the data subject by the DATA CONTROLLER within the framework of the duty to inform is kept consistent with the information disclosed to the Registry.

The DATA CONTROLLER knows that the obligation to fulfil the duty to inform does not depend on a request by the data subject, and carries out this process ex officio.

The burden of proving that the duty to inform has been fulfilled lies with the DATA CONTROLLER.

Where the personal data processing activity is carried out on the basis of the explicit consent condition, the DATA CONTROLLER carries out the duty to inform and the obtaining of explicit consent separately.

The DATA CONTROLLER knows that the purpose of personal data processing to be disclosed within the scope of the duty to inform must be specific, explicit and legitimate. In fulfilling this obligation, the DATA CONTROLLER does not use general and vague expressions, nor expressions that give the impression that personal data may be processed for other purposes that may arise.

Within the scope of the duty to inform, the DATA CONTROLLER makes the notification to the data subject using clear, plain and simple language.

When fulfilling the duty to inform, the DATA CONTROLLER expressly states the legal grounds, the purpose of transferring the personal data and the recipient groups to which they will be transferred, and whether these data were obtained wholly or partly by automated means or by non-automated means forming part of a data recording system.

Pursuant to Article 6 of the same regulation, where personal data are not obtained from the data subject, that is, where there are personal data obtained from a third party, the DATA CONTROLLER informs the data subject within the scope of the duty to inform:

within a reasonable period after the personal data are obtained,

at the time of first contact, where the personal data are to be used for the purpose of communicating with the data subject,

at the latest when the personal data are first transferred, where the personal data are to be transferred.

12. OBLIGATION TO RESPOND TO APPLICATIONS MADE BY DATA SUBJECTS AND TO IMPLEMENT DECISIONS

Pursuant to Article 13 of the KVK Law and to the Communiqué on the Procedures and Principles of Application to the Data Controller published in the Official Gazette dated 10.03.2018 on the basis of that article, applications concerning personal data made by data subjects in writing, or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the electronic mail address registered in the DATA CONTROLLER's system set out in the said Communiqué, or by means of software or an application developed by the DATA CONTROLLER for the purpose of such applications, are concluded by the DATA CONTROLLER free of charge, according to their nature, as soon as possible and within thirty days at the latest.

However, where the transaction requires an additional cost, the DATA CONTROLLER has the right to request from the applicant data subject the fees set out in the tariff determined by the PDP Board.

Where the DATA CONTROLLER accepts the data subject's application request, or rejects it stating its grounds, it notifies the data subject of this response in writing or electronically. Where the request subject to the application is accepted, the requirements of that request are fulfilled by the DATA CONTROLLER as soon as possible. If the application arose from an error of the DATA CONTROLLER, the fee charged is refunded to the person concerned.

Where the application is rejected by the DATA CONTROLLER, where the response given is found inadequate, or where no response is given to the application within the prescribed period, the data subject has the right to lodge a complaint with the PDP Board within thirty days from the date on which they learned of the DATA CONTROLLER's response and, in any case, within sixty days from the date of application.

13. OBLIGATION TO REGISTER WITH THE DATA CONTROLLERS' REGISTRY

Pursuant to Article 16 of the KVK Law, as an organisation registered with the VERBIS system kept publicly by the Personal Data Protection Authority, the DATA CONTROLLER has adopted as a principle compliance with the criteria for processing and transferring personal data set out in the Regulation on the Data Controllers' Registry and determined by the PDP Board as listed below.

Accordingly, these criteria are:

the nature of the personal data,

the quantity of the personal data,

the purpose for which the personal data are processed,

the field of activity in which the personal data are processed,

whether the personal data are transferred to third parties,

whether the personal data processing activity arises from the laws,

the period for which the personal data are retained,

the group of data subjects or the data categories.

14. NOTIFICATION OBLIGATION

Where processed personal data are obtained by others through unlawful means, the DATA CONTROLLER notifies the data subject and the PDP Board of this situation as soon as possible.

Where necessary, the PDP Board has the right and authority to announce this situation on its own website or by another method it deems appropriate.

15. RIGHTS OF THE DATA SUBJECT

Within the framework of Article 11 of the KVK Law, the data subject has the right, by applying to the DATA CONTROLLER at any time, to:

learn whether their personal data are processed,

request information if their personal data have been processed,

learn the purpose of the processing of their personal data and whether they are used in accordance with that purpose,

know the third parties, in the country or abroad, to whom their personal data are transferred,

request the rectification of their personal data where they have been processed incompletely or inaccurately,

request the erasure or destruction of their personal data,

request that the operations carried out concerning the rectification, erasure or destruction of their personal data be notified to the third parties to whom the personal data have been transferred,

object to a result arising against the person themselves through the analysis of the processed data exclusively by automated systems,

claim compensation for the damage where they suffer damage due to the unlawful processing of their personal data.

16. PROCEDURE FOR THE DATA SUBJECT TO SEEK REMEDIES

In order to protect their rights relating to the personal data held by the DATA CONTROLLER, data subjects may, in addition to applying directly to the judicial remedies, use the following remedies introduced by Articles 13, 14 and 15 of the KVK Law.

Pursuant to Article 11 of the KVK Law, data subjects have the right to apply to the DATA CONTROLLER in order to learn whether personal data relating to them are processed, to request information if they have been processed, to request their rectification where the content of the data is incomplete or inaccurate, and their erasure, destruction or anonymisation where the processing is unlawful, to request that the operations carried out accordingly be notified to the third parties to whom the data have been disclosed, and to claim compensation for damage suffered due to the unlawful processing of the data.

In order for data subjects to be able to exercise their right of complaint, they must first apply to the DATA CONTROLLER. A complaint may not be lodged with the PDP Board before this remedy has been exhausted. Data subjects who do not wish to lodge a complaint may apply directly to the judicial remedies.

The data subject's request is answered by the DATA CONTROLLER as soon as possible and within 30 days at the latest, depending on the nature of the request.

Data subjects whose applications are rejected, who find the response given inadequate, or whose applications are not answered within the prescribed period may, from this stage onwards, exercise their right to lodge a complaint with the PDP Board or apply directly to the judicial remedies.

The data subjects' rights to claim compensation are reserved.

The data subject may apply, in writing or by e-mail, regarding their personal data, to the address and contact resources of the DATA CONTROLLER set out on the first page above.

The data subject may apply to the DATA CONTROLLER regarding their personal data by means of a written and wet-signed document, or by using a secure electronic signature or a mobile signature.

These applications may also be made to the DATA CONTROLLER by data subjects in writing, or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address previously notified by the DATA CONTROLLER and registered in VERBIS set out in the Communiqué on Application to the Data Controller, or by means of software or an application developed for the purpose of such applications. The DATA CONTROLLER concludes applications made to it free of charge, according to their nature, as soon as possible and within thirty days at the latest.

The DATA CONTROLLER may accept the requests directed to it, and likewise has the right and authority to reject them by stating its grounds.

Where a request directed to the DATA CONTROLLER is accepted, the requirements of that request are fulfilled directly and immediately. Failure to fulfil the requirements despite the acceptance of the request means that the request has been rejected by the DATA CONTROLLER.

Where the data subject's application is rejected by the DATA CONTROLLER, where the response given is found inadequate, or where no response is given within the prescribed period, the data subject may apply to the PDP Board.

Pursuant to Article 13 of the KVK Law, the DATA CONTROLLER meets data subjects' application requests free of charge. However, where the transaction to be carried out requires an additional cost, it is possible to request a fee from the data subject in accordance with the tariff determined by the PDP Board.

According to this tariff, where the DATA CONTROLLER is to respond to the data subject's application in writing, no fee is charged for up to 10 pages; a processing fee of 1 Turkish Lira is charged for each page exceeding 10 pages. Where the response to the application is to be provided on a recording medium such as a CD or flash memory, the fee that may be requested by the DATA CONTROLLER may not exceed the cost of that recording medium.

Where the DATA CONTROLLER is at fault in the matter concerning the request made by the data subject regarding the application of the KVK Law, the fee charged is refunded to the data subject.

Data subjects whose application to the DATA CONTROLLER is rejected, who find the response given inadequate, or whose application is not answered within the prescribed period, may exercise their right to lodge a complaint with the PDP Board.

In the event that personal data are processed unlawfully, that is, in the event of any breach, the PDP Board has the authority to conduct an examination pursuant to Article 15 of the KVK Law.

The PDP Board may exercise this authority upon a complaint or ex officio without any complaint.

In order for notifications and complaints made to the PDP Board to be processed, they must be submitted in accordance with the provisions set out in Article 6 of Law No. 3071 on the Exercise of the Right to Petition and must together meet the following conditions:

The petition must concern a specific subject.

The petition must not relate to matters falling within the duties of the judicial authorities.

The petition must contain the petitioner's name and surname, signature and business or residential address.

Before lodging a complaint with the PDP Board, an application must be made to the DATA CONTROLLER.

After applying to the DATA CONTROLLER, the data subject must also comply with certain time limits in order to be able to lodge a complaint. Accordingly, the data subject may lodge a complaint with the PDP Board within thirty days from the date on which they learned of the DATA CONTROLLER's response. In any case, the data subject may lodge a complaint with the PDP Board within sixty days from the date of application to the DATA CONTROLLER.

When examining the requests submitted by the data subject, the PDP Board has the right and authority to request all necessary information and documents from the DATA CONTROLLER, to conduct on-site examinations, to require that facilities be provided for on-site examination, and to request that the documents it seeks - with the exception of documents constituting state secrets - be sent to it within fifteen days.

Before the examination process is concluded, the PDP Board may also decide to suspend the processing of data or the transfer of data abroad where damages that are difficult or impossible to compensate may arise and where there is a clear unlawfulness.

The PDP Board must respond to the data subject within a period of sixty days. If no response is given to the applicant during this period, the request is deemed to have been rejected.

There is no time limit for examinations initiated ex officio by the PDP Board.

The PDP Board issues a decision as a result of the examination it initiates upon a complaint or ex officio. Within the scope of the KVK Law, if no response is given within sixty days from the date of the data subject's complaint, the data subject's complaint and the request subject to the complaint are deemed to have been rejected.

Where, as a result of its examination, the PDP Board concludes that a right relating to the protection of personal data has been infringed, it decides that the unlawfulness it has identified shall be remedied by the DATA CONTROLLER and notifies this decision both to the DATA CONTROLLER and to the data subject.

The DATA CONTROLLER fulfils the requirements of the decision issued by the PDP Board and sent to it without delay and within thirty days at the latest from the date of notification.

Compliance with the principle decisions adopted by the PDP Board is mandatory both for those concerned and for other persons concerned in similar cases.

17. UPDATING

This policy is reviewed and updated at least once a year.

18. ENTRY INTO FORCE AND REPEAL

This Policy is deemed to have entered into force following its publication on the websites of the data controller.

This policy may only be repealed by the preparation and entry into force of another written policy.