P.S. This document has no legal power. This is an unofficial translation of the original document from Turkish. Document with the legal power is the one written in Turkish

T.S.T. TURİSTİK AND SPORTİF TESİSLER İNŞAA AND İŞLETME A.Ş.

WEB PRIVACY AND PERSONAL DATA PROTECTION PRINCIPLES

• 1 PURPOSE AND SCOPE

This Privacy and Personal Data Protection Principles (“Principles”), T.S.T. TURİSTİK AND SPORTİF TESİSLER İNŞAA AND İŞLETME A.Ş. (referred to as “TST”, “Company” or “Data Controller”) regulates the principles it accepts regarding the protection of personal data and regulates the personal data of Employee Candidate, Visitor, Customer, Prospective Customer, Supplier, Third Party, Online Visitor (“People Groups”) and determines the personal data processing principles regarding the processing of data and aims to enlighten the said groups of people.

• 2 PRINCIPLES ON THE PROCESSING OF PERSONAL DATA

As TST, we process your personal data in the capacity of Data Controller within the framework of the following principles.

2.1 Lawful and Integrity Processing

In the processing of your personal data, we act in accordance with the principles brought by legal regulations and the general rule of trust and honesty.

2.2 Ensuring Personal Data Are Accurate and Up-to-Date When Necessary

Taking into account your legitimate interests, periodic controls and updates are made to ensure that the processed data is accurate and up-to-date, and necessary measures are taken accordingly. In this context, systems for checking the accuracy of personal data and making necessary corrections are established within TST.

2.3 Processing for Specific, Clear and Legitimate Purposes

Your personal data is processed based on clear, specific and legitimate data processing purposes.

2.4 Relevance, Limitation, and Responsibility for the Purpose for which they are Processed

Your personal data is processed in a measured, purpose-related and limited manner in order to achieve the foreseen purpose/purposes, and the processing of personal data that is not relevant or needed for the realization of the purpose is avoided.

2.5 Retention for as Long as Required for the Purpose of Processing or Envisioned in the Relevant Legislation

Your personal data is retained only for as long as required by the relevant legislation or for the purpose for which they are processed. In this context, first of all, it is determined whether a period is foreseen for the storage of personal data in the relevant legislation, if a period is determined, this period is acted upon. In the event that the period expires or the reasons requiring its processing are eliminated, your personal data is deleted, destroyed or anonymized in accordance with TST's Personal Data Retention and Destruction Policy, unless there is a legal reason allowing them to be processed for a longer period of time.

• 3 TERMS OF PROCESSING PERSONAL DATA

Your personal data is processed by TST within the framework of the following conditions.

3.1 Explicitly Provided in Laws

Your personal data may be processed in cases where the laws expressly stipulate the processing of personal data.

3.2 Failure to Obtain Explicit Consent of the Related Person Due to Actual Impossibility

Your personal data may be processed if the processing of personal data is necessary in order to protect the life or physical integrity of the person or another person, who is unable to express his or her consent due to actual impossibility or whose consent cannot be validated.

3.3 Direct Concern with the Establishment or Performance of the Contract

Provided that it is directly related to the establishment or performance of the contract, your personal data may be processed if it is necessary to process the personal data of the parties to the contract.

3.4 Fulfillment of Legal Obligation of TST

Your personal data may be processed if it is necessary to fulfill legal obligations as a data controller.

3.5 Making Personal Data Public

If your personal data has been made public by you, it may be processed.

3.6 Requirement of Data Processing for the Establishment or Protection of a Right

Your personal data may be processed if data processing is necessary for the establishment, exercise or protection of a right.

3.7 Processing of Data Based on Legitimate Interest

Your personal data may be processed if data processing is necessary for the legitimate interests of TST.

3.8 Consent-Based Processing

In cases where your personal data cannot be processed based on any of the conditions set forth in these Principles, it is processed based on express consent.

• 4 KİŞİSEL VERİLERİN KATEGORİZE EDİLMESİ

• 5 PURPOSE OF PROCESSING PERSONAL DATA

In TST, personal data can be processed for the following purposes, according to the relevant person group, within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698.

5.1 CUSTOMER

Customer personal data, within the scope of personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, execution of the necessary business and operational processes in order to benefit from the products and services offered by the company, execution of the contract, follow-up of finance and accounting works and customer relations management and It can be processed for the purposes of planning and executing customer satisfaction activities processes, following up on contract processes and customer requests and complaints, planning and executing transfer processes, planning information security processes, establishing and managing infrastructure, and auditing and executing.

5.2 EMPLOYEE CANDIDATES

Employee Candidate personal data, within the scope of personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, planning and execution of human resources processes, execution of personnel activities, fulfillment of obligations arising from legislation, planning and execution of benefits, execution of personnel procurement processes, purposes can be processed.

5.3 CANDIDATE CUSTOMER

Planning the activities necessary for the personal data of the Prospective Customer, within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698, to customize the products and services offered by the Company according to the tastes, usage habits and needs of the persons concerned, and to recommend and promote them to the relevant persons; and the execution of the necessary work for the realization of the commercial activities carried out by the Company and the execution of the related business processes, the execution of the necessary work and related business processes to benefit from the products and services offered by the Company, the planning of the activities necessary for the customization and promotion of the products and services offered by the Company and execution, planning and execution of customer relationship management processes.

5.4 VISITOR

Visitor personal data, within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, ensuring the security of buildings and facilities campuses and/or facilities, creating and monitoring visitor records, ensuring the security of fixtures and/or resources, technical and commercial It can be processed for the purposes of ensuring occupational safety, ensuring the security of corporate operations, providing information to authorized institutions and organizations based on legislation.

5.5 THIRD PARTY

Third Party personal data, in accordance with the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698, to carry out the necessary business and operational processes in order to benefit from the products and services offered by the company, to carry out the necessary studies for the realization of commercial activities carried out by the company and to comply with this. It can be processed for the purposes of carrying out the related business processes, carrying out the necessary studies and related business processes to benefit from the products and services offered by the company, customizing and promoting the products and services offered by the Company, and the execution of the contract.

5.6 SUPPLIER / BUSINESS PARTNER

Supplier / Business Partner personal data, within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698, carrying out the necessary business and operational processes in order to benefit from the products and services offered by the company, carrying out the necessary studies for the realization of commercial activities carried out by the company. It may be processed for the purposes of carrying out the necessary work and related business processes in order to benefit from the products and services offered by the company.

5.7 ONLINE VISITOR

Online Visitor personal data, within the scope of the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698, conducting marketing analysis studies, conducting advertising / campaign / promotion processes, conducting communication activities, developing products and services, may be processed for the purposes of fulfilling legal obligations.

• 6 TRANSFER OF PERSONAL DATA

Your personal data; To the companies, legally authorized public institutions and legally authorized private persons, with which TST has commercial relations due to hotel management and similar needs, the principles and purposes set forth in Articles 3 and 5 of these Principles, as well as those specified in Articles 8 and 9 of the Law No. 6698. Personal data can be transferred on a limited basis within the framework of processing conditions and purposes.

• 7 METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA

Your personal data transmitted to TST electronically are processed as follows according to the relevant person groups.

7.1 CUSTOMER

Customer personal data is defined in Article 5 of the Law No. 6698, “provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties of the contract”, “it is necessary for the data controller to fulfill its legal obligation”, “the relevant Provided that it does not harm the fundamental rights and freedoms of the person, data processing is mandatory for the legitimate interests of the data controller. .

7.2 EMPLOYEE CANDIDATES

Employee Candidate personal data is defined in Article 5 of the Law No. 6698, in the context of a possible employment contract, "provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract", "to fulfill the legal obligation of the data controller". on the basis of legal reasons, “it is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, by filling out an application form in electronic environment, by filling out a physical form, by filling in a physical form, from a person or a third party. It is processed automatically by being taken from the person.

7.3 CANDIDATE CUSTOMER

The personal data of the Prospective Customer, in Article 5 of the Law No. 6698, “if the data subject has been made public by himself”, “data processing is mandatory for the establishment, exercise or protection of a right”, “provided that it does not harm the fundamental rights and freedoms of the data subject, Based on the legal reasons that data processing is mandatory for the legitimate interests of the data controller, “it is necessary for the data controller to fulfill its legal obligations”, it is automatically obtained from the person or a third party, in physical and electronic environments, by means of written or verbal data transfer and as part of the data recording system. way is processed.

7.3 VISITOR

Visitor personal data, in Article 5 of the Law No. 6698; Based on the legal reason "it is mandatory for the data controller to fulfill its legal obligations" and "the data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject", the entrance doors, building façades, meeting rooms and events in our service building areas, dining areas, cafeteria, entrance waiting area, parking lot, elevators and floor corridors are recorded and processed automatically by means of security cameras located in the service area.

7.4 THIRD PARTY

Third Party personal data, in Article 5 of the Law No. 6698; Based on the legal reasons, “the data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” and the personal data processing conditions specified in article 6, physical, electronic media, written or verbal data transfer tools and a part of the data recording system. It is processed automatically by being received from the person or the third party.

7.5 SUPPLIER / BUSINESS PARTNER

Provider/Business Partner personal data is defined in Article 5 of Law No. 6698, “provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract”, “it is compulsory for the data controller to fulfill its legal obligation”. , based on the legal grounds that "data processing is obligatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject", in physical and electronic media, by written or verbal data transfer tools and by being received from the person or third party as part of the data recording system. processed automatically.

7.6 VISITOR ONLINE

The Online Visitor can use his/her personal data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, which is included in the Law No. It is processed automatically based on the legal reasons that data processing is obligatory for the data controller” and “obligatory for the data controller to fulfill its legal obligation”.

• 8 SECURITY OF PERSONAL DATA

8.1 TST takes reasonable precautions to prevent unauthorized access risks, accidental data loss, deliberate deletion of data or damage to data in order to ensure the security of personal data and to prevent unlawful processing.

8.2 All necessary technical and physical measures are taken to prevent access to personal data by persons authorized to access it. In this context, the authorization system is designed in such a way that it is not possible for anyone to access more personal data than necessary.

8.3 TST carries out the necessary inspections in its own institution or organization in order to ensure the implementation of the provisions of the Law No. 6698 and has them done.

• 9 COMMITMENTS REGARDING THIRD PARTY PERSONAL DATA

Personal information about third parties, transmitted by the Contact Groups, can be processed by TST, and consent is given by the Person Group. The Related Person Group also undertakes to provide the necessary information and obtain permissions in accordance with the Law on the Protection of Personal Data No. 6698 for the transmitted persons and their information. Otherwise, the losses will remain with the related Person Group.

• 10 APPLICATION PROCEDURES AND PRINCIPLES

As the person concerned, if you have a request regarding your rights in Article 11 of the Law No. 6698; With your application that meets the minimum conditions stipulated in the Communiqué on Application Procedures and Principles to the Data Controller; ................................@......kep.tr to our KEP address kvkk@.... By sending a mobile signed or e-signed message to our .................com e-mail address or ……………………………………………… You can make an application to our address at …………………………………….. in person with a wet signature or through a notary public. As TST, we will finalize your application free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee determined by the Personal Data Protection Board will be charged by TST.

In this context, you have the following rights as the person concerned;

a) Learning whether personal data is processed or not,

b) If personal data has been processed, requesting information about it,

c) Learning the purpose of processing personal data and whether they are used in accordance with its purpose,

ç) To know the third parties to whom personal data is transferred in the country or abroad,

d) Requesting correction of personal data in case of incomplete or incorrect processing,

e) Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,

f) Requesting notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data has been transferred,

g) Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,

ğ) To request the compensation of the damage in case of loss due to unlawful processing of personal data.

RELATED PERSON (PERSONAL DATA OWNER) Click on the link to download the APPLICATION FORM REGARDING THE PROTECTION OF PERSONAL DATA.