KAYA TURİSTİK TESİSLERİ TİTREYENGÖL OTELCİLİK ANONİM COMPANY PUTTING LIGHT ON PROCESSING OF PERSONAL DATA

As Kaya Turistik Tesisleri Titreyengöl Otelcilik A.Ş. (“Company”), we are most concerned about the security of your personal data. With this consciousness, we attach great importance to the processing of personal data of all persons related to the Company, including those who use our products and services as a Company, in accordance with the Law on the Protection of Personal Data ("KVK Law") No. 6698. With full disclosure of this responsibility, we act as Data Officer, handling your personal data as described below and within the limits imposed by the legislation.

PURPOSE OF PROTECTING AND PROCESSING PERSONAL DATA

Purposes and legitimate reasons for the processing of personal data;

Your personal data may be collected verbally, in writing or electronically by means of offices, branches, call centers, social media circles and the like, with automatic or non-automatic methods, which may vary depending on the service, product or commercial activity provided by our company. Your personal data may be processed by creating and updating your personal data for as long as you benefit from our products and services. Your collected personal data will be processed; to provide you with the products and services offered by our company by customizing them according to your taste, usage habits and needs, to establish the legal and commercial security of our company and the people who are in business relations with our company, to determine and apply the business and business strategies of our company and to carry out our company's human resources policies, in accordance with the personal data processing conditions and purposes set forth in Articles 5 and 6 of KVK law.

THE PROCESSING OF PERSONAL DATA AND FOR WHOM AND FOR WHAT PURPOSE

To organize all the records and documents that will be the basis for processing in electronic or paper media; to comply with the information storage, reporting and informing obligations foreseen by the relevant legislation and relevant authorities; to present requested products and services to measure customer satisfaction and to provide the goods or services from the contract you have concluded, your personal data will be transferred. All of the information that is shared within the Company is used within the framework of the applicable legislation and to provide you with the product you need and demand.

This information gathered at the company's servers is kept and used for the purpose of continuing the advertising, promotion and marketing activities to be formed through periodic campaign studies, customer specialization activities for customer profiles, and customer "classification" and personal information for not transmitting unsolicited e-mails. In addition, the company is able to connect with customers to measure customer satisfaction. Personnel or organizations to which personal data may be transferred for the above purposes: Our primary shareholder, direct and / or indirect domestic or foreign subsidiaries and businesses (Kaya Palazzo Golf Resort Belek – Kaya Palazzo Golf Club Belek - Kaya Palazzo Ski&Mountain Resort Kartalkaya – Kaya Izmir Thermal & Convention – Kaya Istanbul Fair & Convention – Kaya Laleh Park Tebriz - Dorukkaya Ski&Mountain Resort Kartalkaya – Kaya Uludağ Ski&Mountain Resort – Kaya Belek Antalya – Kaya Side Antalya – Kaya Green Park Bolu – Kaya Artemis Resort&Casino – Kaya Palazzo Resort&Casino Girne – Abant Su - CCK Travel and other companies and businesses that may be involved in the future). With the aim of presenting the legal and commercial security of our company and the people who are in business relation with our company, the determination and application of our company's commercial and business strategies and the execution of our company's human resources policies, we propose that the services provided by you are customized according to your taste, usage habits and needs and for this reason the personal data will be processed within the terms and conditions specified in the articles 8 and 9 of the KVK Law.

THE METHOD AND LEGAL REASON OF COLLECTING PERSONAL DATA

Your personal data can be processed and collected in any verbal, written or electronic environment in accordance with the above-mentioned purposes for the products and services we offer at the Company's legal framework and for our Company to fulfill contractual and legal responsibilities in a complete and correct manner. For this legal reason, yours collected personal data may also be processed and transmitted to the purposes specified in this document within the scope of the personal data processing requirements and purposes set forth in Articles 5 and 6 KVK Law.

PROVISION OF PERSONAL DATA SECURITY AND AUDIT OBLIGATION

As a company which is responsible for the Personal Data, the Company is taking the utmost care and attention in terms of ensuring data security and in this context, in accordance with Article 12 of the KVK Law, following necessary precautions are taken in this regard to ensure data security in order to ensure compliance with the Law in its institutions or organizations.

Company ensures;

• Preventing illegal processing of personal data
• Preventing personal data from being accessed illegally
• Taking all necessary technical and administrative measures to ensure the appropriate level of security in order to secure the safekeeping of personal data.

OVERVIEW OF THE PERSONAL DATA OWNER'S RIGHTS

The Rights of the Personal Data Owner as listed in Article 11 of the KVK Law;

As personal data owners, if you submit your requests for your rights to our company in the following manner, the company will conclude the request for free within thirty days at the latest in accordance with the nature of the claim. However, if a fee is predicted by the Personal Data Protection Board, the fee will be charged at the rate determined by our company. In this scope, the personal data owners have the right;

• To learn whether or not personal data is being processed,
• To request information about personal data if it has been processed,
• To learn the purpose of processing personal data and whether or not it is used appropriately for the purpose,
• To know the third parties to which personal data is transferred within the country or abroad,
• To requesting correction of processing of personal data if it is incomplete or incorrectly processed and in this context, to request that the process carried out be reported to the third party to which the personal data is transferred,
• To request that personal data be erased or destroyed in the event that the reasons for its processing have been revoked despite the fact that it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and to request that the process carried out in this context be notified to the third party,
• To do objection to the occurrence of a result against the person himself/herself in the result of analysis of the processed data exclusively through automated systems,
• To demand that the damage be eliminated in the event of any kind of loss due to the processing of personal data in violation of the law.

IF YOU WANT TO COMMUNICATE WITH US FOR YOUR REQUESTS

If you wish to communicate with us, give us feedback or direct your inquiries within the scope of the Law No. 6698, please send us your petition along with your identification documents and your request to Küçük Piyale Mahallesi Piyalepaşa Bulvarı Ağaç Köprü Street No: 24 Kasımpaşa Beyoğlu / Istanbul, in person, via a notary channel or you can send it to kvkkbasvuru@kayahotels.com.tr as secure electronic signature. Please click toaccess the relevant form regarding the application which can be done within the framework of Article 13 of the KVK Law.

In this context, the written applications to be made regarding the subject will be accepted after the identity verification which will be done by us and the related persons will be notified within the legal period.