INFORMATION ON THE LAW ON PROTECTION OF PERSONAL DATA BELDEKIZ TUR.İNŞ.TİC VE SAN.LTD.ŞTİ Information Text on Processing of Personal Data A. PURPOSE OF THE PROTECTION AND PROCESSING OF PERSONAL DATA: With this information letter that we have prepared in our capacity as the Data Officer pursuant to the Law on Protection of Personal Data No. 6698 (“LOPPD”), we, as BeldekızTur.İnş.Tic ve San.Ltd.Şti (Company), would like to provide you information about the purpose of processing your personal data, to whom and for what purpose your processed personal data may be disclosed and the method and legal reason of collecting your personal data under the scope of the article 10 titled “The Obligation of the Data Officer to Provide Information” and the article 11 titled “Rights of the Concerned Person” and about your other rights granted by the Article 11 of LOPPD. In our capacity as the date officer we record transfer, share and keep your personal data in the manner explained below and within the limits required by the relevant legislation. Our company always reserves the right to update this Information Text on Protection of Personal Data under the scope of amendments that may be made on the relevant legislation in force. B.COLLECTION AND PROCESSING OF PERSONAL DATA AND THE PURPOSE OF PROCESSING: Your verbal, written or electronic personal data are collected and processed by our company which operates in the fields of activity described in detail in the Articles of Association of the Company with respect to those activities based on the regulations introduced by the Ministry of Tourism and the Administration of Revenues and other relevant entities and the contracts that we have concluded. These personal data will be used for the purpose of providing and increasing the quality of the services of our company, carrying out the sales and marketing and other activities of our company and fulfilling the obligations of keeping, reporting and providing information. Furthermore, your personal data will also be used under the scope of activities like increasing the quality of the service that we provide to you and CRM (Customer Relations Management) applications to be made for sale and marketing activities. Your personal data will not be used for purposes other than those defined above without your express consent and will not be shared with, or transferred to, third persons except as may be required by the law and the official institutions and organization. Our company will share your personal data with our affiliates and direct or indirect subsidiaries and joint ventures at home or abroad or with public organizations and institutions legally authorized to request those data and with the entities, suppliers, authorized vendors/ dealers/ business partners with which we have made contracts at home or abroad, provided that sufficient measures have been taken, for the purpose of providing value-added services and opportunities to our customers, only with the express consent of our customers or in other cases when required by the article 5/f.2 of LOPPD, particularly the legislation to which we are subject. Although your personal data may vary depending on the services and products provided by, and the commercial activities carried out by, our company they may be collected verbally, in writing or in electronic environment using automatic or non-automatic methods through offices, branches, dealers, call centers, websites, social media channels, mobile applications and similar means. Your personal data may be processed either by creating or updating them as long as you make use of the products and services of our company. Furthermore, your personal data may be processed when you: a. use our call center or website, b. visit our company, website or social media channels, c. participate in the training programs, seminars, human resources programs or organizations organized by our company due to the relevant legislation, for the purpose of using our services. Your personal data obtained based on your consent or other legally justifiable reasons stated in the laws of the Republic of Turkey may be processed by our company and its affiliates/subsidiaries and other real and/ or legal entities stated in the article (c) below under the scope of the conditions and purposes of processing personal data defined in the articles 5 and 6 of the law on PPD for the following purposes: i)Enable our business units to carry out the activities so that you can benefit from the products and services provided by our company; ii) Customize the products and services provided by our company based on your likings, habits of use and needs and offering them to you as such; iii) Ensure the legal and commercial security of our company and persons who are in a business relationship with our company (administrative operations carried out by our company directed at communication, ensuring the physical security and control of the locations belonging to the company, processes of assessment of the business partner/customer (including officers or employees), process of legal compliance, financial affairs, etc.); iv) increase the quality of the services provided by our company and development of our quality policy, v) inform you about and letting you benefit from the general and special campaigns, promotions, publicity activities, discounts and similar advantages offered by our company; vi) Process your personal data, preferences and transactions contained in the relevant channels when you log in using your username and password in order to receive service through the channels provided by our company, and process the data obtained during your period of navigation in order to be able to give the information and services demanded by you; vii) send the notifications concerning all kinds of loyalty cards issued and/ or to be issued by our company and its affiliates/subsidiaries and membership of the web sites of our company and affiliates/subsidiaries (like notifications on renewal and expiry, etc.) and provide you information about the changes, updates, etc. on the communication that may be established with you, new products and services to be provided, policies of personal data and the conditions of membership; (viii) inform you about the information, activities and services that you will demand from our company; ix) Determination and implementation of the commercial and business strategies of our company and; (x) Ensure the implementation of the policies of human resources of our company and; (xi) Fulfill the legal obligation required by the relevant legislation if it is expressly required by the legislation or if necessary. C.METHOD AND LEGAL REASON OF COLLECTING PERSONAL DATA: Your personal data are collected in all kinds of verbal, written or electronic environments for the purpose of providing our products and services under the legal framework determined and fulfiling our obligations arising from the contract or required by law completely and properly in line with the puposes stated in the articles above. Your personal data that are collected for that legal reason are processed, recorded, transfered, shared and kept for the purposes stated in the article (B) of this text under the scope of the conditions and purposes of processing personal data stated in the Articles 5 and 6 of the law on PPD. D.PROCESSING OF SPECIAL DATA: According to the law on PPD, individual data about race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, clothing, membership of associations, charity foundations or trade unions, health condition, sexual life, previous conviction and security measures and individual data about biometric and genetic data are considered special personal data. Furthermore, our company takes adequate measures as determined by the Board of Protection of Personal Data in processing of special personal data. Our company will process the special personal data of individuals only with the consent of the relevant person and for the purpose of serving the purpose of collection of such data. E. TO WHOM AND FOR WHICH PURPOSE THE PROCESSED PERSONAL DATA MAY BE TRANSFERRED: The personal data collected about you may be transfered to Beldekız Tur.İnş.Tic and San. Ltd. Şti, our business partners, suppliers, legally authorized public institutions and organizations and private persons under the scope of the conditions and purposes of processing personal data specified in the Articles 8 and 9 of the law on PPD. F. TRANSFER OF PERSONAL DATA TO ABROAD: Our company is authorized to transfer personal data to abroad in accordance with the other conditions of the relevant law after obtaining the express consent of the relevant person for that purpose under the conditions determined by the Board of Protection of Personal Data. G. RIGHTS OF THE HOLDER OF PERSONAL DATA DEFINED IN THE ARTICLE 11 OF THE LAW ON PPD: We agree that, under the scope of the law on PPD, holder of personal data is entitled to be informed and give his approval before processing, recording, transferring, sharing and storing his/her personal data and further to determine the fate of such data after they were processed, recorded, transferred, shared and stored. Under this scope, if you as the holder of personal data submit to our company your request concerning your rights based on the methods indicated below on this “Information Text About the Processing of Personal Data”, our company will finalize your request within no later than 30 days, depending on the nature thereof, free of charge. i.If you want a written reply to your application, no fees will be charged for up to 10 pages. A processing fee of 1 Turkish Lira will be charged for each page over 10 pages. ii) If the reply to the application is given in a recording environment like CD or flash disk, the fee to be charged by our company as the data officer may not exceed the cost of the recording environment. Under this scope, the holders of personal data are entitled to; a.Learn whether their personal data were processed or not, b. Request information about the processed personal data, c.Learn the purpose of processing of personal data and whether they were used in accordance with the purpose, d.Know the third persons at home or abroad to whom personal data were transferred, , e.If personal data were processed incompletely or incorrectly, request the correction thereof and, under this scope, request the notification of the transaction made to the third persons to whom the personal data were transfered, f. Request the deletion, removal or anonymization of personal data and further request the notification of the transaction made under this scope to the third persons to whom the personal data were transfered, g. Raise an objection against the occurrence of a consequence against himself/herself due to the analysis of the processed personal data exclusively through automatic systems. h.In case of incurring loss due to the unlawful or incorrect processing of personal data, the holder of personal data will be entitled to requested compensation thereof. However, individuals have no right whatsoever regarding the data which were anonymized inside the company. Our company will be entitled to share personal data with the relevant institutions and organizations for the purpose of enabling them to perform a judicial duty or exercise state authority, due to a business and contractual relationship. H. PERIOD OF PROCESSING OF YOUR PERSONAL DATA: Your personal data which were processed for the purposes stated in this “Information Text on Processing Personal Data” in accordance with the law on PPD will be deleted and removed by us or will continue to be used by being anonymized when the purpose of processing of the personal data disappears and/or the legal lapse of time to which we were subjected for processing your data expires. I. WHEN OUR COMPANY MAY PROCESS YOUR PERSONAL DATA WITHOUT YOUR EXPRESS CONSENT PURSUANT TO THE RELEVANT LAWS: Pursuant to the article 5 of the LOPPD, our company may process your personal data stated above and obtained in accordance with the relevant law without seeking your express consent in the following cases: Cases expressly required by the laws; i.You as the holder of the data are not able to give your consent due to actual impossibility to do so or, in cases where your consent is not deemed to be legally valid, it is necessary to process your personal data for the purpose of protection of the life or corporeal integrity of yourself or another person, ii.The necessity to process the personal data belonging to the parties of the contract, provided that this is directly related to the execution or performance of a contract concluded between you and our company or its affiliates /subsidiaries or other real and or legal persons stated in the Article (C), iii. It is necessary for our company to fulfil a legal obligations iv.Your personal data are made public by you, v. The necessity to process the data for the purpose of establishment, exercise or protection of a right, vi. The necessity to process the data for the legitimate interests of our company, provided that your basic rights and liberties are not affected. J. MAKING A REQUEST PURSUANT TO THE LAW ON PROTECTION OF PERSONAL DATA: Pursuant to the paragraph 1 of the article 13 of the Law on PPD, you may submit your requests concerning the exercise of your above mentioned rights to our company using the methods determined and/or to be determined by the Board of Protection of Personal Data. Alternatively, you may also submit to our company your application in writing pursuant to the law on PPD. You may always establish contact with our company by sending an email to the address info@montebello-hotels.com in order to exercise your rights stated in the article 11 of the Law No. 6698. Only the email address info@montebello-hotels.com must be used regarding the issues related to your personal data; any requests and notices sent through other channels will not be taken into consideration. Rights related to the personal data may only be used about the data belonging to the persons themselves. Requests about the data belonging to individuals other than the person who filled out the application form with the attached official documents on identity details will not be taken into consideration. Please note that even if your requests for deletion of data are fulfiled, we are obliged to share them with the official authorities if requested by them.