INFORMATION ABOUT THE LAW ON PROTECTION OF PERSONAL DATA

Semsan Hotel

Illumination Text Regarding the Processing of Personal Data

A. PURPOSE OF THE PERSONAL DATA PROTECTION AND PROCESSING POLICY:

As Semsan Hotel (“Company”), we would like to inform you through this “Information” document, prepared in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), regarding our obligations as the Data Controller under Article 10 titled “Obligation of the Data Controller to Inform” and Article 11 titled “Rights of the Data Subject.” This document provides information on the purposes for which your personal data will be processed, the recipients of your processed personal data and the purposes of such transfers, the methods of collecting your personal data, its legal basis, and your other rights as outlined in Article 11 of the KVKK.

As the Data Controller, we process, record, transfer, share, and store your personal data in the manner described below and within the limits imposed by official legislation.

Our company reserves the right to update this “Illumination Text on the Protection of Personal Data” in accordance with any changes in applicable official legislation.

B. COLLECTION, PROCESSING, AND PURPOSES OF PROCESSING PERSONAL DATA:

Our company, which operates in the areas detailed in the Articles of Association, collects and processes your personal data verbally, in writing, or electronically due to regulations from the Ministry of Tourism and Revenue Administration, as well as contracts we have entered into. This personal data will be used to provide services related to our company’s fields of activity and to enhance the quality of these services, to carry out sales, marketing, and other activities of our company, and to comply with information storage, reporting, and notification obligations. Additionally, your personal data may also be used for CRM (Customer Relationship Management) applications to improve the quality of services we offer.

Your personal data will not be used for purposes other than those mentioned above without your explicit consent and will not be shared or transferred to third parties, except for legal obligations and public institutions/organizations.

Our company will only share your personal data with our customers’ explicit consent or under other circumstances specified in Article 5/f.2 of the KVKK, with our affiliates in Turkey or abroad, and with public institutions or organizations authorized to request these data as required by legal obligations, provided adequate precautions are taken, as well as with institutions, suppliers, authorized dealers, partners we have contracted with in Turkey or abroad due to our activities.

Your personal data may be collected verbally, in writing, or electronically through automatic or non-automatic methods, including offices, branches, dealers, call centers, websites, social media channels, mobile applications, and similar tools. As long as you benefit from our products and services, your personal data may be created and updated.

Furthermore, your personal data may be processed when you intend to use our services: a. When you use our call center or website, b. When you visit our company, website, or social media channels, c. When you participate in training, seminars, or events organized by our company. Your personal data collected with your consent or for other legitimate reasons under the laws of the Republic of Turkey will be processed for the following purposes:

(I) To ensure necessary work can be carried out by our business units to benefit you from the products and services offered by our company;

(II) To customize the products and services offered by our company according to your preferences, usage habits, and needs;

(III) To ensure the legal and commercial security of our company and persons with whom we have a business relationship (administering communications operations, ensuring physical security and monitoring of locations belonging to the company, evaluation processes of partners/customers/suppliers, compliance processes, financial affairs, etc.);

(IV) To enhance the quality of the services provided by our company and to improve our quality policy;

(V) To inform you about and benefit from the general and special campaigns, promotions, advertisements, discounts, and similar advantages offered by our company;

(VI) To process your personal data, including your username and password, when you log in to services provided by our company to provide the information and services you requested, along with preferences, transactions, and duration of browsing;

(VII) To make notifications regarding any loyalty cards issued by our company and its affiliates and membership notifications related to the websites of our company and its affiliates (renewals, terminations, etc.), and to inform you about any communication that may be established, new services and products offered, and changes in personal data policies and membership conditions;

(VIII) To provide you with information about requests you make regarding information, events, and services from our company;

(IX) To determine and implement our company’s commercial and business strategies;

(X) To ensure the execution of our company’s human resources policies; and

(XI) To fulfill a legal obligation clearly specified in legislation or when necessary, as stipulated in the legislation.

C. METHOD AND LEGAL BASIS OF COLLECTING PERSONAL DATA:

Your personal data is obtained through all kinds of verbal, written, or electronic means, in line with the purposes specified above, to ensure the lawful provision of our products and services and to fulfill the contractual and legal obligations of our company correctly and fully. The personal data collected for this legal reason is processed, recorded, transferred, shared, and stored within the scope of the conditions and purposes of personal data processing specified in Articles 5 and 6 of the KVKK, as outlined in section (B) of this document.

D. PROCESSING OF SPECIAL CATEGORIES OF DATA:

According to the KVKK, personal data concerning a person's race, ethnicity, political opinion, philosophical belief, religion, sect, or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data, are considered special categories of personal data. Our company takes adequate precautions as determined by the Personal Data Protection Board when processing special categories of personal data. Our company will process individuals’ special category data only with their consent and solely for the purpose of data collection.

E. WHO YOUR PROCESSED PERSONAL DATA MAY BE TRANSFERRED TO AND FOR WHAT PURPOSES:

The personal data collected may be transferred to our company, shareholders, business partners, suppliers, legally authorized public institutions and private individuals, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK.

F. TRANSFER OF PERSONAL DATA ABROAD:

Our company has the authority to transfer personal data abroad, in compliance with the conditions specified by the Personal Data Protection Board in the KVKK, provided that the individual’s explicit consent is obtained and in accordance with the other conditions stipulated in the law.

G. RIGHTS OF THE PERSONAL DATA SUBJECT UNDER ARTICLE 11 OF THE KVKK:

Under the KVKK, we acknowledge that the data subject has the right to be informed and to give consent before their personal data is processed, recorded, transferred, shared, or stored. After the processing, recording, transferring, sharing, or storing of the data, the individual has the right to determine the fate of their data. In this context, if you submit your requests regarding your rights as a personal data owner to our company through the methods set out below in this "Illumination Text Regarding the Processing of Personal Data," our company will respond to the request free of charge within thirty days, depending on the nature of the request.

According to the Communiqué on the Procedures and Principles of Application to the Data Controller published by the Personal Data Protection Board, for your requests related to your rights as personal data owners: I. If a written response is to be provided to your application, no fee will be charged for up to ten pages. For each page exceeding ten pages, a processing fee of 1 Turkish Lira may be charged. II. If the response to the application is provided in a recording medium such as CD or flash memory, the fee requested by our company as the data controller cannot exceed the cost of the recording medium.

In this context, personal data owners have the following rights: a. To learn whether personal data is being processed, b. To request information regarding personal data that has been processed, c. To learn the purpose of processing personal data and whether they are used in accordance with their purpose, d. To know third parties to whom personal data has been transferred, whether domestically or abroad, e. To request correction of personal data if it is incomplete or incorrectly processed and to request that the transaction made in this scope be notified to third parties to whom personal data has been transferred, f. To request the deletion, destruction, or anonymization of personal data under the conditions specified in Article 7 of the KVKK, and to request that the transaction made in this scope be notified to third parties to whom personal data has been transferred, g. To object to the occurrence of a result against themselves by exclusively analyzing processed data through automated systems, h. To request compensation for damages incurred due to unlawful processing of personal data.

However, there is no right related to anonymized data within the company. Our company may share personal data with relevant institutions and organizations as required for the fulfillment of a judicial duty or use of legal authority by state authorities.

H. DURATION OF PROCESSING YOUR PERSONAL DATA:

In accordance with the KVKK, your personal data processed for the purposes stated in this "Illumination Text Regarding the Processing of Personal Data" will be deleted, destroyed, or anonymized when the purpose requiring its processing ceases to exist, or when the statutory limitation periods have elapsed, unless we are required to process your data due to the applicable legislation.

I. CIRCUMSTANCES UNDER WHICH OUR COMPANY CAN PROCESS YOUR PERSONAL DATA WITHOUT YOUR EXPLICIT CONSENT:

Pursuant to Article 5 of the KVKK, your personal data can be processed without your explicit consent under the following conditions: a. When it is clearly provided for in the laws, b. When it is necessary to protect the life or physical integrity of someone who is unable to give consent due to physical or mental incapacity, c. When it is necessary to process personal data of a party to a contract, provided that it is directly related to the establishment or performance of the contract, d. When it is necessary for compliance with a legal obligation to which the data controller is subject, e. When it is made public by the data subject themselves, f. When data processing is necessary for the establishment, exercise, or protection of a right, g. When data processing is necessary for legitimate interests pursued by the data controller, provided that such interests do not override the fundamental rights and freedoms of the data subject

J. REQUESTING RIGHTS UNDER THE PERSONAL DATA PROTECTION LAW:

According to Article 13, Paragraph 1 of the KVKK, you can submit your requests to exercise the rights mentioned above to our Company using the methods determined by the Personal Data Protection Authority. Alternatively, you may also submit your application in writing as per the KVKK. You can always contact us via email at [email protected] to exercise the rights outlined in Article 11 of Law No. 6698. Please note that inquiries regarding your personal data should only be sent to [email protected], and requests or notifications sent via other channels will not be considered.

Rights related to personal data can only be exercised by individuals regarding their own data. Requests concerning the data of individuals other than the person completing the form and submitting official identity documents will not be taken into account. Forms lacking official identity documents will not be considered. Even when data deletion requests are fulfilled, we would like to inform you that we are obliged to share the data with official authorities if requested by them.