KVKK

CUSTOMER INFORMATION TEXT ON PROCESSING AND PROTECTION OF PERSONAL DATA

MITANI TOURISM TRAVEL AND TRADE CO.

DEFINITIONS
a) Explicit consent: Consent related to a specific subject, based on information, and expressed freely.

b) Anonymization: Making personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.

c) Data subject: The natural person whose personal data is being processed. Within the scope of this information text, customers (passengers) receiving services from the Business shall be subject to:

d) Personal data: Any information relating to an identified or identifiable natural person.

e) Processing of personal data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, acquiring, making available, classifying, or preventing the use of personal data, whether fully or partially by automatic means, or non-automated means provided that it is part of any data recording system.

g) Institution: The Personal Data Protection Authority.

ğ) Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller.

h) Data recording system: The recording system in which personal data is structured and processed according to specific criteria.

ı) Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

DATA CONTROLLER AND CONCERNED PERSON IDENTITY
This information text is prepared by MİTANİ TURİZM SEYAHAT VE TİCARET ŞTİ (hereinafter referred to as the "Company"), established in Turkey, in accordance with the provisions of the Personal Data Protection Law No. 6698 dated April 7, 2016 (hereinafter referred to as the "Law"). In its capacity as data controller, in order to inform passengers regarding the procedures and principles regarding the processing of personal data belonging to customers (passengers), the data controller or the person authorized by the data controller is obligated to inform the relevant persons regarding the identity of the Data Controller and their representative, if any; the purpose for which the personal data will be processed; to whom and for what purpose the processed personal data may be transferred; the method and legal basis for collecting personal data; and the other rights listed in Article 11.

DATA COLLECTION METHOD AND LEGAL REASON
The "Company" collects data from "Relevant Persons" in accordance with the Personal Data Protection Law, in accordance with the law, through the channels listed below, by automatic or non-automatic means, verbally, in writing, or electronically. The data is processed in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the Personal Data Protection Law.

Your personal data is collected, in whole or in part, by automatic means, or by non-automatic means, provided that it is part of a data recording system, based on the legal grounds set forth in Article 5 of the Personal Data Protection Law: "It is necessary for the data controller to fulfill its legal obligations" and "Data processing is necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the relevant person."

Personal data of relevant persons is generally collected as described in the paragraph above. Concrete examples of the methods of collecting personal data are provided below, but are not limited to these.

Data is collected through written or electronic application forms,
verbally at the counter,
reservation forms received from agencies,
information received from the call center system,
e-mail, courier, reference, and similar methods sent to the Company,
correspondence conducted through e-mail addresses, text messages sent, information forms, and all communication methods, including all communication channels,
references (relatives),
through the website,
visual and audio recording systems.

LEGAL BASIS

Consumer legislation
Tax legislation,
Law of Obligations legislation,
Commercial law legislation,
Food legislation
Environmental legislation
Identity Notification Law
Notification Law
Law on Regulating Publications on the Internet and Combating Crimes Committed Through Such Publications
Legislation on Electronic Communications, etc. All relevant legislation

DATA CATEGORY: CUSTOMER TRANSACTION
Request information, invoice information, call center records, guest check-in procedures, hotel name, room number, departure time, return time, departure location, guest pickup location, location information, ticket type, credit card information, bank account number

DATA COLLECTION AND PROCESSING PURPOSE
According to the law, any data stored electronically or in print, and specified in the list titled "Processed Personal and Sensitive Data," that can be associated with a natural person, is defined as "Personal Data." Personal data may be shared with relevant institutions and organizations if required by law. Processed in accordance with the law and the principles of integrity, accurately and, when necessary, up-to-date, for specific, clear, and legitimate purposes, and within the principles of being relevant, limited, and proportionate to the purpose for which it is processed.

Personal Data may be processed by the data controller or legal entities/natural persons appointed by the data controller in accordance with the KVKK for the following purposes:

Execution of Emergency Management Processes
Execution of Information Security Processes
Execution of Audit/Ethics Activities
Execution of Activities in Compliance with Legislation
Execution of Finance and Accounting Affairs
Ensuring Physical Space Security
Following and Execution of Legal Affairs
Execution of Internal Audit/Investigation/Intelligence Activities
Execution of Communication Activities
Execution/Audit of Business Activities
Execution of Logistics Activities
Execution of Goods/Services Sales Processes
Execution of Goods/Services Production and Operation Processes
Execution of Marketing Analysis Studies
Execution of Advertising/Campaign/Promotion Processes
Execution of Storage and Archive Activities
Execution of Contract Processes
Execution of Product/Service Marketing Processes
Ensuring the Security of Data Controller Operations
Providing Information to Authorized Persons, Institutions, and Organizations Providing,
Executing administrative activities,
Controlling entry and exit,
Determining working conditions,
Protecting guest health and safety,
Fulfilling legal obligations specified in the Personal Data Protection Law,
Fulfilling legal obligations

TO WHOM AND FOR WHAT PURPOSES MAY PROCESSED PERSONAL DATA BE TRANSFERRED

Your processed personal data, limited to mandatory information, may be transferred domestically or internationally;

We always securely store your data and share it for reservations, information processing, advertising, marketing, promotion, business development, security, promotions, and campaign notifications. Furthermore, we also share your data with our business partners, suppliers (authorized or employees), company officials, shareholders, legally authorized public institutions, and private individuals, provided that the necessary precautions are taken, for the provision of our services and the fulfillment of our legal obligations (Ministry of Health, Ministry of Trade, Ministry of Interior, Ministry of Transport and Infrastructure).
Personal and sensitive personal data may be transferred to judicial authorities or relevant law enforcement authorities for the resolution of legal disputes or upon request in accordance with relevant legislation.
Data may be transferred to servers located abroad, primarily in EU countries, the United States, and Russia, and to companies providing server support, and to cloud computing service providers where cloud computing is used, in accordance with the information technologies used by the data controller;
To relevant audit and consultancy firms, independent audit firms, financial advisor/accounting firms, law firms, and Setur Duty Free for the purpose of fulfilling our obligations and auditing our commercial activities in accordance with relevant legislation;
To public institutions and organizations in order to fulfill legal requirements and/or fulfill the requests of official authorities;
In cases where express consent is required by law, express consent may be obtained (except for cases where express consent is not required by law) and in accordance with the conditions set forth by law.
In cases where express consent is required by law, express consent may be obtained (except for cases where express consent is not required by law) and in accordance with the conditions set forth by law.

PERSONAL DATA STORAGE PERIOD:

Your personal and sensitive personal data will be deleted within 10 years from the date of processing.
Your camera recordings will be stored for 75 days and then deleted. However, in the event of a complaint or suspicion of a complaint, relevant records will be stored for the statute of limitations.
After this period, your personal data will be deleted, destroyed, and/or anonymized by the data controller or, upon your request, by methods in accordance with the Personal Data Protection Law and relevant regulations. You may withdraw your consent for the processing of personal data at any time, except for data legally required to be processed.