Personal Data Protection Policy

ANIA TURİZM YATIRIMLARI A.Ş.

PERSONAL DATA PROTECTION PROCESSING STORAGE AND DESTRUCTION POLICY

CONTENTS

1. Introduction
   1. Purpose
   2. Scope
   3. Abbreviations and definitions
2. ANİA Turizm Yatırımları A.Ş. Regarding the Processing and Protection of Personal Data. Principles Adopted by
3. Compliance with Basic Personal Data Processing Data
4. Compliance with Personal Data Processing Conditions
5. Compliance with Special Personal Data Processing Conditions
6. Responsibility and task distribution
7. recording media
8. Transfer of Personal Data
   1. Transfer of Personal Data Domestically
   2. Transfer of Personal Data Abroad
9. Explanations Regarding the Reasons Requiring Storage and Disposal
   1. Notes on storage
   2. Reasons requiring destruction
10. Rights of Personal Data Owners and Finalization of Their Requests by the Company
11. Technical and administrative measures
    1. Technical measures
    2. Administrative measures
12. Personal data destruction techniques
    1. Deletion of personal data
    2. Destruction of personal data
    3. Anonymization of personal data
13. Storage and disposal periods
14. Periodic destruction time
15. Publication and storage of the Policy
16. Policy update period

ANNEX-1: Application form

1. INTRODUCTION
2. Purpose

The purpose of this document is the Personal Data Storage and Destruction Policy (“Policy”), the Personal Data Protection Law No. 6698 (“KVKK” or “Law”) and the secondary regulation of the Law, which came into force by being published in the Official Gazette dated 28 October 2017. To fulfill our obligations following the Regulation on Deletion, Destruction or Anonymization of Personal Data (“Regulation”) and to inform data owners about the principles of determining the maximum storage period required for the purpose for which their personal data is processed and the deletion, destruction and anonymization processes. It has been prepared by ANİA Turizm Yatırımları A.Ş., the operator of Balmy Hotels, as the data controller (from now on referred to as "ANİA" or "Company").

1. Scope

Personal data belonging to the Institution's employees, employee candidates, service providers, visitors and other third parties are within the scope of this Policy, and this Policy applies to all recording environments and personal data processing activities where personal data owned or managed by the Institution is processed.

1. Abbreviations and Definitions
     

2. PRINCIPLES ADOPTED BY THE COMPANY REGARDING THE PROCESSING AND PROTECTION OF PERSONAL DATA
3. Compliance with Basic Personal Data Processing Principles

The following basic principles are adopted by the company within the scope of complying with and maintaining compliance with personal data protection legislation:

1. Process personal data in accordance with the law and the rules of honesty

The company carries out its personal data processing activities in accordance with the law and the rule of honesty, in accordance with the personal data protection legislation, especially the Constitution of the Republic of Turkey.

2. Ensuring the accuracy and up-to-dateness of personal data processed

While the processing of personal data is carried out by the company, all necessary administrative and technical measures are taken to ensure the accuracy and up-to-dateness of personal data within technical possibilities.

3. Processing of personal data for specific, explicit and legitimate purposes

The processing of personal data by the company is carried out for clear and lawful purposes determined before the personal data processing begins.

4. Processing personal data in a limited and measured manner in connection with the purpose

Personal data is processed by the company in connection with the data processing conditions and as necessary to provide these services. In this context, the purpose of personal data processing is determined before starting the personal data processing activity, and data processing is not carried out with the assumption that it can be used in the future.

5. Keeping personal data for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.

The company retains personal data for a limited period of time stipulated in the relevant legislation or required by the purpose of data processing. Accordingly, if the period stipulated in the legislation expires or the reasons requiring the processing of personal data disappear, personal data is immediately deleted by the Company.

2. Compliance with Personal Data Processing Conditions

The company carries out its personal data processing activities in accordance with the data processing conditions set out in Article 5 of the PDPL. In this context, personal data processing activities are carried out in the presence of the personal data processing conditions listed below:

1. Existence of Explicit Consent of the Personal Data Owner
2. Personal Data Processing Activity is Clearly Provided for in Laws
3. Explicit Consent of the Data Owner Cannot Be Obtained Due to Actual Impossibility and Personal Data Processing is Mandatory
4. Personal Data Processing Activity Is Directly Related to the Establishment or Performance of a Contract
5. It is mandatory to carry out personal data processing activities in order for the company to fulfill its legal obligations
6. Data Processing Is Necessary for the Establishment, Exercise or Protection of a Right
7. Data Owner's Publicization of Personal Data
8. Personal Data Processing is Necessary for the Legitimate Interests of the Company, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Owner
9. Compliance with Special Personal Data Processing Conditions

       Special categories of personal data can be processed in the following cases, provided that adequate measures determined by the Company are taken:

• The relevant person must have explicit consent,
• It is clearly stipulated in the law,
• It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
• Concerning the personal data that the relevant person has made public and being in accordance with the will to make it public,
• It is mandatory for the establishment, use or protection of a right,
• It is necessary for the protection of public health, the execution of preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons or authorized institutions and organizations under the obligation of confidentiality,
• It is mandatory to fulfill legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

3. RESPONSIBILITIES AND DUTIES DISTRIBUTION

4. RECORDING MEDIA

Personal data is stored securely in accordance with the law in the environments listed below.

5. TRANSFER OF PERSONAL DATA

      We may share personal data with our business and solution partners that provide services such as tourism, hotel management, travel agency, tour operator, as well as with our Company subsidiaries, social media, advertising and analysis business partners, in order to provide services by the Company. Our business partners may combine this information with other information you have provided to them or that they have collected while using their services.

      Within the framework of national and international legislation provisions, especially KVKK, the Company may transfer the personal data it processes domestically or abroad. It may be subject to transfer procedures. During these transactions, articles 8 and 9 of the KVK Law, Directive 95/46/EC and the provisions of the GDPR, which repeals this directive, are taken into account. The company has fulfilled the conditions stipulated by the above-mentioned laws and directives regarding the transfer of personal data domestically and abroad.Kişisel Verilerin Yurtiçinde Aktarılması

The company may transfer the data it processes to third parties by obtaining the express consent of the relevant person within the framework of the authority granted by Articles 8 and 9 of the PDPL and this policy. The basic principles listed below are explained in Section 2 of this Policy within the scope of compliance and maintenance of compliance with the personal data protection legislation by the Company.

The data duly collected, stored and processed by the company is shared with the following domestic third parties for purposes such as receiving technical support services and ensuring data security, and is processed within the scope of explicit consent.

Google LLC
Meta Inc,
Microsoft Corporation, Inc.,
Yandex LLC,
and also within the scope of Digital Marketing activities
Cyber Media Information Technologies. Tic. Ltd. Ltd.

Provisions in other laws are reserved for the domestic transfer of personal data.

If there is any Data Processor within the scope of this Data Policy, the provisions of Article 8 of the PDPL apply to personal data transfers between the Data Processor and the Company. Data transfer between employees operating in the legal entity and different departments within the legal entity of the company that has the title of data controller is not considered a transfer within the framework of Article 8 of the PDP Law. However, data transfers with those who have separate legal entities operating as cooperation or solution partners with the company are considered as data transfer within the scope of Articles 8 and 9 of the PDP Law and this PDP Policy.

2. Transfer of Personal Data Abroad

Personal data by the company in accordance with the personal data processing conditions in accordance with Article 9 of the KVKK;

(1) Existence of adequate protection (Countries with adequate protection are determined and announced by the Institution.)

(2) In case there is no adequate protection, the data controllers in Turkey and the relevant foreign country must undertake adequate protection in writing and have the permission of the Authority.

(3) The standard contract announced by the Institution must be signed with the company and the third party to be shared with.

or

• Performance of a contract or implementation of pre-contractual measures,
• Establishment or execution of a contract for the benefit of the relevant person, a superior public interest,
• Establishment, use or protection of a right,
• It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity.
• Transfer from a registry that is open to the public or persons with legitimate interests

In such cases, it can be transferred abroad.

6. EXPLANATIONS REGARDING THE REASONS REQUIRING STORAGE AND DISPOSAL

Personal data belonging to data owners are stored securely by the Company in the physical or electronic environments listed above, within the limits specified in KVKK and other relevant legislation, especially in order to continue commercial activities, fulfill legal obligations, plan and fulfill employee rights and benefits, and manage customer relations.

1. 1. Information on Storage

Personal data processed in accordance with the law and this Policy may be stored under the following conditions.

• Storing personal data because it is directly related to the establishment and execution of contracts,
• Storing personal data for the purpose of establishing, exercising or protecting a right,
• It is mandatory to keep personal data for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of individuals,
• Storing personal data for the purpose of fulfilling any legal obligations of the Company,
• Storage of personal data is clearly stipulated in the legislation,
• Explicit consent of data owners is required for storage activities that require explicit consent of data owners.
  2. Reasons Requiring Destruction

 In accordance with the Regulation, in the cases listed below, personal data of data owners are deleted, destroyed or anonymized by the Company ex officio or upon request.

• Amendment or fulfillment of the relevant legislation provisions that constitute the basis for the processing or storage of personal data,
• Elimination of the purpose requiring the processing or storage of personal data,
• Elimination of the conditions requiring the processing of personal data in Articles 5 and 6 of the Law,
• To withdraw the consent of the relevant person in cases where the processing of personal data is carried out only on the basis of explicit consent,
• The data controller accepts the application made by the relevant person for the deletion, destruction or anonymization of his personal data within the framework of his rights in paragraphs 2 (e) and (f) of Article 11 of the Law,
• In cases where the data controller rejects the application made to him by the data subject requesting the deletion, destruction or anonymization of his personal data, his response is found insufficient, or he does not respond within the period stipulated in the Law; Making a complaint to the Institution and this request being approved by the Institution,
• Although the maximum period requiring the storage of personal data has passed, there are any conditions that justify storing personal data for a longer period of time.

The company retains personal data for the period necessary for the purpose for which they are processed and the minimum period stipulated in the relevant legal legislation. In this context, the Company first determines whether a period of time is stipulated in the relevant legislation for the storage of personal data, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is stored for the period shown in the table above that is necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the data owner's application and with the specified destruction methods (deletion and/or destruction and/or anonymization).

7. RIGHTS OF PERSONAL DATA OWNERS AND CONCLUSION OF THEIR REQUESTS BY THE COMPANY

     If data owners submit their requests regarding their personal data to the Company in writing or by other methods determined by the KVK Authority, the Company, as the data controller, shall ensure that the request is finalized as soon as possible and within thirty (30) days at the latest, in accordance with Article 13 of the KVK Law, depending on the nature of the request. carries out the necessary processes to ensure Data owners must make their requests regarding their personal data in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

      Within the scope of ensuring data security, the company may request information to determine whether the applicant is the owner of the personal data subject to the application. Our company may also ask questions to the personal data owner regarding his/her application in order to ensure that the personal data owner's application is finalized in accordance with the request.

      Application of the data owner; In cases where there is a possibility of hindering the rights and freedoms of other persons, it requires disproportionate effort, or the information is publicly available, the request may be rejected by the Company by explaining the reason.

Rights of Personal Data Owners In accordance with Article 11 of the KVK Law, you can apply to our Company and request the following issues:

1. To learn whether your personal data is being processed or not,
2. To request information if your personal data has been processed,
3. To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
4. To learn the third parties to whom your personal data is transferred domestically or abroad,
5. To request correction of your personal data if it has been processed incompletely or incorrectly, and to request that the action taken in this context be notified to third parties to whom your personal data has been transferred,
6. To request the deletion, destruction or anonymization of your personal data in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the provisions of PDPL and other relevant laws, and to request that the action taken in this context be notified to third parties to whom your personal data has been transferred,
7. To object to the emergence of a result against you by analyzing your processed data exclusively through automatic systems,
8. To request compensation in case you suffer damage due to unlawful processing of your personal data.

8. TECHNICAL AND ADMINISTRATIVE MEASURES

Company within the framework of adequate measures determined and announced by the Institution for special personal data in accordance with Article 12 of the Law and the fourth paragraph of Article 6 of the Law, in order to safely store personal data, prevent unlawful processing and access of personal data, and destroy personal data in accordance with the law. Technical and administrative measures are taken by the company.

1. Technical Measures

• With penetration tests, risks, threats, vulnerabilities and vulnerabilities, if any, regarding our Company's information systems are revealed and necessary precautions are taken.
• As a result of real-time analysis with information security incident management, risks and threats that will affect the continuity of information systems are constantly monitored.
• Access to information systems and authorization of users are made through the access and authorization matrix and security policies through the corporate active directory.
• Necessary precautions are taken for the physical security of our company's information systems equipment, software and data.
• In order to ensure the security of information systems against environmental threats, hardware (access control system that allows only authorized personnel to enter the system room, 24/7 employee monitoring system, ensuring the physical security of the edge switches that form the local area network, fire extinguishing system, air conditioning system, etc.) and software. Precautions (firewalls, attack prevention systems, network access control, malware blocking systems, etc.) are taken.
• Risks to prevent unlawful processing of personal data are identified, technical measures appropriate to these risks are taken, and technical controls are carried out for the measures taken.
• Access procedures are established within the company and reporting and analysis studies regarding access to personal data are carried out.
• Access to storage areas containing personal data is recorded and improper access or access attempts are kept under control.
• The Company takes the necessary measures to ensure that deleted personal data is inaccessible and unusable for relevant users.
• In case personal data is obtained by others unlawfully, a suitable system and infrastructure has been created by the Company to notify the relevant person and the Institution by sending an e-mail to info@balmyhotels.com.
• Security vulnerabilities are monitored, appropriate security patches are installed and information systems are kept up to date.
• Strong passwords are used in electronic environments where personal data is processed.
• Secure record keeping (logging) systems are used in electronic environments where personal data is processed.
• Data backup programs are used to ensure safe storage of personal data.
• Access to personal data stored in electronic or non-electronic media is limited according to access principles.
• The company does not store personal data in flash memory, USB drive, Data Bank and similar portable systems under any circumstances, and the transfer of existing personal data to such portable systems is not allowed.
• The authorizations of users who have access to data for employees involved in special personal data processing processes are defined.
• Electronic environments where special personal data are processed, stored and/or accessed are protected using cryptographic methods, cryptographic keys are kept in secure environments, all transaction records are logged, security updates of the environments are constantly monitored, necessary security tests are carried out regularly, test results are recorded. to be taken under,
• Adequate security measures are taken for the physical environments where special personal data are processed, stored and/or accessed, and unauthorized entries and exits are prevented by ensuring physical security.

1. 2. Administrative Measures

Administrative measures taken by the company regarding the personal data it processes are listed below:

• In order to improve the qualifications of employees, training is provided on preventing unlawful processing of personal data, preventing unlawful access to personal data, ensuring the preservation of personal data, communication techniques, technical knowledge and skills, Law No. 657 and other relevant legislation.
• Employees are made to sign confidentiality agreements regarding the activities carried out by the company.
• A disciplinary procedure has been prepared for employees who do not comply with security policies and procedures.
• Before starting to process personal data, the Company fulfills its obligation to inform the relevant persons.
• A personal data processing inventory has been prepared.
• Periodic and random audits are carried out within the company.
• Information security training is provided to employees.
• A separate policy has been determined for the security of sensitive personal data.
• Training is provided on special personal data security for employees involved in special personal data processing processes, and confidentiality agreements have been signed regarding special personal data security.

9. PERSONAL DATA DESTRUCTION TECHNIQUES

At the end of the period stipulated in the relevant legislation or the storage period required for the purpose for which they are processed, personal data are destroyed by the Company ex officio or upon the application of the relevant person, using the techniques specified below, in accordance with the relevant legislation.

1. 1. Deletion of Personal Data

1. 2. Destruction of Personal Data

10. STORAGE AND DISPOSAL PERIOD

Regarding the personal data processed by the company within the scope of its activities;

• Personal data-based retention periods for all personal data within the scope of activities carried out depending on the processes are included in the Personal Data Processing Inventory;
• Process-based retention periods are in the Personal Data Storage and Destruction Policy.

takes place.

For personal data whose storage period has expired, the Company will ex officio delete, destroy or anonymize it.

2. PERIODIC DESTRUCTION PERIOD

Periodic destruction periods are determined as 3 months. Within the company, destruction is carried out every year in 3-month periods on the date determined by the Company.

3. PUBLISHING AND STORAGE OF THE POLICY

The policy is published in two different media, with wet signature (printed paper) and electronically, and is disclosed to the public on the website. The printed paper copy is stored at the office headquarters.

4. UPDATED PERIOD OF THE POLICY

This data policy was updated on 21.03.2024 and will be reviewed if necessary in line with developments and the necessary sections will be updated. Updates are published on the web page.

ANNEX-1 APPLICATION FORM

This form is submitted to ANİA Turizm Yatırımları A.Ş. in accordance with Article 11 of the Law on the Protection of Personal Data. It has been prepared to make it easier for you to exercise your right to receive information by applying to (ANIA). For detailed information about the processing process of your Personal Data and the process after your application with this form, see “ANİA Turizm Yatırımları A.Ş.” published on the balmyhotels.com website. Please review the "Policy on Protection, Processing, Storage and Destruction of Personal Data".

1. Applicant's Contact Information

The information requested through this form is necessary to accurately identify you, to conduct detailed research regarding your request, and to notify you of the result of your application, and may be processed for this purpose. Therefore, please submit your information accurately and completely. Your requested personal data will not be used in any way other than to fulfill the Purpose.

2. Applicant's Relationship with ANIA
    
3. 1. Please indicate your relationship with ANIA.

For example: Employee; Shareholder; Company official; Customer; Customer Representative/Employee; Reseller.

…………...…………………………………………………………………………………………………......

1. 2. Which unit within ANIA did you communicate with?

…………...…………………………………………………………………………………………………......

3. Applicant's Request

Please describe your request in detail below.

…………...…………………………………………...……………………………………………………......

…………...…………………………………………………………………………………………………......

…………...…………………………………………………………………………………………………......

…………...…………………………………………………………………………………………………......

…………...…………………………………………………………………………………………………......