CUSTOMER CONTACT LIGHTING TEXT ON PROTECTION AND PROCESSING

1. Data Controller

By the Personal Data Protection Law No. 6698 (“KVKK”), as Zem Grup Turizm Ticaret Limited Şirketi (Holidaynekolay or the “Company”), with this Enlightenment Text on the Protection and Processing of Personal Data (“Clarification Text”), as Data Controller, We would like to inform you, our valued customers, within the framework of our lighting obligation under the KVKK.

Within the scope of KVKK, personal data includes all kinds of information related to an identified or identifiable natural person (“Personal Data”), and Special Quality Personal Data, which is a special type of this, is based on race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, means data on clothing, association, foundation or union membership, health, sexual life, criminal conviction, and security measures, and biometric and genetic data (“Special Quality Personal Data”). In this context, the definition of Personal Data also includes your Sensitive Personal Data.

2. Collection Method of Your Data and Legal Reasons for Processing

Your Data is collected in connection with your transactions with the Company and for the purpose and scope specified in Section 4 below, by automatic or non-automatic means, verbally, in writing, and electronically, and through the following methods and the Company's contracted third parties.

a. Employing verbal or written requests, questions, opinions, or complaints you have submitted via the company's website, call center, applications, and platforms (WhatsApp) that provide live support or messaging services,

b. Through third parties with whom the Company receives services regarding its customers and has a contracted business relationship.

The legal reasons specified in Articles 5 and 6 of the KVKK regarding the processing of your Data are as follows:

a. Having your express consent,

b. stipulated in the law,

c. It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid,

D. Processing personal data in connection with the establishment or performance of a contract,

to. It is compulsory for the fulfillment of our legal obligations,

f. The person concerned has been made public by himself,

g. Data processing is mandatory for the establishment, exercise, or protection of a right, and

h. It is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.

3. Your Data Collected

The Personal Data we collect from you is the data that we process in proportion to the processing purposes we have stated in Section 4 below.

4. Purposes of Processing Your Data

Your Data is processed by the Company for the following purposes, based on your express consent or in other cases legally permitted under the KVKK:

a. Receiving questions, requests, opinions, or complaints (contact information) via the Company's website, call center, applications, and platforms (WhatsApp) that provide live support or messaging services, (Legal reason: establishment and performance of the contract, establishment, and exercise of a right) and data processing is mandatory for its protection, mandatory for our legitimate interests)

b. Evaluation, follow-up, and concluding of verbal or written questions, requests, opinions, or complaints transmitted via the Company's website, call center, applications, and platforms (WhatsApp) providing live support or messaging services to manage customer relations and ensure customer satisfaction (identification information, contact information, visual and audio information, customer transaction information, transaction security information) (Legal reason: Data processing is mandatory for the establishment and performance of the contract, fulfillment of our legal obligations, establishment, use and protection of the right)

c. Follow-up and execution of legal affairs (identity information, contact information, customer transaction information, legal transaction information) within the scope of carrying out customer complaint processes on legal platforms (Legal reason: Data processing is mandatory for the establishment and performance of the contract, establishment, exercise, and protection of a right, legitimate obligatory for our interests)

D. Providing information to authorized persons, institutions, and organizations in the context of fulfilling legal obligations and requests of administrative authorities (identity information, contact information, customer transaction information, transaction security information, visual and audio recordings, legal transaction information) (Legal reason: Fulfillment of our legal obligations mandatory)

5. To Whom Your Data May Be Transferred And For What Purpose

Your data, by the Company, based on your express consent or in other cases legally permitted (and within the framework of the purposes set out in Article 4), in the country and abroad;

a. In line with the above-mentioned data processing purposes, the Company provides services to third parties (CRM (Customer Relationship Management), call center, customer services, communication channel service (all kinds of electronic written communication channels, messaging services) Platforms (WhatsApp), messaging service infrastructure provider (Connexease) and providers of these platforms and applications abroad (Meta Inc.), cloud computing, backup, software support companies) to third parties,

b. To the authorized institutions and organizations and official public institutions and organizations to resolve legal disputes and fulfill the obligations arising from the legislation.

can be transferred or made accessible. This may also include countries that do not provide the same level of legal protection under the Law and implementing legislation.

6. Security of Your Data

Company,

a. To prevent the unlawful processing of personal data

b. To prevent unlawful access to personal data,

c. To ensure the protection of personal data

It is obliged to take all kinds of technical and administrative measures to ensure the appropriate level of security while carrying out data processing activities for the purpose.

Your data must be accurate and up-to-date. You have the right and obligation to contact the Company immediately if any information is inaccurate or out of date. The Company will correct, update, delete, or remove such information.

7. Your Rights

To the extent that your data is processed by the Company and the Company processes your data as a data controller, you have the following rights by Article 11 of the KVKK in terms of your data:

a.Learning whether any of your data is processed,

b. Requesting information regarding the processing activities of your data,

c. Learning the purposes of processing your data and whether they are used by the purposes,

D. Learning these third parties if personal data has been transferred to third parties in the country or abroad,

to. Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this framework to the third parties to whom the personal data has been transferred,

f. even though it has been processed by the KVKK and other relevant law provisions, in case the reasons requiring its processing disappear, this data is deleted, destroyed, or anonymized within 30 (thirty) days by the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. and requesting the notification of the transaction made in this context to the third parties to whom the personal data has been transferred,

g. Objecting to adverse results that may arise as a result of processing personal data through automated systems, and

h. To request compensation for the damage if you suffer damage due to the unlawful processing of your data.

You can submit your applications regarding your rights listed above to the Company by filling out the Related Person Application Form, which you can access at https://wwtatilnekolaycom/ille-kisi-basvuru-formu-pdf.

In this context, you can submit your request regarding your above rights to our e-mail or KEP address given below, by using your e-mail address previously notified to the Company and registered in the Company's system (by attaching the documents identifying your identity) or our e-mail address below. You can hand over the identifying documents and a petition with a wet signature or send it through a notary public.

In the application containing the explanations regarding the right you have as the personal data owner and you will make and request to use the above-mentioned rights; The subject you request must be clear and understandable, the subject you request is related to you or if you are acting on behalf of someone else, you must be specifically authorized in this regard and this authority must be documented, and the application must include your identity and address information.

The company concludes the requests included in the application as soon as possible and within thirty days at the latest (in case there is no cost), free of charge, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff to be determined by the Personal Data Protection Board may be charged. If the answers to the applications exceed 10 (ten) pages, a processing fee of 1.00 (one) TL will be charged for each page. If the answer is requested to be given in a recording medium such as CD, or flash memory, a fee will be charged according to the cost of the requested recording medium.

Data Controller: Zem Group Tourism Trade Limited Company

Postal address: Altınşehir Mah. Balkan St. No:12 Umraniye/Istanbul

E-mail address: [email protected]

KEP address: [email protected]