PDPL

This Clarification Text concerns the processing of your data by the DATA CONTROLLER by the Personal Data Protection Law No. 6698 ("PDPL") and other relevant legislation. The Company responsible for processing your data is EKF Turizm İnşaat Sanayi Ticaret Limited Şirketi, located at İstasyon mah—Armoni St. No:1/1 Merkez / EDİRNE registered with 3270405715 Tax Number. This form provides information related to the processing of personal data by EKF Turizm İnşaat Sanayi Ticaret Limited Şirketi ("Company") by the NOTIFICATION and other relevant legislation.

According to PDPL, personal data includes information about an identified or identifiable natural person ("Personal Data"). Particular personal data, a specific type of personal data, provides information such as race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, data regarding appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data ("Special Qualified Data").

As the Data Controller, we will record, store, maintain, rearrange, and share your personal data with institutions legally authorized to request such Data. We may also process your data in other ways listed within the scope of PDPL in a limited and measured manner within the framework of the purpose that requires processing and is in connection with this purpose. We will do this as you notify us or if our Company has advised us.

PDP Law: Personal Data Protection Law No. 6698,

PDP Board: Personal Data Protection Board,

Processing of personal data: Obtaining, recording, storing and preserving personal data by fully or partially automatic or non-automatic means, provided that it is part of any data recording system, to be altered, rearranged, disclosed, transferred, taken over, made available, classified or prevented from being used. Any operations performed on data such as these are considered processing of personal data.

1. METHODS AND LEGAL REASONS FOR COLLECTION OF PERSONAL DATA

Our Company will collect your data through automatic or non-automatic methods in all kinds of written, verbal, and electronic media or via websites that allow it. Your data can be collected in physical and digital environments via mail, forms and other documents you have filled out. To the Company's legal obligation and legitimate interest to ensure workplace security, we collect data through cameras in the workplace building.

According to the 2nd paragraph of Article 5 of the Law, personal data can be processed without the explicit consent of the relevant person if one of the following conditions is met: according to paragraph (a), "explicitly foreseen in the law"; according to paragraph 5/2 (b), "actual impossibility"; according to paragraph 5/2 (c), "provided that it is directly related to the establishment or execution of a contract"; according to paragraph (d), "it is mandatory for the data controller to fulfil its legal obligation"; according to paragraph (f), "it is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person"; and according to the third paragraph of Article 6, "Personal data regarding health data can only be used for the protection of public health, preventive medicine, medical diagnosis, treatment and care."

2. SECURITY CAMERA RECORDINGS

2.1. How Personal Data is Collected, Legal Reasons and Storage Period

Personal data may be collected through closed-circuit camera systems located in areas where data processing is mandatory for the data controller's legitimate interests as long as it does not harm the relevant person's fundamental rights and freedoms. This is based on the legal reason that data processing is mandatory for these interests. Our Company processes the camera recordings 24/7 for specific purposes and stores them for two months. At the end of the storage period, the recordings are destroyed.

2.2. Purpose of Processing Camera Recordings

The personal data collected is processed for the legitimate interests of the data controller as long as it does not harm the data controller's fundamental rights and freedoms. The data is processed digitally to ensure security and confidentiality in our building, provide better service, use it as evidence in potential disputes, meet demands from authorized public institutions or organizations in a judicial case, manage emergencies, and ensure the Company's security. Camera recordings can also be used for detection and control purposes in cases of criminal offences.

2.3. Parties to Whom Camera Recordings Can Be Transferred and the Purpose of Transfer

The personal data collected can be shared with legally authorized institutions and organizations to ensure the legal, technical, and commercial-occupational security of the relevant persons who have a business relationship with the Company and the security of locations belonging to the Company. This is based on the personal data processing conditions and purposes specified in Articles 8 and 9 of the law.

3. PURPOSE AND LEGAL REASONS FOR PROCESSING PERSONAL DATA

The personal data collected by the Company or provided by the Personal Data Subject may be obtained, recorded, preserved, disclosed, transferred to third parties or processed in ways permitted by the legislation. Current technology requirements are the data controller, the Company, and relevant legislation. The purpose of collecting this data is to carry out commercial activities per the law, access legal portals and fulfil legal obligations.

Apart from legal regulations regarding data processing, the personal data in question is also subject to express approval by the Personal Data Owner following the review of this clarification form. The personal data may be used to confirm the identity information of the person who made/had it done on behalf of the Company, to make necessary checks, to provide the address and other information for communication, to record the required information, to provide information to public officials upon request, and to fulfil legal obligations.

In addition to the commercial activities carried out by the Company, personal data may be processed and stored by legally authorized public institutions, business partners, and suppliers. This is done within the scope of explicit consent and for other matters specified in the express consent/consent form and permitted by the Data owner. It can also be shared with organizations and private law legal entities.

The Company does not share personal data with third parties in any way prohibited by law, with or without explicit consent. Personal data will be processed according to Article 4 of the Personal Data Protection law. In this context, the personal data will be deleted and destroyed by the procedures and principles of Article 7 of the law.

4. TRANSFER OF PROCESSED PERSONAL DATA

Personal data can be shared with official institutions and organizations in the country, third-party actual and legal persons with whom we are affiliated, service provider companies and their officials, business partners and shareholders of our Company, our group companies and subsidiaries, and suppliers for the purposes outlined in this information text.

5. YOUR RIGHTS RELATED TO THE DATA PROCESSING PROCESS

Article 11 of the Personal Data Protection Law gives you the right to contact a company and ask about your data to determine whether it is being processed. If it has been processed, you can request information about it, including its purpose and whether that purpose is using it. You can also ask about any third parties with whom your data has been shared, either within or outside your country. If your data is incomplete or incorrect, you can request it to be corrected, and the Company must inform any third parties to whom the data has been shared. You can also request the deletion or destruction of your data, subject to the conditions stipulated in relevant legal provisions, and demand that transaction records be shared with third parties to whom your data was transferred.

You also have the right to object to any results from analyzing your processed data exclusively through automatic systems. You can demand compensation if you suffer damage due to illegal processing.

To exercise these rights, you must submit your application to the Company at 30356 dated 10.03.2018, along with documents that show your identity. You can obtain the application form by sending an email to info@theplazahoteledirne.com. You must sign the form and submit it in one of the following ways:

a. In person or through a notary, at the address: "EKF Turizm İnşaat Sanayi Ve Ticaret Limited Şirketi HR Department - Istasyon mah. Armoni st. No:1/1, Merkez/Edirne”

b. Email info@theplazahoteledirne.com using a registered email (KEP) address, secure electronic signature, mobile signature, or the email address you previously notified the Company and registered in their systems.

c. By any other method specified in the PDP Law.

If a third party applies on behalf of the data owner, the data owner must provide an extraordinary power of attorney issued by a notary.

The Company will finalize your request(s) free of charge as soon as possible and within 30 days at the latest, depending on their nature. However, if the transaction requires an additional cost for the Company, the fee will be charged according to the tariff set by the Personal Data Protection Board.