Clarification Text for Protection of Personal Data

Dear Guests and Visitors,

As Tourama Yolcu Tasimaciligi ve Turizm A.S. (“Data Officer”, “Company”), we pay utmost attention to the security of your personal data. In this regard, we, as a Company, attach great importance to the processing and protection of all personal data belonging to all our guests and visitors who have a relationship with our Company, including the parties benefiting from our products and services, in accordance with the Law on the Protection of Personal Data ("KVKK", "Law"). With the full understanding of this responsibility, we, acting in the capacity of Data Officer, process your personal data as explained below and within the limits stipulated by the legislation.
This Clarification Text for the Protection of Personal Data (“Clarification Text”) aims to provide information to you about the Company's personal data practices and your rights as a data subject.
Collection and Processing of Personal Data and Purposes of Processing
In particular during the establishment of contracts, our company processes the personal data of its guests and visitors as laid down in this Clarification Text. Personal data processed within this scope are limited to identity information, contact information, financial information, information on visual and audio recordings, travel information and information on transaction security, and they are processed within the scope of express consent of data subjects or on the basis of legal reasons for the establishment and performance of the relevant contract or fulfilment of legal obligations. Personal data mentioned above are stored especially for the purposes of carrying out service procurement processes, contract management, accounting procedures, marketing activities and security purposes. In this regard, the processed personal data are deleted or destroyed after the termination of the contract, provided that there is no legitimate purpose for their retention. However, personal data that are of a nature that may require our Company to keep them as a means of proof in case of possible commercial disputes, are retained by our Company during the legal prescription period. In the retention of special categories of personal data, the principles and procedures determined in the decision no. 2018/10 of the Personal Data Protection Authority are followed.

Based on the legal reasons such as fulfilment of the legal obligations and ensuring the establishment and continuation of the service contract and the protection of legitimate interests, our Company obtains personal data such as name & surname, phone number, e-mail address, date of birth and other civil registrations, contact details, credit card details etc., which are shared by our guests and visitors via the website, as well as personal data such as traffic information that can be collected automatically by the website, and preserves some of them only in physical environment and some of them at both physical and digital environment.
In order to ensure the security of the data shared via our website as well as above-mentioned personal data, all kinds of administrative and technical measures are taken by our company. All personal data collected via our company's website are processed only for the following purposes:

Making the provision of services, conclusion of reservation enquiries and establishment of contracts possible via our website, carrying out customer service activities regarding our services purchased or requested,
Answering questions about our services and our website,
Sharing information about advertisements, raffles, promotions, announcements and campaigns etc., which our guests may be interested in, with our guests (subject to the prior approval of our guest visiting our website), and in this context, determining our guests’ product preferences and analysing them in order to offer only the products which our guests may be interested in,
Carrying out activities regarding the improvement of the functionality of our website such as data analysis, security, tests, development, improvement and change of services, determination of user trends, etc.
Carrying out accounting, invoicing, settlement and collection procedures.

In addition, your personal data collected by us shall be processed for the purpose of ensuring legal and commercial security (administrative operations for communication carried out by our company, ensuring the physical safety and control of the company's lotions, evaluation processes for business partners/customers/suppliers (representatives or employees), legal compliance process, financial affairs etc.), determining and implementing our company's commercial and business strategies and ensuring that our Company's human resources policies are carried out, in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVK Law.
To Whom and For What Purposes the Processed Personal Data may be Transferred
All personal data kept by the company may only be accessed by personnel and managers designated within the Company whom an access permission is granted to. Unauthorized persons may not have access to personal data. Personal data stored in the company may not be copied unless there is an absolute necessity, even by those who have access to them. In order to ensure the security of the personal data which are stored in the company, the company uses servers that are subjected to periodic penetration tests and constantly monitors the physical security of and access to server rooms and other places where personal data are located. In order to prevent unauthorized personnel from accessing personal data, all administrative and technical measures are taken by the Company. In addition, a training is provided to all key personnel for the purpose of increasing their awareness on the protection of personal data. The company may not transfer the personal data obtained to third parties, except in the cases specified in Articles 8 and 9 of the KVKK. Personal data stored by the company in this context may only be transferred to business partners, suppliers, group companies of Diana Otel Yatirimlari ve Isletmeciligi A.S., shareholders, legally authorized public institutions and private persons, audit firms, insurance agencies, lawyers and accountants, banks and public institutions and organizations, whether abroad or at home.

Method for Collection of Personal Data and its Legal Reason
Your personal data are obtained by means of all kind of verbal, written or electronic communication, in order to present the products and services of our Company in line with the above-mentioned purposes within the legal framework and, in this context, to ensure the fulfilment of our company’s contractual and legal obligations in a complete and accurate manner. Your personal data collected on the basis of these legal reasons may also be processed and transferred for the purposes specified in articles (1) and (2) of this text, in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

Rights of Data Subject in accordance with the Article 11 of the KVKK
In the event that you, as a data subject, submit your requests regarding your rights to our Company by the methods set out below in this Clarification Text, our company shall finalize the request free of charge no later than thirty days, depending on the nature of the request. However, a fee shall be collected from you at the tariff determined by our Company, if stipulated by the Personal Data Protection Board. In this context, the data subjects shall have the right

to learn whether their personal data are processed or not,
to demand for information as to if their personal data have been processed,
to learn the purpose of the processing of their personal data and whether these personal data are used in compliance with the purpose,
to know the third parties to whom their personal data are transferred in country or abroad,
to request the rectification of the incomplete or inaccurate data, if any, and request reporting of the operations carried out to third parties to whom their personal data have been transferred,
to request erasure, destruction or anonymisation of personal data in the event that all of the conditions for processing personal data no longer exist, although it has been processed in accordance with the provisions of the KVKK and other relevant laws, and request reporting of the operations carried out to third parties to whom their personal data have been transferred,
to object to the processing, exclusively by automatic means, of their personal data, which leads to an unfavourable consequence for the data subject,
to request compensation for the damage arising from the unlawful processing of their personal data. In accordance with the Article 13(1) of the KVKK, you can submit your request to exercise your rights mentioned above to our Company in writing or by other methods determined by the Personal Data Protection Board.

In this context, the channels and procedures where you can submit your application in writing to our Company within the scope of Article 11 of the KVKK are explained below.
You can send your request equipped with a secure electronic signature, which includes your explanations about your right to use the rights specified in Article 11 of the KVKK, to [email protected] by providing information required to identify you in order to exercise your rights stated above.
In case of any changes in personal data practices, the Clarification Text is updated by our Company. The current Clarification Text becomes effective as of the date it is published on the Website.

CONTACT DETAILS OF TOURAMA
Tourama Yolcu Tasimaciligi ve Turizm A.S.
Website          : www.touramatransfer.com
Address           : Altinova Sinan Mahallesi Serik Caddesi No: 331 Kepez / ANTALYA
Tax Office -No : Kusadasi Kurumlar - 85 80 86 56 79
MERSIS No.     : 0858086567900001
Phone No.       : 0850 300 31 50
E-mail            : [email protected]