EN TR RU DE THE LAW ON PROTECTION OF PERSONAL DATA INFORMATION ON THE PERSONAL DATA PROTECTION We at ‘Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret Anonim Şirketi’ (“PEGAS”) comprehensively consider our esteemed customers’ security and, thus we would like to inform you of the pertinent provisions of the “Personal Data Protection Law” with respect to personal data and, fulfill our “Information Obligation” thereunder in order to protect fundamental rights and liberties, in particular, the right to privacy. Our purpose here is to inform you of the ways we collect your personal data, the aims of processing them, the legal reasons thereof and, your rights with respect thereto in the most transparent manner. In respect of all type of personal data (“Data”) that you have forward to PEGAS, in accordance with the pertinent provisions of the Personal Data Protection Law No. 6698 (the “PDPL”, which entered into force on April 7, 2016, Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret A.Ş., acting in the capacity of Data Controller and Data Processor, may obtain, save, store, maintain, update for the purpose of maintaining the performance of its services, change and reedit the personal data to the extent that is explained by the Law and within the terms and limits that are described below and, may disclose, transfer, forward to and share with third parties to the extent permitted by the law and, classify, anonymize and process the said personal data in such other manners as mentioned in the law. Data Controller: Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret Anonim Şirketi with the following contact information The purposes and legal reasons of processing your personal data; identification information, access/contact information, information consumption habits, and all types documents and information that may be used to identify or make identifiable the personal identifying information of our customers obtained as a result of audio or video interviews or such procedures carried out under the scope of the respective agreements fall into the subject of the definition of personal data as per the pertinent provisions of the article 3/d of the PDPL. Data Categorization Description of the Data Categorization Personal Identifying Information Information and documents that contain Name & Surname, Turkish ID Number, passport number, place and date of birth, gender, civil status, and IP address information Contact Information Telephone number, address, e-mail address, fax numbers, IP address information Payment Information The respective and masked parts of the card information submitted to us for bank provisions and payments (our systems do not store expiry dates and cvv/cvv2 information of credits cards as per the PCI-DSS rules). Information on Consumption Habits Preferred types of tours, accommodations, hotels and rooms Security Information Video and audio records that legally need to be obtained due to the service offered during the check-in and stay at the hotel and, audio records obtained at call centers Demand/Complaint Management Information Personal data concerning the receipt and assessment of all types of demands and complaints addressed to our Company Your personal data may be processed to fulfill the requirements of the agreements concluded with you; provide the package tour, reservation, accommodation services and other services based on the service you have selected; affect your payments; carry out the procedures concerning e-invoicing, e-archive invoicing and, returns and changes when necessary; share the necessary information with you about the package tours, reservations, accommodations and other services you have purchased through the communication channels preferred by you; determine the transaction information; carry out promotion/information, marketing and campaign activities, about which you have consented for communication; send activity bulletins; conduct data analyses-research activities; monitor and forward your complaints/ demands to our Company; backup/archive, store and save the transaction records; comply with the requirements as set forth under the pertinent legislations concerning data storage, reporting and information; and fulfill our legal obligations. PEGAS will not use your personal data for such processing purposes not mentioned hereunder, not transfer or disclose to 3rd parties without your explicit consent or unless there are such reasons as provided under the pertinent legislations. How to collect the personal data and, how long it will be stored: Your personal data may be collected through the corporate website www.swandorhotels.com; mobile sites and applications, call center, retail outlets, contracted agencies with which our Company work, and audio and video records for security purposes, whether automatically or non-automatically, in writing, verbally or using electronic environment. Our Company may store such personal data it has obtained in compliance with the periods if there is such a period as provided by the applicable legislations and, if there is no such a period, then for a period necessary to fulfill the purpose of processing thereof, but in any case, for a period not exceeding 5 years at maximum. If there is no valid reason to store the data for extended periods, it shall delete, destroy or anonymize the said personal data. Persons/institutions that your personal data may be transferred to for the above-mentioned purposes: Your Personal Data may be transferred to the respective banks, online payments systems depending on the payment method you have preferred; to the infrastructure provider so that we are able to offer you better services; to the respective departments/ institutions and the infrastructure providers thereof for e-invoicing/e-archive invoicing transactions; to such server hosting, archiving, storing and software service providers, which with we work for the purpose of backing-up/saving/archiving/storing the respective transaction records; to the principal shareholder of our Company and, its direct/indirect local/foreign affiliates; to the employees, financial and tax consultant and auditors of our Company to remedy a problem or fulfil our legal obligations and; to such persons, institutions and departments that are legally entitled to obtain this data. Any transfer of your personal data to such third parties mentioned here will be carried out on the need-to-know basis. Your Rights under the Article 11 of the Law and the Exemptions Thereof; by means of applying to our Company in writing or using other methods as determined by the Board; you are entitled to: a) learn if your personal data are processed; b) request for information if your personal data are processed; c) learn the purpose of the processing of your personal data and if the same are used for the intended purposes, ç) learn the identity of such third parties, to whom your personal data are transferred locally or internationally; d) ask for correction of your personal data if it is processed deficiently or wrongly; e) ask for the deletion or destruction of your personal data as per the terms and conditions as set forth under the article 11 of the Law; f) request that such third parties, to whom your personal data are transferred, are notified of the procedures carried out as per the paragraphs (d) and (e) above, g) object to any negative consequences against me as a result of analyses of your personal data exclusively by means of automatic systems; e) request for the indemnification in case of any loss and damage against you due to the illegal processing of your personal data. It is possible that you excursive your rights as of 07.10.2016 when the pertinent regulations entered into force. Together with the personal identifying information and, the rights you wish to exercise, you may submit your requests concerning to personal data, a) by means of completing the form available on the respective help pages on the website of our Company: http://www.swandorhotels.com/iletisim/, b) by means of a petition/letter of application that you may send to Yenigöl Mah. Nergiz Sok. No:94/2 Muratpaşa/Antalya through certified mail, via notary public or by hand delivery. Further, in case there are some other methods as described by the Board concerning the submittal of a request, then you may also use such other methods to send your requests. Our Company will ensure that your requests indicated in the application will be concluded for free of charge as soon as possible not later than thirty days according to the nature thereof. However, in case it requires an extra cost, a fee indicated in the tariff as determined by the Board may be collected. Our Company is entitled to accept or refuse the request by means of providing the reason thereof and, inform the data subject accordingly in writing or electronically. In case the request as indicated in the application is accepted, our Company will carry out the respective procedures. In case the respective request is attributable to a fault of our Company, any fee received in this respect, if any, will be returned. In case the request is refused, the applicant finds the answer insufficient or our Company fails to provide an answer in due time, the applicant reserves the right to submit a complaint to the Board within thirty days from the date, the applicant became aware of the answer of our Company and, in any case, within sixty days from the application date. Based on the provision of the article 14/2 of the PDPL, no complaint may be submitted to the Board before an application is made to our Company as the data controller. Those, whose personal rights have been violated, reserve the right to claim indemnification based on the general provisions. Nonetheless, please note that, based on the provisions of the article 28/2 of the PDPL, except for the right to claim identification of the respective losses, the provisions of the article 11 that regulate your rights may not be applied if a) the personal data processing is required to prevent the commitment of a crime or carry out an investigation thereon; b) the personal data that has been anonymized by the respective person is processed; c) the personal data processing is required so that the respective competent public departments and offices and such professional organizations that are considered public departments based on the legal authorities are able to carry out auditing or regulating procedures and, disciplinary proceedings or prosecutions; ç) the personal data processing is required to protect the economic and financial benefits of the State in respect of budget, tax and financial issues. Situations that Do Not Require Consent: as per the pertinent provisions of the paragraph 2, the article 5 of the Personal Data Protection Law No. 6698, our Company is entitled to process the personal data without the need for explicit consent in case that it is explicitly provided under the pertinent laws, that it is necessary to proceed the personal data of the parties to an agreement provided that it is directly related to establishing or performing the agreement; that it is necessary for Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret Anonim Şirketi to fulfill its legal obligations as the data controller/ the data processor; that has been anonymized by the respective person; that it is necessary to process the personal date for the purpose of establishing, exercising or protecting a right and, that it is necessary to process the personal data for the purpose of fulfilling the legitimate interests of our Company as the data controller, provided that the fundamental rights and freedoms of the respective person will not be harmed. In Respect of Being Informed of the Campaigns: I hereby agree and explicitly consent that such announcements about special promotions and campaigns may be sent to me through e-mail or sms in line with the privacy policies of Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret A.Ş. If you choose not to receive e-mails to be sent by Pegas Turizm Otel İşletmeciliği İnşaat Sanayi ve Ticaret A.Ş. that you may send a petition/letter of application to Yenigöl Mah. Nergiz Sok. No:94/2 Muratpaşa/Antalya through certified mail, via notary public or by hand delivery. Further, in case there are some other methods as described by the Board concerning the submittal of a request, then you may also use such other methods to send your requests. Our Company will ensure that your requests indicated in the application will be concluded for free of charge as soon as possible not later than thirty days according to the nature thereof.