Personal Data Policy

İstanbul Akvaryum Turizm Ticaret Anonim Şirketi within the Framework of the Law No. 6698 on the Protection of Personal Data Information Text Regarding the Processing of Personal Data

1. Purpose and Scope of the Information Text

This Statement is intended to set forth the approach of İstanbul Akvaryum Turizm Ticaret Anonim Şirketi (“Company”) regarding the protection and processing of personal data of our customers, potential customers, employees, employee candidates, company shareholders, company officials, visitors, employees, shareholders and officials of institutions with which we cooperate, and third parties (hereinafter referred to as “data subjects”) within the scope of the Law on the Protection of Personal Data (“KVKK”) and to inform the data subjects accordingly, in line with the importance that İstanbul Akvaryum Turizm Ticaret Anonim Şirketi (“Company”) attaches to personal data. Prepared.

The Personal Data Processing Information Text (“Text”) includes all personal data of the data subject processed automatically or non-automatically as part of any data recording system.

This Text, prepared by our company, is dated 08.11.2018. In case of renewal of the entire Text or certain articles, the effective date and version of the Text will be updated. The Text is published on our company's website (www.cpistanbulflorya/kvkk) and is made available to the data subject upon their request.

2. Principles Regarding Personal Data

a. Processing of Personal Data

Our company processes your personal data in accordance with Article 20 of the Constitution and Article 4 of the Personal Data Protection Law,

• In accordance with the law and rules of honesty,
• Accurately and, when necessary, up-to-date,
• With specific, clear and legitimate purposes,
• In relation to the purpose,
• In a limited and proportionate manner,
• By retaining it for the period stipulated in the laws or required by the purpose of personal data processing,
• Based on one or more of the conditions specified in Article 5 of the Personal Data Protection Law.

Our company processes personal data within the scope of the purposes specified in Article 5 of the KVKK (Personal Data Protection Law) and listed below;

• The processing of personal data by our company is explicitly foreseen in the laws,
• The processing of personal data by our company is directly related to and necessary for the establishment or performance of a contract,
• The processing of personal data is necessary for our company to fulfill its legal obligations,
• Provided that the personal data has been made public; Personal data may be processed by our Company only for the purpose of making it public, limited to the following circumstances: the processing of personal data by our Company is necessary for the establishment, exercise, or protection of the rights of our Company, the data subject, or third parties; the processing of personal data is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject; the processing of data is necessary for the protection of the life or physical integrity of the personal data owner or another person, and in this case, the personal data owner is unable to express their consent due to factual impossibility or legal invalidity.

Article 6 of the KVKK (Personal Data Protection Law) defines certain personal data as "special categories" which carry the risk of causing harm or discrimination to individuals if processed unlawfully. These data include: This includes data relating to race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Our company processes special categories of personal data in the following cases, provided that adequate measures are taken as determined by the Personal Data Protection Board (Board): Special categories of personal data other than the health and sexual life of the data subject are processed in cases stipulated by law, and special categories of personal data relating to the health and sexual life of the data subject are processed only by persons or authorized institutions and organizations under an obligation of confidentiality for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing. If the above-mentioned data processing conditions are not met, explicit consent is obtained from the data subject by our company for data processing.

c. Transfer of Personal Data

Our company may transfer personal data, as stated in section 2.b of this Text, for the purposes specified below;

• To legally authorized public institutions and organizations within the scope of their legal authority, limited to the purpose requested by them
• To legally authorized private legal entities within the scope of their legal authority, limited to the purpose requested by them.

ç. Purpose of Collecting Personal Data

Your personal data is collected in accordance with the purposes stated above; to provide and develop the products and services we offer and to conduct our commercial activities. Your personal data collected in this process; Personal data is collected through our employees and representatives or through public databases within the scope of relevant legislation for the legal reason of conducting our commercial activities. Personal data collected for this legal reason may also be processed and transferred within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698, and for the purposes stated in clauses (b) and (c) of this Disclosure Statement.

Personal data is processed by our Company within the scope of the conditions stated above, for the provision of our services and in accordance with local legislation, for the purposes stated below. To ensure the implementation of our Company's human resources policies; to conduct HR operations in accordance with the Company's HR policies, to provide suitable personnel for open positions in accordance with the Company's HR policies, to fulfill obligations and take necessary measures within the framework of occupational health and safety. To ensure the fulfillment of legal and commercial obligations of our Company and persons with whom our Company has a business relationship; The administrative operations related to communication, service-related operations, ensuring the physical security and control of company locations, partner/customer/supplier/business partner (authorized persons, employees or partners) evaluation processes, legal and commercial risk analyses, legal compliance process, and financial management are carried out by our company. Furthermore, the necessary work is done to customize and recommend the products and services offered by our company to our customers according to their preferences, usage habits and needs; one-on-one and/or integrated marketing activities, sales and after-sales operations are carried out by our company; and the determination and implementation of our company's commercial and business strategies are carried out by our company. The financial operations, communication, market research and social responsibility activities, purchasing operations (demand, offer, evaluation, order, budgeting, contract), determination and implementation of our company's commercial and business strategies, internal system and application management operations, and management of legal operations carried out by our company can be listed as follows. The personal data processed by our company within the scope of this Text is listed in KSV1_LIST and the data subject whose data is processed is categorized and listed in KSV2_LIST.

d. Storage and Deletion of Data

Our company stores the personal data it processes for the periods determined by legislation, and if no period is determined in the legislation; personal data is stored for the period necessary for the processing of that data in accordance with the services provided by our company and the customs of our company's commercial life, and after this period only for the purpose of constituting evidence in possible legal disputes. Personal data is stored for the periods specified as necessary. After the expiration of these periods, the personal data in question is deleted, destroyed, or anonymized.

3. Data Subject's Rights

Article 20 of the Constitution stipulates that everyone has the right to be informed about personal data concerning them, and Article 11 of the Personal Data Protection Law (KVKK) states that the right to "request information" is among the rights of the personal data owner. In this context, our company provides the necessary information when the personal data owner requests information; This Statement informs the data subject how to exercise the right to request information and how matters related to information requests will be evaluated. The personal data subject has the following rights:

To learn whether personal data is being processed, to request information if personal data has been processed, to learn the purpose of processing personal data and whether it is being used in accordance with its purpose, to know the third parties to whom personal data has been transferred domestically or abroad, to request the correction of personal data if it is incomplete or inaccurate, and to request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred, even if it has been processed in accordance with the KVKK and other relevant laws, if the reasons requiring its processing have been eliminated. Requesting the deletion or destruction of personal data if it is removed, and requesting that this action be notified to third parties to whom the personal data has been transferred; objecting to a result that is detrimental to the individual arising from the analysis of processed data exclusively through automated systems; demanding compensation for damages if the individual suffers damage due to the unlawful processing of personal data.

According to Article 28 of the KVKK (Personal Data Protection Law), the following cases are excluded from the scope of the KVKK; The data subject cannot assert the rights listed above in these matters: Processing of personal data for purposes such as research, planning, and statistics through official statistics and anonymization. Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy, or personal rights, or constitute a crime. Processing of personal data by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security within the scope of preventive, protective, and intelligence activities. Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or execution proceedings.

In accordance with Article 28/2 of the KVKK (Personal Data Protection Law), in the following cases, the personal data subject cannot assert the rights listed above, except for the right to claim compensation for damages:

• When the processing of personal data is necessary for the prevention of crime or for criminal investigation.
• When the processing of personal data is necessary for the performance of auditing or regulatory duties, or for disciplinary investigation or prosecution, by authorized and competent public institutions and organizations and professional organizations with the status of public institutions, based on the authority granted by law.
• When the processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters.

Personal data subject

Data subjects may submit their requests regarding the rights mentioned above to our Company by completing the form available at www.cpistanbulflorya.com/kvkk, signing it with a wet signature, and delivering it in person to the address Şenlikköy Mah. Yeşilköy Halkalı Cad. No:93/1 Florya, Bakırköy/İstanbul, or by sending it via a notary public or registered mail with return receipt requested. For a person other than the data subject to make a request, a special power of attorney issued by the data subject for the person making the request must be available. Duly submitted requests to our Company will be processed within a maximum of thirty days. If the completion of the process requires additional costs, our Company will charge the applicant the fee specified in the tariff determined by the Board. Our Company may request information from the relevant person to determine whether the applicant is the data subject, and may ask the data subject questions regarding their application to clarify the matters stated in the application.

Our company may reject the applicant's application, explaining the reasons, in the following cases:

Processing of personal data for purposes such as research, planning, and statistics through official statistics and anonymization. Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy, or personal rights, or constitute a crime. Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security. Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or execution proceedings. Data processing is necessary for the prevention of crime or for criminal investigation. Processing of personal data that has been made public by the data subject themselves. Processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by authorized and competent public institutions and organizations, and professional organizations with the status of public institutions, based on the authority granted by law. Processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters. The data subject's request may hinder the rights and freedoms of other individuals. Requests requiring disproportionate effort have been made. The requested information is publicly available.

Data subject to the Personal Data Protection Law (KVKK) In accordance with Article 14, in cases where the application is rejected, the answer given is deemed insufficient, or no response is given to the application within the specified time; a complaint may be filed with the Board within thirty days from the date the Company learns of the response, and in any case within sixty days from the date of the application.

4. Security of Personal Data

a. Security Measures

In accordance with Article 12 of the KVKK (Personal Data Protection Law), our Company takes the necessary measures and controls to ensure an appropriate level of security to prevent the unlawful processing of personal data it processes, to prevent unlawful access to data, and to ensure the preservation of data, and conducts or has conducted the necessary audits in this context. The measures and controls taken by our Company in this regard are listed below:

Employment of personnel knowledgeable in establishing and operating systems in accordance with the principles and relevant legislation regarding the processing of personal data; Providing training to ensure that personnel are informed about personal data, including provisions in personnel contracts regarding compliance with personal data protection legislation and Company application rules; Using backup programs compliant with legislation that ensure the secure storage of personal data; In cases where a service covering personal data processing processes is outsourced, including provisions in contracts with outsourcing companies that they will take the necessary security measures to protect personal data and ensure compliance with these measures in their own organizations; Evaluating all personal data processing processes involved in all activities carried out by our Company within the scope of the data processing conditions regulated by the Personal Data Protection Law (KVKK), and ensuring that these processes comply with the KVKK. Taking the necessary technical and organizational measures to ensure that personal data processing is carried out in accordance with the provisions, Determining and implementing the rules of practice regarding the management of personal data processing processes and compliance structure, including precautions and controls, Maintaining and monitoring personal data processing processes and related systems with management systems that have technical and organizational characteristics.

b. Audit

Our company conducts or commissions the necessary audits within its own structure in accordance with Article 12 of the Personal Data Protection Law. The results of these audits are reported to the relevant department within the scope of the company's internal operations, and necessary activities are carried out to improve the measures taken. The necessary systems are established and the necessary training is provided to employees to raise awareness among the existing employees of the company's business units and the employees newly included in the business units regarding the protection of personal data.

c. Data Breach Management

Our company operates a system that ensures that if personal data processed is obtained by others through unlawful means, this situation is reported to the relevant personal data owner and the Board as soon as possible, in accordance with Article 12 of the Personal Data Protection Law. If deemed necessary by the Board, this situation may be announced on the Board's website or by another method.

Title: İstanbul Akvaryum Turizm Ticaret Anonim Şirketi

Mersis No: 048112368420001

Phone Number: +90 212 463 05 00

Fax Number: +90 212 463 05 50

Mail Address: Şenlikköy Mah. Yeşilköy Halkalı Cad. No:95 Florya, Bakırköy/İstanbul/Türkiye

E-mail address: kvkk@cpistanbulflorya.com

KSV1_LIST Personal Data Categories

Personal Data Processed for the Determination and Monitoring of Our Legal Receivables and Rights, and for the Fulfillment of Our Obligations and in Compliance with Our Legal Responsibilities and Company Policies

• Identity Information: All information contained in documents such as driver's license, national identity card, residence permit, passport, lawyer's ID, marriage certificate.
• Contact Information: Phone number, address, Information such as email.
• Customer Information: Information obtained and produced about the customer's authorized representative or employee as a result of our commercial activities and the operations carried out by our business units within this framework.
• Customer Transaction Information: Information such as records related to the use of our products and services, and instructions and requests necessary for the customer's use of products and services.
• Physical Space Security Information: Personal data relating to records and documents, including camera recordings taken during entry to and stay within a physical space.
• Transaction Security Information: Your personal data processed for the purposes of ensuring the fulfillment of technical, administrative, legal and commercial obligations while conducting our commercial activities.
• Financial Information: Personal data of the customer's authorized representative or employee regarding the customer's information, documents and records showing all kinds of financial results.
• Job Candidate Information: Personal data processed regarding individuals who have applied to become an employee of our company, or who have been evaluated as job candidates in line with our company's human resources needs in accordance with commercial customs and rules of honesty, or who are in a working relationship with our company.
• Legal Procedures and Compliance
• Special Category Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
• Marketing Information: Customer usage habits of our products and services, Personal data of the customer's employee or authorized representative, processed for the purpose of customizing and marketing the products and services according to their preferences and needs, and the reports and evaluations created as a result of this processing.

KSV2_LIST Data Subject Categories

• Customer Employee/Authorized Representative: Employees and authorized representatives of our customers who use or have used the products and services offered by our company.
• Potential Customer Employee: Those who request to use our products and services or Employees and officials of legal entities that have been assessed as having an interest in or may have such an interest in accordance with commercial customs and rules of honesty; Suppliers/Manufacturers; Natural persons who supply products and services to our company; Natural persons who produce using the products of our company or other companies; Visitors; Natural persons who have entered the physical premises of our company for various purposes or who have visited our websites; Third Parties; To ensure the security of commercial transactions between our company and the aforementioned parties, or to protect the rights and interests of the aforementioned persons. Natural persons associated with these individuals (e.g., Guarantor, Companion, Family Members and Relatives).
• Job Applicant: Natural persons who have applied for a job at our company or have made their resume and related information available for our company's review.
• Company Shareholder: Natural persons who are shareholders of our company.
• Company Official: Natural persons who are members of our company's board of directors and other authorized individuals.
• Employees, Shareholders and of Institutions with which we cooperate Officials: Individuals, including but not limited to, employees of institutions with which our company has any kind of business relationship (such as business partners, suppliers), shareholders and officials of these institutions.