Protection of Personal Data

CLARIFICATION TEXT REGARDING PROCESSING OF PERSONAL DATA OF WESTBLOCKS’S CUSTOMERS / POTENTIAL CUSTOMERS

Pursuant to the Turkish Protection of Personal Data Law no. 6698 (“PPDL”) and the European Union’s General Data Protection Regulation (“GDPR”), AKARETLER TURIZM YATIRIMLARI A.S. and HAYAT TURIZM TICARET A.S. (both defined as “Company” individually and which are companies of Bilgili Holding Group), duly incorporated as per the legislation of the Republic of Turkey, shall be able to process your personal data within the scope stated below:

a)Purposes of Processing Your Personal Data

Your personal data (identity information, financial information, contact information, education information, employment details) and special categories of your personal data (including but not limited to ethnic origin and recordings) collected shall be processed by the Company or people/companies that have business with our Company in compliance with the GDPR and the conditions stated in Article 5 and 6 of the PPDL for the following purposes: to fulfill obligations, to give information and updates, to execute contracts, to remind you about your legal obligations, to engage in various advertisement and campaign activities of our Company or group companies via SMS or e-mail, to perform/pursue legal/financial works, to pursue requests/complaints, to plan/perform activities regarding customer satisfaction, to obtain customer’s opinions via surveys and polls, to determine products, projects and services customisable for you, to provide effectual customer service, to determine our visitor’s profiles and to answer your requests/complaints.

b) To Whom and For What Purposes Processed Personal Data Can Be Transferred

Your collected personal data can be transferred to legally authorized agencies, the Company’s local/international business partners and group companies within the framework of the conditions and purposes for processing personal data outlined in Article 8 and Article 9 of the PPDL and in compliance with the GDPR.

c) Method for Collecting Personal Data and Legal Basis Thereto

Your personal data will be processed and acquired in any verbal, written or electronic format within the framework of the law in line with the purposes outlined above in paragraphs (a) and (b) of this text in compliance with the GDPR and the conditions stated in Article 5 and 6 of the PPDL as it is “necessary for the legitimate interests of” the Company without harming your fundamental rights and freedoms and for execution of the Company’s legal obligations.

d) Personal Data Subject Rights Specified in Article 11 of the PPDL

Personal data subjects have the right to :

• Find out whether or not personal data has been processed,
• Request information about the processing of personal data if it has occurred,
• Find out the purpose of processing the personal data and whether or not it was processed for this purpose,
• Know third parties to whom personal data was transferred either domestically or abroad,
• Request that personal data processed incorrectly or incompletely be corrected and request that third parties to whom the transaction in correction was made are informed,
• Request that personal data be erased or destroyed if the reasons that required processing no longer apply in spite of the fact that it was processed in accordance with the provisions of the PPDL or other applicable legislation, and request that third parties to whom personal data was transferred as part of this process be informed,
• Object to any unfavourable consequences arising from the analysis of processed data via exclusively automatic systems,
• Request remedy of damages if they incur losses due to the unlawful processing of personal data.

As a personal data subject, requests you make in connection with your rights may be sent to the Company by filling in the KVKK Data Subject Application Form found at http://www.westblocks.com/. Your requests shall be answered by the Company within 30 days at the latest following its receipt. However, if a charge is specified by the Personal Data Protection Board, the cost on the fee schedule specified shall be collected by the Company.