PERSONAL DATA PROTECTION POLICY

As TAILA TOURISM TRAVEL AGENCY, we are committed to protecting the privacy when dealing with the personal information of all individuals associated with our Agency, especially our customers and employees. Our Company processes your personal data in accordance with the Constitution of the Republic of Turkey, Personal Data Protection Law No. 6698 and another relevant legislation, to ensure your privacy, fundamental rights and freedoms. Your personal data may be processed by TAILA TOURISM TRAVEL AGENCY as data controller, as described below, in accordance with the Personal Data Protection Law ("PDP Law") No. 6698.

Personal Data Processing In line with the principles listed in Article 4 of the Personal Data Protection Law, your personal data is processed in the following manner:

• Lawfully and fairly,

• Accurately and as up to date as possible,

• For specific, clear and legitimate purposes,

• As linked, limited and proportional to relate to the processing purposes,

• For the period stipulated in the relevant legislation or for the time required for the relevant purpose.

Personal data processing refers to any data-related operations, including a collection recording, storing, protection, altering, editing, disclosure, transferring, taking over, making accessible, classification or prevention of use in automated or non-automated methods if it is part of any data recording system. The Purpose of Processing Your Personal Standard personal data and special categories of personal data, particularly health-related information, may be processed so that we can offer better services to our customers, including products and services tailored to the preferences and habits of our customers. We also process data to be able to notify customers about our products and services, to measure customer satisfaction and to develop our products and services in line with our customers’ desire, as well as for finance and accounting activities, emergency management and similar purposes, in line with the processing terms specified in Articles 5 and 6 of Law No. 6698. Transferring Your Personal Data Your personal data may be transferred to our affiliates and subsidiaries, our business partners, investors, performance assistants and suppliers and our shareholders, as well as legally authorized public entities and private individuals, particularly official and judicial authorities, and regulatory and supervisory institutions, in consideration with the principles and objectives described above and if necessary security measures are undertaken within the scope of the objectives and terms specified in Articles 8 and 9 of the Personal Data Protection Law. In this context, your personal data may be retained in the country or transferred abroad. Collection Method of Personal Data and Legal Basis Your personal data may be collected by our Company or by natural or legal persons processing data on behalf of our Company, based on different legal grounds, verbally, in writing and/or via electronic means including, but not limited to websites, electronic mail, mobile communications, mobile applications, application and membership forms and various contracts. Your Rights as Data Owner In line with Article 20 of the Constitution, stating that all persons have the right to information regarding their personal data, you may submit a request to our Company to exercise your rights as personal data owners in the manner set forth in this Policy. Your requests will be concluded within a maximum of 30 days. Personal data owners have the following rights in accordance with Article 11 of the Personal Data Protection Law and the other legislation in force:

• To make a written request for details of your personal information and a copy of that personal information if it has been processed;

• To learn the purpose of processing personal data and whether the data is used appropriately;

• To learn the third parties to which personal data is transferred inside or outside the country;

• To request correction of personal data if it is incomplete or incorrectly processed;

• To request the deletion or erasure of personal data, within the framework of the terms stipulated in the legislation of the Personal Data Protection Law.

• To request that the process carried out within this scope be notified to any third parties to which the personal data is transferred, including your requests for deletion, erasure or correction of data.

• To object to a decision based solely on the automated processing of your data which produces legal effects concerning you or similarly significantly affects you;

• To request that damage be resolved if damage is incurred due to the processing of personal data unlawfully.

In accordance with Article 13/1 of the Personal Data Protection Law, you may submit requests to our Company for the use of your aforementioned rights in writing or by other methods determined by the Personal Data Protection Board. You may send your request to our registered e-mail address:

[email protected] via electronic mail.

Laws by: https://www.resmigazete.gov.tr/eskiler/2016/04/20160407-8.pdf