LAW ON THE PROTECTION OF PERSONAL DATA

CLARIFICATION TEXT

As ORACLE TOURISM INVESTMENTS AND CONSTRUCTION JOINT STOCK COMPANY, we attach the utmost importance to the security of your personal data. With this awareness, as a company, we place great emphasis on the processing and protection of all personal data belonging to individuals in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”). Fully aware of this responsibility, and in our capacity as the “Data Controller” defined under the KVKK, we process your personal data within the scope and limitations mandated by the relevant legislation, as explained below.

Definitions in This Clarification Text

• Personal Data: Any information relating to an identified or identifiable natural person.

• KVKK: The Law on the Protection of Personal Data No. 6698, which entered into force upon publication in the Official Gazette on 07.04.2016.

• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

• Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the controller.

Data Controller

Personal data you share in your capacity as counterpart, supplier, customer, employee, intern, visitor, etc., will be processed by ORACLE TOURISM INVESTMENTS AND CONSTRUCTION JOINT STOCK COMPANY, the legal entity designated as the Data Controller, under the following scope.

Collection, Processing, and Purpose of Use of Personal Data

Depending on your relationship with our company, your personal data may be collected verbally, in writing, or electronically via automatic or non-automatic methods, through our departments, website, social media platforms, mobile applications, and similar means. Your personal data will continue to be generated and processed as long as your relationship with our company continues.

Collected personal data may be processed:

• To enable relevant departments to carry out the necessary work to benefit from our services,

• To ensure the legal and commercial security of individuals who are in a business relationship with our company,

• To determine and implement our company’s commercial strategies,

• To execute our company’s human resources policies.

Processing will be carried out in accordance with Articles 5 and 6 of the KVKK, and under the following principles:

• Lawful and fair processing,

• Accurate and up-to-date when necessary,

• Processed for specified, explicit, and legitimate purposes,

• Relevant, limited, and proportionate to the purposes for which they are processed,

• Retained only for as long as required by applicable laws or the purposes of processing.

To Whom and for What Purpose Personal Data May Be Transferred

Your personal data may be transferred to:

• Our business partners,

• Suppliers,

• Public institutions and private individuals authorized by law,
  in accordance with Articles 8 and 9 of the KVKK, for the purposes of executing relevant services, ensuring legal and commercial security, implementing business strategies, and executing human resources policies.

Method and Legal Basis of Personal Data Collection

Your personal data is collected in any verbal, written, or electronic form to deliver our services and to fulfill our legal and contractual obligations fully and correctly. The data is processed based on the legal grounds specified in Articles 5 and 6 of the KVKK and may be processed and transferred for the purposes listed in sections (1) and (2) of this clarification text.

Your Rights Under Article 11 of the KVKK

As a personal data subject, if you submit your requests regarding your rights to our company by the methods outlined below, your request will be resolved free of charge within 30 days, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the determined tariff will be charged. Within this scope, personal data subjects are entitled to:

1. Learn whether personal data is being processed,

2. Request information if personal data has been processed,

3. Learn the purpose of processing and whether personal data is used appropriately,

4. Know the third parties to whom personal data is transferred within the country or abroad,

5. Request correction of incomplete or inaccurate personal data,

6. Request deletion or destruction of personal data under the conditions set out in Article 7,

7. Request notification of corrections or deletions to third parties to whom data was transferred,

8. Object to any outcome arising to your detriment from automated processing,

9. Request compensation if you suffer damages due to unlawful processing of personal data.

Application Method under Article 13 of the KVKK

Pursuant to Article 13(1) of the KVKK, you must submit your request regarding the exercise of your above-mentioned rights in writing or by other methods determined by the Personal Data Protection Board. Since the Board has not yet specified an alternative method, applications must be made in writing for now. The application must clearly state your request and include identity and address information, with supporting documents.

You can submit your application — including your explanations regarding which rights under Article 11 of the KVKK you wish to exercise, together with documents verifying your identity — as a signed hard copy:

• By hand delivery,

• Via postal mail,

• Or through a notary,

to the following address:
Altınkum Mahallesi Atatürk Bulvarı No: 50/A Didim, Aydın, Turkey,
or via email: info@opdturkey.com

Respectfully,
ORACLE TOURISM INVESTMENTS AND CONSTRUCTION JOINT STOCK COMPANY