PERSONAL DATA PROTECTION LAW

Data Controller

As Kalsedon Cave Suites (“Company”), we would like to inform you, our valued customers and visitors, within the framework of our disclosure obligation within the scope of KVKK, in the capacity of Data Supervisor, in accordance with the Law No.6698 on Protection of Personal Data. Within the scope of the law on the protection of personal data, personal data includes all kinds of information related to an identified or identifiable person, and a special type of this, such as race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data (“Special Quality Personal Data”). In this context, the definition of Personal Data also includes your Special Quality Personal Data. Methods of Personal Data Collection and Legal Reasons for Processing Your Personal Data is collected by automatic or non-automatic means, verbally, in writing, or electronically, and through the following methods and third parties in connection with your transactions with Kalsedon Cave Suites and within the scope and scope specified in Section 4 below. In this case, the personal data collection methods and means are as follows:

• Registration documents filled out during customer registration procedures within the scope of hotel accommodation and/or activities, at the reception and/or event entrances during visits to the hotel,

• Documents filled during reservations made through the Kalsedon Cave Suites website, online sales channels such as e-mail and phone,

• Opinion and complaint forms filled in at Kalsedon Cave Suites,

• Camera systems in Kalsedon Cave Suites and in its car park,

• The legal reasons stated in Articles 5 and 6 of the Law on the Protection of Personal Data regarding the processing of Personal Data by third parties (tourism agencies, etc.) with whom Kalsedon Cave Suites receives services for its customers and has a business relationship with are as follows: -Personal data cannot be processed without the explicit consent of the data subject. -It is clearly provided for by the laws. -It is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid. -Processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfilment of that contract. -It is mandatory for the controller to be able to perform his legal obligations. -The data concerned is made available to the public by the data subject himself. -Data processing is mandatory for the establishment, exercise or protection of any right. -It is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

The Personal Data we collect from you is your data that we process in proportion to the processing purposes we have stated in Section 4 below. Kalsedon Cave Suites processes personal data for the following purposes based on your express consent or in other cases legally permitted under the Personal Data Protection Law:

• Ensuring the sending of electronic commercial messages (service advertisement, campaign, offer of advantages and benefits to you, SMS, e-mail, or other forms) as part of the execution of advertisement/campaign/promotion and service marketing processes (identity, communication, marketing, customer transaction, customer survey information, vehicle information) (Legal reason: Explicit consent)

• Customized marketing activities within the scope of marketing process execution, execution management, execution of other marketing studies, execution of customer relations activities, execution of satisfaction surveys (identity, communication, marketing, customer transaction, customer survey information, vehicle information), (Legal reason: Explicit consent)

• Execution of health processes in Kalsedon Cave Suites as a result of Covid-19, protection of people's health in it (identity, communication, health, customer transaction information, identity of the parent child, health information), (Legal reason: Explicit consent, compliance with legal obligations, and data processing is mandatory for the establishment, exercise, or protection of a right.) Providing accommodation service, only within the framework of organizations held at the hotel without accommodation (ex: using certain parts and services of the hotel for events such as conferences and weddings), without organization (ex: using the restaurant, cafe, and pool facilities) within the scope of hotel facilities providing or making reservations for the services mentioned (identity, communication, finance, visual records, customer transaction information, vehicle information), (Legal reason: Personal data processing is required for the establishment, exercise, or protection of a right; data processing is mandatory for the establishment, exercise, or protection of a right.)

• Maintaining a record of visitor requests and complaints (identity, communication, customer transaction, customer survey, request and complaint information), (Legal reason: Data processing is mandatory for the fulfillment of our legal obligations, establishment, exercise or protection of a right, it has been made public by the person concerned)

• Carrying out legal dispute resolution processes (identity, communication, legal action, customer transaction, request and complaint information), (Legal reason: Data processing is mandatory for the establishment, exercise or protection of a right, compulsory for our legitimate interests)

• Providing the use of the hotel parking lot by the visitors (identity, communication, vehicle, physical space security, visual records information), (Legal reason: Data processing is mandatory for the fulfillment of our legal obligations, establishment, exercise or protection of a right, compulsory for our legitimate interests) Ensuring the safety of physical spaces (identity, communication, physical space security, visual records information, vehicle information), (Legal reason: Data processing is mandatory for the fulfillment of our legal obligations, the establishment, exercise or protection of a right)

• Providing information to authorized individuals, institutions, and organizations in order to fulfill legal obligations and administrative authority requests (identity, communication, physical space security, customer transaction, legal action, health information, vehicle information, request and complaint information), (Legal reason: Fulfillment of our legal obligations, express consent)

• Invoicing customers after sales, fulfilling tax and other legal obligations (identity, communication, customer transaction, legal transaction, finance, request and complaint information), all within the context of carrying out activities in accordance with the law, (Legal reason: Data processing is obligatory for the clearly stipulated in the laws, the performance of the contract, the establishment, exercise or protection of a right)

• Completing the suggestion book (identity, contact information, and customer transaction information) (Legal reason: fulfillment of our legal obligations, mandatory for our legitimate interests) • Protection of the rights of Kalsedon Cave Suites (identity, communication, customer transaction, physical space security (image information via security camera), finance, vehicle information), (Legal reason: Data processing is mandatory for the establishment, exercise or protection of a right, it is necessary for our legitimate interests.

• In addition, in order to complete payment transactions, your credit and debit card information is processed (within the framework of security measures). To Whom Your Personal Data can be Transferred and the Reasons for Transferring Personal Data, Kalsedon Cave Suites, your personal data, where permitted by law (and for the purposes set out in Article 4), in the country; to real and legal person business partners with whom cooperation and/or services are provided, to resolve legal disputes with persons who receive support in law, accounting, sales and marketing (including digital marketing), advertising, promotion, data processing, software and similar fields, and with other third parties to whom the transfer is required for specified purposes, in order to fulfill the obligations arising from the legislation, it can transfer and/or open access to the authorized institutions and organizations and, upon request, to the judicial authorities or the relevant law enforcement forces.

Article 11 of the Law on the Protection of Personal Data specifies the rights of the personal data owner. As the owner of personal data, you have the right to request the following rights from Kalsedon Cave Suites, the Data Controller, at any time, in accordance with Article 11 of the Personal Data Protection Law. The rights you have in this context are as follows:

•Learn if your personal data is processed or not;

•Ask for information if your personal data has been processed; •Learn the purpose of processing your personal data and if this information is used in accordance with the purpose;

•Learn the third parties to whom your personal data has been transferred in domestic or abroad;

•Ask for the correction if your personal data has been processed incompletely or erroneously; and to request the notification of the transaction made within this framework to the third parties to whom the personal data has been transferred;

•Request the deletion or destroy of your personal data within the framework of the conditions prescribed in the relevant article of the law; and to notify the third parties to whom the personal data has been transferred;

•Raise objections to the results arising against the person by analyzing your information processed through automatic systems;

•Claim the indemnification of your loss if you suffer from any losses due to the illegal processing of the personal data.

The above-mentioned requests will be submitted in writing to Kalsedon Cave Suites as the data controller, or by other means determined by the board. In this context, you can send your request for the above rights to our e-mail address, which may change from time to time, via your registered e-mail (KEP) address, with a secure electronic signature, mobile signature, or previously notified to Kalsedon Cave Suites. You can hand over the documents identifying your identity and a petition with a wet signature, or send it via a notary public, by using your e-mail address registered in the system (by attaching the documents identifying your identity) or to our mail address below, which may change from time to time.

In the application containing explanations regarding the rights you have as the personal data owner and you will make and request to use the above rights; the subject you request must be clear and understandable, the subject you request is related to yourself or if you are acting on behalf of someone else, you must be specifically authorized in this regard and this authority must be documented, and the application must include your identity and address information.

Depending on the type of the request, Kalsedon Cave Suites completes the requests included in the application free of charge, as soon as possible, and within thirty days at the most (if there is no cost). However, if the transaction necessitates an additional fee, the fee in the Personal Data Protection Board's tariff may be charged. If the application responses exceed 10 pages, a processing fee of 1.00 TL per page will be charged. If the answer is requested to be given in a recording medium such as a CD or flash memory, a fee will be charged based on the cost of the requested recording medium.

Data controller: Turmalin Hotel Management and Toursim Ind. Trade Inc.

Post address: Cumhuriyet Neighborhood. 50th year Street No: 3 Çat Town / Nevşehir

E-mail address: info@kalsedoncavesuites.com