Personal Data Protection Law Clarification Text

1. DATA CONTROLLER

Data Controller: SUR TATIL EVLERI GAYRİMENKUL YATIRIM ORTAKLIGI A.S.
MERSİS No: 0784067715500001
Website for Detailed Information: www.surtatilgyo.com.tr
Telephone: 0216 556 08 00
Postal Address: Burhaniye Mah. Abdullahaga Cd. No: 21, Uskudar/Istanbul
Data Subject Application KEP Address: [email protected]

2. PURPOSE AND SCOPE OF THE CLARIFICATION TEXT

a. With this Clarification Text on Processing Personal Data, it is aimed to provide the necessary information regarding the personal data processed in accordance with the Personal Data Protection Law No. 6698 (“PDPL”) of customers and website visitors who benefit from the products and services offered by the real estate investment partnership managed by our company and to fulfill the disclosure obligation introduced by Article 10 of the PDPL.

b. Pursuant to Article 3 of the PDPL, personal data refers to any information that identifies a real person or makes him/her identifiable (name, surname, Turkish ID number, camera recording, address, IP, log, e-mail, etc.).

c. Your personal data is processed by our Company as the Data Controller in accordance with the general principles specified in Article 4 and based on one or more of the personal data processing conditions specified in Article 5 of the PDPL.

d. Pursuant to Article 5 of the PDPL, some of your data may be processed without your explicit consent, subject to certain legal exceptions, while other data may only be processed based on your “informed consent, freely given for a specific purpose.” You may withdraw your explicit consent to the processing of your data at any time by submitting a request to our Company using the “Data Subject Request Form” in accordance with the explanations provided in Article 11 of the PDPL and in section 6 of this notice titled “Your Rights.” If you withdraw your explicit consent and the relevant data is not processed for other purposes, it will be destroyed. Otherwise, it will continue to be processed without your explicit consent for the purposes and legal reasons specified.

e. This clarification text provides information regarding the data processing procedures specified below.
I. Data processing procedures relating to website visitors
II. Commercial electronic message
III. Data processing procedures related to visits to sales offices, project sites, etc.

3. PERSONAL DATA THAT MAY BE PROCESSED, PURPOSES OF PROCESSING DATA, AND LEGAL JUSTIFICATIONS

The personal data processed by our Data Controller company and the purposes and legal justifications (explicit consent/exceptional legal compliance conditions) for processing such data are listed below.

I. WEBSITE VISIT

If you visit our website, your personal data listed below is processed for the purposes and legal reasons specified below.

I.I. DUE TO VISITING THE WEBSITE

Personal Data that Can be Processed: Transaction security (Traffic Information—source IP address, destination IP address, connection date and time information, etc.)
Purposes of Processing: As per law no. 5651
Legal justifications for processing: Explicitly stipulated in law

I.II. WHEN YOU VISIT OUR WEBSITE, WITH COOKIES

Personal Data that Can be Processed: Information of the Device used for access, visitor behavior on the website, traffic information
Purposes of Processing: Analyzing the performance of our website, improving its functionality, ensuring ease of use, and conducting statistical studies on usage
Legal justifications for processing:

• Based on the legal grounds that the data processor has a legitimate interest, provided that it does not harm the fundamental rights and freedoms of the data subject,
• With the existence of explicit consent, for the purposes of profiling, targeting, and personalized advertising activities, as well as marketing and analysis activities,
• Due to the legal reason for the necessity of data processing for the performance of the contract with Cookies required for the use of the website

I.III. IF YOU CONTACT US THROUGH THE CONTACT FORM IN THE WEBSITE

Personal Data that Can be Processed: Transaction security (Traffic Information - source IP address, destination IP address, connection date and time information, etc.), name, surname, e-mail, mobile phone, message to be transmitted
Purposes of Processing: To respond appropriately to complaints, suggestions and questions sent to our Company by visitors and to communicate with the people who sent us their messages.
Legal justifications for processing: Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

II. COMMERCIAL ELECTRONIC TRANSMISSION PROCESS

When you give your consent to receive commercial electronic communications via our website, your personal data listed below will be processed for the purposes and legal reasons specified below.

II.I. OBTAINING CONSENT FOR COMMERCIAL ELECTRONIC COMMUNICATIONS

Personal Data that Can be Processed: Identity (Name and Surname), Contact (E-mail), Other (Consent Statement, Consent Date)
Purposes of Processing: Informing customers, facility and sales office visitors and website visitors about upcoming events, campaigns and innovations at Sur Holiday Houses Antalya, sending e-mails and short messages containing marketing, advertising, campaigns, promotions, publicity, competitions, sweepstakes, wishes and congratulations, or leaving voice calls regarding these matters, conducting surveys on customer satisfaction and service processes, providing commercial communication with customers, Sur Holiday Houses Antalya visitors and website visitors, carrying out advertising activities, carrying out customer loyalty and satisfaction processes
Legal justifications for processing: Explicit consent

II.II. ENSURING THE LEGAL OBLIGATION OF COMMERCIAL ELECTRONIC MESSAGE CONSENT

Personal Data that Can be Processed: Providing information to authorized persons, institutions and organizations regarding your personal data such as Transaction Security (Log Records), Other (Your Consent Statement, Your Consent Date)
Purposes of Processing: To be able to carry out storage and archive activities and to carry out our activities in accordance with the legislation.
Legal justifications for processing: Clearly stipulated in the laws

III. IF YOU VISIT SUR HOLIDAY HOMES ANTALYA

If you visit Sur Holiday Houses Antalya, your personal data listed below is processed for the purposes and legal reasons specified below.

III.I. FOR ENSURING PHYSICAL SECURITY OF THE PREMISES

Personal Data that Can be Processed: Camera Recording (taken for security purposes only)
Purposes of Processing: Creating and monitoring visitor records, ensuring physical space security, ensuring the security of data controller operations, informing authorized persons, institutions and organizations,
Legal justifications for processing:

• Such processing is mandatory for the data controller to fulfill its legal obligation,
• Data processing is compulsory for the legitimate interests of the data supervisor, provided that the fundamental rights and freedoms of the related individual are not impaired.

III.II. IF YOU USE OUR WI-FI SERVICE

Personal Data that Can be Processed: Identity (Name-surname), device IP number and internet visit information
Purposes of Processing: Since our company is an access provider, we use it to ensure transaction security, fulfill the legal obligations of the data controller, and create visitor records
Legal justifications for processing:

• It is clearly foreseen in the laws as per the Law No. 5651 on Regulation of Publications Made on the Internet and Combating Crimes Committed Through These Publications.
• Data processing is compulsory for the legitimate interests of the data supervisor, provided that the fundamental rights and freedoms of the related individual are not impaired.

VI. DATA SUBJECT APPLICATION PROCESS

When you submit a request regarding the processing of your personal data as the Data Subject and/or the personal data of persons represented by you, the personal data you provide in the request form below may be processed for the purposes and legal reasons specified below.

Personal Data that Can be Processed: Identity (Relevant Person Name - Surname, Republic of Türkiye Identity Number, Attorney Name - Surname, Republic of Türkiye Identity Number), Power of Attorney information, Contact (phone number, e-mail address)
Purposes of Processing: To evaluate whether the applications made by the relevant person are acceptable, to provide the necessary response and to ensure communication if the application is notified in a manner and manner suitable for evaluation.
Legal justifications for processing:

• Such processing is mandatory for the data controller to fulfill its legal obligation,
• Clearly provided for in the Laws

4. PERSONAL DATA COLLECTION METHOD

Your personal data may be collected via oral, written or electronic media, if you visit our website or Sur Holiday Houses Antalya, in the course of carrying out our advertising/marketing activities (holding a sweepstakes, sending commercial electronic messages, sharing photo-video recordings), if commercial electronic message approval is given; if you visit Sur Holiday Houses Antalya automatically/partially automatically or non-automatically, provided that it is part of any data recording system, from all information and documents provided by you or obtained through public/private institutions and organizations and other third parties, depending on the nature of the service or activity and the channel through which you communicate with us, including social media channels, with the cameras located within the facility.

5. TRANSFER OF PERSONAL DATA

a. Your personal data may be transferred to public institutions and organizations upon request, institutes and other third parties from which we receive services and cooperate to carry out our activities such as Our data controller company departments, shareholders, group companies, lawyers, IT Support company as well as that are responsible for taking data security measures, such as protecting all your personal data, preventing unauthorized access and unlawful processing, together with us, in compliance with Article 8 of the PDPL and other legislation and limited to the achievement of the above-mentioned purposes and the fulfillment of these purposes.

b. In cases where our company is obligated to do so, it may be shared with legally authorized public institutions and private individuals (e.g., İYS A.S.).

c. If you have explicit consent, your name, surname, photograph, video and personal data stated/shared in these records may be recorded in activities and organizations of our Company and may be shared with the public via website, company catalogues, social media and other channels for advertisement-marketing, also with companies providing service to us (agency, (it/information processing support company) in order to realize this activity.

e. If you give your explicit consent, your name, surname, telephone number, and e-mail address may be processed for the purpose of sending you commercial electronic messages for advertising and marketing purposes, and may be shared with our suppliers (agencies, IT/information processing support companies) and İYS AS in order to carry out this activity.

f. If you have explicit consent, your personal information such as name, surname, telephone number, e-mail, raffle information may be processed by our organization for you to enter our raffles in order to ensure advertisement-marketing and customer satisfaction, if the raffle is made open to public or if the results are announced to the public, it can be shared with the public through the website, company catalogues, social media and other channels, and with our suppliers in order to carry out this activity (agency, it/information support company, notary).

g. Your personal data is not transferred abroad.

6. YOUR RIGHTS

a. Within the scope of Article 11 of the KVKK, which regulates the rights of the data subject, you have the right to learn whether your personal data is being processed; request information about your data if it has been processed; learn the purpose of processing your data and whether it is used in accordance with its purpose; know the third parties to whom your data is transferred, whether at home or abroad; request correction of your data if it is processed incompletely or incorrectly; request deletion or destruction of your data if the reasons requiring processing are eliminated, despite processing in accordance with the PDPL and other relevant legal provisions; if your data has been transferred, to request that the correction, deletion or destruction be notified to third parties to whom the data has been transferred; object if a result against you is revealed by analysis of the data exclusively through automated systems; request compensation for damages if you suffer damage due to the unlawful processing of your data.

b. You can send your requests as Data Subject (Data Owner) by filling "Relevant Person Application Form" to our mailing address via a notary or with letter with return receipt or to our KEP address or our e-mail address assigned for PDPL contact using electronic mail address of our company (KEP), secure electronic signature, mobile signature or your email address notified and recorded with us according to the Communiqué on the Procedures and Principles for Application to the Data Controller.

Although no fees are charged for requests, the Company reserves the right to charge fees in accordance with the fee schedule determined by the Personal Data Protection Board and in compliance with legal regulations.

In the application you have as Data Subject and including the explanations provided to use your rights specified above or the right you requested to use; the matter you requested must be clear and understandable, the subject must be related to you or if you act on behalf of another person, you have to provide your special power of attorney certified by a notary. Your applications must include your first and last name, signature, Turkish ID number, postal address, telephone number, and the subject of your request. Applications that do not contain the aforementioned elements will not be accepted by our Company.

Our company reserves the right to make changes to this clarification text at any time for reasons arising from the PDPL, secondary regulations, and decisions of the Personal Data Protection Board. Any changes made to the clarification text and the updated text shall take effect immediately as of the date of notification to you.

In accordance with the Personal Data Protection Law No. 6698 (“PDPL”), your personal data, for which you will give your explicit consent below, may be processed and shared by us, the data controller, for the limited purpose of processing.

You may withdraw your consent at any time by using the channel you have selected in accordance with the information provided above, as notified to you in our disclosure notice. We kindly ask you to state your acceptance or rejection preference regarding processing personal data by clicking on the box if you fill this form in the website or through the link provided to you or by filling the box, signing or putting another sign if you fill this form physically.

Personal Data Subject to Explicit Consent

Receiving commercial electronic messages containing campaigns, promotions and advertisements from my contact information, processing my personal data for this purpose, and sharing it with third parties from whom you receive service.

To hold a raffle with me by sending my contact information or through other channels, to process my personal data for this purpose and to share it with your suppliers.

Processing my personal data for advertising/marketing purposes during events and organizations organized or attended by your business, shared with the public via the website, social media channels and other media, and shared with your suppliers for the realization of this activity.