PDPL LIGHTING TEXT

PDPLLIGHTING TEXT Clarification Text on the Processing of Personal Data of Tryp By Wyndham Istanbul Şişli Hotel within the Framework of the Law on Protection of Personal Data No. 6698

Purpose and Scope of the Clarification Text

This Statement, in accordance with the importance that Magna Turizm Otelcilik A. and its officials and third parties (shortly “data subject”), within the scope of the Personal Data Protection Law (“PDPL”), to reveal our company's approach to the protection and processing of personal data and to inform the data subject in this direction. The data included within the scope of the Clarification Text on the Processing of Personal Data (“Text”) relates to all personal data of the data subject that is processed automatically or non-automatically, provided that it is a part of any data recording system. This text issued by our company is dated 01.03.2022. In case the whole or certain articles of the text are renewed, the effective date and version of the text will be updated. The text is published on the website of our Company and made available to the relevant persons upon the request of the personal data subject.

Principles Regarding Personal Data

• Processing of Personal Data

Our company, in accordance with Article 20 of the Constitution and Article 4 of the PDPL, • Compliant with the law and honesty rules, • Accurately and up-to-date when necessary, • Pursuing specific, clear and legitimate purposes, • Related to the purpose, • In a limited and measured way, • By keeping it for as long as required by the laws or for the purpose of processing personal data, • It is processed based on one or more of the conditions specified in Article 5 of the PDPL. Our company, in accordance with Article 20 of the Constitution and Article 10 of the PDPL, during the acquisition of the said personal data; • For what purpose personal data will be processed, • To whom and for what purpose the processed personal data can be transferred, • Method and legal reason for personal data collection, and • Rights of the personal data subject It fulfills its obligation to inform by informing about the issue.

Legal Reasons for Processing Personal Data

Personal data are processed by our company for the purposes stated in Article 5 of the PDPL and below;
• It is clearly stipulated in the Laws for our Company to carry out relevant activities regarding the processing of personal data,
• The processing of personal data by our Company is directly related to and necessary for the establishment or performance of a contract,
• The processing of personal data is mandatory for our Company to fulfill its legal obligations,
• Provided that personal data is made public; Processing by our Company in a limited way for the purpose of publicizing,
• The processing of personal data by our Company is mandatory for the establishment, exercise or protection of the rights of our Company or the data subject or third parties,
• It is mandatory to process personal data for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject,
• If the data processing activity is necessary for the protection of the life or physical integrity of the personal data subject or someone else, and in this case, the personal data subject is unable to express his or her consent due to actual impossibility or legal invalidity.

In Article 6 of the PDPL, a set of personal data that carries the risk of causing victimization or discrimination when processed unlawfully is determined as "special quality". These data are; Data related to race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data. By our company; Special categories of personal data are processed in the following cases, provided that adequate measures to be determined by the Personal Data Protection Board (Board) are taken: • Special categories of personal data other than the health and sexual life of the personal data subject, in cases stipulated by the laws,
• Private personal data related to the health and sexual life of the personal data subject is only for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, or persons or authorized institutions under the obligation of confidentiality. by organizations, It is being processed. In the absence of the above-mentioned data processing conditions, express consent is obtained from the data subject for data processing by our Company.

Transfer of Personal Data

Our company will be able to transfer the personal data specified in the same section for the purposes specified in section 2.b of this text, for the purposes stated below;
• Legally Authorized public institutions and organizations, limited to the purpose requested by the relevant public institutions and organizations within their legal authority
• Personal data will be transferred to legally authorized private legal persons, limited to the purpose requested by the relevant private legal persons within their legal authority.
• Again, your personal data may be transferred abroad within the framework of the execution of our Company's commercial activities and operational activities, within the conditions specified in Article 9 of the Law.

Purpose of Personal Data Collection

Your personal data in accordance with the above-mentioned purposes; It is collected in order to provide and develop the products and services we offer and to carry out our commercial activities. Your personal data collected in this process; It is collected for legal reasons to carry out our commercial activities, through our employees and representatives or through public databases within the scope of the relevant legislation, through business cards collected, through e-mails sent to our company's e-mail address with the "info" extension. Your personal data collected for this legal reason can also be processed and transferred for the purposes specified in articles (b) and (c) of this Clarification Text within the scope of personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.
Personal data is processed by our Company within the scope of the above-mentioned conditions, in accordance with the provision of services by our Company and in accordance with the local legislation, for the purposes stated below.
• In line with the aim of ensuring the execution of our company's human resources policies;
Carrying out HR operations in accordance with the HR policies of the company, supplying suitable personnel for open positions in accordance with the HR policies of the Company, fulfilling the obligations within the framework of occupational health and safety and taking the necessary measures
• In line with the fulfillment of legal and commercial obligations with our company and persons who have business relations with our company; Administrative operations for communication, operations for service carried out by our company, ensuring the physical security and supervision of the company's locations, business partner/customer/supplier/business partner (authorized or employees or partners) evaluation processes, legal and commercial risk analysis, legal compliance process, execution of financial affairs
• In line with the aim of carrying out the necessary studies to customize the products and services offered by our company according to the tastes, usage habits and needs of our customers, and to recommend them to our customers; One-to-one and/or integrated marketing activities, sales and after-sales operations carried out by our company,
• In line with the purpose of determining and implementing our company's commercial and business strategies; Financial operations, communication, market research and social responsibility activities carried out by our company, purchasing operations (demand, offer, evaluation, order, budgeting, contract), determination and implementation of our company's commercial and business strategies, In-house system and application management operations can be listed as the management of legal operations.
Personal data processed by our company within the scope of this Text are specified in KSV1_LIST and the data subject whose data is processed is classified categorically and specified in KSV2_LIST.

Storage and Deletion of Data

Our company stores the personal data it processes for the periods determined by the legislation, and in the absence of a separate period specified in the legislation; Personal data are stored for the period that requires processing in accordance with the practices of our Company and the practices of commercial life, depending on the services our company provides while processing that data, and after this period, only for the periods of time required in practice in order to constitute evidence in possible legal disputes. After the expiry of the specified periods, the personal data in question is deleted, destroyed or anonymized.

Rights of the Relevant Person

Article 20 of the Constitution stipulates that everyone has the right to be informed about the personal data related to him/her, and Article 11 of the PDPL includes the right to "request information" among the rights of the personal data subject. In this context, our company provides the necessary information in case the personal data subject requests information; With this Statement, our Company informs the relevant person about how the right to request information will be exercised and how the issues related to the information request will be evaluated.

The personal data subject has the following rights:
• Learning whether personal data is processed,
• Requesting information on personal data if it has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with the purpose,
• Knowing the third parties to whom personal data is transferred in the country or abroad,
• Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to third parties to whom personal data has been transferred,
• Requesting the deletion or destruction of personal data in the event that the reasons requiring it to be processed disappear, although it has been processed in accordance with the provisions of the PDPL and other relevant laws, and requesting that the transaction carried out within this scope be notified to the third parties to whom the personal data has been transferred,
• Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• Requesting the compensation of the damage in case of loss due to unlawful processing of personal data.
Pursuant to Article 28 of PDPL, the following cases are excluded from the scope of PDPL; The personal data subject cannot claim the above-mentioned rights in these matters:

• Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics.
• Processing of personal data for art, history, literature or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime. > • Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.
• Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.

Pursuant to Article 28/2 of the PDPL, the personal data subject cannot claim the above-mentioned rights in these matters, except for the right to demand the compensation of the damage, in the following cases:
• The processing of personal data is necessary for the prevention of crime or for criminal investigation.
• Processing of personal data made public by the personal data subject.
• The processing of personal data is necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by the authorized and authorized public institutions and organizations and professional organizations in the nature of public institution, based on the authority given by the law.
• Economic and financial issues of the State regarding the budget, tax and financial issues of personal data processing.

It is necessary for the protection of their interests.

The personal data subject can request the above-mentioned rights by filling out the form at https://www.trypsisli.com/assets/pdf/illan_kisi_basvuru_formu_web.pdf completely and signing with wet signature TRYP BY WYNDHAM İSTANBUL SISLI HOTEL 19 MAYIS MAH.BALÇIK TARLASI SOK NO:4/1 34360 ŞİŞLİ İSTANBUL in person, through a notary public or by sending a registered letter with return receipt. In order for a person other than the personal data subject to make a request, there must be a special power of attorney issued by the personal data subject on behalf of the person making the application. The duly submitted requests to our company will be finalized within thirty days at the latest. In the event that the finalization of the aforementioned requests requires an additional cost, the fee in the tariff determined by the Board will be collected from the applicant by our Company.

Our company may request information from the relevant person in order to determine whether the applicant is a personal data subject, and may ask questions about the application to the personal data subject in order to clarify the issues stated in the application. Our company may reject the application of the applicant in the following cases by explaining the reason:
• Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics.
• Processing of personal data for art, history, literature or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime. > • Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security.
• Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.
• The processing of personal data is necessary for the prevention of crime or for criminal investigation.
• Processing of personal data made public by the personal data subject.
• The processing of personal data is necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by the authorized and authorized public institutions and organizations and professional organizations in the nature of public institution, based on the authority given by the law.
• The processing of personal data is necessary for the protection of the economic and financial interests of the State with regard to budgetary, tax and financial matters.
• The possibility of the personal data subject's request to prevent the rights and freedoms of other people
• Requests that require disproportionate effort
• The requested information is publicly available.
In case the application is rejected in accordance with Article 14 of the PDPL, the answer given is insufficient or the application is not answered in due time; Complaints can be made to the Board within thirty days from the date our company learns of the answer, and in any case within sixty days from the date of application.

Security precautions

In accordance with Article 12 of the PDPL, our company takes the necessary precautions and controls to ensure the appropriate level of security in order to prevent the unlawful processing of the personal data it processes, to prevent the illegal access to the data and to ensure the preservation of the data, and in this context, it carries out or has the necessary inspections made. The measures and controls taken by our Company in this direction are given below.
• Employing personnel who are knowledgeable about establishing and operating systems that comply with the principles and relevant legislation regarding the processing of personal data,
• Providing trainings to ensure that personnel are informed about personal data, including provisions regarding compliance with personal data protection legislation and Company practice rules in personnel contracts
• The use of backup programs in accordance with the legislation that ensure the safe storage of personal data,
• In case of outsourcing of a service covering personal data processing processes, inclusion of provisions in the contracts made with outsourcing companies regarding that necessary security measures will be taken for the protection of personal data and that these measures will be complied with in their own organizations,
• Evaluating the personal data processing processes involved in all activities carried out by our company within the scope of the data processing conditions regulated by the PDPL, taking the necessary technical and organizational measures to maintain the said processes in accordance with the provisions of the PDPL,
• Determination of the rules of practice regarding the management of personal data processing processes and compliance structure, including measures and controls, and implementation of these rules
• Maintaining and auditing personal data processing processes and systems related to these processes with management systems with technical and organizational features,

Audit
In accordance with Article 12 of the KVK Law, our company carries out or has had it done, within its own body. The results of these audits are reported to the relevant department within the scope of the internal operation of the Company and necessary activities are carried out to improve the measures taken.
Necessary systems are established to raise awareness of the current employees of the company's business units and the newly recruited employees about the protection of personal data, and necessary trainings are provided to the employees.

Data breaches management
Our company operates the system that ensures that the personal data processed in accordance with Article 12 of the PDPL are obtained by others unlawfully, and this situation is reported to the relevant personal data subject and the Board as soon as possible. If deemed necessary by the Board, this situation may be announced on the website of the Board or by another method.
Title : Magna Turizm Otelcilik A.Ş.
Mersis No:6110115035200001……………………………………………………..
Phone Number: (0212)2330700…………………………………………………
Fax Number:(0212)233077…………………………………………………...
Postal Address : 19 Mayıs Mahallesi Balçık Tarlası Sokak No:4/1 Şişli / İstanbul
E-mail address: www.trypsisli.com

KSV1_LIST Personal Data Categories
Credential
All information contained in documents such as Driver's License, Identity Card, Residence, Passport, Attorney's ID, Marriage Certificate
Contact Information
Information such as phone number, address, e-mail, business cards
Customer Information
Information obtained and produced about the customer's official or employee, as a result of our commercial activities and the operations carried out by our business units within this framework
Customer Transaction Information
Information such as records for the use of our products and services and the customer's instructions and requests for the use of products and services
Physical Space Security Information
Personal data regarding the records and documents, including the camera recordings taken at the entrance to the physical space, during the stay in the physical space
Transaction Security Information
Your personal data processed for the purposes of ensuring the fulfillment of technical, administrative, legal and commercial obligations while carrying out our commercial activities
Financial Information
Personal data of the customer's official or employee regarding the information, documents and records of the customer showing all kinds of financial results
Candidate Information
Personal data processed about individuals who have applied to be an employee of our company or who have been evaluated as an employee candidate in line with the human resources needs of our company in accordance with commercial practices and honesty rules, or who have a working relationship with our Company
Legal Process and Compliance Information
Personal data processed within the scope of determination, follow-up and performance of our legal receivables and rights and compliance with our legal obligations and our company's policies
Special Quality Personal Data
Regarding the race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, disguise and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures specified in Article 6 of Law No. 6698 data and biometric and genetic data
Marketing Information
The personal data of the customer's employee or officer processed for the purpose of customizing and marketing our products and services in line with the customer's usage habits, tastes and needs, and the reports and evaluations created as a result of these processing results

KSV2_LIST Data Subject Categories
Customer Employee/ Official
Employees and officials of our customers who use or have used the products and services offered by our company
Lead Employee
Employees and officials of legal entities that have requested or been interested in using our products and services or have been evaluated in accordance with the rules of commercial practice and honesty that may have this interest
Supplier/ Manufacturers
Real persons who supply products and services to our company, Real persons who produce using the products of our company or other companies
Visitor
Real persons who have entered the physical campuses owned by our company for various purposes or visited our websites
Third Party
Real persons (e.g. guarantor, companion, family members and relatives) who are related to these persons in order to ensure the security of commercial transactions between our company and the above-mentioned parties or to protect the rights of the aforementioned persons and to obtain benefits
Employee Candidate
Real persons who have applied for a job in our company or have opened their CV and related information to our company for review
Company Shareholder
The shareholders of our company are real persons
Company Official
Member of our company's board of directors and other authorized real persons
Employees, Shareholders and Officials of the Institutions We Collaborate
Natural persons, including shareholders and officials of these institutions, working in institutions (such as but not limited to business partners, suppliers) with which our company has any business relationship