This Clarification Text C.I.T.Y Turizm Tic. Singing. and Ltd. Şti. (hereinafter referred to as "Company" or "City Turizm").

1 . OBJECTIVE AND SCOPE

In the Law No. 6698 on the Protection of Personal Data (KVKK) published in the Official Gazette No. 29677 dated April 7, 2016, titled "Obligation of Data Officer to Disclosure "10. The Clarification Text, prepared in accordance with this KVKK, about the procedures and principles to be followed in fulfilling its obligations, has been prepared in order to explain the processing activities of personal data and special quality personal data processed by CITY Tourism as Data Controller within the scope of the laws.

2 DEFINITIONS

In line with the Personal Data Protection Law, the definitions listed below in this Clarification Text will be valid:

Data Subject: Real person whose personal data is processed,

Personal data of special nature: Data on the race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health information, sexual life, criminal conviction and security measures. biometric and genetic data

Data recording system: A recording system in which personal data are structured and processed according to certain criteria,

Data controller: Natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,

Data Processor: Real or legal person who processes personal data on behalf of the data controller based on the authority given by him.

Processing of personal data: Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, by means of non-automatic means, provided that personal data are fully or partially automated or part of any data recording system. such as being classified or prevented from being used; any action taken on the data

Explicit consent: Consent on a specific subject, based on information and expressed with free will.

Board: Personal Data Protection Board

Authority: Personal Data Protection Authority

KVKK: Personal Data Protection Law.

3 PROCESSED PERSONAL DATA

As City Turizm, our employees and employee candidates, family members and relatives of our employees and employee candidates, our customers, suppliers, supplier employees, consultants, business partners, company officials, company representatives, the person (s) we have contractual relations with, the person / persons who are the addresse of legal transactions. We process the following personal data of our visitors within the scope of collaborations and services provided;

Identity Information: name, surname, place of birth, date of birth, age, photo, identity card, identity number, passport data, work permit card, certificate of identity register copy, Contact Information: workplace address, home address, e-mail, telephone, mobile phone, residence, address registration system records;

Personal Information: Driver's license, criminal record, GBT, SGK information,

Professional Experience Information: OHS Training, SRC Certificate,

Bank Account data: Bank account number, IBAN number,

Vehicle data: Plate, license, road document, Compulsory Traffic and Seat Insurance information, vehicle inspection report, Public Transport Vehicle Usage Certificate

Health Data: Health Report, Psycho Technical Report, Disability information, blood group information, personal health information, (health conditions requiring special regulation)

Data regarding the security of our company campus: visitor records, entrance and exit records to the facilities, image records

4 PROCESSING OF PERSONAL DATA

City Turizm will process all kinds of personal data transmitted to the company by the data owner or with the explicit consent of the third party data owner, by complying with the provisions of local and international personal data protection legislation and secondary regulations, and by taking the necessary administrative and technical measures.

Within the scope of KVKK, "Data Processing Activities" for all kinds of personal data; It defines keeping, recording, keeping, enlightening, transferring, deleting, destroying, classifying, retrieving, providing access and other activities required by law.

CITY Tourism; processes the personal data it obtains in accordance with the following legal reasons within the scope of article 5 of the KVKK and other relevant legislation:

If the relevant data owner has explicit consent,

If clearly stipulated in the laws,

Within the scope of the contract made with the supplier, business partner or third party,

Within the scope of fulfilling the legal obligation,

In cases where it requires the legitimate interest of the data controller, limited to the purpose,

In the event that it is necessary for the protection of the life / body integrity of the person or someone else who cannot explain his consent with the actual impossibility or whose consent is not legally valid.

The purposes of processing personal data obtained by City Turizm are as follows in order to fulfill legal obligations as required or required by the relevant legislation:

Carrying out commercial activities of our company,

Execution of contract processes,

Within the scope of the school service services, making collections and creating student records accordingly,

Follow-up of service vehicles,

Carrying out training activities,

Carrying out activities in accordance with the legislation,

Execution of transactions regarding special transfer requests,

Carrying out cooperation with other companies,

Planning and execution of sales, marketing and after-sales processes of services,

Informing about the content of the services

Sharing the in-vehicle audio and video recordings of service users with the relevant institutions,

Follow-up and execution of legal affairs,

Monitoring and auditing of finance and / or accounting affairs

Answering customer demands,

Conducting communication activities,

Carrying out occupational health and safety processes,

Receiving and evaluating suggestions for improvement of business processes,

Planning and executing Human Resources and personnel recruitment processes, and monitoring and realizing education and training activities

Organization and event management,

Sharing the supplier information with the service providers in order to execute the contracts made within the scope of student and personnel shuttle transportation services,

All kinds of invoices, e-invoices, receipts, delivery notes etc. cutting of documents,

Conducting performance evaluation processes,

Execution of custody and archive activities,

Giving information to authorized persons, institutions and organizations,

Execution of information security management services

Creating and tracking visitor records,

Ensuring the physical security and supervision of company locations,

Conducting social responsibility and civil society activities,

Follow-up of customer management, demands, complaints and suggestions,

5 PROCESSING OF SPECIAL QUALITY PERSONAL DATA

Our company carries out the processing of personal data with a special nature that has the risk of creating discrimination when unlawfully processed, in accordance with the Data Protection Legislation and the Regulation on the Processing of Personal Health Data and Ensuring Privacy. The processing of special quality personal data without the express consent of the personal data owner is prohibited, except for the exceptional cases specified in the third paragraph of Article 6 of the KVK Law. However, provided that adequate measures are taken in accordance with the Data Protection Legislation, personal data of special nature may be processed without the express consent of the personal data owner in the following cases:

Processing of Personal Health Data

Personal health data; (i) To take adequate measures to be stipulated by the KVK Board, (ii) to act in accordance with the general principles (iii) by the authorized institutions and persons under the obligation of secrecy in the presence of one of the following conditions:

The express written consent of the personal data owner,

Protection of public health

Preventive medicine

Carrying out medical diagnosis, treatment and care services,

Planning and management of healthcare and financing

Processing of Personal Data of Special Nature Other than Health and Sexual Life The data within this scope are processed with the express consent of the personal data owner or in the cases stipulated by the laws.

Your personal data of special nature are collected, stored and processed based on the following legal compliance reasons.

Special quality personal data, if you have your explicit consent, and personal data other than Health can be shared without seeking explicit consent in cases stipulated by law.

Personal data related to health can only be shared by persons under confidentiality obligation or authorized institutions and organizations for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and their financing, without seeking the express consent of the relevant person.

6 TRANSFER OF PROCESSED PERSONAL DATA

Your personal data, within the scope of the provisions of the Law on the Protection of Personal Data No.6698 regarding the transfer of personal data and its transfer abroad, for the purposes of the 3rd article of this Clarification Text; to official institutions and organizations in Turkey, courts and enforcement offices, third party real and legal persons with whom we are related, service provider companies and officials, schools, business partners, banks, shareholders of our company, our group companies and affiliates, suppliers and support service providers, administrative and can be transferred by taking technological measures.

7 METHODS OF COLLECTING PERSONAL DATA AND LEGAL REASONS

Provided that your personal data is from you, third parties and legal authorities during the establishment of your legal relationship with City Turizm and during the continuation of the relationship in question; They are collected, stored and processed by internet, telephone, e-mail and physical, written, verbal and electronic channels, based on the reasons for compliance with the law stated in the provisions of Articles 5, 6 and 8 of the Law, within the scope of the above-mentioned purposes.

Having your explicit consent,

Especially Labor Law, Occupational Health and Safety Law, Social Insurance and General Health Insurance Law, Law of Obligations, Tax Procedure Law, Turkish Commercial Code, Identity Reporting Law, Income Tax Law, Corporate Tax Law, Check Law, Private Pension Savings and Investment System It is clearly stipulated in all legislation that our company is subject to, including the Law,

Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary to process data for the legitimate interests of the data controller.

To comply with the national and international principles and principles regarding the recognition of customers, to comply with the information storage, reporting and information obligations stipulated by the legislation and official authorities,

Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties of the contract, to be able to provide the requested products and services and to fulfill the requirements of the contracts you have concluded,

It is mandatory to fulfill the legal obligation,

It is made public by the person concerned,

Data processing is mandatory for the establishment, use or protection of a right,

CHANGES TO PERSONAL DATA PROTECTION AND PROCESSING POLICY, REVIEW

8.1.The Company may make changes in this Personal Data Protection Clarification Text from time to time to the extent required by the activities or legally. These changes become valid when the new modified Personal Data Protection Clarification Text is placed on the "www.cityturizm.com" site and the landing page of the software programs you use within the scope of the services we provide. In order for you to be aware of the changes in this Personal Data Protection Clarification Text, a notification will be sent to our valued stakeholders as a warning when you enter the site.

8.2 REVIEW

KVKK Illumination Text comes into force as soon as it is approved by C.I.T.Y Tourism Management. Except for the abolition of this Clarification Text, the General Manager has been authorized by C.I.T.Y Tourism Management regarding the changes to be made in the text and how they will be put into effect. With the approval of the General Manager of C.I.T.Y Turizm, changes can be made and put into effect in this text.

The rules of practice, which will be regulated in accordance with this text, will indicate how the issues specified in this text will be executed in specific subjects, will be arranged as procedures and instructions. The documents will be published and put into effect with the approval of the General Manager of C.I.T.Y Tourism.

This text is reviewed once a year in any case, and if there are necessary changes, it is updated by submitting to the approval of the General Manager of C.I.T.Y Tourism.

C.I.T.Y Tourism Clarification Text has been published by C.I.T.Y Turizm on its website and made available to the public. In case of conflict with the current legislation, especially the KVK Law, and the regulations included in this text, the provisions of the legislation are applied.

C.I.T.Y Turizm reserves the right to make changes in the C.I.T.Y Turizm KVK Lighting Text in line with the legal regulations. The updated version of the C.I.T.Y Turizm KVK Clarification Text can be accessed on the C.I.T.Y Turizm website (www.cityturizm.com).

STORAGE PERIOD OF DATA COLLECTED WITHIN THE SCOPE OF KVKK

Your personal data will be stored for the period required by our Company's practices and commercial life, or for the period required by the aforementioned processing purposes, and then deleted, destroyed or destroyed in accordance with Article 7 of the Law on the Protection of Personal Data. are also anonymized

10 SECURITY OF YOUR DATA COLLECTED AND PROCESSED BY OUR COMPANY

Information Security Management System technical and administrative measures encouraged by our management, Personal Data Protection Management System requirements as well as Personal Data Security Guideline requirements published by the Board of KVKK, are continuously operated in order to prevent your personal data from being exposed to unauthorized access, loss and damage in the environments where they are processed and stored, and develops within the scope of continuous improvement.

11 RIGHTS OF THE DATA OWNER

In accordance with article 11 of KVKK, the rights of the Data Owner are as follows:

Learning whether your Personal Data is processed and if it is transferred, where it is transferred, if it is transferred.

Learning the purpose of the processing of Personal Data and whether they are used appropriately for their purpose.

To request the correction of your Personal Data if it is incomplete or incorrectly processed,

In the event that the reasons requiring the processing of your Personal Data are eliminated, when you request the deletion or destruction of your data, correction of incomplete or inaccurate data and the deletion or destruction of your personal data, as stipulated by the KVKK and the relevant legal legislation and within the limits and legal periods, request to be notified to third parties,

To request the compensation of the damage in case of damage due to the processing of your Personal Data in violation of the Law

How Can You Exercise Your Rights?

Your applications and requests regarding your personal data;

With wet signature and photocopy of identity card C.I.T.Y TURİZM TİC. SINGING. LTD. ŞTİ. Kartaltepe Mah. Kosuyolu Cad. No: 48 Bakırköy / İSTANBUL,

With a valid identification document C.I.T.Y TURİZM TİC. SINGING. By applying to LTD ŞTİ personally,

By using a registered e-mail address and secure electronic signature or mobile signature, you can send it to our registered e-mail address [email protected] or [email protected].

In accordance with the Communiqué on the Principles and Procedures of Application to the Data Controller, the name, surname of the Relevant Person in the application, signature if the application is in writing, T.C. identification number (passport number if the applicant is a foreigner), place of residence or workplace address for notification, e-mail address for notification, if any, telephone number and fax number, and information on the subject of the request.

The Related Person must clearly and understandably state the subject requested in the application, which includes explanations about the right he will make and demand to use the rights mentioned above. Information and documents related to the application must be attached to the application.

Although the subject of the request should be related to the person of the applicant, if acting on behalf of someone else, the applicant must be specially authorized in this regard and this authority must be documented (special power of attorney). In addition, the application must contain identity and address information and documents confirming the identity must be attached to the application.

Requests made by unauthorized third parties on behalf of someone else will not be taken into consideration.

How Long Will Your Requests Regarding The Processing Of Your Personal Data Be Replied?

Your claims regarding your personal data are evaluated and answered within 30 days at the latest from the date they reach us. If your application is evaluated negatively, the reasons for the rejection are sent to the address you specified in the relevant application by one of the selected procedures, especially by e-mail or mail.

12 Open Consent

Within the scope of the services we provide, we know and accept that the personal data you have provided to us through our software programs, mobile applications and our website can be processed in accordance with the Law and this Law on the Protection of Personal Data No.6698 and for the specified purposes, and also this Law No.6698 on Protection of Personal Data You declare that the obligation to be made under the law has been fulfilled, that you have read and understood the Clarification Text and Service Agreement, and that you are aware of your rights and obligations.

Personal Data Owner Application Form