1
Aska Konaklama Hizmetleri ve Turizm Yatırımları Inc.
Explanatory Note on Personal Data Processing

A. PURPOSE OF PROTECTION AND PROCESSING OF PERSONAL DATA:


Aska Konaklama Hizmetleri ve Turizm Yatırımları Inc. (hereinafter referred to as the "Company") in accordance with the Law No. 6988 On Protection of Personal Data (hereinafter referred to as he “the Law on PPD”), presents the text of this  Explanatory Note prepared by the personal data operator under the Article 10 "Informational Obligations of the Personal Data Operator" and Article 11 "Rights of Concerned Persons" of the Law on PPD, containing information on  purposes of personal data processing, recipients and purposes of communicating processed data, methods and legal background for collection of personal data and other rights of the personal data owners listed in Article 11 of the Law on PPD.


The personal data operator processes, records, communicates, publishes and stores personal data by following methods within the framework of existing legislation. 


The Company reserves the right to change and update the wording of this Explanatory Note on Personal Data Processing in accordance with applicable law. 


B. COLLECTION, PROCESSING AND PURPOSES OF PERSONAL DATA PROCESSING:


In order to implement statutory activities and in accordance with the regulations of the Department of Tourism and State Revenue and other state authorities, as well as in accordance with signed agreements, the Company collects personal data in verbal, written and electronic form. Such personal data are used to provide services related to the Company´s field of activity, to improve the quality of these services, to implement sales, marketing and other activities by the Company, as well as fulfil obligations on storage, reporting and notification of information. In addition, personal data can be used as part of research to improve service quality, sales, and marketing by using such applications as CRM (Customer Relationship Management).


Personal data cannot be used without the explicit consent of its owner, except for the situations listed below and shall not be communicated to or shared with the third parties except for communication to official institutions/organizations in order to fulfil regulatory and legal obligations. 


The company may communicate personal data exclusively in the specified scope with the explicit consent of customers or in accordance with applicable law, namely in cases stipulated in Paragraph 2 of Article 5 of the Law on PPD in order to provide customers with additional services, special offers and improve the quality of services, fulfil obligations with domestic and foreign business partners arising from mutual agreements, domestic and foreign organizations, suppliers, authorized sales representatives/dealers/partners, as well as in the events stipulated by legislation, authorized state authorities and organizations provided that necessary measures have been taken. 
Personal data may vary depending on the services, products or commercial activity performed by the Company; Personal data can be collected verbally, in writing or electronically, automatically or manually by offices, branches, dealers, call centres through websites, social networking channels, mobile applications and similar tools. Personal data can be processed by creating and updating accounts during all period of use of the Company products and services.


In addition, personal data can be processed in order to use the Company services:


a. When using the Call Centre services or visiting the Company website,


b. When visiting the office, website or social networking channels of the Company, 


c. When participating in training sessions, seminars or events organized by the Company. Provided there is an explicit consent or circumstances stipulated by current legislation of Republic of Turkey, obtained personal data shall be processed for the following purposes: (i) Performing necessary research by the Company units in order to provide relevant products and services; (ii) Recommendation of products and services offered by the Company, adjusted to the preferences, habits and needs of customers; (iii) Ensuring legal and commercial security of the Company and its business partners (administrative operations performed by the Company for communication purposes, ensuring and monitoring the physical security of the Company´s location, evaluating a business partner/customer/supplier (authorized person or employees), legal compliance, financial operations, etc.); (iv) Improving the quality of the Company services and improving the Company policy on quality; (v) Notifying on and using the benefits of general and special campaigns, promotions, presentations, discounts and similar special offers provided by the Company; (vi) Processing personal data, preferences, operations and data obtained when logging into the Company system with a username and password through the channels provided by the Company in order to provide requested information and services; (vii) Notifying on any loyalty program cards issued and/or to be issued by the Company or its affiliated companies, membership on the website of the Company or its affiliated companies (renewal, expiration, etc.), any communications, new products and services, as well as any potential changes in the policy of the Company regarding personal data and membership conditions and other issues; (viii) Providing information on events and services requested by the Company customers; (ix) Defining and implementation of the Company commercial and business strategies; (x) Exercising the policy of the Company on employees; (xi) Fulfilling legal obligations defined by the legislation in the events directly specified by law when it is required as a result of the situation in the order and under the conditions stipulated in the Article 5 and 6 of the Law on PPD when the data may be communicated by the Company and/or affiliated companies to third parties, as specified in paragraph (C) of this Explanatory Note.

C. METHODS AND LEGAL BACKGROUND FOR COLLECTION OF PERSONAL DATA:


Personal data is collected verbally, in writing and electronically for the above mentioned purposes in order for the Company to provide products and services within the framework of regulatory and legal requirements, as well as full and precise compliance with the Company´s obligations emerging from the agreements signed by the Company and regulatory requirements. Personal data obtained with such a legal background within the framework of the conditions and objectives stipulated in the Articles 5 and 6 of the Law on PPD are processed, recorded, communicated, shared and stored for the purposes listed in the paragraph (B) of this Explanatory Note.


D. PROCESSING PERSONAL DATA OF SPECIFIC NATURE:


According to the Law on PPD, personal data of specific nature means data on race, ethnic origin, political views, philosophical, religious, confessional and other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health status, intimate life, criminal record and security measures, as well as biometric and genetic data. When processing personal data of specific nature, the Company shall take appropriate measures, specified by the Personal Data Protection Council. In order to improve the quality of provided services provided, the Company shall process personal data of specific nature exclusively within the targeted framework for collecting such data and with the explicit permission of its owner.


E. RECIPIENTS AND PURPOSE OF COMMUNICATION OF PROCESSED PERSONAL DATA:


Collected personal data may be communicated for the purpose of providing the services listed in paragraph (B) of this Explanatory Note to shareholders, business partners, suppliers of Aska Konaklama Hizmetleri ve Turizm Yatırımları Inc., legally authorized public authorities and individuals under the terms and conditions of personal data processing  listed in Articles 8 and 9 of the Law on PPD. 


F. COMMUNICATING PERSONAL DATA ABROAD:


The company is authorized to communicate personal data abroad in accordance with the rules established by the Personal Data Protection Council and other regulations for protection of personal data, subject to the explicit consent of the owner of personal data. 


G. RIGHTS OF A PERSONAL DATA OWNER ACCORDING TO ARTICLE 11
OF THE LAW ON PROTECTION OF PERSONAL DATA


The company recognizes the right of the owner of the personal data to familiarize with and accept the conditions for processing, recording, communicating, publishing and storing of the personal data prior to performing these operations, as well as determining the destiny of the data after processing, recording, communicating, sharing and storing it in the framework of the Law on PPD. Under these conditions, the owner of the personal data can exercise the right to submit an inquiry to the Company in the ways specified in this Explanatory Note on Personal Data Processing, and the Company shall process the inquiry free of charge no later than thirty days upon its reception, depending on the nature of the inquiry.


In accordance with the Regulations for the Procedure and Principles of the Inquiry Processing by the Personal Data Operator issued by the Personal Data Protection Council:
i. If the response to the inquiry does not exceed 10 pages, there shall be no charge for such a response. If the response contains more than 10 pages, a fee of 1 Turkish Lira shall be charged for each subsequent page of the response.
Ii. Should the response to the inquiry be provided on a data carrier, such as a compact disk or a flash card, the Company may charge a fee for the response that shall not exceed the cost of the data carrier.


In this context, personal data owners are entitled to:
a. Obtain information on the status of personal data processing,
b. Inquire information in the event that personal data has already been processed,
c. Obtain information on purposes of processing and proper use of personal data,
d. Obtain information on communicating personal data to the third parties in the country or abroad,
e. In the event of incomplete or incorrect processing of personal data, require  adjustments and notifying the third parties-recipients of the processed personal data, as well as in accordance with the Article 7 of the Law on PPD, require deletion, erasure or anonymization of data and notifying the third parties-recipients of such data on this.
g. In the event of unfavourable to the personal data owner results that emerge from analysing the data using automated systems that have negative impact on the owner, object such results,
h. Require reimbursement of damage in the event such a damage results from an unlawful personal data processing. At the same time, personal data owners are not entitled to require changing the data that has already been anonymized by the Company. The company is entitled to share personal data with relevant institutions and organizations in order to fulfil regulatory requirements of judicial or state authorities, as well as the requirements emerging from business and contractual relations.


H. PERIOD OF PERSONAL DATA PROCESSING:


In accordance with the Law on PPD, the personal data processed for the purposes specified in this document, upon achievement of the purpose of processing of the personal data and/or after expiration of the storage period of data in accordance with the Paragraph 1 of the Article 7 of the Law on PPD, the personal data shall be deleted, erased or used in an anonymized form.

İ. CONDITIONS FOR PROCESSING OF PERSONAL DATA BY THE COMPANY WITHOUT EXPLICIT CONSENT FROM THE PERSONAL DATA OWNER:


In accordance with article 5 of the Law on PPD, the Company may process personal data without obtaining explicit consent in accordance with the law in the following cases:    


When it is directly provided by law:
i. The need to protect the life or physical integrity of a person who is not physically able to express his or her explicit consent or is unaware of his or her legal propriety or other persons,
ii. The need to process personal data of parties of a contract, provided that this is directly related to the preparation or execution of contracts signed by the Company and affiliated companies/organizations with legal entities and/or individuals specified in paragraph (C) of this Explanatory Note,
iii. The need to fulfil legal obligations of the Company,
iv. Disclosure of personal data to the public by the owner himself,
v. In the events when data processing is mandatory for establishing, exercising or protecting rights,
vi. The need for data processing to ensure the legitimate interests of the Company, provided that such processing shall not prejudice the fundamental rights and freedoms of the person concerned.


İ. SUBMITTING THE INQUIRY ABOUT PERSONAL DATA PROCESSING IN THE FRAMEWORK OF THE LAW ON PROTECTION OF PERSONAL DATA:


To exercise the rights specified in the Paragraph 1 of the Article 13 of the Law on PPD, an inquiry about data processing may be submitted to the Company in ways determined/to be determined by the Personal Data Protection Council. In addition, at the owner’s discretion, the inquiry may be submitted to the Company in writing in accordance with the Law on PPD. According to the Article 11 of the Law on PPD, the above rights can be exercised by sending an e-mail to:  kvkk@askahotels.com. Messages regarding personal data shall be reviewed only if sent to kvkk@askahotels.com email address. Messages sent to other email addresses shall not be reviewed.


Only the owner of the personal data may exercise of the rights regarding the processing of personal data. Requests sent by any other person, except for the form submitter, whose identification documents are provided in the annex to the inquiry form, shall not be reviewed. Inquiries that do not contain identification documents of the submitter shall not be reviewed. Please be advised that the Company is obliged to provide data to government authorities upon their request, even in the event when the inquiry to delete personal data has already been completed.