1.1. Introduction

Since the protection of personal data is a fundamental human right, it is among the most important priorities of "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." Company ("Company"). The company makes maximum efforts to comply with all applicable legislation in this regard in order to secure the right to the protection of personal data. Within the framework of this "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." Policy for the Protection and Processing of Personal Data ("Policy"), the principles adopted in the conduct of personal data processing activities carried out by our Company and the basic principles adopted in terms of compliance of our Company's data processing activities with the regulations in the Law No. 6698 on the Protection of Personal Data ("Law") are explained, and thus, our Company provides the necessary transparency by informing the data subjects. Your personal data is processed and protected within the scope of this Policy with full awareness of our responsibility in this context.

1.2. Scope

"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." ("COMPANY") Policy for the Processing and Protection of Personal Data ("Policy") has been prepared with the aim of disciplining the processing of personal data within the framework of the legislation on personal data and protecting the fundamental rights and freedoms, especially the privacy of private life, as stipulated in the Constitution.

While preparing the "Policy", it has been determined as the basic principle to determine which data is collected by the business units and why, and why they need to transfer these data to third parties within the organizational chart of the "COMPANY" and to understand the personal data processing method of the COMPANY. While transferring the requirements of the relevant legislation to the "Policy", it is adopted as a principle to explain in a simple and understandable manner what data the "COMPANY" provides and why, and why it processes these data by being privatized, within the framework of the requirement of protecting personal data. In addition, it is aimed to take the necessary administrative and technical precautions to protect data privacy within and outside the organization of the "COMPANY" and to inform and enlighten the individuals whose data are processed.

1.3. Implementation of the Policy and PDPL Legislation

Regarding the processing and protection of personal data, the relevant legal regulations in force shall be applied first. In case of inconsistency between the current legislation and the Policy, our Company accepts that the applicable legislation shall prevail. The Policy regulates the rules laid down by the relevant legislation by concretizing them within the scope of Company practices.

1.4. Enforcement of the Policy

The effective date of this Policy is 04.01.2023. This Policy is published on the website of "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." [https://www.bestillhotel.com/]

2.1. Ensuring the Security of Personal Data

Our company takes the necessary measures depending on the nature of the data to be protected in order to prevent the illegal disclosure, access and transfer of personal data or security deficiencies that may occur in other ways, in accordance with Article 12 of the Law. In this context, our Company takes administrative measures, conducts inspections or have them done in accordance with the guidelines published by the Personal Data Protection Board ("Board") to ensure the required security level.

2.2. Protection of Private Personal Data

Particular attention has been given to the use of some personal data by the Law due to the risk of victimization or discrimination of persons when they are processed illegally. These data are data with respect to race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.

"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." acts sensitively for the protection of private personal data determined by the Law as "private" and processed in accordance with the law. Within this context, the technical and administrative measures taken by "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." for the protection of personal data are carefully applied with respect to the private personal data and necessary controls are provided within "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S.".

2.3. Raising Awareness and Supervision of Business Units

BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S.” organizes regular trainings in order to raise awareness to prevent unlawful processing of personal data, illegal access to personal data and to protect personal data. Necessary systems are established to create awareness of the employees of BESTILL TURIZM OTELCILIK SAN.VE TIC.A.S.” on the protection of personal data,and it is worked with consultants in case of need.In this regard, our Company participates in the relevant trainings, seminars and information sessions especially organized by the Personal Data Protection Authority through its employees and renews its trainings in parallel with the updating of the relevant legislation

Processing of Personal Data in Accordance with the Principles Stipulated in the Legislation

Requirements for Processing Personal Data

Except for the explicit consent of the personal data owner, the basis of the personal data processing activity may be only one of the conditions stated below, or more than one condition may be the basis of the same personal data processing activity. In case the processed data is private personal data, the conditions included in item 3.3 ("Processing of Private Personal Data") of this Policy shall be applied.

Processing of Private Personal Data

Private personal data are processed by our Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical precautions, including the methods to be determined by the Board, and in the presence of the following conditions:

• •(i) Private personal data other than health and sexual life can be processed without requiring the explicit consent of the data owner, in case it is clearly stipulated in the laws, in other words, there is an explicit provision in the law regarding the processing of personal data. Otherwise, the explicit consent of the data owner shall be obtained in order to process such private personal data.
• •(ii) Private personal data related to the health and sexual life can be processed by the persons or authorized institutions and organizations under the obligation of confidentiality without requiring the explicit consent, for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing. Otherwise, the explicit consent of the data owner shall be obtained.

Enlightening Data Subjects

"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." enlightens personal data owners in accordance with Article 10 of the Law and the secondary legislation. In this context, "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S.", as the data supervisor, informs the data subjects about who processes the personal data and for what purposes, for what purposes it is shared, with which methods it is collected, and its legal reason and the rights of the data owners within the scope of the processing of their personal data.

Transfer of Personal Data

Our company may transfer the personal data and private personal data of the personal data owner to the third persons (third party companies, public and private authorities, third party real persons) by taking necessary security measures in line with the legal personal data processing purposes. In this respect, our Company acts in compliance with the regulations set out in Article 8 of the Law.

Although the personal data owner has not given his/her explicit consent, personal data can be transferred by our Company with due care to third parties by taking all necessary security precautions, including the methods prescribed by the Board, in case one or more of the conditions stated below are present.

• •If the relevant activities regarding the transfer of personal data are clearly stipulated in the laws
• •If the transfer of personal data by the Company is directly related with and necessary for the establishment or performance of a contract
• •If the transfer of personal data is mandatory for our Company to fulfill its legal obligation
• •If the personal data is transferred by our Company in a limited way for the purpose of making it public, provided that it has been made public by the data owner
• •If the transfer of personal data by the Company is mandatory for the establishment, use or protection of the rights of the Company or the data owner or third parties
• •If it is mandatory to carry out personal data transfer activities for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner
• •If it is compulsory for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid

Transfer of Private Personal Data

Private personal data can be transferred by our Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical precautions, including the methods to be determined by the Board, and in the presence of the following conditions:

• •(i) Private personal data other than health and sexual life can be processed without requiring the explicit consent of the data owner, in case it is clearly stipulated in the laws, in other words, there is an explicit provision in the law regarding the processing of personal data. Otherwise, the explicit consent of the data owner shall be obtained.
• •(ii) Private personal data related to the health and sexual life can be processed by the persons or authorized institutions and organizations under the obligation of confidentiality without requiring the explicit consent, for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing. Otherwise, the explicit consent of the data owner shall be obtained.

How Can You Exercise Your Rights?

You can fill in the "application form", which you can download using the link https://www.kvkk.gov.tr/, in line with your request/complaint, send this form to us via MAİL ADRESS, or you can fill the form physically and send it to "Ortahisar Beldesi Yeni Mah.Hisar Sk.Suzan Özbay Sitesi Best Cave Hotel Blok No 10 İç kapı no Z1 NEVŞEHİR" by courier/ mail. If you submit your request to us using one of the methods indicated above, your request shall be evaluated within 30 days at the latest and you will be informed about the subject, pursuant to Article 13/2 of the PDPL. If your request is accepted, the necessary actions shall be carried out immediately by the data supervisor COMPANY. As a rule, requests are met free of charge, but if fulfilling the request requires costs, a fee can be charged by the COMPANY pursuant to the following provision stipulated in article 7 of the "Communiqué on the Procedures and Principles of Application to the Data Supervisor": "If the application of the data subject will be answered in writing, no fee is charged for up to 10 pages.A transaction fee of 1 TL shall be charged for each page after ten pages.If the answer is given to the application in a recording medium such as CD or flash memory, the fee that may be requested by the data supervisor shall not exceed the cost of the recording medium."

Personal Data Processing Activities Performed at the Entrances and Inside of Buildings and Facilities, and Website Visitors

In order to ensure security, "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." performs personal data processing activities in the buildings and facilities of "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." by security cameras for monitoring the entrances and exits of the visitors.

Camera Monitoring Activities of "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." at the Entrances and Inside of Buildings and Facilities

"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." carries out camera monitoring activities in accordance with the Law on Private Security Services and the relevant legislation in order to ensure security in its buildings and facilities.

• •"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." carries out security camera monitoring activities for the purposes stipulated in the relevant legislation in force and in accordance with the personal data processing conditions listed in the Law, in order to ensure security in its buildings and facilities.
• •In accordance with Article 10 of the Law, "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." informs the personal data owner through more than one method regarding the camera monitoring activity. In addition, "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." processes personal data in line with, limited to and restrained with the purpose they are processed, in accordance with Article 4 of the Law.
• •The purpose of maintaining the video camera monitoring activity by "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." is limited to the purposes listed in this Policy. In this regard, the monitoring areas of security cameras, their number and time of monitoring are implemented in a sufficient and limited way to achieve the security goal.
• •Areas (for example, toilets) that may result in interference with the privacy of the person exceeding the security goals are not subject to monitoring.
• •Only a limited number of employees of "BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." have access to the records saved and preserved on the digital media with vital camera images. A limited number of persons with access to the records declare that they will protect the confidentiality of the data they obtain through a confidentiality commitment.

Tracking of Entries and Exits of Visitors

"BESTILL TURIZM OTELCILIK SAN. VE TIC. A.S." performs personal data processing activities for monitoring the entrances and exits of the visitors to ensure security and for the purposes specified in this Policy.

While obtaining the names and surnames of the persons who come to the buildings of "BESTILL TURIZM OTELCILIK SAN.VE TIC.A.S." as visitors, or through texts posted by "BESTILL TURIZM OTELCILIK SAN.VE TIC.A.S." or made available to the visitors in other ways, the personal data owners are informed in this context.The data obtained for the purpose of monitoring the entrances and exits of the visitors is processed only for this purpose and the relevant personal data is recorded in the data recording system in the physical environment.