CCTV PRIVACY NOTICE

DATA CONTROLLER

This Privacy Notice is prepared to inform data subjects about the procedures and principles regarding the processing of personal data collected through the closed-circuit recording systems used in the buildings and annexes of KONKAR TURİZM YATIRIM SANAYİ VE TİCARET A.Ş. (‘Company’), within the scope of the Personal Data Protection Law No. 6698 (‘Law’).

PERSONAL DATA TO BE PROCESSED

This includes the images of individuals captured by the cameras, and the vehicle plate data of those entering the Company’s buildings, hotel and beach facilities, restaurant, hotel and facility lobbies, and parking lots by vehicle.

PURPOSE OF PROCESSING PERSONAL DATA

The collected personal data is processed to ensure the legal, technical, and commercial job security of related individuals within the Company, and to secure the Company’s buildings, facilities, and annexes. This includes ensuring the security and protection of employees, customers, suppliers, and assets, and detecting potential legal violations and obtaining evidence. All cameras operate 24 hours a day, 7 days a week.

METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA

Personal data is collected through the camera systems located in the Company’s buildings, facilities, and annexes. Camera monitoring activities are carried out as part of the Company’s security policy. The collected personal data is processed based on the legal grounds and purposes specified in Articles 5 and 6 of the Law due to the legitimate interest of the data controller.

PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND PURPOSE OF TRANSFER

Your personal data may be shared with authorized public institutions and organizations, as well as other third parties, in accordance with the above-mentioned legal regulations and other legislation, ensuring administrative and technical security measures.

RETENTION PERIOD

Camera recordings are retained by the Company for 1 week and are destroyed when the purpose requiring their processing ceases or when the retention period specified under the legislation expires.

RIGHTS OF THE DATA SUBJECT

As the owner of personal data, you have the following rights under Article 11 of the Law:

a.     To learn whether your personal data is processed or not,

b.     To request information if your personal data has been processed,

c.     To learn the purpose of processing your personal data and whether they are used appropriately, d

d.     To know the third parties to whom your personal data are transferred domestically or abroad,

e.     To request correction of incomplete or inaccurate processing of your personal data,

f.      To request the deletion or destruction of your personal data,

g.     To request notification of the correction, deletion, or destruction of your personal data to third parties to whom your personal data has been transferred,

h.     To object to the emergence of a result against you by analyzing the processed data exclusively through automated systems,

i.      To demand compensation if you suffer damage due to the unlawful processing of your personal data.

Your personal data collected and processed must be accurate and up-to-date as required by Article 4 of the Personal Data Processing Law No. 6698. Therefore, you can inform us of any changes in your personal data using the methods specified below.

METHOD OF APPLICATION TO THE DATA CONTROLLER

You can submit your application by written notice to:

·       Ölüdeniz Mahallesi Ölüdeniz Cad. Otel Meri Sit. No: 48 Fethiye/Muğla;

·       By sending an email to [email protected] using the electronic mail address registered in our system;

·       By sending a registered electronic mail to [email protected].

Your application must include:

·       Your name, surname, and signature if the application is in written form,

·       Your Turkish Republic ID number, if you are a citizen of Turkey; your nationality, passport number, or ID number if you are a foreigner,

·       Your residence or business address for notification,

·       Your email address, telephone, and fax number for notification, if any,

·       Your request, along with any relevant information and documents.

Your application will be concluded within thirty days, and (i) your request may be accepted and the information provided to you, or (ii) it may be rejected with an explanation. Your requests will be responded to in writing or electronically within the shortest time possible, and at most within thirty days, depending on the nature of your request.