PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

Request Form

This Privacy Notice on the Processing of Personal Data applies to the data held by the Company, acting as the data controller, in respect of individuals who submit requests via the Contact Form located at https://yardim.yolcu360.com/iletisim-form/.

1. WHY ARE WE SENDING THIS NOTICE?

As YOLCU 360 BİLİŞİM ANONİM ŞİRKETİ (hereinafter referred to as "Yolcu360" or the "Company"), pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation, published in the Official Gazette dated 10.03.2018 and numbered 30356, this "Notice", prepared by the Company in its capacity as Data Controller, is issued in order to inform you, within the framework of Article 10 ("Data Controller's Disclosure Obligation") and Article 11 ("Rights of the Data Subject") of the KVKK and Articles 4 and 5 of the aforementioned Communiqué, about: for which purposes your personal data will be processed, to whom and for what purposes your processed personal data may be transferred, the method and legal basis for collecting your personal data, and your other rights listed under Article 11 of the KVKK.

2. WHAT TOPICS DOES THIS NOTICE COVER?

• Which of your personal data is collected

• The purposes for which your personal data is processed

• With whom and for what purposes your personal data is shared

• The method and legal basis for collecting your personal data

• Destruction of your data

• Your rights under the KVKK

3. WHICH PERSONAL DATA DO WE PROCESS?

*We kindly request that you do not share any personal and/or special category personal data for which explicit consent is required under Law No. 6698 on the Protection of Personal Data, within the explanations and documents you provide regarding your requests. If you nevertheless share such data with us within the scope of your requests and the documents you attach, your explicit consent will be deemed to have been given for the fulfillment of the processing purposes specified below, and destruction procedures will be carried out for such data where necessary.

4. WITH WHOM AND FOR WHAT PURPOSES DO WE SHARE YOUR PERSONAL DATA?

Where legal obligations exist or the conditions of Articles 8/2 and 9 of the KVKK are met, the personal data specified in Section 3 may be shared, for the processing purposes specified in Section 6, with our contracted suppliers and service providers in order to deliver our services through our website and improve the quality of the services we provide; with the law firm we work with for the follow-up of legal matters; and with judicial and administrative authorities requesting information for the exercise of our legal defense rights and for responding to official or legal requests for information and documents in the event of a possible legal dispute, investigation, judicial or administrative audit, or similar situations.

Because the servers of the cloud service providers used by the Yolcu360 Platform are located abroad (Amazon Web Services), the personal data processed by our Company within the scope of the request form is transferred to cloud service providers (Amazon Web Services) for the purposes of operating the Yolcu360 Platform, delivering the Yolcu360 Platform's services, receiving and responding to your contact requests, and securely storing, backing up, and accessing your personal data in the cloud. This transfer is carried out in compliance with the KVKK and in a secure manner, under the standard contract signed between the Company and Amazon Web Services, Inc., based on the legal ground set out in Article 9/4(c) of Law No. 6698, namely "the existence of a standard contract announced by the Board, covering matters such as the categories of data, the purposes of data transfer, the recipient and recipient groups, the technical and administrative measures to be taken by the data recipient, and additional measures taken for special category personal data."

Likewise, in the course of its commercial and administrative activities, our Company uses Google Cloud Platform, Google Workspace, Cloud Identity, Looker (Original), SecOps Service, Application Services, and/or other Google Cloud services ("Google Solutions"). In this context, personal data processed through the use of Google Solutions (for example, user access logs processed on Google Cloud Platform, appointment information stored in the Google Workspace calendar application, or user interaction data analyzed via Looker (Original)) will, due to the nature of the technical process, be transferred to Google Cloud EMEA Limited, whose servers are located in the European Union. Our Company has signed a standard contract with Google Cloud EMEA Ltd. pursuant to Article 9/4(c) of the KVKK, and personal data transfers abroad carried out through the use of Google Solutions are performed in compliance with the KVKK and in a secure manner.

5. WHAT IS THE METHOD AND LEGAL BASIS FOR COLLECTING YOUR PERSONAL DATA?

We collect your personal data through automated means, via your completion of the Contact Form located at https://yardim.yolcu360.com/iletisim-form/, based on the legal grounds set out in Article 5/2 of Law No. 6698 — namely "data processing being mandatory for the establishment, exercise, or protection of a right" and "data processing being mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject" — as detailed for each category of personal data in Section 6 below.

6. PURPOSES AND LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA

7. YOUR RIGHTS UNDER THE KVKK

By applying to our Company, you have the right to:

• a) learn whether your personal data is being processed;

• b) request information if it has been processed;

• c) learn the purpose of processing and whether it is used in accordance with that purpose;

• ç) know the third parties to whom it is transferred, domestically or abroad;

• d) request correction if it has been processed incompletely or incorrectly;

• e) request its erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK;

• f) request that the actions taken under items (d) and (e) above be notified to third parties to whom the data has been transferred;

• g) object to a result that arises to your detriment through analysis exclusively via automated systems; and

• ğ) request compensation for damages in the event you suffer harm due to unlawful processing.

You may submit your request regarding the exercise of the above rights, in Turkish and in writing, or via registered electronic mail (KEP), secure electronic signature, mobile signature, or the e-mail address previously notified to and registered with our Company, pursuant to Article 13(1) of Law No. 6698 and the Communiqué on the Procedures and Principles for Applications to the Data Controller (Official Gazette No. 30356, dated 10.03.2018). Applications will only provide information about the applicant themselves; information about other family members or third parties cannot be obtained. Our Company reserves the right to verify your identity before responding.

Your application must include:

• Your name, surname, and signature (if the application is in writing);

• For Turkish citizens, your Turkish ID number; for foreign nationals, your nationality, passport number, or identification number if available;

• Your residential or business address for notification purposes;

• Your e-mail address, telephone, and fax number for notification, if available;

• The subject of your request, along with any related information and documents, if applicable.

You may submit written applications, together with the required documents, to our Company as data controller at the following address: Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R İç Kapı No:13 Ataşehir / İstanbul.

You may submit applications through the e-mail address previously notified to and registered with our Company via the communication channels on the https://yolcu360.com website.

Applications signed with a secure electronic signature under Law No. 5070 on Electronic Signatures may be submitted via registered electronic mail (KEP) to our KEP address. Submissions to KEP addresses can only be made from KEP-extension addresses.

Depending on the nature of your request, it is necessary to provide us with complete and accurate information and documents enabling identity verification. If the requested information and documents are not provided adequately, there may be disruptions in our Company's ability to conduct a complete and proper investigation in response to your request. In such cases, our Company declares that it reserves its legal rights. Therefore, your application should be submitted completely and should include the information and documents required for identity verification, according to the nature of your request.

8. MEASURES REGARDING THE PROTECTION OF YOUR PERSONAL DATA

The protection of personal data is an important matter for our Company. Our Company takes the necessary technical and administrative measures to protect personal data against unauthorized access, loss, misuse, disclosure, alteration, or destruction. Our Company undertakes to keep your personal data confidential and to take all necessary technical and administrative measures and to exercise the necessary diligence to ensure confidentiality and security.

Notwithstanding the necessary information security measures taken by our Company, in the event that personal data is damaged or falls into the hands of third parties as a result of attacks on the website and systems, our Company will immediately notify you and the Personal Data Protection Board of such situation.

9. KEEPING YOUR PERSONAL DATA ACCURATE AND UP TO DATE

Individuals who share their personal data with our Company acknowledge and declare that they are aware that the accuracy and up-to-date maintenance of this information is important both in terms of the rights they hold over their personal data under Law No. 6698 on the Protection of Personal Data and under other relevant legislation, and that they bear full responsibility for any liability arising from the provision of inaccurate information.

You may notify us of any changes and/or updates to your shared personal data by physical mail to the notification address specified below, or through the communication channels on the https://yolcu360.com website.

10. ERASURE, DESTRUCTION, OR ANONYMIZATION OF YOUR PERSONAL DATA

Your personal data processed for the purposes specified in this Notice will, once the purpose requiring its processing under Article 7/1 of the KVKK ceases to exist and any statutory retention periods have elapsed, be erased, destroyed, or anonymized by our Company, either ex officio or upon your request, in accordance with our Personal Data Retention and Destruction Policy, which has been prepared in compliance with the Regulation on the Erasure, Destruction, or Anonymization of Personal Data.

11. IDENTITY OF THE DATA CONTROLLER

YOLCU 360 BİLİŞİM ANONİM ŞİRKETİ

Mersis No: 0981139899000001

Address: Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R İç Kapı No:13 Ataşehir / İstanbul

KEP Address: yolcu360bilisim@hs01.kep.tr