Clarification Text on the Protection of Personal Data

1. Purpose and Scope of the Policy

Within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK"), Personal data refers to any information relating to an identified or identifiable natural person. In accordance with the provisions of the KVKK, the natural or legal person responsible for determining the purposes and means of processing personal data and responsible for the establishment and management of the data recording system is referred to as the data controller. Within the scope of KVKK, your personal data regarding your transactions made through the website www.obilet.com ("Website") and Obilet's mobile application ("Mobile Application") will be processed by Obilet Bilişim Sistemleri A.Ş. ("Obilet") as the data controller within the scope, purposes, and legal reasons described below. The Website and the Mobile Application will be collectively referred to as the "Platform" herein this Clarification Text.

Obilet is the data controller in terms of ticket listing, trip display, ticket sales, car rental, car listing, hotel listing, hotel booking, and similar services provided through the Platform. In terms of personal data processed as part of the ticket, car rental, and/or hotel reservation programs provided by Obilet other than the services stated above, Obilet has the title of "data processor" within the scope of KVKK.

This Clarification Text has been prepared to inform the real persons whose personal data are processed by Obilet as the data controller within the framework of Article 10 of the KVKK and the Communique on Principles and Procedures to Be Followed in Fulfillment of The Obligation to Inform. Obilet is committed to transparency and accountability. In this regard, we have prepared this Clarification Text to fulfill our obligations arising from the legislation as well as to provide our users with a good customer experience. In this context, the Clarification Text includes information on the identity of the data controller and its representative, if any, the purpose for which personal data will be processed, to whom and for what purpose personal data may be transferred, the method and legal reason for collecting personal data and other rights of the data subject listed in Article 11 of the KVKK.

Obilet may update the Clarification Text in case of changes in the applicable legislation, decisions of the Personal Data Protection Board, judicial decisions, changes in personal data processing and/or transfer methods, purposes, reasons, or similar developments. Any update of the Clarification Text will be published on the Platform. Obilet may publish other clarification texts, rules, conditions, or other explanations on the Platform within the framework of its activities regarding the processing and/or transfer of personal data. If you have any questions regarding the matters set forth in this Clarification Text, we kindly ask you to contact us via the following e-mail address : [email protected].

2. Methods of Collecting Personal Data and Legal Basis

The security of personal data is one of our primary objectives. Your personal data is processed by Obilet in accordance with the provisions of the Constitution of the Republic of Turkey, the KVKK, Law No. 6563 on the Regulation of Electronic Commerce, the Turkish Penal Code No. 5237, and the relevant legislation.

In accordance with the personal data processing conditions specified in the KVKK and in line with the legal reasons specified in this Clarification Text, Obilet processes personal data visually, audibly, physically, electronically, orally, or in writing through the Platform, authorized agencies, service providers, intermediary service providers, social media accounts, cookies call center, messaging programs on the Platform, notifications from administrative and judicial authorities, and other communication channels for the purposes of establishing commercial relations, receiving job applications, making offers, establishing a contractual relationship, fulfilling its obligations arising from the law and/or within the framework of its legitimate interests.

When interacting with Obilet through Facebook, Twitter, Instagram, and YouTube channels used by Obilet as social media platforms, the provided personal data to the relevant social media platform may also be processed by Obilet. However, the use of social media platforms and the content and features provided are subject to the respective platform's own privacy and usage policies.

We use "cookies" to help personalize your online experience and to enable you to log in to our services. Obilet collects personal data for different purposes through cookies on the Platform. Cookies are text files placed on visitors' computers by visited websites. Cookies are widely used on almost all websites for websites to work effectively and in line with visitors' preferences, as well as to provide information to website administrators. Cookies are used to determine the preferences of our visitors, to determine the requests for a specific page, to improve the Platform usage experience, to keep our services secure, and to perform online behavioral advertising activities for our users. Many internet browsers are set to automatically accept cookies by default. If you do not want these tools to be used, you can disable them by setting in your browser. However, please note that in this case, you may not be able to use the full functionality of the Platform.

For detailed information on personal data processed through cookies, please review the Cookie Policy.

3. Personal Data Processed

Your processed personal data may vary depending on the nature of the legal relationship with Obilet. Nevertheless, in general terms, the processed personal data are as follows:

4. Purposes of Processing Personal Data

In accordance with the KVKK, personal data cannot be processed without the explicit consent of the data subject as a rule. Obilet processes your personal information when and to the extent permitted by the legislation.

In this respect, the purposes of processing your personal data are as follows:

• To confirm the identity information of the person who buys a ticket on the platform and on whose behalf the ticket is purchased, who rents a car and on whose behalf the car is rented, who makes a hotel reservation and on whose behalf the hotel reservation is made,
• To save the address and other necessary information for contact,
• To manage the procedures for the establishment and execution of contracts,
• To communicate with our customers regarding the conditions, current status, and updates of the concluded contracts under the relevant articles of the Distance Sales Agreement and the Law on the Protection of Consumers, to provide the necessary information, and to fulfill the obligations undertaken in accordance with the concluded contracts,
• To organize all records and documents that will be the basis of the transaction in electronic or hardcopy format,
• To be able to provide information to public officials on matters related to public security upon request and in accordance with the legislation,
• To provide a better service to our customers, to inform our customers about our products that our customers may be interested in, taking into account the interests of our customers, and to share campaigns,
• To provide information to our customers via email or text message within the framework of the Law on the Regulation of Electronic Commerce and the relevant legislation,
• To increase customer satisfaction, to recognize our customers from the Platform, to use it in customer network analysis, to use it in various marketing and advertising activities, and to organize surveys in electronic and/or physical environments through contracted organizations in this context,
• To be able to offer suggestions to our customers by our contracted institutions and solution partners and to inform our customers about our services,
• To evaluate customer complaints and suggestions regarding our services,
• To carry out goods and services production, operation and sales processes, finance and accounting activities, and archive activities,
• To ensure information security,
• To fulfill our legal obligations and to exercise our rights arising from the legislation in force.

In addition, the personal data of our employees may be processed without consent to the extent necessary for business relations. The terms and conditions specified in the Policy on the Protection and Processing of Personal Data of Employees shall apply to the processing of personal data of our employees.

5. Rights and Obligations of our Company Arising from the Law

Personal data are processed and transferred by our Company in accordance with Article 20 of the Constitution and Article 4 of the KVKK, by keeping them for the period stipulated by law or required by the purpose of processing personal data, based on the conditions specified in Articles 5 and 6 of the KVKK under the following conditions;

• Consistent with the law and good faith,
• Accurate and up to date,
• For specific, explicit and legitimate purposes,
• Linked to processing purposes,
• In a limited and measured way
• All data received through the platform is transferred from your computer or mobile device to our application servers with a 256-bit RSA SSL certificate compatible with TLS 1.2 standard. Your sensitive payment information is not stored on the servers of our application in any way and is encrypted in the standards required by the relevant payment system and transmitted to the relevant bank and/or payment system infrastructure.
• Leak tests are performed periodically and the resistance of the system to unauthorized access is tested.
• Access authorization and control matrices have been established for employees to prevent unlawful processing of personal data collected from the Platform.
• Personal data on paper media are kept in locked cabinets accessible only by authorized persons.

Since Obilet has the obligation to keep the personal data of the relevant persons accurate and up-to-date in accordance with Article 4 of the KVKK, our customers are required to share their accurate and up-to-date data with Obilet to fulfill these obligations. In case your personal data changes in any way, we would like you to update your information by visiting your profile page.

Obilet stores the processed personal data for the periods specified in the legislation. In case no specific period is set in the legislation, the personal data is stored for the period required to be processed in accordance with Obilet's practices and the customs of Obilet's commercial life, depending on the services provided by Obilet while processing the relevant personal data. After this period, the personal data is stored only for the periods required in practice to constitute evidence in possible legal disputes. After the expiration of the specified periods, the personal data in question are deleted, destroyed, or anonymized.