INFORMATION ON PROCESSING OF PERSONAL DATA

Dear Clients, Guests, Passengers and Business Partners,

As per the Law on the Protection of Personal Data numbered 6698, which was published in the Official Gazette dated 07.04.2016 and numbered 29677 (“LPPD”), your personal data permitted under LPPD may be processed by our Company, ATÜ Turizm İşletmeciliği A.Ş., as a “Data Supervisor” within the boundaries and under the circumstances set forth in the LPPD.

At duty-free stores operated by our Company (“Stores”), sales are made in compliance with the provisions of the Customs Law numbered 4458 and the Customs Regulation comprising the Customs Warehouse Regime and the relevant articles of the Regulation on Duty-Free Stores, published in the Official Gazette dated 08.08.2017 and numbered 30148, the Tax Procedural Law numbered 213, and provisions of other legislation concerning the Stores, including but not limited to the decisions and orders of competent authorities (“Legislation”).

1. The Objectives of Processing Your Data

Pursuant to the Legislation; the following are mandatory: issuance of a Sales Note for each sale made at the Stores, insertion in the Sales Note the names and surnames of persons who have a  right to shop from the Stores (“Right Holders”), the boarding cards or passport numbers of passengers who will travel abroad, the passport numbers of passengers who come from abroad, the landing card numbers or passport numbers of transit passengers and other passenger and sale information (“Personal Data”), and retention of the Sales Note for a period of time set forth in the Legislation. We, in the capacity of a “Data Supervisor” within the scope of LPPD, kindly notify you that, in order to fulfill our abovementioned legal obligations set forth in the Legislation, the Personal Data of the Right Holders is obtained by us, recorded, retained, analyzed via automatic systems, classified, and where the Legislation requires and/or permits, is disclosed and conveyed to third persons, administrative and public authorities.

There are closed circuit camera systems in the Stores and the persons present at the Stores are continuously and regularly being monitored by video and audio surveillance due to the Legislation and Airport security rules.

Your personal data may be processed by our Company within the scope of the personal data processing conditions specified in Articles 5 and 6 of LPPD for the following purposes (“Objectives”) within the scope of the activities required to benefit you from the products and services offered by our Company and to carry out the relevant business processes:

• Offering duty free services, invoicing, ensuring commercial job security,
• Ensuring the spatial security of our Duty Free Stores and their surroundings,
• Planning and execution of marketing processes of products and services;
• Management of customer demands and complaints;
• Carrying out customer satisfaction studies.

2. The Procedure of Collection of Your Personal Data and The Legal Reason

The procedure regarding the collection of Personal Data during the sales made to the Right Holders includes scanning the passports or boarding cards of the Right Holders through passport readers, recording the same to the Sales Note, and the collection of the same as written and electronic data, image and audio recording by monitoring through closed circuit camera systems.

Legal reasons of processing your Personal Data are based on the principles in Article 5 and Article 6 of LPPD and rules set-forth in Legislation which are fulfilling our legal responsibilities, the necessities that are clearly stated within the law and the legitimate interest of our Company. In addition, your Personal Data can be processed in order to form and execute the contract.

3. The Objectives of Transferring Your Personal Data

Your Personal Data that is processed by our Company may be transferred to our subsidiaries, shareholders, business partners, legally authorised public authorities and private persons in order to:

• Planning and execution of commercial and / or business strategies,
• Carrying out the necessary work by our relevant business units for the execution of the commercial activities carried out by our company and carrying out the related business processes,
• Ensuring the legal, technical and commercial job security of our company and the related persons who have business relations with our company,
• Carrying out the necessary work by our business units to benefit the relevant people from the products and services offered by our company and carrying out the relevant business processes within the scope of legal reasons of transferring your Personal Data that are based on the principles in Articles 8 and Article 9 of LPPD and rules set-forth in Customs Legislation. These legal reasons are; fulfillment of legal obligations, legitimate interest of our company, necessities that are clearly stated within the law, forming and execution of the contract.

4. Your Rights as Personal Data Owner

Within the scope of LPPD, you have the right resort to our Company and to be informed about:

• Whether or not your personal data has been processed;
• If it has been processed, to request information in this respect;
• To be informed regarding the purpose of the processing and whether or not the data has been utilized in compliance with such purpose;
• To know the domestic and foreign third persons that the data has been conveyed to;
• If your personal data has been deficiently or incorrectly processed, to request the correction of the same;
• If the reasons which require the personal data to be processed are removed, to request the deletion or disposal of the data; to request that the transactions performed are notified to third persons to whom the data was transferred;
• To object to any outcome against you exclusively through an analysis of automatic systems;
• If you incur any damage due to the processing of your personal data contrary to LPPD, to request that such damage is cured.

As per Article 13/1 of LPPD, you may send your request by writing to the the address of ATÜ Turizm İşletmeciliği A.Ş – Ayazağa Mahallesi Cendere Caddesi No: 109L 2C Blok 2 ve 7. Kat Sarıyer – İstanbul or to kvkk_iletisim@atu.com.tr by using Registered electronic mail (KEP) address, secure electronic signature, mobile signature or your e-mail address previously notified to our Company and registered in our system.

If there is a cost in the said transactions, this amount is reflected to you in accordance with the relevant legislation.

In accordance with the relevant legislation, requests and complaints that are not sent via the aforementioned means and do not contain the following conditions will not be taken into consideration:

• Name-Surname and if the request is in writing, the signature,
• Identity Number for Turkish Citizens; nationality, passport number or identity number for foreigners,
• Place of residence or workplace address for notification,
• If available, e-mail adress, phone or fax number for notification,
• The subject of request,
• Information and documents related to the subject.