Clarification Text on the Protection of Personal Data

1. Aim and Scope of the Policy

In accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”), personal data refers to all kinds of information related to a certain or identifiable natural person. A natural or legal person who determines the purposes and means of processing personal data in accordance with the provisions of the KVKK and is responsible for the establishment and management of the data registration system is qualified as a data controller. Under the KVKK, your personal data regarding your transactions through the www.obilet.com domain website (the “Website”) and the mobile application belonging to Obilet (the “Mobile Application”) will be processed by Obilet Bilişim Sistemleri A.Ş. (the “Obilet”) as the data controller for the purposes and legal reasons and in the scope described below. The Website and the Mobile Application will be referred to together as the “Platform” in this Clarification Text document.

Obilet is responsible for data in terms of ticket listing, flight viewing, ticket sales, car rental, car listing, hotel listing, hotel booking and similar services provided through the Platform. In terms of personal data processed within the framework of ticket, car rental and/or hotel reservation programs provided by Obilet other than the specified services, Obilet has the title of “data processor” within the scope of PDPL.

This Clarification Text has been prepared in order to inform the natural persons whose personal data is processed by Obilet as data controller in accordance with Article 10 of the KVKK about the Procedures and Principles to be Followed in Fulfilling the Obligation of Clarification within the framework of the Communiqué. Being transparent and accountable is important for that Obilet. In this context, we have prepared this Clarification Text in order to provide a good customer experience to our users in addition to fulfilling our obligations arising from the legislation. In this context, the Clarification Text contains information about the identity of the data controller and its representative, if any, for what purpose personal data will be processed, to whom and for what purpose personal data may be transferred, the method and legal reason for collecting personal data and the other rights of the relevant person listed in Article 11 of the KVKK.

Obilet may update the Clarification Text in case of changes to the applicable legislation, decisions of the Personal Data Protection Board, judicial decisions, changes in the methods, purposes, reasons for processing and/or transferring personal data, or similar developments. If the Clarification Text is updated, the current text will be published on the Platform. Obilet may publish other clarification texts, rules, conditions or other explanations on the Platform within the framework of its activities related to the processing and/or transfer of personal data. If you have any questions about the issues contained in this Clarification Text, you may contact with us throght the e-mail address [email protected]

2. Methods of Collecting Personal Data and Legal Grounds

Ensuring the security of personal data is one of our priority goals. Obilet processes your personal data in accordance with the provisions of the Constitution of the Republic of Turkey, KVKK, Law No. 6563 on the Regulation of Electronic Commerce, Turkish Penal Code No. 5237 and the relevant legislation, especially in accordance with the provisions of the relevant legislation.

Obilet processes the data Platform, authorized agents, service providers, tool, service providers, social media accounts, cookies, call centre platform messaging programs, notices and other communication channels through administrative and judicial authorities as visual, auditory, physical, electronic, whether oral or written, establishing a business relationship, job application submission, bid, contract, Property Law relationship for the purposes of fulfilling the obligations arising from and/or legitimate interests within the framework of PDPL in accordance with the personal data processing requirements and in accordance with the legal reasons specified in this Disclosure Text.

When you interact with Obilet through Facebook, Twitter, Instagram and Youtube channels that Obilet uses as a social media platform, your personal data that you provide to the relevant social media platform may also be processed by Obilet. However, we would like to note that the use of social media platforms, the content and features provided are subject to the respective platform's own privacy and usage policies.

It uses “defining information” (cookies) to help you personalizing your online experience and to enable you to log in to our services. Obilet collects personal data through cookies on the Platform for different purposes. Cookies are text files placed on visitors' computers by visited websites. It is widely used on almost all Internet sites in order for websites to work effectively and according to the preferences of visitors, as well as to provide information to the administrators of the website. Cookies are used to determine the preferences of our visitors, to identify requests for a specific page, to improve the experience of using the Platform, to keep our services safe and to engage in online behavioral advertising activities for our users.

Google Analytics, an analytics service owned by Google Inc. ("Google"), is used on our Website and Mobile Application. Google Analytics, on the other hand, uses “cookies”, that is, text files saved on your computer that allow you to analyze the use of the website by you. The information generated by cookies in relation to the use of the website is transmitted to a server of Google in the USA and stored there. As instructed by the operator of this website, Google uses this information to evaluate your use and prepare reports to provide related services. The IP address transmitted from your browser within the framework of Google Analytics is not combined with other data of Google. If you do not want these cookies to be stored, you can set the appropriate settings in your browser. In addition, AdWords and double-click-Cookies (cookies) are also used on our Website for statistical purposes.

We use third-party cookies and our own cookies to show you personalized ads on our websites. This is called "retargeting" and aims to be based on the pages you browse our Website, the products you view, and the clicks on the ad space (banner) displayed to you. We also use cookies as part of our online marketing campaigns to see how users interact with our Platform after online ads are shown, including those on third-party websites. You can delete these cookies from your browser at any time.

Many internet browsers are set to automatically accept cookies by default. If you do not want these tools to be used, you can disable them by setting them in your browser. However, we would like to note that in this case you may not be able to use all the functions on the Platform in their full scope.

3. Processed Personal Data

Your processed personal data may vary depending on the nature of the legal relationship you have established with Obilet. However, in general, the personal data we process with are as follows:

4. Purposes of Processing Personal Data

• As a rule, personal data cannot be processed without the express consent of the relevant person in accordance with the PDPL. Obilet processes your personal information as and to the extent permitted by law.
• Within this framework, the purposes of processing your personal data are as follows:
• o confirm the identity information of the person who received the ticket through the platform and received the ticket on behalf of,
• Save the address and other necessary information for communication,
• To contact our customers about the terms, current status and updates of the contracts we have concluded in accordance with the relevant articles of the laws on the Contract of Distance Sales and Consumer Protection, to be able to provide the necessary information, to fulfil the obligations assumed in accordance with the contracts we have concluded,
• To organize all records and documents that will be the basis for processing in electronic or paper media,
• To be able to provide information to public officials on matters related to public safety upon request and in accordance with the legislation,
• To provide a better service to our customers, to be able to inform our customers about our products that our customers may be interested in by taking into account the interests of our customers, to transfer campaigns,
• Informing our customers about the Regulation of Electronic Commerce within the framework of the Law and relevant legislation by e-mail or text message,
• To increase customer satisfaction, to get to know our customers from the Platform and to use it in customer environment analysis, to use it in various marketing and advertising activities and to organize surveys in electronic environment and/or physical environment through contracted organizations in this context,
• To be able to offer suggestions to our customers by our contracted institutions and solution partners, to inform our customers about our services,
• To be able to evaluate customer complaints and suggestions about our services,
• To be able to fulfil our legal obligations and to exercise our rights arising from the current legislation.

In addition, the personal data of our employees can be processed without approval, as far as it is necessary for business relations. Regarding the processing of our employees' personal data, the terms and conditions set out in the Policy on the Protection and Processing of Employees' Personal Data apply.

5. Rights and Obligations of Our Company Arising from the Law

Personal data are collected by our company in accordance with Article 20 of the Constitution and Article 4 of the KVKK;

• In accordance with the law and the rules of honesty,
• Accurately and up-to-date,
• For specific, clear and legitimate purposes,
• In connection with the processing purposes,
• In a limited and measured form,

it is processed and transferred on the basis of the conditions specified in Articles 5 and 6 of the KVKK by maintaining it for as long as required by the laws or for the purpose of processing personal data.

The personal data shared with Obilet is under the supervision and control of Obilet. Obilet has assumed responsibility as data contorller for establishing the necessary organization and taking and adapting technical measures to protect the confidentiality and integrity of information in accordance with the provisions of the relevant legislation in force. Aware of our obligation in this regard, we would like to note that we have taken the following administrative and technical security measures. In this context, we inform you that we are always updating our data processing policies.

• All data received through the platform is transferred from your computer or mobile device to our application servers with a 256-bit RSA SSL certificate compliant with the TLS 1.2 standard. Your critical payment information is not kept in any way on the servers of our application, it is encrypted according to the standards required by the relevant payment system and transmitted to the relevant bank and/or payment system infrastructure.
• The infiltration tests are carried out periodically and the system's resistance to unauthorized access is tested.
• In order to prevent unlawful processing of personal data collected from the Platform, access authorization and control matrices have been created for employees.
• Personal data on paper media is stored in lockers, and only authorized persons have access to these media.

Since Obilet has an obligation to keep the personal data of the relevant persons accurate and up-to-date in accordance with Article 4 of the KVKK, our customers must share their accurate and up-to-date data with Obilet in order to fulfill these obligations. We would like to point out that if your personal data is changed in any way, you should update your data by visiting our profile page.

Obilet stores the personal data it processes for periods determined by the legislation, and if no period is specified in the legislation, the personal data is also stored for periods that require processing in accordance with Obilet's practices and the rules of business life, depending on the services Obilet provides when processing the relevant personal data, and after this period only for periods that are required in practice to provide evidence in possible legal disputes. After the expiration of the specified periods, such personal data is deleted, destroyed or anonymized.

6. Transfer of Personal Data

The sharing of personal data with third parties is carried out within the framework of the applicable legislation and/or the express consent of the relevant persons. However, due to our legal obligations and limited to, personal data are shared with courts and other public institutions. In addition, personal data is transferred to third parties within the framework of a contractual relationship in order to provide the services we undertake and to carry out quality control of the services provided.

Necessary technical and administrative measures are being taken to prevent data breaches during the transfer of data to third parties. For example, SSL and transport layer are used during data transfer.

Your personal data can be shared with third parties that have the title of service provider and/or intermediary service provider with the program partner institutions, organizations that we cooperate with in order to carry out our activities, our business partners who provide special integrator services, third parties providing independent audit, domestic or international organizations providing storage of data in the cloud environment, people and institutions that we provide services to, domestic/foreign organizations to send commercial electronic messages to our customers, our financial advisors, the Interbank Card Centre, the banks we have contracted, organizations that provide payment services and deliver various marketing activities in order to provide better service and customer satisfaction and abroad within the scope of various agencies, advertising companies, survey companies and domestic/overseas about our partners and other third parties, our shareholders and subsidiaries, as well as with third parties with whom we receive services under a contractual relationship, our lawyers, consultants and legally authorized public institutions and private legal entities.

7. Rights of the Person of Interest

According to Article 11 of the KVKK, the person of interest;

• Find out if personal data about her/him has been processed,
• If personal data about her/him has been processed, do not request information about it,
• To find out the purpose of processing personal data and whether they are used for their intended purpose,
• Know the third parties to whom personal data is transferred at home or abroad,
• Requesting correction of personal data in case of incomplete or incorrectly processed,
• Although it has been processed in accordance with the provisions of the law and other relevant laws, it does not require the deletion or destruction of personal data in the event that the reasons requiring its processing disappear,
• Request notification of transactions made as a result of requests for correction, deletion and destruction to third parties to whom personal data has been transferred,
• By analyzing the processed data exclusively through automated systems, one does not argue with the emergence of a result against one's self,
• In case of damage due to unlawful processing of personal data, it has the right to demand compensation for the damage.

In order to exercise these specified rights, you must submit your request in this direction in accordance with Article 13 of the KVKK and in accordance with the Communique on the Procedures and Principles of Applying to the Data Controller, to the Obilet's address “Sultan Selim Mah. Yunus Emre Cad. Artillery Works Merk. No:1/11 floor:3 Kağıthane/Istanbul”, with your first and last name and your signature, if you are a citizen of the Republic of Türkiye ID number, if you are not a citizen of the Republic of Türkiye, your nationality, your passport number or ID number, your residential or business address for notification, the basis of the notification, electronic mail address, and telephone number and the subject of your request and your identity for the determination of the necessary information and documents by adding and/or in writing through the use of application form, you can apply via your e-mail address where your membership has been confirmed, or by e-mail to get general information about KVKK if you do not have any membership. Your application will be evaluated by Obilet and will be completed free of charge within thirty days. However, if the transaction also requires a cost, the fee may be charged at the tariff set by the Personal Data Protection Board.

Click here to access the Application Form that you can use to submit your requests.