FABAY TOURISM INVESTMENTS CONSTRUCTION MANUFACTURING JOINT STOCK COMPANY SOCIAL MEDIA COMMUNICATION INFORMATION NOTICE

Data Controller: Fabay Tourism Investments Construction Manufacturing Joint Stock Company Saray Mah. Dr. Adnan Büyükdeniz Cad. 2 Blok No: 4 Inner Door No: 9 Ümraniye/Istanbul

Fabay Tourism Investments Construction Manufacturing Joint Stock Company (hereinafter referred to as “FABAY”) as the data controller, in accordance with the Personal Data Protection Law No. 6698 (“KVKK”), relevant legislation, and legal regulations, has prepared this information notice to inform you about the processing, storage, and transfer of your personal data obtained by FABAY in the context of the Communication activities carried out by FABAY.

What Personal Data is Processed and What are the Purposes, Legal Grounds, and Collection Methods of Processing Your Personal Data?

Within the scope of communication activities, your personal data such as identity information (name, surname) and contact information (telephone number, email address) are processed for the purposes of conducting communication activities, tracking requests/complaints, conducting necessary research/investigations regarding the subject of the request, providing support services, and providing information and support services to you. These processing activities are carried out based on the necessity of processing personal data belonging to the parties of a contract or directly related to the establishment or performance of a contract, as stipulated in Article 5/2-a of the Law, and based on the legitimate interests of the data controller, as stipulated in Article 5/2-f of the Law. FABAY obtains your personal data through electronic forms available on social media accounts.

To Whom and for What Purposes Can Your Personal Data be Transferred?

In accordance with the above-mentioned purposes and legal grounds, FABAY may transfer your personal data to:

Authorized Public Institutions and Organizations, in a limited manner, for compliance with legal regulations and applicable legislation, and for providing information to competent public institutions and organizations,

Social Media Platforms located abroad, for the purpose of conducting storage and archival activities, These transfers will be made in compliance with the rules specified in Article 8 regarding transfers or Article 9 regarding transfers to abroad of the KVKK, and with the necessary technical and administrative measures, only to the extent necessary for the realization of the relevant purpose.

During the use of social media accounts, you can access detailed information about the processing of your personal data through the privacy policies of the relevant social media platforms.

What are Your Rights as the Data Subject?

Regarding your personal data, you have the following rights:

• To learn whether your personal data is processed or not,
• If your personal data is processed, to request information regarding this processing,
• To learn the purpose of processing your personal data and whether they are used in accordance with the intended purpose,
• To know the third parties to whom your personal data is transferred, whether domestically or abroad,
• If your personal data is incomplete or inaccurately processed, to request the correction of such data,
• To request the deletion or destruction of your personal data in accordance with the conditions stipulated in the KVKK legislation,
• If your incomplete or inaccurately processed data is corrected or if your personal data is deleted or destroyed, to request that such actions be notified to third parties to whom your personal data has been transferred,
• To object to a result against you that arises solely from the analysis of your data through automated systems,
• If you suffer damages due to the unlawful processing of your personal data, to request the compensation of such damages.

How Can You Exercise Your Rights?

• You can submit your applications and requests regarding your personal data using the Data Subject Application Form. You can:
• Send the form witha wet signature and supporting identification documents to the address: “Saray Mah. Dr. Adnan Büyükdeniz Cad. 2 Blok No: 4 Inner Door No: 9 Ümraniye/Istanbul,”
• Personally visit FABAY with a valid identification document,
• Send an email to fabayturizm@hs01.kep.tr using a registered electronic mail (KEP) address and a secure electronic signature or mobile signature,
• Send an email to kvkkbasvuru@fabay.com.tr using a secure electronic signature or mobile signature,
• Send an email to kvkkbasvuru@fabay.com.tr from the previously notified and registered email address in our system.

According to the “Communique on the Procedures and Principles of Application to the Data Controller” (“Communique”), your application must include mandatory information such as your name, surname, signature (if the application is in writing), Republic of Turkey ID number (or passport number if you are a foreigner), residential or workplace address for notification, if applicable, the email address, phone number, and fax number, and clear and explicit information about the subject of the request. Information and documents related to the application should be attached to the application.

Although the subject of the request should be related to the personal data of the applicant, if someone is acting on behalf of another person, the applicant must be authorized in this regard and this authorization should be documented (power of attorney). If the subject of the request falls within the scope of special category data, the applicant must be specifically authorized in this regard according to Article 10 of the Regulation on Personal Health Data. In addition, the application must include identity and address information, and supporting documents verifying the identity must be attached to the application. Requests made by unauthorized third parties on behalf of others will not be considered.

How Long Does It Take to Respond to Your Requests Regarding the Processing of Your Personal Data? Your requests regarding your personal data will be evaluated and concluded free of charge within the shortest time possible and no later than 30 days; however, if the process requires additional costs, you may be charged a fee in accordance with the principles set forth in the Communique. Our response to your application will be sent to the address you provided in the application, through means such as electronic mail or postal service, if possible.

FABAY TOURISM INVESTMENTS CONSTRUCTION MANUFACTURING JOINT STOCK COMPANY ELECTRONIC COMMERCIAL MESSAGE RULES AND INFORMATION NOTICE

As Fabay Tourism Investments Construction Manufacturing Joint Stock Company (“FABAY”), in accordance with the Law No. 5809 on Electronic Communications, the Law No. 6563 on Regulation of Electronic Commerce, the Law No. 6698 on Protection of Personal Data (“KVKK”), and relevant legislation, we have prepared this Electronic Commercial Message Rules and Information Notice to provide you with information regarding the sending of commercial electronic messages to you and the processing, storage, and transfer of your personal data.

In this context, the contact information you have shared through electronic forms on social media accounts may be used for marketing communications with your consent. The processing of your personal data for marketing activities includes conducting communication, planning and implementing marketing processes, conducting marketing analysis studies, and sending commercial electronic messages such as services, promotions, announcements, surveys, events, advertisements, etc. through social media accounts, phone, SMS, email, and other channels to which you have given consent. This processing is based on the requirement of obtaining explicit consent under Article 6 of the Law No. 6563 on Regulation of Electronic Commerce and the legal basis of obtaining explicit consent under the first paragraph of Article 5 of the KVKK.

You can withdraw your explicit consent at any time, and if you revoke your consent regarding the sending of commercial electronic messages, it will be deemed that you have withdrawn your explicit consent.

Your personal data will be directly used by FABAY or through data processors and will be shared with FABAY’s business partners and suppliers in order to fulfill the stated purposes.

You can submit your requests regarding the rights listed under Article 11 of the KVKK through the channels specified in the Information Notice in accordance with the “Communiqué on Procedures and Principles of Application to the Data Controller”.