INFORMATION TEXT ON THE PROTECTION OF PERSONAL DATA ACCORDING TO THE LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA ("KVKK")

(for customers, potential customers, supplier representatives, supplier employees, and visitors)

As Aria Palace Taksim ("Company"); in the capacity of data controller; we inform you that your personal data collected from our central and branch workplaces verbally, in writing, or electronically can be recorded, stored, preserved, shared with institutions legally authorized to request such personal data, classified under the conditions stipulated by KVKK, and processed in other ways enumerated in KVKK.

Personal Data That May Be Processed The personal data that may be processed by the COMPANY from parties such as customers, potential customers, supplier representatives, supplier employees, and visitors include, for example, the following categories: Identity card information (Name, Surname, ID Number, Date of Birth, Place of Birth, Mother-Father Name, ID card serial and number, Gender, Marital Status, City-District of Registration, Neighborhood-Village, Volume Number, Family Serial Number, Sequence Number, Place of Issue, Reason for Issue, Date of Issue, Registration Number), Phone number, Mobile phone number, e-mail address, Residential address, Workplace address, Vehicle plate information, Shopping history information, Invoice information, Promissory note information, Check information, Bank and branch information, Bank IBAN number, Information in correspondence with judicial authorities, Information in the case file, Camera recordings.

Method and Legal Reason for Collecting Your Personal Data Your personal data are collected from our central and branch workplaces verbally, in writing, or electronically; within the framework of the legal legislation, by the COMPANY based on legal reasons such as the performance of contracts, explicitly stipulated by law, your personal data being made public by you, the necessity for the establishment, use or protection of a right granted to you, and the necessity for the COMPANY to fulfill its legitimate interests and legal obligations without harming your fundamental rights and freedoms.

Purposes for Processing Personal Data Your collected personal data will be processed for the purposes of:

• Conducting business activities

• Conducting communication activities

• Conducting finance and accounting affairs

• Conducting procurement processes

• Conducting sales processes

• Ensuring physical space security

• Following and conducting legal affairs

• Conducting product and service marketing processes

• Providing information to authorized persons, institutions, and organizations

within the personal data processing conditions and purposes stated in Articles 5 and 6 of Law No. 6698, and will be stored for the maximum period required for the purposes for which they are processed or as stipulated in the relevant legislation.

To Whom and For What Purpose Processed Personal Data May Be Transferred Your collected personal data may be transferred to legally authorized public institutions and organizations, administrative authorities, and legal authorities, limited to the realization of the purposes stated above.

Rights of the Personal Data Owner Under Article 11 of Law No. 6698 As personal data owners, if you submit your requests regarding your rights to the Company through the methods set out below, the Company will finalize the request as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction incurs an additional cost, the Company will charge the fee determined in the tariff by the Personal Data Protection Board.

In this context, personal data owners have the right to:

• Learn whether their personal data are processed,

• Request information if their personal data have been processed,

• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

• Know the third parties to whom personal data are transferred domestically or abroad,

• Request the correction of incomplete or inaccurate data, if any, and to request notification of the transactions made within this scope to the third parties to whom personal data have been transferred,

• Request the deletion or destruction of personal data in the event that the reasons requiring the processing of data disappear, even if it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, and to request notification of the transactions made within this scope to third parties to whom personal data have been transferred,

• Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,

• Demand compensation for the damages in case of suffering damage due to the unlawful processing of personal data.

You may submit your request to exercise your above-mentioned rights in accordance with the 1st paragraph of Article 13 of Law No. 6698 and the Communiqué on the Principles and Procedures for Application to the Data Controller dated 10.03.2018 and numbered 30356, in writing or via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the electronic mail address previously notified to the Company and registered in our system.

In your application, it is mandatory to include: a) Your name, surname, and signature, b) Your Turkish ID number, nationality if you are a foreigner, passport number, or identity number if any, c) Your request, d) Your address for notification, e) Your notification e-mail address, telephone, and fax number, if any, f) Information and documents related to the subject, if any.

You can hand-deliver your written applications with the necessary documents to the data controller Aria Palace Hotel and Spa, Hüseyinağa, Atif Yilmaz Sok. No:11, 34150 Beyoğlu/Istanbul address or send them via registered mail.

You can send your applications via e-mail to info@ariapalacetaksim.com.

It is necessary to provide the information and documents completely and accurately according to the nature of your request. In the case of incomplete or incorrect information and documents, there may be delays in the full and qualified conduct of the research to be carried out by the COMPANY based on your request. In this case, the COMPANY reserves its legal rights. Therefore, your application must be submitted completely and with the requested information and documents according to the nature of your request.