PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This Privacy Notice has been prepared in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. It is intended to inform our natural-person customers and business partners whose personal data are processed by our Company.

1. IDENTITY OF THE DATA CONTROLLER

Your personal data may be processed by Papillon Istanbul (hereinafter referred to as the “Company”), acting as the data controller, within the scope described below pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”).

2. PURPOSES OF PROCESSING PERSONAL DATA

The Company processes personal data of our valued visitors falling within the categories of identity, contact information, visual and audio records, financial information, and customer transaction data.

Our Company processes your personal data solely for the legal and legitimate purposes listed below:

• Managing emergency processes.
• Conducting activities in compliance with applicable legislation.
• Managing communication and customer relations processes.
• Ensuring the security of our Company.
• Providing services and carrying out the necessary activities within this scope.
• Responding to your requests conveying complaints and requests.
• Identifying and resolving issues and communicating with individuals during these processes.
• Carrying out the necessary work by our business units to enable you to benefit from the services offered by our Company.
• Coordinating communications regarding goods and services supplied to our Company by you or by an enterprise you represent.
• Maintaining financial and accounting records and carrying out payment transactions.
• Ensuring communication among suppliers, business partners, external service providers, and customers.
• Managing customer complaints.
• Managing post-service processes.
• Preparing reports deemed necessary within the scope of the Company’s activities.

3. METHOD AND LEGAL BASIS FOR COLLECTING YOUR PERSONAL DATA

Your personal data are collected by automated and non-automated means for the purposes listed above.

When processing your personal data, our Company relies, to the extent applicable according to the nature of the processing activity, on the legal grounds set out in Article 5 of the Law. In this context, your personal data are processed only on the following legal grounds:

• To the extent directly related to the performance of sales agreements to which you are a party, we process the identity, contact, customer transaction, and financial data of our valued customers, prospective customers, and business partners.
• We process identity and customer transaction data in order to fulfill our Company’s legal obligations, such as issuing invoices.
• For the purpose of ensuring the security of our Company, our head office is monitored 24/7 through closed-circuit CCTV systems. Taking care not to harm the fundamental rights and freedoms of our customers and business partners, visual recordings of our visitors are processed within the scope of our Company’s legitimate interests.

4. PARTIES TO WHOM YOUR PERSONAL DATA ARE TRANSFERRED AND PURPOSES OF TRANSFER

Our Company does not transfer the personal data of our valued visitors abroad.

Personal data belonging to our customers and business partners are transferred only where necessary for the data controller to fulfill its legal obligations and only to the extent required, to legally authorized public institutions (including finance and tax authorities), private organizations from which support is legally required (including accounting service providers), and our group companies. During such transfers, our Company, as data controller, acts in accordance with all required technical and administrative measures.

• Planning and carrying out our Company’s human resources policies and processes.
• Carrying out the necessary work by our business units to enable relevant persons to benefit from the services offered by our Company and conducting the related business processes.
• Planning and carrying out activities necessary to customize, recommend, and promote the services offered by our Company according to the preferences, usage habits, and needs of relevant persons.
• Carrying out the necessary work by our relevant business units to conduct the commercial activities performed by our Company and managing the related business processes.
• Planning and implementing our Company’s commercial and/or business strategies.
• Ensuring the legal, technical, and commercial/business security of our Company and of relevant persons who have a business relationship with our Company.

5. YOUR RIGHTS AS A DATA SUBJECT UNDER ARTICLE 11 OF THE LAW

As a personal data subject, you have the following rights under Article 11 of the Law:

• To learn whether your personal data are processed.
• If your personal data have been processed, to request information regarding such processing.
• To learn the purpose of processing your personal data and whether they are used in accordance with that purpose.
• To know the third parties to whom your personal data are transferred domestically or abroad.
• To request correction of your personal data if they have been processed incompletely or inaccurately, and to request that the transaction carried out in this respect be notified to third parties to whom your personal data have been transferred.
• Even though processed in compliance with the Law and other applicable laws, to request deletion or destruction of your personal data where the reasons requiring their processing no longer exist, and to request that the transaction carried out in this respect be notified to third parties to whom your personal data have been transferred.
• To object to the occurrence of a result against you arising from the analysis of processed data exclusively through automated systems.
• To claim compensation for damages arising from the unlawful processing of your personal data.

6. FOR YOUR REQUESTS

If you wish to contact us within the scope of Law No. 6698 on the Protection of Personal Data, provide feedback, exercise your rights under the Law as explained above, or submit questions on this matter, you may personally deliver your petition containing your request together with documents verifying your identity to Maslak Mah. Büyükdere Cad. No: 237 Noramin İş Merkezi Floor: 4 Sarıyer/Istanbul, or send it to the same address through a notary public.

Depending on the nature of your request, your application will be concluded free of charge as soon as possible and no later than thirty days. However, if the process gives rise to an additional cost, our Company reserves the right to charge a fee in accordance with the tariff determined by the Personal Data Protection Board.