Disclosure Text

As the data controller (DREAM WORLD) OPTIMAL TOURISM INDUSTRY TRADE JOINT STOCK COMPANY, you can access the details related to the explanations in this disclosure text prepared in accordance with the KVKK Policy and Law No. 6698 on the Protection of Personal Data (KVKK Law), which has been prepared and implemented in this accommodation facility, through the documents included in the Data Controller KVKK Policy and its annexes. Accordingly;

Your Personal Data Being Processed

• Identity and Family Information: Name-surname, ID No, Passport No, place of birth – date, marital status, profession, gender, child name, number, age and dates of birth, signature, voucher (travel card) information and register card (accommodation card information), room type and number, flight number, hotel stayed, accommodation dates and amount

• Contact Information: Address, phone number, email address

• Location Information: Accommodation and location information

• Customer Transaction Information: Vehicle plate, survey form, records for product and service delivery, requests, instructions, photos, marriage, birth special days anniversary, call center records, invoice, promissory note, check information, information on cashier receipts, order information, request information

• Physical Space Security Information: Entry and exit record information of employees and visitors, camera and audio recordings

• Transaction Security Information: IP address, hotspot records, password and password information, website login exit information, log and digital traffic records

• Financial Information: Bank account number, IBAN, Credit card number, CVC code, expiration date

• Visual and Audio Recordings and Information: Audio recordings received through the call center, Visual and audio recordings and information

• Health Information: Information about disability status, blood type information, chronic diseases, past illnesses, asthma, diabetes, heart, blood pressure diseases, personal health information, device and prosthesis information used

Collection Method and Legal Reasons of Your Personal Data

According to this disclosure text, your personal data is obtained verbally, in writing or electronically by automatic or non-automatic methods, provided that they are part of the data recording system, through solution partners with whom we cooperate, third parties with whom we have contracted and provide services as a requirement of operating in a contractual relationship, or through information, documents and similar means sent by you.

This data can be processed directly under the conditions specified below in cases where your explicit consent is not required, within the framework of Article 5 of Law No. 6698 on KVKK. Accordingly;

• Explicitly stipulated in laws.

• Necessary for the protection of the life or physical integrity of the person who is unable to express his/her consent due to actual impossibility or whose consent is not legally valid.

• Necessary for the processing of personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.

• Mandatory for the data controller to fulfill its legal obligation.

• Made public by the relevant person himself/herself.

• Mandatory for the establishment, use or protection of a right.

• Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

Within the scope of Article 6 of Law No. 6698 on KVKK, your special category personal data other than health and sexual life can be processed based on your explicit consent or in cases stipulated by law in accordance with the provisions of the same article. In the absence of your explicit consent, your personal data relating to health and sexual life can only be processed by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

Processing Purpose of Your Personal Data

Your personal data is processed within the following purposes, taking into account the principles of compliance with law and honesty rules, being accurate and up-to-date when necessary, being processed for specific, clear and legitimate purposes, being limited and proportionate to the purpose they are processed, being kept for the period stipulated in the relevant legislation or necessary for the purpose they are processed, in accordance with Articles 4, 5 and 6 of Law No. 6698 on KVKK.

Your personal data is not processed for purposes other than those indicated above. All kinds of technical and administrative measures are taken by the business to prevent the processing of personal data illegally or illegal access to it.

Transfer of Your Personal Data

Your personal data can be transferred domestically or abroad in the presence of the following conditions according to Articles 8 and 9 of Law No. 6698 on KVKK.

Personal data obtained due to the existence of the conditions in Article 5 of Law No. 6698 on KVKK or in accordance with your explicit consent can be transferred to persons, institutions and companies with whom we cooperate, persons and institutions with whom we interact such as shareholders, suppliers, third parties to whom services are provided or from whom services are received, in accordance with the provisions of Articles 8 and 9 of the Law, for the purposes stated above and again for the purpose of realizing the activities stated above.

Provided that sufficient measures are taken, your personal data related to health can be transferred by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the relevant person.

In cases where it is explicitly stipulated in laws, it is necessary to protect the life or physical integrity of a person who is unable to express his/her consent due to actual impossibility or whose consent is not legally valid, it is necessary for the processing of personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract, it is necessary for the data controller to fulfill its legal obligation, the data has been made public, it is necessary for the establishment, use or protection of a right, and it is necessary for the processing of data for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms, and also for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or authorized institutions and organizations under the obligation of confidentiality, your personal data can be transferred abroad without seeking your explicit consent, provided that there is sufficient protection, and in the absence of sufficient protection, provided that the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing and with the permission of the KVKK Board.

Within this framework, your personal data can be transferred for the following purposes:

• To Authorized Public institutions and organizations

• To Company partners and authorities

• To Business and solution partners

• To Supplier persons and companies

• To Real or legal persons with whom they interact

Your Rights as a Personal Data Subject

Within the scope of the law, the data subject, i.e. the relevant person:

• Learning whether personal data is processed or not,

• Requesting information if personal data has been processed,

• Learning the purpose of processing personal data and whether it is used in accordance with its purpose,

• Knowing the third parties to whom personal data is transferred domestically or abroad,

• Requesting correction if personal data is incomplete or incorrectly processed,

• Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

• Requesting notification to third parties to whom it has been transferred regarding incorrectly processed personal data whose correction is requested and personal data whose destruction is requested,

• Objecting to the occurrence of a result against the person as a result of the analysis of the processed data exclusively through automated systems,

• Requesting compensation for damages in case of damage due to illegal processing of personal data,

In order to be able to use the complaint rights you have as a personal data owner, you must first apply to the personal data controller using the following contact channels. The path to complaint to the KVKK Board cannot be taken without exhausting this path.

Your request is answered by our company as the data controller within the shortest time and at most within 30 days, depending on the nature of the request.

In case of rejection of your application or finding the answer insufficient or not responding to your application in time, you can use your right to complain to the KVKK Board or apply directly to the judiciary.

Retention Period of Your Personal Data

Your personal data, which needs to be processed by the methods specified above and for the purposes specified, is kept for the period specified in the data inventory, taking into account the statute of limitations and forfeiture periods specified in the law. When the reasons requiring the processing of your data disappear or when the periods mandatory for the processing of your data under the legislation expire, it is deleted, destroyed or anonymized by our Company using any of the destruction methods within six months at the latest ex officio or within thirty days at the latest upon your request.

Deletion of your personal data is the process of making it completely inaccessible and reusable for relevant users.

Destruction of your personal data is the process of making personal data completely inaccessible, irrecoverable and reusable by anyone.

Anonymization of your personal data is making the data unrelated to an identifiable or identifiable natural person through the use of appropriate techniques.

The transactions made regarding the deletion, destruction and anonymization of your personal data are recorded. In the face of public requirements, these minutes are kept for a period of 5 years.

We respectfully submit to your information.