Personal Data Protection (KVKK) Notice

This Privacy Notice has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698(“KVKK” or the “Law”) and the related secondary legislation, in order to inform users of the online hotel reservation platform operating under the Bedoka brand about the processing of their personal data.

1. Identity of the Data Controller

Your personal data is processed by the company whose details are set out below, in its capacity as “data controller” as defined in Article 3 of the KVKK:

• Title:DYF Turizm Ltd. Şti. (the “Bedoka” or the “Company”)
• Tax Office / No.: Üsküdar Tax Office — 3210363044
• TÜRSAB Licence No.: 7747
• Address: [company address]
• Phone: [phone]
• Email: info@bedoka.com — Web: bedoka.com

2. Categories of Personal Data Processed

Depending on the nature of the intermediary (reservation) service it provides, Bedoka may process the following categories of personal data:

• Identity data: first name, surname, date of birth, national ID / passport number (where required by the hotel or by legislation), nationality.
• Contact data: email address, mobile phone number, billing/contact address.
• Reservation and transaction data: stay dates, hotel and room preferences, number of guests, special requests, reservation code, cancellation/refund records, order history.
• Payment data: payment amount and currency, payment method, transaction reference, invoice information. Your card details are not stored by the Company; payment is collected by authorized payment/banking institutions through secure infrastructures.
• Usage and cookie data: IP address, device and browser information, session logs, on-site navigation data, and data obtained through cookies and similar technologies. For details, please see our Cookie Policy.

3. Purposes of Processing Personal Data

Your personal data is processed primarily for the following purposes:

• Establishing, carrying out and completing the hotel reservation and intermediary service;
• Confirming the reservation by sharing it with the relevant hotel and/or partner agencies;
• Performing payment transactions and carrying out invoicing and accounting processes;
• Evaluating and concluding cancellation, change and refund requests;
• Providing customer support services and managing requests/complaints;
• Measuring and improving service quality and ensuring platform security;
• Sending marketing, campaign and information messages where your explicit consent exists;
• Fulfilling legal obligations (tax, tourism, identity-notification legislation, etc.).

4. Legal Grounds for Processing Personal Data

Your personal data is processed on the basis of the following legal grounds set out in Articles 5 and 6 of the KVKK:

• Establishment or performance of a contract (Art. 5/2-c): Processing of your data is necessary to create and confirm the reservation and to provide the service.
• Fulfilment of a legal obligation (Art. 5/2-ç): Obligations arising from tax, invoicing, identity-notification and tourism legislation.
• Establishment, exercise or protection of a right (Art. 5/2-e): Keeping evidence and records in dispute, cancellation and refund processes.
• Legitimate interest of the data controller (Art. 5/2-f): Platform security, prevention of fraud and service improvement.
• Explicit consent (Art. 5/1 and Art. 6/2): Your explicit consent is obtained for the sending of commercial electronic messages, non-mandatory cookies and other consent-based processing activities.

5. Transfer of Personal Data

Your personal data may be transferred to the following parties, limited to the realization of the purposes stated above and subject to compliance with the conditions in Articles 8 and 9 of the KVKK:

• Accommodation facilities (hotels): To the hotel that is the subject of the reservation, for the purpose of confirming the reservation and providing the service.
• Partner travel agencies: For the purpose of completing the reservation through the relevant sales channel.
• Payment and financial institutions: For the purpose of securely carrying out the payment transaction through banks, payment institutions and virtual POS providers.
• Service providers: Suppliers from whom we receive IT, server/hosting, email and SMS delivery, customer support and audit services (only to the extent required by the service).
• Authorized institutions and bodies: Public institutions and judicial/administrative authorities, in the event of a legal obligation or request and to the extent permitted by legislation.

Transfer Abroad

Where some of the IT, hosting or communication infrastructures used are located abroad, your personal data may be transferred abroad in compliance with the conditions set out in Article 9 of the KVKK (adequate protection, undertaking, obtaining your explicit consent where necessary, or the other transfer conditions under the Law).

6. Method of Collecting Personal Data

Your personal data is collected through forms you complete via the website and mobile interfaces, the account and reservation records you create, customer support channels, cookies and similar automated means; through partly automated, fully automated, or non-automated methods that form part of a data recording system.

7. Retention Period of Personal Data

Your personal data is retained for the period required by the purposes of processing, taking into account the statutes of limitation and retention periods set out in the relevant legislation (for example, as a rule 10 years under tax and commercial legislation). Upon expiry of the retention period and the elimination of the purpose of processing, your data is deleted, destroyed or anonymized.

8. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK, by applying to the data controller you have the following rights regarding your personal data:

• To learn whether your personal data is being processed;
• To request information about it if it has been processed;
• To learn the purpose of processing and whether it is used in accordance with that purpose;
• To know the third parties to whom the data is transferred domestically or abroad;
• To request correction if it has been processed incompletely or inaccurately;
• To request its deletion or destruction within the framework of the conditions in Article 7 of the KVKK;
• To request that the correction, deletion and destruction operations be notified to the third parties to whom the data has been transferred;
• To object to a result arising against you due to the analysis of the processed data exclusively by automated systems;
• To request the indemnification of the damage if you suffer loss due to unlawful processing.

9. Application Method

You may submit your requests regarding the rights listed in Article 11 to our Company, together with information verifying your identity, through one of the following methods:

• Email: To info@bedoka.com, from the email address registered in the system;
• Registered Electronic Mail (KEP):To our Company’s KEP address [company KEP address];
• Written application: Your wet-signed petition delivered in person or by post to [company address].

Your application will be concluded free of charge within at most 30 (thirty) days, depending on the nature of the request; however, if the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient, or no response is given within the time limit, you reserve the right to lodge a complaint with the Personal Data Protection Board.