MAS ASSISTANCE SERVICES TOURISM TRAVEL AGENCY JOINT STOCK COMPANY

PERSONAL DATA PROTECTION AND PROCESSING POLICY

DATA PROTECTION PURPOSE

Within the scope of the Law on the Protection of Personal Data, we aim to ensure transparency by informing the persons whose personal data is processed by our Company, especially our Employee Candidates, Company Shareholders, Company Officials, Visitors, Employees, Shareholders and Officials of the Institutions we cooperate with, and Third Parties. In addition, we take the necessary protective measures in accordance with the relevant law in the processing of your personal information.

PERSONAL DATA PROTECTION POLICY

• Information Text on Processing of Personal Data:

Article 10 of the Law on the Protection of Personal Data No. 6698 (“LPPD”), with the title of “Data Controller’s Obligation to Inform”, imposes an obligation on MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ, which is the ‘data controller’, to inform the relevant persons (in other words, ‘data owners’) about the identity of the data controller, the purposes of processing personal data, the persons to whom personal data is transferred and the purposes of transfer, the legal reasons and methods of collecting personal data, and the rights that the personal data owner may direct towards the data controller, as listed in Article 11 of the LPPD. In this context;

1. Identity of the Data Controller:

Article 10, paragraph 1, subparagraph (a) of the KVKK titled ‘Data Controller’s Obligation to Disclose’ has introduced the obligation to provide information on the identity of the data controller. Article 3, paragraph 1, subparagraph (ı) of the KVKK defines the data controller as ‘the natural or legal persons who determine the purposes and means of processing personal data and are responsible for the establishment and management of the data recording system’. In terms of the application of the KVKK, MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ may be the “data controller”. In this context, the “identity of the data controller” means the company established as a joint stock company in accordance with the laws of the Republic of Turkey and continuing its existence without interruption, registered with the Istanbul Trade Registry Office with the registration number 1007610, with the Mersis Number 0612173128500001, with its headquarters in Suadiye Mah. Emin Alipaşa Cad. MAS ASSISTANCE SERVIS HIZMETLERI TURIZM SEYAHAT AGENCY JOINT STOCK COMPANY is located at Suadiye Palas 18/5 Kadıköy/İstanbul.

1. Purposes of Processing Personal Data:

Your Personal Data is processed in accordance with the personal data processing principles specified in Article 4 of the KVKK based on one or more of the personal data processing conditions specified in Article 5 of the KVKK. In all personal data processing activities carried out by MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ, the obligations sought in all relevant legislation, primarily KVKK, are also complied with. The purposes of processing your personal data are to ensure that our business units carry out the necessary work to enable you to benefit from the products and services offered by our Company within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK; to customize the products and services offered by our Company according to your tastes, usage habits and needs and to recommend them to you; to ensure the legal and commercial security of our Company and the persons who have a business relationship with our Company; and to determine and implement the commercial and business strategies of our Company.

1. To Whom and For What Purposes Can Processed Personal Data Be Transferred:

Your collected personal data may be transferred to our business partners, suppliers, shareholders, legally authorized public institutions and private persons within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK, limited to the purposes specified in the MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ Personal Data Processing and Protection Policy, which you can access from the internet address ………………, for the purposes of carrying out the necessary work by our business units to enable you to benefit from the products and services offered by our Company; customizing the products and services offered by our Company according to your tastes, usage habits and needs and recommending them to you; ensuring the legal and commercial security of our Company and the persons who have a business relationship with our Company, and determining and implementing the commercial and business strategies of our Company.

1. The Method and Legal Reason for Collecting Your Personal Data:

Your personal data is collected by MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ through different channels and based on legal reasons in order to carry out our commercial activities. Your personal data may also be processed and transferred for the purposes specified in this Disclosure Text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

1. Rights of the Personal Data Owner Listed in Article 11 of the KVKK:

As personal data owners, you can submit your requests regarding your rights to us through the procedures in accordance with the law set out in the MAS ASSİSTANCE SERVİS HİZMETLERİ TURİZM SEYAHAT ACENTELİĞİ ANONİM ŞİRKETİ Personal Data Processing and Protection Policy shared with the public at the internet address …………………. Your request will be finalized free of charge as soon as possible and within thirty days at the latest. However, “ Communiqué on the Procedures and Principles of Application to the Data Controller” In accordance with Article 7, if the written response to the application of the relevant person is to be given, no fee will be charged for up to 10 (ten) pages, and a processing fee of 1 Turkish Lira may be charged for each page over 10 (ten) pages. If the response to the application is given on a recording medium such as an external memory, the fee that may be requested by our company will not exceed the cost of the recording medium.

The rights of real persons whose personal data is processed, pursuant to Article 11 of the KVKK, are as follows:

• Learning whether personal data is being processed,
• To request information regarding the processing of personal data,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred, either domestically or abroad,
• To request correction of personal data if it is processed incompletely or incorrectly and to request notification of the action taken to third parties to whom personal data is transferred,
• Requesting the deletion or destruction of personal data in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the provisions of the KVKK and other relevant laws, and requesting that the action taken within this scope be notified to third parties to whom personal data has been transferred,
• To object to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems,
• To request compensation in case of damages due to unlawful processing of personal data.

PROCESSING OF PERSONAL DATA OF EMPLOYEE CANDIDATES DURING THE RECRUITMENT AND PLACEMENT PROCESS

This section contains special regulations regarding the processing of personal data of Candidate Employees during the recruitment process.

• Personal Data Collected and Processed During the Recruitment Process:

The Company may process all or part of the information specified in Section 6 of this Policy titled “Categorization of Personal Data” depending on the nature of the application made. The Company may also collect and process the following information of Job Applicants:

• Name, address, date of birth, e-mail address, telephone number and other contact information,
• CV, cover letter, past or relevant work experience or other experience, educational status, transcripts, language test results or supporting or explanatory documents regarding the job application,
• Records of information obtained during the interview, in the case of face-to-face interviews or via means such as video conferencing, telephone,
• Information obtained as a result of references received from previous employers or checks conducted to verify the accuracy of information provided by the candidate or information obtained as a result of research conducted by the Company,
• Results of recruitment tests that identify aptitude and personality traits.

Depending on the nature of the job, the Company may request special personal data (for example, criminal record or health report) from the applicants. In such a case, the Employment Candidate is informed about the reason for requesting the special personal data and the purpose of use via the application form or a separate explanatory note.

• Purposes of Collecting and Processing Personal Data of Job Candidates

The Company may process the personal data of the Job Applicants based on one or more of the purposes specified in Section 7 of this Policy titled “Purposes of Processing Personal Data” and taking into account the nature of the application. The Company may also collect and process the information of the Job Applicants for the following purposes:

• To evaluate the suitability of the candidate’s qualifications, experience and interests for the open position,
• If necessary, to check the accuracy of the information provided by the Employee Candidate or to contact third parties and conduct research about the Employee Candidate,
• To contact the Candidate for Employment regarding the application and recruitment process or, if appropriate, to contact the Candidate for any position opened later in the country or abroad or for MAS ASSISTANCE SERVICE HİZMETLERİ TURİZM SEYAHAT ANCENTELİĞİ ANONİM ŞİRKETİ Group companies, to direct them to other MAS ASSISTANCE SERVICE HİZMETLERİ TURİZM SEYAHAT ANCENTELİĞİ ANONİM ŞİRKETİ Group companies that may be suitable,
• To meet the requirements of any legislation or the requests of any authorized institution or organization.
• To develop and improve the recruitment policies applied by the Company.

• Methods of Collecting and Processing Personal Data of Job Candidates

• Through a digital application form published in written or electronic media,
• Through the CVs that Candidate Employees send to the Company via e-mail, cargo, references and similar methods,
• Through employment or consultancy companies,
• During the interview, in cases where an interview is conducted via video conference, telephone, or face-to-face,
• During the checks and research conducted by the Company to verify the accuracy of the information provided by the Candidates,
• Through recruitment tests that identify talents and personality traits, conducted by experts and whose results are examined.

The Company processes the collected personal data by automatic or non-automatic means through computer systems and human resources personnel.

• Personal Data Collected During the Candidacy Process to be Processed in the Event of Recruitment

All personal data collected and processed about the Candidate Employees during the recruitment process are transferred to the employee file if it is decided to employ the Candidate Employee in the relevant open position.

• Security of Personal Data of Employee Candidates

There is no negative discrimination between the security of personal data of the Company’s employees and candidates applying for a job at the Company.

CONDITIONS FOR PROCESSING PERSONAL DATA OF EMPLOYEE CANDIDATES

The explicit consent of the personal data owner is one of the legal bases that enable the lawful processing of personal data. In addition to explicit consent, personal data may also be processed if one of the other conditions listed below is present. The basis for the personal data processing activity may be only one of the conditions listed below, or more than one of these conditions may be the basis for the same personal data processing activity. In the event that the processed data is special personal data, in addition to the rules stated here; the conditions set out in the “Instances in Which Special Personal Data Can Be Processed” section below shall apply.

• Processing of Personal Data of Job Candidates Based on Explicit Consent

Unless otherwise specified, personal data of job candidates are processed based on explicit consent. Job candidates are informed about the personal data processed, the purposes and reasons for which their personal data is processed, the sources from which their personal data is collected, with whom this personal data will be shared and how it will be used, and their explicit consent is obtained in this manner. Obtaining explicit consent is prepared specifically for each data collection source, taking into account the source from which personal data is collected.

• Explicitly Provided in Laws

In cases where the law explicitly requires the processing of personal data, the Company processes personal data without obtaining the express consent of the Employee Candidate whose data will be processed.

• Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility

Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility

• Direct Interest in the Establishment or Performance of the Contract

Data may be processed if it is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract.

• Fulfillment of the Company’s Legal Obligations

If processing is mandatory to fulfill legal obligations as the data controller, the data of the Employee Candidate may be processed without obtaining explicit consent.

• Employee Candidate’s Making His/her Personal Data Public

If the personal data of the Employee Candidate is made public, the data may be processed without the need for explicit consent.

• Data Processing is Necessary for the Establishment or Protection of a Right

If data processing is mandatory for the establishment, exercise or protection of a right, the data may be processed without the explicit consent of the Employee Candidate.

• Processing of Data Based on Legitimate Interest

If data processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the Employee Candidate, the data may be processed without the explicit consent of the Employee Candidate.

ENLIGHTENING AND INFORMING THE CANDIDATE EMPLOYEE

During the collection of personal data, personal data owners are informed by the Company. In this context, the identity of the Company representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data, and the rights of the Job Candidates are notified to them. If Job Candidates request information regarding their personal data, the Company provides the necessary information.

CATEGORIZATION OF PERSONAL DATA

Within the scope of this Policy, the Company processes the personal data of the Job Candidates in the following categories.

• Identity Information
• Contact information
• Physical space security information
• Audio/visual information
• Financial information
• Personal information
• Special personal data
• Request/complaint management information

STORAGE PERIOD OF PERSONAL DATA

When determining the storage period of personal data, the obligations imposed by legal regulations are taken into account. In addition to legal regulations, the storage period is determined by taking into account the purposes for which personal data is processed. If the purpose of data processing is eliminated, the data is deleted, destroyed or anonymized unless there is another legal reason or basis that allows the data to be retained.

If the purpose of processing personal data has ended; if the storage periods determined by the relevant legislation and the Company have also expired; personal data may only be stored as evidence in possible legal disputes or for the purpose of asserting the relevant right related to personal data or establishing a defense. In establishing the periods herein, the storage periods are determined based on the statute of limitations for asserting the said right and the examples of previous requests made to the Company on the same issues despite the expiration of the statute of limitations. In this case, the stored personal data is not accessed for any other purpose and access is provided to the relevant personal data only when it is required to be used in the relevant legal dispute. Here too, after the mentioned period has expired, personal data is deleted, destroyed or anonymized.

SECURITY OF PERSONAL DATA

In order to ensure the security of personal data, reasonable measures are taken to prevent unauthorized access risks, accidental data loss, deliberate deletion of data or damage to data. All necessary technical and physical measures are taken to prevent access to personal data by persons other than those authorized to access it. In this context, the authorization system is designed in such a way that no one can access more personal data than necessary. While ensuring the security of special personal data such as health data, stricter measures are taken compared to other personal data. Authorized persons are subjected to the necessary security checks. In addition, these persons are trained on their duties and responsibilities. Records of access to personal data are kept to the extent that technical possibilities allow and these records are reviewed at regular intervals. In the event of unauthorized access, an investigation is initiated immediately.