Preliminary Information Form

Agreements

Preliminary Information Form

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

Data Controller, Categories of Personal Data, and Collection Methods In accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK No. 6698”) and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 (“GDPR”); your personal data consisting of identity, contact, customer transaction, and transaction security information are collected from you or third parties via written data transfer in electronic environments through automated means. These data are processed by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (the “Company”), as the data controller, within the scope detailed below.
Personal Data Privacy Principles You may access the principles followed by our Company in ensuring data privacy through the "Web Privacy and KVK Principles" text available on our website.
Purposes and Legal Grounds for Processing Personal Data Your personal data collected by us are processed based on the following purposes and legal grounds:

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

Data Controller, Categories of Personal Data, and Collection Methods In accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK No. 6698”) and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 (“GDPR”); your personal data consisting of identity, contact, customer transaction, and transaction security information are collected from you or third parties via written data transfer in electronic environments through automated means. These data are processed by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (the “Company”), as the data controller, within the scope detailed below.
Personal Data Privacy Principles You may access the principles followed by our Company in ensuring data privacy through the "Web Privacy and KVK Principles" text available on our website.
Purposes and Legal Grounds for Processing Personal Data Your personal data collected by us are processed based on the following purposes and legal grounds:

Purpose of Data Processing	Personal Data Categories	Legal reason
Conducting Activities in Compliance with Legislation	Transaction Security	Law No. 6698 Article 5/2-a: Explicit provision in laws. Law No. 6698 Article 5/2-c: Being mandatory for the data controller to fulfill its legal obligation.
Conducting Information Security Processes	Transaction Security
Conducting Storage and Archiving Activities	Identity, Communication, Customer Transactions, Transaction Security
Conducting Membership Processes	Identity, Communication, Customer Transactions	Law No. 6698 Article 5/2-c: Being necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
Conducting Communication Activities	Identity, Communication, Customer Transactions, Transaction Security	Law No. 6698 Article 5/1: Having the explicit consent of the data subject
Conducting Customer Satisfaction Processes

Transfer of Personal Data

Your personal data may be transferred to third parties under the following conditions:

Legal Basis for Transfer	Purpose of Transfer	Recipient Party
Law No. 6698 Article 8/2-a: Being necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject	Transfer of necessary information to our business partners for conducting information security processes	Business Partners
Law No. 6698 Article 8/2-a: Being mandatory for the data controller to fulfill its legal obligation	Conducting activities in compliance with legislation	Authorized Public Institutions

Retention Periods for Personal Data

The retention periods for personal data processed by the Company are as follows:

Personal Data Category	Retention Period
Identity	10 years from the end of the legal relationship
Communication	10 years from the end of the legal relationship
Customer Transaction	10 year
Transaction Security	6 month

Personal Data Security Measures You may access the measures taken by our Company to ensure data privacy through the "Web Privacy and KVK Principles" text available on our website.

Your Rights Regarding Personal Data

Rights Regarding Personal Data Under KVKK No. 6698 The rights that data subjects may exercise regarding their personal data are set forth in Article 11 of KVKK No. 6698 and are as follows:

To learn whether personal data is being processed,
To request information if personal data has been processed,
To learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,
To know the third parties to whom personal data are transferred within the country or abroad,
To request the rectification of personal data if it is incomplete or incorrectly processed,
To request the erasure or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK and to request notification of the operations carried out in this regard to third parties to whom the personal data has been transferred,
To object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
To request compensation for the damages in case of loss due to unlawful processing of personal data.

Rights Regarding Personal Data Under GDPR

The rights that data subjects may exercise regarding their personal data are set forth in Chapter 3 (Articles 12-23) of the GDPR and are listed below:

To withdraw consent at any time where your personal data is processed based on your explicit consent;
To request the restriction of processing of your personal data in the following cases:
- If the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy,
- If the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
- If we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims, or
- If you have objected to processing pursuant to Article 21 of the GDPR, pending the verification whether our legitimate grounds override yours;
To object to the processing of your personal data, including profiling, where your personal data is processed on the grounds of public interest, the exercise of official authority, or the legitimate interests of the data controller or a third party;
To access the following information:
- Confirmation as to whether or not personal data concerning you are being processed, and where that is the case, access to the personal data and information regarding the purposes and categories of processing,
- The recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
- The existence of the right to request rectification, erasure, or restriction of processing, the right to object to such processing, and the right to lodge a complaint with a supervisory authority,
- Where the personal data are not collected from the data subject, any available information as to their source, and
- The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
To receive your personal data in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller (data portability) where the processing is based on consent or a contract and is carried out by automated means;
The right to be informed about the existence of automated decision-making, including profiling, and the logic involved, as well as the significance and envisaged consequences for the data subject.

Application Procedures and Principles

You may submit your rights and requests regarding your personal data by filling out the "Application Form Regarding the Protection of Personal Data" available on our website or by submitting an application that meets the minimum requirements stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following methods. As the Company, we will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company.

Application Procedure	Application Address
Electronic message you will send via KEP	[email protected]
The message you send will be sent via the email address registered in our system or with a secure electronic signature or mobile signature	[email protected]
Application that you submit in writing, either in person or through a notary public	Fabrikalar Mah. Namık Kemal Blv. DalgakulePlaza / 51 B/28

Effectiveness and Updatability

This privacy policy entered into force on the date of its publication. This privacy policy is updated to adapt to changing conditions and legislation. The privacy policy, updated in light of current Board decisions and requirements, is monitored by the Company and published on its website.

Transfer of Personal Data