KVKK Policy

I. Purpose of the Personal Data Processing and Protection Policy

This Personal Data Processing Policy has been prepared by Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. Etiler Mah. Arnavutköy Yolu Sok. No:3 Beşiktaş/İSTANBUL (“Yoyo” or the “Company”), in its capacity as data controller, within the framework of the Law (Law No. 6698 on the Protection of Personal Data), in order to determine the procedures and principles regarding the processing and protection of the personal data of natural persons, including customers, prospective customers, website visitors, employees, job applicants, employees and authorised representatives of business partners and suppliers, visitors and third parties, and to inform data subjects on these matters.

II. Scope

This Policy covers all information (personal data) and documents of any kind managed by the Company that can be associated with an identified or identifiable natural person, as well as the measures taken and the arrangements made in relation to them.

III. Definitions

The expressions used within the scope of the Personal Data Processing and Protection Policy have the meanings set out in Annex I.

IV. General Principles

The regulations of the Law have determined the principles to be complied with when processing personal data.

1. Compliance with the law and the rules of good faith.

When processing personal data, Yoyo acts in accordance with the principles introduced by laws and other legal regulations; while carrying out its data processing purposes and legal obligations within the framework of the legal basis in the legislation, it informs data subjects about data processing activities and takes their interests into account.

2. Being accurate and, where necessary, up to date.

Yoyo collects the personal data it processes directly from the data subject as far as possible, and takes care to keep the data accurate, complete and up to date and to ensure that inaccurate or incomplete data is corrected, completed or deleted.

3. Processing for specified, explicit and legitimate purposes.

Personal data is processed only for a legitimate purpose defined before the data is used, based on a legal processing condition.

The data subject is informed about which of their data is processed for which purpose and on which legal basis.

4. Being relevant, limited and proportionate to the purposes for which they are processed.

Yoyo limits its processing of personal data to data that is sufficient and suitable for achieving the specified purposes and fulfilling its legal obligations, and uses it only for these purposes.

5. Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Upon termination of the commercial relationship, the data is removed from processing and access, and upon expiry of the statutory retention periods, the personal data is deleted, destroyed or anonymised.

V. Processing of Personal Data

1. Classification of Personal Data

1.1. Personal data; is any information relating to an identified or identifiable natural person. Information belonging to legal entities that does not contain information relating to a natural person is not within the scope of personal data protection and is not protected by the legislation on the Law.

1.2. Special categories of personal data; Data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data.

2. Conditions for the Processing of Personal Data

The conditions for the processing of personal data are regulated in Articles 5 and 6 of the Law:

2.1. The person having declared their explicit consent

This is the case where the data subject, having been informed about a specific matter and on the basis of that information, declares with their free will, clearly and leaving no room for doubt, their consent to the processing of their personal data. In the presence of the cases listed in the article below, the explicit consent of the person is not sought, since in these cases the data controller needs to process the personal data and there is no benefit in obtaining the person's consent. Where the Company is to carry out any personal data processing activity other than in the cases specified below, it informs the person extensively and seeks their explicit consent.

2.2. Processing without seeking explicit consent

Where one of the cases specified below exists, the data controller needs to carry out personal data processing activities, and the data may be processed without seeking the explicit consent of the person.

1. Being expressly provided for by law.

Cases such as the processing of personal data while keeping personnel files of employees within the framework of the Labour Law and its legislation, or in the context of invoicing transactions within the framework of tax legislation, are cases expressly provided for by law, and personal data is processed lawfully by the Company.

2. Being mandatory for the protection of the life or bodily integrity of the person themselves or of another person, where the person is unable to express their consent due to actual impossibility or where their consent is not legally valid.

In cases such as an accident, where it is not possible to obtain explicit consent from the data subject, personal data processing takes place.

3. The processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of a contract.

4. Being mandatory for the Data Controller to fulfil its legal obligation.

These are, in particular, personal data requested by the Social Security Institution (SGK), the tax authority and police departments, and processing this data is an obligation of the data controller.

5. The personal data having been made public by the data subject themselves.

This is the case where personal data has been made public and accessible to everyone in any way by the person themselves. Such data is permitted to be processed lawfully without seeking the explicit consent of the person.

6. Data processing being mandatory for the establishment, exercise or protection of a right.

Such data processing activities cover, in particular, information contained in documents that serve as evidence in legal proceedings.

7. Data processing being mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

3. Processing of Special Categories of Personal Data

Our Company acts in accordance with the data processing conditions set out in Article 6 of the Law when processing personal data specified as special categories, which carry a risk of causing discrimination if processed unlawfully. In addition, it also takes the adequate measures determined by the Personal Data Protection Board (the “Board”) when processing special categories of personal data. Processing special categories of personal data without the explicit consent of the data subject is prohibited. However, in the following cases (article 3.), special categories of personal data may be processed even without the explicit consent of the data subject:

4. Processing of Personal Health Data

Personal health data may be processed, provided that (i) the adequate measures to be stipulated by the Ministry of Health are taken, (ii) the general principles are complied with, and (iii) the persons are under an obligation of confidentiality, where one of the conditions listed below exists:

• Written explicit consent of the data subject
• Protection of public health
• Preventive medicine
• Conducting medical diagnosis, treatment and care services,
• Planning and management of health services and their financing.

By complying with all of the matters specified, the Company takes the utmost care to protect special categories of personal data, particularly health data. Such data belonging to Company employees may be processed by the persons stipulated by law.

5. Method of Collecting Personal Data

5.1. Personal data may be collected in person from the data subjects, from the authorised representatives and/or employees of service providers and business partners, from communication channels such as the website, application, e-mail and telephone, from documents such as signature circulars and contracts, through data transmitted via the Call Centre and other digital channels, the office and other service channels, physical forms, information you provide to us during the contractual relationship, and through cooperating institutions and organisations, film production companies, public authorities and other third parties, and through technical communication files submitted via the Company website or automatically transmitted by computer during a visit; verbally, in writing or electronically; by fully or partially automated means or by non-automated means as part of any data recording system.

5.2. Personal data collected through cookies; through cookies, we may collect, process, transfer and store your personal data in order to improve the functioning and use of our website and to remember the preferences you make in these environments.

You can access detailed information on the cookies we use via the “Cookie Policy” link.

6. Personal Data Categories

The personal data categories listed below may be processed by us in connection with our activities:

Identity Information: information such as name and surname, mother's and father's names as stated in the Turkish identity document, mother's maiden name, date of birth, place of birth, marital status, identity card serial number, Turkish ID number,

Contact Information: address, telephone number, address (personal and / or business), e-mail address (personal and / or business), fax number, communication content (e.g. e-mail, fax, call centre voice call recordings, video recordings, etc.),

Legal Transaction: information in correspondence with judicial authorities, information in case files,

Transaction Security Information: data such as IP address information, website/application log-in and log-out information, password and passcode information,

Financial Information: data such as balance sheet information, financial performance information, IBAN, payment data, tax number,

Location Information : information obtained via a GPS device showing the location of the vehicle

Professional Experience: diploma information, courses attended, in-service training information, certificates,

Personnel File Information: information such as payroll information, disciplinary investigations, records of employment start and end documents, CV information,

Special Category Personal Data-Health Information: blood group and device data in the driving licence: information on disability status, blood group information in the identity document, personal health information in employee health reports, information on devices and prostheses used,

Special Category Personal Data-Biometric Data: photograph information used for the protection of certain areas,

Special Category Personal Data -Criminal Convictions and Security Measures: information contained in the Criminal Record,

Risk Management: information processed for the management of commercial, technical and administrative risks,

Contract data: Signature circulars and signature data, etc.

7. Data Subject Groups and Categories of Data Processed

While the Company, in its capacity as data controller as defined in the law, takes care to process as little personal data as possible within the scope of its activities, it is required to process certain personal data as required by laws, contracts and its activities. The groups of persons whose personal data is processed by the Company and the categories of personal data of each group subject to processing are shown below.

8. Purpose

Yoyo may process personal data, in general, for the purposes specified below:

• Conducting Emergency Management Processes
• Conducting Information Security Processes
• Managing Access Authorisations
• Conducting Storage and Archiving Activities
• Planning Human Resources Processes
• Conducting Job Applicant / Intern / Student Selection and Placement Processes
• Conducting Job Applicants' Application Processes
• Fulfilling Obligations Arising from Employment Contracts and Legislation for Employees
• Conducting Fringe Benefits and Benefits Processes for Employees
• Conducting Talent / Career Development Activities
• Conducting Training Activities
• Conducting Assignment Processes
• Conducting Activities in Compliance with the Legislation
• Conducting Finance and Accounting Affairs
• Following Up and Conducting Legal Affairs
• Conducting Internal Audit / Investigation / Intelligence Activities
• Conducting Communication Activities
• Conducting / Auditing Business Activities
• Conducting Business Continuity Activities
• Conducting Goods / Services Production and Operation Processes
• Conducting Customer Relationship Management Processes
• Conducting Risk Management Processes
• Conducting Contract Processes
• Following Up Requests / Complaints
• Conducting Remuneration Policy
• Ensuring the Security of Data Controller Operations
• Providing Information to Authorised Persons, Institutions and Organisations
• Conducting Management Activities

The Company processes personal data specifically for the purposes specified below:

• Personal data is processed by the Company within the scope of its activities and within the framework of the legal obligations arising from the relevant legislation, in order to fulfil those purposes and legal obligations.
• In addition, it may be processed for purposes such as the analysis of products and services, marketing activities, reporting and analysis, improving our website, legal follow-up, use as evidence in potential disputes, and similar purposes.
• As required by the mandatory provisions of the law, it is processed in cases made necessary by reasons such as sharing information with public institutions, providing the necessary information in line with the requests and audits of official authorities, and fulfilling legal obligations, as required by the provisions of Turkish Criminal Code No. 5237, the Law (Law No. 6698 on the Protection of Personal Data) (“KVKK”), Identity Notification Law No. 1774, tax legislation in particular, other relevant legislation and the secondary legislation relating to the relevant laws, and within the framework of other provisions of legislation.
• Personal data processing activities are carried out to track the entries and exits of guests visiting the Company. When the name-surname information of persons coming to our Company is obtained, such data is processed only for this purpose, and the relevant personal data is recorded in a physical record system.
• Where Company visitors use the Company WIFI network, information is processed in order to provide this service and in accordance with Law No. 5651 and its relevant secondary legislation.
• Processing of Personal Data of website visitors: the IP address of users visiting the Website, i.e. relating to the parties, the start and end time of the service provided, the type of service used and the amount of data transferred are processed in accordance with Law No. 5651.

9. Legal basis

As stated above, personal data is processed by Yoyo in order to provide its services and to fulfil Yoyo's legal obligations arising from contracts and the relevant legislation, as regulated in Articles 5 and 6 of the Law, based in particular on the following legal grounds: the explicit consent of the data subject and, without seeking explicit consent, (i) being expressly provided for by law, (ii) the processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of a contract, (iii) being mandatory for the data controller to fulfil its legal obligation, (iv) data processing being mandatory for the establishment, exercise or protection of a right, and (v) data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

10. Information

Pursuant to Article 10 of the Law, at the time personal data is obtained, the Company informs data subjects, with regard to data processing activities, of the identity of the data controller, the method of collecting personal data, the purposes of processing, the legal basis, to whom and for what purpose the data may be transferred, and the rights of data subjects, and obtains declarations of explicit consent where legally required.

VI. Transfer of Data

The procedures and principles to be applied to personal data transfers are regulated in Articles 8 and 9 of the Law, and the personal data and special categories of personal data of the data subject may be transferred to third parties domestically and abroad. Within Article 8 of the Law, within the scope of the Law and the relevant legislation and for the purposes stated above, personal data may be shared with authorised institutions and organisations, in particular the relevant official authorities, and with persons we cooperate with, including banks and insurers, for the purposes of car rental and sales, related services and the development and conduct of services, and with other third parties.

1. Purposes of Transfer

The main purposes of transfer are:

• Planning, conducting and managing its commercial partnerships and strategies correctly,
• Ensuring corporate operations, and planning and executing management and communication activities,
• Enabling Personal Data Owners to benefit from its products and services in the best way and offering them in a personalised manner according to their requests, needs and wishes,
• Ensuring data security,
• Creating databases,
• Improving the services offered on the website and eliminating errors occurring on the site,
• Managing relationships with business partners or service providers,
• Conducting personnel processes,
• Executing/following up the Company's legal affairs,
• Providing information to authorised organisations upon their requests arising from legislation,

In addition, as required by the mandatory provisions of the law, personal data may be shared in cases made necessary by reasons such as sharing information with public institutions, providing the necessary information in line with the requests and audits of official authorities, and fulfilling legal obligations, as required by the provisions of Highway Traffic Law No. 2918, Turkish Criminal Code No. 5237, the Law (Law No. 6698 on the Protection of Personal Data) (“KVKK”), Identity Notification Law No. 1774, tax legislation in particular, other relevant legislation and the secondary legislation relating to the relevant laws, and within the framework of other provisions of legislation.

2. Institutions and Organisations to Which Personal Data Is Transferred

3. Domestic Transfer

In accordance with Article 8 of the Law, the domestic transfer of personal data will be possible provided that one of the conditions specified in Section V titled “Processing of Personal Data” of this Personal Data Policy is met.

4. Transfer Abroad

In accordance with Article 9 of the Law, where personal data is transferred abroad, in addition to the conditions for domestic transfers being met, one of the following is required:

• The country to which the transfer will be made being among the countries with adequate protection announced by the Board, or
• Where adequate protection does not exist in the country to which the transfer will be made, the data controllers in Türkiye and in the relevant foreign country undertaking adequate protection in writing and the Board's permission being obtained.

Transfer abroad will be possible provided that the specified conditions are met.

VII. Technical and Administrative Measures to Ensure Data Security

Pursuant to Article 12 of the Law, the Data Controller is obliged to take all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of and access to personal data and to ensure its retention.

Personal data must be protected, both in the electronic and physical environment, against unauthorised access, unlawful processing and disclosure, and accidental loss, alteration or destruction. To ensure this security, Yoyo determines procedures and rules, ensures that the measures to be taken are at the current level of science and technology, reviews them periodically, prepares status reports and updates them where necessary.

The personal data processed has been classified and an appropriate protection mechanism has been determined. The main technical measures taken by Yoyo are:

A. Administrative Measures

1. In the personal data protection compliance process, including the Law on the Protection of Personal Data, the relevant secondary legislation and Board decisions, the Company's organisation chart was drawn up, and then the Personal Data Inventory was prepared by each unit checking the personal data it processes.

2. The inventory is continuously updated and reflects the Company's most up-to-date data processing activities.

3. The personal data processed has been assessed for each data processing activity, taking into account the legal and actual requirements. For personal data that was found not to be required to be processed on the basis of legal necessity, contractual requirement and the other legal grounds regulated in Article 5 of the Law, the following has been ensured:

a) Where applicable, its destruction with respect to data already collected retrospectively,

b) Going forward, by revising the data processing activity appropriately, that personal data not required to be processed is not processed.

The data processing policy and trainings state that data processing activities are to be shaped in accordance with the fundamental principles of the Law, so that the minimum amount of personal data is processed for the relevant purpose.

The personal data processed in this way is reduced as far as possible.

4. The Technical and Administrative Measures applied by the Company within the scope of personal data protection have been reviewed. The existing risks and threats have been identified, and the measures to be taken have been put into practice after consultation with the relevant department managers.

5. Personal data security policies and procedures have been prepared and put into practice. In this context:

• General Personal Data Protection Policy
• Personal Data Retention and Destruction Policy
• Special Categories of Personal Data Policy
• Data Security (Technical and Administrative Measures) Policy
• Employee/Job Applicant Personal Data Policy
• Cookie Policy
• Internal Audit Policy
• Data Breach Procedure
• Data Transfer Procedure
• Data Subject Application Procedure
• Key Management Procedure
• Procedures and legal texts for Access, Mobile Devices, Password Security, Remote Access and other Administrative and Technical Measures, etc. have been prepared and put into practice.

6. The necessary security measures are taken regarding entries to and exits from physical environments containing personal data.

7. Physical environments containing personal data have been placed in office cabinets so that they are not exposed to fire and water, and the security of the environments against external risks is ensured with fire/gas detectors and fire extinguishers.

8. A Personal Data Protection Committee has been established, and an Administrative Manager, a Legal Manager and an IT Manager have been appointed as committee members. An Internal Directive and other texts determining the duties and powers of the Committee have been prepared. The Committee and employees are ensured to take an active role in monitoring personal data security through their own duties, the planned periodic and random audits, and trainings covering all Company employees.

9. Company employees are informed, both through in-house procedures and in trainings, about reporting to the Committee the personal data security issues they identify. Where the Committee identifies data security issues as a result of such notifications, its own duties or internal audits, it reports them to the Company management together with proposed solutions.

10. An internal audit policy and procedure have been prepared, and the persons responsible for conducting internal audits have been determined. Considering the limited amount of personal data processed by the Company and the Company's high security standards, an annual period has been set for internal audits. The next internal audit has been planned for October-December 2021.

In addition to periodic internal audits, random audits will be carried out by decision of the Company Management or the Committee.

11. With regard to employees;

• Employment contracts have been revised with data security provisions and undertakings are obtained,
• Disciplinary regulations containing data security provisions are in place.
• Personal data protection trainings were given in September 2020; updates and periodic trainings and awareness activities are carried out at certain intervals,
• A duty and authorisation matrix has been created
• The authorisations in this area of employees who change roles or leave the company are revoked,

12. With regard to Special Categories of Personal Data:

• A policy and procedure for data security have been determined and are applied,
• Secure encryption / cryptographic keys are used and managed by different units,
• If to be sent by electronic mail, it is sent encrypted and using a KEP (registered electronic mail) or corporate mail account,

13. With regard to the Data Processor/Supplier/Subcontractor:

• Data security provisions have been added to contracts, or an additional data security protocol has been signed and added to contracts already in force,
• Confidentiality agreements or confidentiality undertakings are made.

14. The data transfer method has been determined by a separate Data Transfer Procedure and regulated separately for the digital and physical environment and for personal data and special categories of personal data. For transfer in the digital environment, encryption and a VPN for the network connection have been stipulated. Extra security measures are taken for personal data transferred on paper.

B. Technical Measures

1. Network security is ensured;

• Network Access Rules have been determined and put into practice (Network Security and Access Procedure)
• A Firewall is used
• Intrusion Detection and Prevention Systems are used.
• Penetration testing is carried out.
• Data loss prevention (DLP) software is used.

2. A closed system network is used for personal data transfers over the network.

3. Encryption is applied.

4. Special categories of personal data transferred on portable memory, CD or DVD are transferred encrypted.

5. Key management is applied to ensure the security of passwords (Key Management Procedure).

6. Up-to-date anti-virus systems are used.

7. User Account Management (User Account and Access Procedure) has been regulated and put into practice. Its monitoring is carried out by the IT Officer.

Access logs are kept regularly.

Log records are kept in a way that allows no user intervention.

8. The security of environments containing personal data is ensured through various physical measures such as entry and exit controls to the physical environment and keeping special categories of data in locked cabinets, and the security of digital environments through various technical measures such as access authorisation management, encryption and backup.

9. The security of personal data stored in the cloud is ensured.

It was established at the time of procuring the service that the cloud service provider applies adequate technical and administrative measures, and continuity is ensured by checking the service provider's periodic audit reports. In addition, a two-factor authentication method is used to access personal data stored in the cloud, and personal data in the cloud is stored encrypted.

10. Data masking is applied where necessary.

Where different units use the same application and unit employees have different access authorisations to personal data, personal data is protected against unauthorised access by masking.

11. Personal data is backed up and the security of the backed-up personal data is also ensured.

C. Measures for special categories of personal data

1. A separate, systematic, manageable and sustainable policy and procedure with clearly defined rules has been determined for the security of special categories of personal data.

2. For employees involved in the processing of special categories of personal data,

• Training is provided on special categories of personal data security,
• Confidentiality agreements are made,
• The scope and duration of the authorisations of users with access to the data are clearly defined,
• Authorisation checks are carried out periodically,
• The authorisations in this area of employees who change roles or leave the company are revoked immediately, and the data in their possession is fully returned.

3. If the environments in which special categories of personal data are processed, stored and/or accessed are electronic environments

a) The data is stored using cryptographic methods,

b) Cryptographic keys are kept in secure and separate environments,

c) Transaction records of all actions performed on the data are securely logged,

ç) Security updates for the environments where the data is located are continuously monitored, the necessary security tests are performed regularly and test results are recorded,

d) If the data is accessed through software, user authorisations for that software are set up, security tests of such software are performed regularly and test results are recorded,

e) If remote access to the data is required, at least a two-factor authentication system is provided,

4. If the environments in which special categories of personal data are processed, stored and/or accessed are physical environments

a) Adequate security measures are taken according to the nature of the environment in which special categories of personal data are located (against situations such as electrical leakage, fire, flooding, theft, etc.),

b) The physical security of these environments is ensured and unauthorised entries and exits are prevented,

5. If special categories of personal data are to be transferred

a) If the data needs to be transferred by e-mail, it is transferred encrypted using a corporate e-mail address or a Registered Electronic Mail (KEP) account,

b) If it needs to be transferred via media such as Portable Memory, CD or DVD, it is encrypted using cryptographic methods and the cryptographic key is kept in a different environment,

c) If a transfer is carried out between servers in different physical environments, the data transfer is carried out by setting up a VPN between the servers or by the sFTP method,

ç) If the data needs to be transferred on paper, the necessary measures are taken against risks such as the documents being stolen, lost or seen by unauthorised persons, and the documents are sent in the “classified documents” format.

VIII. Data Retention Periods

Yoyo retains personal data for the period stipulated in the relevant legislation; where no period is stipulated in the legislation, it retains personal data for as long as necessary for the purpose for which it is processed. If the purpose of processing personal data has ended and the end of the retention periods stipulated in the relevant legislation has been reached, it may be retained only for the purpose of serving as evidence in potential legal disputes, asserting the relevant right related to the personal data or establishing a defence. A "Personal Data Retention and Destruction Policy"regulating retention periods and destruction methods in detail has been prepared and put into practice.

IX. Deletion, Destruction and Anonymisation of Data

Although personal data has been processed in accordance with the relevant legislation, where the reasons requiring its processing no longer exist, it is deleted, destroyed or anonymised by us as a result of our periodic reviews carried out every 6 months or upon the request of the data subject (and if there is no statutory retention obligation).

1. Deletion and Destruction of Personal Data

Deletion of personal data is the process of making personal data inaccessible and unusable in any way for the relevant users. Destruction of personal data is the process of making personal data inaccessible, irretrievable and unusable in any way by anyone.

The data controller is obliged to take all necessary technical and administrative measures regarding the deletion and destruction of personal data.

The Company uses the methods of physically destroying the relevant data carriers, securely deleting by software and having data securely deleted by an expert.

2. Anonymisation of Personal Data

This is making personal data impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data.

Yoyo applies the methods of masking, data derivation, pseudonymisation, aggregation and data hashing.

Yoyo records all operations carried out regarding the deletion, destruction and anonymisation of personal data, and such records are retained for at least three years, excluding other legal obligations.

3. Appointment of Responsible Persons and Duties

Responsible persons have been appointed and duties have been defined for the procedures for deleting, destroying and anonymising personal data.

X. Data Breach Procedure

A Data Breach is a security breach that results in situations such as accidental or unlawful access to, or access by unauthorised persons to, disclosure, transmission, loss, alteration or destruction of personal data.

Where personal data processed in these ways is obtained by others through unlawful means, Yoyo employees immediately inform the data protection committee or the officers of the relevant unit, and Yoyo notifies the Personal Data Protection Board and the data subject of the situation without delay. The Board may, if it deems necessary, announce this situation on its own website/application or by another method it deems appropriate.

The data protection committee takes the urgent measures set out in the Personal Data Policy to end the data breach.

XI. Internal Data Audit

Annual periodic and random internal audits are carried out for ensuring personal data security and compliance with the legislation, and the findings are reported and continuously improved.

XII. Rights of the Data Subject

Data subjects have the right to:

• Learn whether their personal data is processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing of personal data and whether it is used in accordance with that purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request the rectification of personal data if it has been processed incompletely or inaccurately, and request that the action taken in this context be notified to third parties to whom the personal data has been transferred,
• Request the erasure or destruction of personal data where the reasons requiring its processing no longer exist, even though it has been processed in accordance with the provisions of the Law and other relevant laws, and request that the action taken in this context be notified to third parties to whom the personal data has been transferred,
• Object to a result arising against the person through the analysis of the processed data exclusively by automated systems,
• Request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.

However, the Law regulates cases in which these rights cannot be exercised in favour of data subjects. In Article 28 of the Law, these cases are listed as follows:

• Processing of personal data for purposes such as research, planning and statistics by anonymising it with official statistics,
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, or constitute a crime,
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations assigned and authorised by law to ensure national defence, national security, public safety, public order or economic security,
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings,

The data subject's requests to exercise the rights specified above may be sent, with an application containing explanations regarding the relevant right together with documents identifying the person: in writing by registered mail with return receipt to Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. Etiler Mahallesi Arnavutköy Yolu Sokak No:3, Beşiktaş/İstanbul, or to the registered electronic mail (KEP) address yoyodrive@hs03.kep.tr with a secure electronic signature, or by means of the “Application Form”. The Company may request additional information and documents in order to verify the identity of the applicant.

If the request additionally incurs a cost, the Company may charge a fee according to the tariff to be determined by the Personal Data Protection Board.

The Company has provided the environment to conclude the application as soon as possible and within thirty days at the latest, depending on the nature of the request, and has defined and put into practice the application procedure and duties. The Company will accept the data subject's request or reject it by explaining its reasons, and will notify the data subject of its response in writing or electronically.

The request may also be rejected, with its reasons explained, in cases such as the data subject's application being likely to impede the rights and freedoms of other persons, requiring disproportionate effort, or the information being publicly available.

XIII. Entry into Force

Yoyo reserves the right to update its Personal Data Processing Policy at any time within the framework of changes that may be made to the legislation in force and, where it deems necessary, in line with changing conditions.

Data Controller

Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş.

Maslak Mahallesi Sümer Sokak Kar Plaza Blok No:4/11 Sarıyer, İstanbul

ANNEX I: “DEFINITIONS”

In this Policy and its Annexes, the following words and expressions shall have the meanings set out opposite them:

Explicit Consent: Consent relating to a specific matter, based on information and expressed with free will.

Recipient group: The category of natural or legal persons to whom personal data is transferred by the data controller.

Employee: Company personnel.

Electronic environment: Environments in which personal data can be created, read, modified and written with electronic devices.

Non-electronic environment: All other written, printed, visual, etc. environments outside electronic environments

Service provider: A natural or legal person providing services to the Company under a specific contract

Data Subject/Personal Data Owner: The natural person whose personal data is processed.

Recording medium: Any medium containing personal data processed by fully or partially automated means or by non-automated means, provided that it is part of any data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Anonymisation of Personal Data: Making personal data impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data.

Processing of Personal Data: Any operation performed on data, such as obtaining, recording, storing, retaining, modifying, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partially automated means or by non-automated means, provided that it is part of any data recording system.

Deletion of Personal Data: Making personal data inaccessible and unusable in any way for the relevant users.

Destruction of Personal Data: Making personal data inaccessible, irretrievable and unusable in any way by anyone.

Special Category of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Board: The Personal Data Protection Board.

Authority: The Personal Data Protection Authority.

KVK Regulations: Law No. 6698 on the Protection of Personal Data, all secondary regulations on the protection of personal data, decisions of the Personal Data Protection Board, court decisions, applicable international agreements on the protection of data and all other legislation.

KVK Law (the Law): Law No. 6698 on the Protection of Personal Data.

KVK Committee: The Personal Data Protection Committee appointed by the Company Management with the duty of managing and supervising the Personal Data Protection processes.

Policy: The policies prepared on the basis of the Personal Data Protection legislation within the Company,

Company: Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş.

Verbis/Data Recording System: A recording system in which personal data is structured and processed according to certain criteria.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and who keeps the data systematically.

Visitor: Natural persons who have entered the Company headquarters or other physical premises owned by the Company for various purposes or who visit our websites.

Terms not otherwise defined in this Policy shall have the meanings attributed to them under Law No. 6698 on the Protection of Personal Data and the legislation on the protection of personal data.