Privacy Notice on Protection of Personal Data

This information has been prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 (“DPL”) and the Communiqué on the Procedures and Principles to be Followed in the Fulfilment of the Obligation to Inform.

As İGA Havalimanı İşletmesi Anonim Şirketi and TAYA Yolcu Hizmetleri Anonim Şirketi (“Data Controller”), we attach great importance to the security and protection of your personal data. With this awareness, we take special care to process and store all personal data collected in accordance with the DPL and its secondary regulations.

As the Data Controller, we are fully aware of our responsibility for personal data processed by us or on our behalf in accordance with the DPL. We process your personal data in the manner described below and within the limits permitted by law

1. Data Controller

In accordance with the DPL, your personal data may be processed by İGA Havalimanı İşletmesi Anonim Şirketi and TAYA Yolcu Hizmetleri Anonim Şirketi as the “Data Controller”, within the scope of the information provided below.

2. Collection, Processing and Purposes of Processing Personal Data

Your personal data will be collected and processed as specified in the table below.

The personal data you provide will only be processed within the scope specified above. If the purpose of processing changes, you will be provided with additional information, as this will constitute a new processing activity.

Your personal data collected will be processed in accordance with the principles of lawfulness, fairness, accuracy, and, where necessary, updating, as well as for specific, explicit and legitimate purposes, and in a manner that is relevant to the purposes for which they are processed, limited to what is necessary, and in accordance with the principles of storage for the period required by the relevant legislation or for the purposes for which they are processed.

3. Transfer of Personal Data to Third Parties and Purposes of Transfer

TYour collected personal data may be transferred to subsidiaries and affiliates within the IGA group of companies, suppliers, natural persons or private legal entities, or authorized public institutions and organizations only when there is a legal basis, and strictly for the purposes outlined in Article 2.

IGA may process and store your personal data on servers located in Turkey or other electronic environments, provided that the necessary security measures are taken in accordance with the purposes specified above.

In cases where personal data is transferred abroad, the required technical and administrative measures are taken, and appropriate safeguards stipulated under Article 9 of the KVKK are ensured.

4. Your Rights as a Data Subject

As a data subject, if you submit your requests regarding your rights to the Data Controller using the methods specified below, the Data Controller will process your request as soon as possible and within a maximum of thirty days, free of charge, depending on the nature of the request. However, a fee may be charged if deemed necessary by the Personal Data Protection Board.

According to Article 11 of the DPL, your rights as data subjects are as follows:

1.Right to learn whether your personal data has been processed,
2.Right to request information about the processing of your personal data,
3.Right to learn the purpose of processing your personal data and whether your data is being used for its intended purpose,
4.Right to know the third parties to whom your personal data has been transferred, within or outside the country,
5.Right to request the correction of your personal data if it has been processed incorrectly or incompletely, and to request that this correction be communicated to third parties to whom your personal data has been transferred,
6.Right to request the deletion or destruction of your personal data if the reasons for processing no longer exist, even if it has been processed in accordance with the DPL and other relevant laws, and to request that the third parties to whom your personal data has been transferred be notified of the action taken in this regard,
7.Right to object to the emergence of a result against you through the analysis of your processed data exclusively by automated systems,
8.Right to request compensation for damages incurred due to the processing of your personal data in violation of the law.

The Data Controller reserves the right to make changes to this Privacy Notice due to changes in the DPL and decisions made by the Personal Data Protection Board.

In accordance with the first paragraph Article 13 of the DPL, you may exercise your rights mentioned above by sending us your request using the attached form. The use of the attached form, the address to which it should be sent, and the information it must contain are determined in accordance with the DPL, and the relevant explanations are included in the form. While the use of the attached form is not mandatory, we would like to emphasize that requests submitted using the form may be responded to more promptly for organisational reasons.

Annex 1 - Application Form

Pursuant to Article 13, paragraph 1 of the DPL, the notification regarding the data subject rights must be made in writing. In this context, applications must be submitted to the Data Controller by printing this form, presenting valid identification in person, through a notary public, or via a certified email address. If your email address is already registered in our system, you may also contact us at [x].

Address to which the application will be sent: [X]

Unit to which the application will be sent: [X]

Information to be specified in the application: BThe envelope containing the application must be marked with “Data Subject Information Request”.

Your application, which has been sent to us as specified above, will be responded as soon as possible in accordance with the second paragraph of Article 13 of the DPL, starting from the date we receive your request, and this period will not exceed thirty days. Our responses will be sent to you in writing or electronically, as required by the same article of the DPL.

1. Data Subject Information:

Name:

Surname:

Date of Birth:

ID Number:

Phone Number:

Email Address:

Address:

2. Your Relationship with Data Controller :

Please indicate your relationship with the Data Controller.

3. Your Request

Please specify your request within the scope of the DPL. If you do not have any requests in this regard, the response will be sent to the email address specified above

This application form has been prepared to ensure that your personal data can be identified more accurately and completely in order to respond to you within the maximum period specified in the DPL. The Data Controller may request additional documents to identify or confirm the identity and authorization of the data subjects.

By signing and submitting this form to us, you confirm that the information provided in this form is accurate and up-to-date, and that you are authorized to provide this information and submit this request. You also acknowledge that the Data Controller shall not be held liable for any inaccuracies, outdated information, or unauthorized submissions.