KVKK Privacy Notice and Explicit Consent Declaration

GEZİHANE TURİZM VE SEYAHAT ACENTASI PERSONAL DATA PROTECTION INFORMATION TEXT AND EXPLICIT CONSENT STATEMENT 1. DATA CONTROLLER Pursuant to Law No. 6698 on the Protection of Personal Data ("PDPL"), your personal data is processed by GEZİHANE TURİZM VE SEYAHAT ACENTASI (TÜRSAB Document No: 8511) as the data controller, within the scope explained below. Address: Tahtakale Mah. 20. Okul Sk. Serez İş Hanı 19/B OSMANGAZİ / BURSA Telephone: 5320575395 Email: info@gezihaneturizm.com 2. PERSONAL DATA PROCESSED The following data is processed in order to provide package tour services: - Identity data: name and surname, Turkish ID number or passport number and validity date, date of birth, nationality information - Contact data: telephone number, email address, full address (including province/district) - Travel data: reservation records, flight/accommodation/transportation preferences, seat information - Financial data: payment amount and collection records - Special category data if required by the nature of the tour: information conditional on participation such as health/allergy declarations 3. PROCESSING PURPOSES Your data is processed for the purposes of establishing and performing the package tour contract, conducting reservation and accommodation transactions, organizing transportation and transfers, contacting you in emergency situations, fulfilling legal obligations (Law No. 1618, Law No. 6502 on Consumer Protection, tax legislation, law enforcement notification obligations), invoicing and maintaining accounting records. 4. LEGAL BASIS Identity, contact and travel data are processed under PDPL Art. 5/2-c (establishment and performance of contract) and Art. 5/2-ç (legal obligation); special category health data is processed under PDPL Art. 6/2 based on YOUR EXPLICIT CONSENT. 5. TRANSFER Your data may be transferred to accommodation facilities, transportation companies, guides, insurance companies and authorized public institutions and organizations to the extent necessary for the performance of the service. In international tours, data may be transferred to facilities and authorized authorities in the country of travel. 6. RETENTION PERIOD Your data is retained for the periods specified in the relevant legislation (minimum 10 years); it is deleted, destroyed or anonymized upon expiration of the period. 7. YOUR RIGHTS Pursuant to PDPL Art. 11, you have the right to learn whether your personal data is being processed, request information if it is being processed, learn the purpose of processing, know the third parties to whom it is transferred, request correction if it is processed incompletely or incorrectly, request deletion or destruction, object to processing and request compensation for damages. You may submit your requests to the contact addresses above. 8. EXPLICIT CONSENT STATEMENT I have read and understood the information text above. I give my explicit consent to the processing of my identity, contact, travel and (where required by the tour) health data for the purpose of providing the package tour service and to the transfer of this data to the parties specified in the text. Name and Surname: ____________ Turkish ID / Passport No: ____________ Date: 15.10.2026 ────────────────────────────────────────────────────────────────────── APPENDIX — WEBSITE PRIVACY POLICY (gezihaneturizm.com) Privacy Agreement PURCHASE TRANSACTION SECURITY AND SSL CERTIFICATE Our website www.gezihaneturizm.com secures all transactions made with credit cards with Geotrust RapidSSL certificate. Your card information is encrypted with 2048-bit protection during transfer. You can verify that the SSL (Secure Socket Layer) connection is active by the lock icon in your browser's address bar when you enter your card information on the payment page. The lock icon located in the bottom right corner of the page where you enter your credit card information indicates that the page is encrypted with SSL, and when clicked, it displays information about which company the encryption belongs to. Personal information you provide during membership is kept confidential and is not shared with any person or institution without your approval. SSL technology secures information by encrypting the information flow between customer-business-bank with 2048-bit encryption. COOKIES AND OTHER TECHNOLOGIES www.gezihaneturizm.com may use cookies and other technologies to improve online services, understand user behavior and easily provide its services. Cookies help remember user preferences during visits to the site and thus provide a more personalized experience. Cookies record information about the pages you visit, track your orders and provide you with a specialized service on subsequent visits. You can delete or block cookies from your browser settings at any time. Cookies may also be used to measure the effectiveness of advertising and marketing activities. Gezihane Turizm may use this information anonymously in marketing and statistical analysis. USE OF PERSONAL INFORMATION GEZIHANETURIZM.COM uses users' personal information solely for the purpose of providing services and offering users a better experience. Suppliers and partners it cooperates with may use this information for statistical analysis or market research without disclosing users' identities. Pursuant to Law No. 5651, it may be necessary to resolve problems on the site and identify users' IP addresses. However, users' IP addresses will be used only for general identification and demographic analysis purposes. Gezihane.com.tr may share user information only in the following cases: • Legal obligations, • Requests from judicial authorities, • Protection of user rights and security. Despite all security measures taken, GEZIHANETURIZM.COM is not responsible if your information falls into the hands of third parties as a result of attacks on the system. INTELLECTUAL PROPERTY RIGHTS The www.gezihaneturizm.com website and its content belong to GEZIHANE TOURISM AND TRAVEL AGENCY. Information, text, visuals, logos and other content on the website are protected under relevant laws. This content cannot be reproduced, copied or used for commercial purposes without written permission. Turkish law applies to disputes arising from the use of the website, and Turkish courts in Bursa are competent for dispute resolution.