Personal Data Protection

1. Purpose and Scope of the Policy

Under the Personal Data Protection Law No. 6698 (“PDPL”), personal data refers to any information relating to an identified or identifiable natural person. According to the PDPL provisions, the real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system is considered the data controller. Within the scope of the PDPL, your personal data processed through transactions on the website with the domain name www.villabiz.com.tr (“Website”) will be processed by Oral Architecture Real Estate Marketing Construction Project Decoration Inc. (“Palmoral Travel”) as the data controller, within the scope, for the purposes, and based on the legal reasons explained below. This Clarification Text document will refer to the Website as the “Platform.”

This Clarification Text has been prepared to inform real persons whose personal data are processed by Palmoral Travel as the data controller, in accordance with Article 10 of the PDPL and the Communiqué on the Principles and Procedures for Fulfilling the Obligation to Inform. Transparency and accountability are important for Palmoral Travel. In this context, the Clarification Text includes information about the identity of the data controller and its representative if any, the purposes for which personal data will be processed, to whom and for what purposes the personal data can be transferred, the method and legal reason for collecting personal data, and other rights of the data subject listed in Article 11 of the PDPL.

Palmoral Travel may update the Clarification Text in the event of changes in the applicable legislation, decisions of the Personal Data Protection Board, judicial decisions, changes in personal data processing and/or transfer methods, purposes, reasons, or similar developments. Should the Clarification Text be updated, the current text will be published on the Platform. Palmoral Travel may publish other clarification texts, rules, conditions, or similar statements on the Platform regarding the processing and/or transfer of personal data. If you have any questions regarding the matters included in this Clarification Text, please contact us via email at info@villabiz.com.tr.

2. Methods and Legal Grounds for Collecting Personal Data

Ensuring the security of personal data is among our primary objectives. Your personal data is processed by Palmoral Travel in accordance with the provisions found in the Constitution of the Republic of Turkey, the PDPL, the Law No. 6563 on the Regulation of Electronic Commerce, the Turkish Penal Code No. 5237, and other relevant legislation.

Palmoral Travel processes personal data through the Platform, authorized agents, service providers, intermediary service providers, social media accounts, cookies, call centers, messaging programs on the Platform, notifications from administrative and judicial authorities, and other communication channels, visually, audibly, physically, electronically, verbally, or in writing; for purposes such as establishing commercial relationships, receiving job applications, making offers, establishing contractual relationships, fulfilling legal obligations, and/or within the scope of legitimate interests, in accordance with the conditions for processing personal data specified in the PDPL and for the legal reasons outlined in this Clarification Text.

When you interact with Palmoral Travel through social media platforms such as Google, Facebook, Twitter, Instagram, and YouTube, the personal data you provide to the relevant social media platform may also be processed by Palmoral Travel. However, we would like to note that the use of social media platforms, the content provided, and the features are subject to the privacy and usage policies of the respective platform.

Cookies are used to personalize your online experience and enable you to log into our services. Palmoral Travel collects personal data for various purposes through cookies on the platform. Cookies are text files placed on visitors’ computers by the websites they visit. They are commonly used on almost all websites to work efficiently and cater to visitors’ preferences, as well as to provide site administrators with information. Cookies are used to determine visitors’ preferences, detect specific page requests, enhance platform usage experience, maintain service security, and conduct online behavioral advertising activities for our users.

Our Website uses Google Analytics, an analysis service provided by Google Inc. (“Google”). Google Analytics uses “cookies,” which are text files saved on your computer that allow the analysis of your website usage. The information generated by the cookies about your use of the website is transmitted to and stored by Google on servers in the USA. On behalf of the website operator, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. If you do not wish these cookies to be stored, you can adjust your browser settings accordingly. Additionally, our Website uses AdWords and double-click cookies for statistical purposes.

Third-party cookies and our cookies are used to display personalized ads on websites. This is called “retargeting,” aiming to base on the pages you browse, the products you view, and the clicks you make on advertising space (banners) on our Website. We also use cookies as part of our online marketing campaigns to see how users interact with our Platform after online ads, including those on third-party websites, are displayed. You can delete these cookies from your browser at any time.

Many internet browsers are set to automatically accept cookies by default. If you do not want these tools to be used, you can disable them in your browser settings. However, we would like to note that you may not be able to use all the functions of the Platform to their full extent in this case.

3. Processed Personal Data

The personal data processed may vary depending on the nature of your legal relationship with Palmoral Travel. However, the personal data we generally process are as follows:

Identity Information: Name, surname, identity information, date of birth, driver’s license information, passport number, nationality, etc., personal data you provide when registering on the Platform, purchasing tickets, renting a car, making villa or hotel reservations, during conversations through live support or call centers, and in all your applications.

Contact Information: Email address, phone number, mobile phone number, social media contact information, address, etc., personal data you provide when registering on the Platform, purchasing tickets, renting a car, making villa or hotel reservations, during conversations through live support or call centers, and in all your applications.

Customer (Including Consumer/Guest/Client etc.) Information: Name, surname, nationality, date of birth, Turkish ID number, passport number, driver’s license, gender, reservation information, purchase information, invoice details, delivery information, travel information, travel dates, accommodation details, location information, reservation details, customer transaction information, travel document types and numbers, start and end dates of validity, and issuing country of personal data; call center records, credit card statements, cashier receipts, customer instructions, records stored in relevant channels, information and records collected within the scope of requests and complaints and their outcomes, and website password and login information created while using our digital services.

Financial Information: Credit/bank card information, bank account details, IBAN, balance information, debt balance, and other financial data.

Sensitive Data: Necessary information related to your health condition that may affect the service you receive, disability information, HES code, and other special category personal data processed based on explicit consent when explicitly prescribed by legislation and necessary for our operations.

Marketing Information: Reports indicating preferences for marketing purposes, targeting information, cookie

 records, data derived from data enrichment activities, surveys, information and evaluations obtained as a result of campaigns and direct marketing efforts.

Transaction Security Information: IP address information, password and login details, cookie information.

Other Information: Information about family members and close relations (including personal and contact information related to the children and spouses of the relevant persons), physical space security information (entry/exit records, visit information, photographs, camera and audio recordings), legal transaction and compliance information (requests from judicial and administrative authorities, etc.).

4. Purposes of Processing Personal Data

Under the PDPL, personal data cannot be processed without the explicit consent of the data subject, as a general rule. Palmoral Travel processes your personal data within the extent permitted by legislation. In this context, the purposes for processing your personal data are as follows: To verify the identity information of the person who makes a villa/residence reservation on the Platform and for whom the reservation is made, to record address and other necessary information for communication, to manage processes related to the formation and execution of contracts, to contact our customers regarding the conditions, current status, and updates of contracts we enter into under the relevant articles of the Distance Sales Contract and the Law on Consumer Protection, to fulfill the obligations undertaken under the contracts we enter into, to prepare all records and documents that will be the basis for processing in electronic or paper format, to provide information to public officials upon request and as required by legislation on matters related to public security, to provide better service to our customers, to inform our customers about our products that may interest them based on their interests, to convey campaigns, to send information via email or text message within the framework of the Law on the Regulation of Electronic Commerce and related legislation, to increase customer satisfaction, to recognize our customers from the Platform and use it for customer environment analysis, to use it in various marketing and advertising activities, and to organize surveys electronically and/or physically through contracted institutions in this context, to make suggestions to our customers through our contracted institutions and solution partners, to inform our customers about our services, to evaluate customer complaints and suggestions, to carry out production, operation, and sales processes of goods and services, financial and accounting activities, and archive activities, to ensure information security, to fulfill our legal obligations and exercise our rights arising from the current legislation.

In addition, the personal data of our employees can be processed without consent to the extent necessary for the business relations. The provisions and conditions specified in the Policy on the Protection and Processing of Employees’ Personal Data are applicable to the processing of our employees’ personal data.

5. Our Company’s Rights and Obligations Under the Law

Our company processes personal data in accordance with Article 20 of the Constitution and Article 4 of the PDPL, in a manner that is compliant with the law and the rules of honesty, accurately and up-to-date, for specified, explicit, and legitimate purposes, relevantly, limitedly, and measuredly, for the period prescribed by law or required for the purpose for which personal data are processed, and transfers them based on the conditions specified in Articles 5 and 6 of the PDPL.

Personal data shared with Palmoral Travel are under the supervision and control of Palmoral Travel. Palmoral Travel has undertaken the responsibility as the data controller to establish the necessary organization and take and adapt technical measures to protect the confidentiality and integrity of the information in accordance with the provisions of the relevant applicable legislation. Aware of our obligation in this matter, we would like to state that we have taken the following administrative and technical security measures. In this context, we would like to inform you that we always keep our data processing policies up-to-date.

Palmoral Travel stores the processed personal data for the periods specified in the legislation, and if no specific period is determined by the legislation, personal data are stored for the period required for Palmoral Travel to process the relevant personal data in connection with the services provided while processing the relevant personal data and thereafter only for the period required for possible legal disputes to serve as evidence. After the specified periods have expired, the relevant personal data are deleted, destroyed, or anonymized.

6. Transfer of Personal Data:

The sharing of personal data with third parties is carried out within the framework of the applicable legislation and/or the explicit consent given by the relevant individuals. However, personal data are shared with courts and other public institutions due to our legal obligations and limited to these reasons. Additionally, personal data are transferred to third parties within the framework of a contractual relationship to provide the services we commit to and conduct quality control of the provided services.

During the transfer of data to third parties, necessary technical and administrative measures are taken to prevent data breaches. For example, SSL and transport layer security are used during data transfer.

Your personal data may be shared with program partner institutions, organizations we cooperate with to carry out our activities, service providers and/or intermediary service providers, independent auditing third parties, domestic individuals and institutions from whom we receive cloud storage services, domestic organizations with whom we have agreements to send commercial electronic messages to our customers, our financial advisors, the Interbank Card Center, banks we have agreements with, payment service providers, various domestic agencies, advertising companies, and survey companies as part of various marketing activities to provide better service and ensure customer satisfaction, and other domestic third parties, our relevant business partners, shareholders, affiliates, and third parties from whom we receive services within the scope of a contractual relationship, our lawyers, advisors, and legally authorized public institutions and private law legal entities.

7. Rights of the Data Subject

According to Article 11 of the PDPL, the data subject has the right to:

a. Learn whether his/her personal data are processed,

b. Request information if his/her personal data have been processed,

c. Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

ç. Know the third parties to whom personal data are transferred domestically or abroad,

d. Request rectification in case personal data are processed incompletely or inaccurately,

e. Request deletion or destruction of personal data under the conditions set forth in the law and relevant other statutory provisions, even if the personal data have been processed in accordance with the PDPL and other relevant laws but the reasons necessitating their processing cease to exist,

f. Request notification of the operations made as per subparagraphs (d) and (e) to third parties to whom personal data have been transferred,

g. Object to the occurrence of any result that is to his/her detriment by means of analysis of personal data exclusively through automated systems,

ğ. Request compensation for the damages in case the person suffers damage due to unlawful processing of personal data.

To exercise these rights, you can submit your request in accordance with Article 13 of the PDPL and the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to Palmoral Travel’s address “Deger 16, Ihlamur Yolu No: 16, Nişantaşı Şişli Istanbul,” including your name, surname, signature, Turkish Republic identity number for Turkish citizens, nationality, passport number or identity number if available, permanent residence or workplace address, email address for notification, phone number, subject matter of the request, and necessary information and documents to determine your identity, and/or by using the Application Form, via the email address confirmed during your membership or, if you are not a member, via email for general information on the PDPL. Your application will be evaluated by Palmoral Travel and concluded free of charge within thirty days. However

, if the transaction requires additional costs, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

Data Controller: Oral Architecture Real Estate Marketing Construction Project Decoration Inc.

Tax Office / Tax Identification Number: Beyoğlu / 6450343397

Address: Harbiye Neighborhood, Abdi İpekçi Street, Ada Building No.22, Floor 3, Apartment 11, Şişli / Istanbul

KEP Address: oralmimarlik@hs01.kep.tr

Electronic Notification Address: 25969-45320-66584

Contact Phone: +90 535 025 1361

Trade Registry Number: 554920-0

MERSIS: 0645034339700001

Email Address: info@deger16.com