Clarification Text

You can access the details regarding the explanations in this clarification text prepared in accordance with the KVKK Policy prepared and put into practice in this accommodation facility belonging to (DREAM WORLD) OPTİMAL TURİZM SANAYİ TİCARET ANONİM ŞİRKETİ, which is the data controller, and the Law on Protection of Personal Data No. 6698 (KVK Law) from the documents in the Data Controller KVKK Policy and its annexes. Accordingly;

Your Processed Personal Data

• Identity and Family Information: Name-surname, TR ID No, Passport No, place - date of birth, marital status, profession, gender, child name, number, age and dates of birth, signature, voucher (travel card) information and register card (accommodation card information), room type and number, flight number, hotel stayed, accommodation dates and amount

• Contact Information: Address, phone number, e-mail address

• Location Information: Accommodation and location information

• Customer Transaction Information: Vehicle license plate, survey form, records for product and service presentation, requests, instructions, photos, marriage, birth special days anniversary, call center records, invoice, promissory note, check information, information on box office receipts, order information, request information

• Physical Space Security Information: Entry and exit record information of employees and visitors, camera and voice recordings

• Transaction Security Information: IP address, hotspot records, password and password information, website entry and exit information, log and digital traffic records

• Finance Information: Bank account number, IBAN, Credit card number, CVC code, expiration date

• Visual and Audio Recordings and Information: Voice recordings received via call center, Visual and audio recordings and information

• Health Information: Information on disability status, blood group information, chronic diseases, past diseases, asthma, diabetes, heart, blood pressure diseases, personal health information, device and prosthesis information used

Method of Collecting Your Personal Data and Legal Reasons

According to this clarification text, your personal data is obtained verbally, in writing or electronically through information, documents and similar means transmitted by third parties with whom we cooperate, with whom we have a contractual relationship, with whom we have an agreement as a requirement of operating with solution partners and to whom services are provided, or by you, by automatic or non-automatic methods provided that they are part of the data recording system.

These data can be processed directly in the presence of the conditions specified below in cases where your explicit consent is not required, due to your explicit consent within the framework of Article 5 of the KVK Law No. 6698. Accordingly;

• Explicitly provided for in the laws.

• It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid, or of another person.

• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.

• It is mandatory for the data controller to fulfill its legal obligation.

• It has been made public by the person concerned himself.

• Data processing is mandatory for the establishment, exercise or protection of a right.

• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Within the scope of Article 6 of the KVKK No. 6698, your special categories of personal data other than health and sexual life can be processed based on your explicit consent or in cases stipulated in the laws in accordance with the provision of the same article. In the absence of your explicit consent, your personal data regarding health and sexual life can only be processed by persons or authorized institutions and organizations under the obligation of secrecy for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

Purpose of Processing Your Personal Data

Your personal data are processed within the purposes shown below, taking into account the principles of compliance with the law and honesty rules, being accurate and up-to-date when necessary, being processed for specific, clear and legitimate purposes, being connected, limited and measured with the purpose for which they are processed, and being kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed, in accordance with Articles 4, 5 and 6 of the KVK Law No. 6698.

Your personal data are not processed for purposes other than those shown above. All kinds of technical and administrative measures are taken by the enterprise to prevent unlawful processing of personal data or unlawful access to personal data.

Transfer of Your Personal Data

Your personal data may be transferred domestically or abroad in the presence of the following conditions in accordance with Articles 8 and 9 of the KVK Law No. 6698.

Personal data obtained due to the existence of the conditions in Article 5 of the KVK Law No. 6698 or in line with your explicit consent may be transferred to persons, institutions and companies with whom cooperation is made, to persons and institutions with whom interaction is made such as shareholders, suppliers, to third parties from whom service is received or to whom service is provided, in accordance with the provisions of Articles 8 and 9 of the Law for the purposes stated above and again for the realization of the activities stated above.

Provided that sufficient precautions are taken, your personal data regarding health can be transferred without seeking the explicit consent of the person concerned by persons or authorized institutions and organizations under the obligation of secrecy only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

In cases where it is explicitly stipulated in the laws, it is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid, or of another person, provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract, it is mandatory for the data controller to fulfill its legal obligation, the data has been made public, data processing is mandatory for the establishment, exercise or protection of a right, data processing is mandatory for the legitimate interests of the data controller provided that it does not harm your fundamental rights and freedoms, and also provided that it is fulfilled by persons or authorized institutions and organizations under the obligation of secrecy for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, your personal data may be transferred abroad without seeking your explicit consent provided that there is sufficient protection in the foreign country, and in case there is not sufficient protection, the data controllers in Turkey and in the relevant foreign country undertake sufficient protection in writing and the permission of the KVK Board is available.

In this context, your personal data may be transferred for the purposes stated below:

• To Authorized Public institutions and organizations

• To company partners and officials

• To business and solution partners

• To supplier persons and companies

• To real or legal persons with whom interaction is made

Your Rights as a Personal Data Owner

Within the scope of the law, the data owner, that is, the relevant person:

• Learning whether personal data is processed or not,

• Requesting information if personal data has been processed,

• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,

• Knowing the third parties to whom personal data is transferred domestically or abroad,

• Requesting correction of personal data in case of incomplete or incorrect processing,

• Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

• Requesting notification of the transactions made regarding the correction of incomplete or incorrect data and the deletion or destruction of personal data to the third parties to whom the personal data has been transferred,

• Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,

• Requesting compensation for the damage in case of damage due to unlawful processing of personal data,

In order to use your complaint rights as a personal data owner, you must first apply to the personal data controller using the communication channels below. It is not possible to complain to the KVK Board without exhausting this way.

Your request is answered by our company as the data controller as soon as possible and within 30 days at the latest depending on the nature of the request.

In case your application is rejected or the answer given is found insufficient or your application is not answered in time, you can use your right to complain to the KVK Board or apply directly to the judicial remedy.

Retention Period of Your Personal Data

Your personal data that needs to be processed with the methods specified above and for the specified purposes are stored for the period specified in the data inventory, taking into account the statute of limitations and forfeiture periods specified in the law. In case the reasons requiring the processing of your data disappear or the periods required for the processing of your data in accordance with the legislation expire, they are deleted, destroyed or anonymized by our Company ex officio in periods of six months at the latest or upon your request within thirty days at the latest using any of the destruction methods.

Deletion of your personal data is the process of making it inaccessible and unusable for the relevant users in any way.

Destruction of your personal data is the process of making personal data inaccessible, irretrievable and unusable by anyone in any way.

Anonymization of your personal data is making the data unrelated to an identified or identifiable natural person even by using appropriate techniques.

Transactions regarding the deletion, destruction and anonymization of your personal data are recorded. In the face of public requirements, these records are kept for 5 years.

We present it for your information.