Business Partners – Privacy Statement

We want you to be familiar with how we collect, use and disclose personal data as per the Turkish Law on Protection of Personal Data numbered 6698 ("LPPD"). This Privacy Statement describes how personal data provided by business partners is collected, used and disclosed.

Who is collecting and processing the personal data?

We, Amadeus Bilgi Teknolojisi Hizmetleri Anonim Şirketi ("Amadeus IT Services Türkiye" or “Amadeus”), as Data Controller, hereby declare that as per the Law on Protection of Personal Data numbered 6698 ("LPPD"), we may, within the scope of our commercial or business relationships with you, and in the context of the purposes requiring processing of such data, and in connection with, and to the extent limited to such purposes, and by maintaining accuracy and actuality of the personal data disclosed to us by you or otherwise, record, store, retain, reorganize your personal data obtained by the following methods; and disclose personal data with agencies authorized by law to request such data; and may transmit and transfer, and classify these personal data to third parties in and outside the country according to the conditions stipulated by LPPD; and may process referred personal data in other ways stated under LPPD.

What personal data do we collect?

Amadeus IT ServicesTürkiye may collect the following personal data from customers, vendors and other third parties with whom Amadeus has a commercial relationship and employees, contractors, and other points of contact in those companies or organizations (“Business Partners”) and in the processing of personal data of individuals potentially interested in Amadeus’ products and services (“Prospects”).

1. Personal data directly collected from you

Identity Data: Name, Surname, R.T. ID No., date of birth, place of birth, gender, marital status, nationality, copy of identity card / driver's license.

Contact Data: Email, mobile phone number, address.

Financial Data: Bank account information in case this is needed to keep the commercial relationship.

Visual and Audio Data: Photo of the natural person, surveillance footage, audio recordings during interviews with Company officers.

Career data: education and professional experience

Marketing and communications data: communication preferences.

Profile data: interests, preferences, feedback and survey responses.

2. Personal data inferred from you:

In some cases, the above data may have been provided by the company you work for or may have been inferred from your interaction with Amadeus. Also, Amadeus may collect and process:

• User behavioral data: IP address, login data, browsing actions and patterns.
• Meeting metadata: date, topic of the meeting and, in some cases, agenda, minutes and recording.
• Relevant system/machine data: device and network data, application logs.

Other: Vehicle registration plate.

All kinds of personal data required to operate the business and fulfill the legal obligations during the business term shall be processed;

• within the scope of commercial affairs or to the extent of our business relationship,
• pursuant to, and in connection with, limited and proportionate to the purpose of the processing required, and
• shall be saved, stored, retained, readjusted and processed otherwise within the scope of the records specified herein.

3. For what purpose will your personal data be used?

Personal Data of the data subject shall be processed by Data Controller for the following purposes;

• To execute contracts, to provide products and services, and for identification of natural person customers and legal person representatives within this scope.
• To fulfill the legal obligations of Amadeus IT Services Türkiye.
• To enable you and/or other representatives/employees of your company to transmit us, physically or in electronic medium, the personal data we have requested, for the legitimate interest of Amadeus IT Services Türkiye, from you and/or other representatives/employees on behalf of your company; and to input information in our platform; and to log information, via these platforms, into the cloud system installed on the infrastructure of Amadeus IT ServicesTürkiye in a way that will be accessible by Amadeus IT Services Turkey officials.
• To provide efficient support services to the customers of Amadeus IT Services Türkiye.
• To keep finance and accounting records.
• To manage and control invoicing and payment processes.
• For budget management and reporting.
• To provide communication between natural person customers and natural person representatives of customers.
• To get assistance from customer employees.
• To coordinate and execute works and communications relating to the services provided to you, and to make quality control and assessment relating to execution of services/contracts.
• To conduct research and development works.
• To market products during the process of developing and managing our current applications and applications under R&D phase.
• To improve and increase the efficiency of the Amadeus IT ServicesTürkiye platform for our legitimate interest, by electronic means via cookies used on our website as explained in detail under our Cookies Policy.
• To ensure the Data Controller fulfills its obligations arising from the contract between the Parties, and from the provisions of relevant legislation.
• To manage the relationships between Amadeus and Amadeus Business Partners upon the performance of a contract or upon the adoption of precontractual measures;
• To send commercial communications for marketing and sales purposes upon Amadeus’ legitimate interest in promoting products and services, where that is not possible, upon consent;
• To send surveys upon Amadeus’ legitimate interest in gathering feedback from Amadeus Business Partners or, where that is not possible, upon consent;
• To manage the relationships between Amadeus and Amadeus Business Partners upon the performance of a contract or upon the adoption of precontractual measures;
• For fraud prevention purposes and to protect the security of Amadeus and its products and services, as well as the security of the Amadeus Business Partners, upon the performance of a contract or upon Amadeus’ legitimate interest in ensuring network and information security, respectively;
• To perform internal business processes, such as testing or quality assurance, and other uses compatible with providing the services upon the performance of a contract or upon Amadeus’ legitimate interest in ensuring the proper delivery of products and services; and
• To defend against legal claims and/or comply with applicable legislation.

4. Legal basis for processing

• the processing is necessary to fulfill the contractual obligations (for the purposes of providing or receiving products and services, managing the relationship, and for security and auditing purposes) and protect the rights arising from the agreement (i.e., necessary for the performance of a contract that Amadeus IT ServicesTürkiye has or is about to enter into with the Business Partner),
• the legitimate interest of Amadeus IT Services Türkiye, or
• compliance with laws and regulations.
• Specifically with respect to Prospects, Amadeus processes your personal data for marketing and sales purposes. This is done upon consent or upon legitimate interest (in promoting products and services).

Such data are collected, limited to the aforementioned purposes, in electronic medium and/or from recordings of phone calls between you and our employees.

5. Transfer of Processed Personal Data in the Country and Out of the Country

Personal data may be transferred as stated below only if necessary to fulfill obligations arising from the contract concluded between the Parties and from the provisions of relevant legislation, and to improve service quality and to safeguard the legitimate interests of both parties, and to the extent and scope required and by taking into consideration the rulings of the Authority, for the purposes and legal grounds set out in Articles 5 and 6 of the LPPD and, where applicable, pursuant to the rules governing international transfers of personal data. In particular, personal data:

• May be transferred by Amadeus IT ServicesTürkiye to the other companies of the Amadeus Group and by other companies of the Amadeus Group to Amadeus IT Services Türkiye, in line with the legitimate interest of Amadeus IT Services Turkey, for the purpose of providing assistance to you, communicating with you whenever necessary, for operational, administrative, compliance, customer support and business continuity purposes, and to ensure that services are not interrupted.
• May be transferred to agencies, legal consultants and lawyers authorized by law, and/or
• May be transferred to employers inTürkiye or overseas that the Data Controller has made an application to. Where required, such transfers shall be carried out in accordance with the conditions for international data transfers set out under the LPPD, and/or
• May be transferred to tax offices, labor inspectors and other administrative agencies and institutions, particularly to SSI.
• May be transferred to necessary third parties for the purpose of thanking you for working with us, promoting and marketing new or updated products of Amadeus IT Services Türkiye, inviting you to special events organized for such and similar purposes, and sending you gifts to celebrate and congratulate you on your special occasions (related organization firms, companies and establishments where such organization shall take place, company/platform for sending gifts, courier company, etc.). Such information shall be limited to your name and surname, address and telephone number. Where required by applicable law, such communications shall be sent based on the data subject's consent or other applicable legal grounds.
• May be accessed by authorized employees and personnel who need such information for the performance of their duties
• May be transferred, as per the conditions stipulated under LPPD, to independent auditors that Amadeus IT ServicesTürkiye collaborates with and/or to third parties in or outside the country that operate in line with its area of activity, and/or to service providers providing information services regarding advertisement, promotion and marketing communications, and monitoring customer satisfaction information services.
• As we work with third-party companies in and outside the country in connection with sending bulk emails and SMS to inform you about developments, promotions and innovations, we may transfer necessary personal data to such third parties only for the aforementioned purposes.
• May be transferred to the companies and audit companies we are affiliated with as required and for the purpose of inspections to be carried out and reports to be issued relating to accounting and finance transactions such as budget management and invoicing.
• As we are able to share your personal data, when necessary, in relevant programs used for accounting and for the management of financial transactions, in line with the purpose of processing thereof, we may transfer your personal data to companies that provide this database.
• In order to preserve the records encompassing your personal data throughout their retention period, we may transfer the related records to third-party archive companies who provide this service.

6. Personal Data Storage

Your personal data is stored in a physical and digital environment by Amadeus IT ServicesTürkiye departments and personnel by similar means. Your personal data may be stored for the period required for the purposes for which it is processed. If we no longer have any legal reason for storing personal data after the reason for processing of the data ceases to exist, we delete, destroy or anonymize your personal data.

7. Personal Data Security

Amadeus IT ServicesTürkiye takes appropriate technical and administrative measures to ensure your personal data is processed lawfully, stored securely, and that unlawful access to your personal data is prevented.

8. Your Rights as per Article 11 of LPPD no. 6698

The data subject has the following rights, apart from and in addition to its right to observe and request the performance of the basic principles summarized above, as per Article 11 of LPPD:

• To be informed whether his/her personal data is processed or not.
• To request further information about the processing of personal data relating to him/her.
• To be informed of the purpose of the processing of personal data and whether such data is used consistently with the purpose.
• To be informed of the third parties, in the country or abroad, to whom personal data is transferred.
• To request rectification of personal data if processed incompletely or inaccurately.
• To request, when the reasons which require processing of personal data cease to exist, the deletion or destruction of his/her personal data as stipulated and to the extent stated under the law and relevant legal legislation.
• To request that third parties to whom personal data is transferred are notified about the request of deletion and destruction of personal data.
• To object to the processing, exclusively by automatic means, of his/her personal data which leads to an unfavorable consequence for the data subject.
• To request compensation for damage arising from the unlawful processing of his/her personal data.

As per the principles and procedures set out in the Communiqué on Procedures and Principles regarding Application to the Data Controller published in the Official Gazette numbered 30356 and dated 10.03.2018, you may send your request bearing your wet signature to the address stated in the last section of this document via hand delivery, post, cargo or notary; or you may send us an e-mail with your digital signature or mobile signature to our registered e-mail address (KEP); or you may send us an ordinary e-mail from an e-mail address previously notified to Amadeus IT ServicesTürkiye and recorded in our system. Requests may also be submitted to dataprotection@amadeus.com, which is the dedicated contact address for data protection matters.

We will finalize your requests as soon as possible and at the latest within 30 days, depending on the nature of the request, and no fee will be charged in this respect. However, if the performance of the request leads to the incurrence of additional costs, the standard fees determined by the Board may be collected.

Amadeus IT ServicesTürkiye shall accept or decline the application and provide its response to the data subject in writing or in electronic media.

If your application is declined, the response is found unsatisfactory, or a response is not given in due time, you may file a complaint before the Board within 30 days from the date you are served with the response of Amadeus IT Services Türkiye, or within 30 days as of the end of the 30-day period following the application date, in any case.

9. Contact Info

Company Name: Amadeus Bilgi Teknolojisi Hizmetleri A.Ş.

Central Registration System (MERSIS) No: 0463049827700001

KEP Address: amadeus.ist@hs02.kep.tr

Email: verbis.its@amadeus.com

Address: Fulya Mahallesi, Büyükdere Caddesi, Torun Center A Blok No:74A/İç kapı:141, Şişli, 34394 / İstanbul