Amadeus IT Services Turkey - PRIVACY STATEMENT

We want you to be familiar with how we collect, use and disclose personal data as per the Turkish Law on Protection of Personal Data numbered 6698 (“LPPD”). This Privacy Statement describes how personal data provided by business partners is collected used and disclosed.

We, Amadeus Bilgi Teknolojisi Hizmetleri Anonim Şirketi (“Amadeus IT Services Turkey”), as Data Controller, hereby declare that as per the Law on Protection of Personal Data numbered 6698 (“LPPD”), we may, within the scope of our commercial or business relationships with you, and in the context of the purposes requiring processing of such data, and in connection with, and to the extent to limited to such purposes, and by maintaining accuracy and actuality of the personal data disclosed to us by you or otherwise; record, store, retain, reorganize your personal data obtained by following methods; and disclose personal data with agencies authorized by law to request such data; and may transmit and transfer, and classify these personal data to third parties in and outside the country according to the conditions stipulated by LPPD; and may process referred personal data in other ways stated under LPPD.

What personal data do we collect?

The Amadeus IT Services Turkey may collect the following personal data from employees, contractors and other points of contact of companies or organizations with which a commercial relationship exists or may exist (Business Partners):

All kinds of Personal Data required to operate the business and fulfill the legal obligations during the business term shall be processed;

• within the scope of commercial affairs or to the extent of our business relationship,
• pursuant to, and in connection with, limited and proportionate to the purpose of the processing required,
• shall be saved, stored, retained, readjusted and processes otherwise within the scope of the records specified herein.

For what purpose will your personal data be used?

Personal Data of the Data Subject shall be processed by Data Controller for the following purposes;

• For what purpose will your personal data be used?
• Personal Data of the Data Subject shall be processed by Data Controller for the following purposes;
• To execute contracts and for identification of Natural Person Customer and Legal person representative within this scope,
• To fulfill legal obligations of our Amadeus IT Services Turkey,
• To enable you and/or other representatives/employees of your company to transmit us, physically or in electronic medium, the personal data we have requested, for the legitimate interest of the Amadeus IT Services Turkey, from you and/or other representatives/employees on behalf of your company; and to input information in our platform; and to log information, via these platforms, into the cloud system installed on the infrastructure of our Amadeus IT Services Turkey** in a way that will be accessible by the Amadeus IT Services Turkey officials.
• To provide efficient support services to the customers of our Amadeus IT Services Turkey,
• To keep finance and accounting records,
• To manage and control invoicing and payment processes,
• For budget management and reporting,
• To provide communication between Natural Person Customers and Natural Person Representatives of Customers,
• To get assistance from Customer employees,
• To coordinate and execute works and communications relating to the services provided to you, and to make quality control and assessment relating to execution of services/contracts,
• To ensure Amadeus IT Services Turkey** Customer database runs smoothly,
• To conduct research and development works,
• To market products during the process of developing and managing our current applications and applications under R&D phase,
• To develop in-house software using external and internal resources,
• To improve and increase efficiency of the Amadeus IT Services Turkey platform for our legitimate interest, by electronic means via cookies used on our web site as explained in detail under our Cookies Policy,
• To ensure Data Controller fulfills its obligations arising from the contract between the Parties, and from provisions of relevant legislation.

The legal basis for processing personal data is:

• the processing is necessary to fulfill the contractual obligations and protect the rights arising of from the agreement, this means necessary for the performance of a contract that Amadeus IT Services Turkey has or is about to enter into with the Business Partner,
• legitimate interest of the Amadeus IT Services Turkey, or
• compliance with laws and regulations.

Such data are collected, limited to the aforementioned purposes, in electronic medium and/or from recordings of phone calls between you and our employees.

Transfer of Processed Personal Data in the Country and Out of the Country

Personal Data may be transferred as stated below only if necessary to fulfill obligations arising from the contract concluded between the Parties and from provisions of relevant legislation, and to improve service quality and to safeguard legitimate interests of both parties, and to the extent and scope required and by taking into consideration the rulings of the Authority,

• may be transferred by the Amadeus IT Services Turkey to the other companies of the Amadeus Group and by other companies of the Amadeus Group to Amadeus IT Services Turkey , in line with the legitimate interest of our Amadeus IT Services Turkey, for the purpose of providing assistance to you, and for communicating with you whenever necessary, and to ensure that services are not interrupted,
• may be transferred to agencies, legal consultants and lawyers authorized by law, and/or
• may be transferred to employers in Turkey or overseas that Data Controller has made an application to and/or
• may be transferred to tax offices, labor inspectors and other administrative agencies and institutions, particularly to SSI
• may be transferred to necessary third parties for the purpose of thanking you for working with us, and for promoting and marketing new or updated products of the Amadeus IT Services Turkey, and for inviting you to special events organized for such and similar purposes, and for sending you gifts to celebrate and to congratulate you on your special occasions (related organization firms, companies and establishment where such organization shall take place, company/platform for sending gifts, courier company etc.), and such information shall be limited with your name and surname, your address and telephone number,
• may be transferred to related employees authorized by the Amadeus IT Services Turkey and/or
• may be transferred as per the conditions stipulated under LPPD, to independent auditors that Amadeus IT Services Turkey collaborates with and/or to third parties in or outside the country that operates in line with its area of activity and/or to service providers providing information services regarding advertisement, promotion and marketing communications, and monitoring customer satisfaction information services,
• as we work with third party companies in and outside the company in connection with sending bulk emails, SMS to inform you about developments, promotions and innovations, we may transfer necessary personal data to such third parties only for the aforementioned purposes,
• may be transferred to the companies and audit companies we are affiliated with as required and for the purpose of inspections to be carried out and reports to be issued relating to accounting and finance transactions such as budget management, invoicing,
• As we are able to share your personal data, when necessary, in relevant programs used for accounting and for the management of financial transactions, in line with the purpose of processing thereof, we may transfer your personal data to companies that provides this database.
• In order to preserve the records encompassing your personal data through their period of retention, we may transfer the related records to third party archive companies who provide this service.

Personal Data Storage

Your Personal Data is stored in physical and digital environment by Amadeus IT Services Turkey departments and personnel by similar means. Your personal data may be stored for the period required for the purposes for which these are processed. If we no longer have any legal reason for storing personal data after the reason for processing of data ceases to exist, we delete, destroy or anonymize your personal data.

Personal Data Security

Amadeus IT Services Turkey takes appropriate technical and administrative measures to ensure your personal data is processed lawfully, and stored securely, and unlawful access to your personal data is prevented.

Your Rights as per Article 11 of LPPD no. 6698:

Data Subject has the following rights respectively, apart from and in addition to its right to observe and request the performance of the basic principles summarized above as per Article 11 of LPPD:

• To be informed whether his personal data is processed or not,
• To request further information about processing of personal data relating to him,
• To be informed of the purpose of processing of personal data and whether such data is used consistently with the purpose,
• To be informed of the third parties in the country or abroad to whom personal data is transferred,
• To request rectification of personal data if processed incompletely or inaccurately,
• To request, when reasons which require processing of Personal Data ceases to exist, the deletion or destruction of his personal dataas stipulated and to the extent stated under the law and relevant legal legislations,
• To request that third parties to whom Personal Data is transferred to are notified about the request of deletion and destruction of Personal Data,
• To object to the processing, exclusively by automatic means of his personal data, which leads to an unfavorable consequence for the data subject,
• To request compensation for the damage arising from unlawful processing of his Personal Data.

As per the principles and procedures set out in Communiqué on Procedures and Principles regarding Application to the Data Controller published in Official Gazette numbered 30356 and dated 10.03.2018, you may send your request bearing the wet signature to the address stated in the last section of this document via hand delivery, post, cargo or notary; or may send us an e-mail with your digital signature, mobile signature in the mail to our registered e-mail address (KEP) or may send us an ordinary e-mail from your e-mail address notified to the Amadeus IT Services Turkey in advance and recorded under our system.

We will finalize your requests under the application as earliest as possible and at latest within 30 days depending on the essence of the request and no fee will be charged in this respect. However, if performance of the request leads to incurrence of additional costs, the standard fees determined by the Board may be collected.

The Amadeus IT Services Turkey shall accept the application or decline it and provide its response with the data subject in writing or in electronic media.

If your application is declined, the response is found unsatisfactory or the response is not given in due time, you may file a complaint before the Board within 30 days as of you are served with the response of the Amadeus IT Services Turkey, or within 30 days as of the end of 30 days following the application date, in any case.

Contact Info

Company Name: Amadeus Bilgi Teknolojisi Hizmetleri A.Ş.

KEP Address: amadeus.ist@hs02.kep.tr

Central Registration System (MERSIS) No: 0463049827700001

Email: verbis.its@amadeus.com

Address İstanbul Ahlsb Y.köy Sb. Mh. H. Limanı Cd. N.1 Plaza Sk. K.5 N.501-502 Bakırköy İstanbul