Protection and Processing of The Personal Data of Vendor and Vendor's Employess Information Disclosure

TAV MILAS-BODRUM TERMINAL OPERATIONS CO.

PROTECTION AND PROCESSING OF THE PERSONAL DATA OF VENDOR AND VENDOR'S EMPLOYEES INFORMATION DISCLOSURE

1. DATA CONTROLLER

Your personal data can be processed by TAV Milas-Bodrum Terminal Operations Co (the “Company”), in the capacity of the data controller, in the context explained below, in accordance with the Personal Data Protection Law no. 6698 (the “Law”).

You can reach detailed information regarding the processing of your personal data by our Company in the “TAV Milas-Bodrum Terminal Operations Co, Policy on Protection and Processing of Personal Data”, publicly available at the web address of [www.milas-bodrumairport.com].

2. PURPOSES OF PROCESSING YOUR PERSONAL DATA

Your personal data which shall be collected can be transferred to our shareholders, our other suppliers and vendors, legally authorized public authorities and competent private persons, in accordance with the basic principles set forth in the Law and within the scope of personal data processing terms and conditions set forth in articles 5 and 6 of the Law, for the purposes of, mainly, defining our supplier candidates; ensuring definition of our suppliers in our internal systems; providing necessary information, documents and certificates to enable necessary evaluations; managing supplier relations and conducting corporate communication activities; conducting printed, visual or audio communication activities which shall be shared with internal and external stakeholders; conducting supplier relations management processes; conducting negotiations relating to proposals and agreements within the scope of establishing and/or maintaining business relation (purchasing, project, cooperation or campaign management), selection of supplier/supplier’s staff; ensuring business continuity and conducting other communication activities relating to the services; furthermore, with regards to employees of a Supplier acting as a subcontractor, that perform their duties at our Company regularly, conducting the activities of management of occupational health and safety, management of apron cards applications and employee personal rights processes; conducting keeping and archive management, goods/services purchasing activities, and conducting the supply chain management, risk management processes; conducting organization and event management, finalizing your requests and complaints, business activities; following the orders, agreement processes and legal demands; conducting finance and accounting operations; fulfilling our legal, contractual obligations or obligations relating to internal and external procedures which we are subject to; responding to requests which are binding legally and which are received from authorized public or private institutions; making evaluation relating to purchased products and services.

3. METHOD AND LEGAL REASON FOR COLLECTING YOUR PERSONAL DATA

If you contact our Company, your personal data shall be collected in electronic and/or physical environment, by means of business cards, open internet sources, fax, mail, e-mail, phone, communication center, website, and corporate social media channels.

In addition, your personal data shall be collected based on the reasons for the fulfillment of the legal obligations set forth in articles 5 and 6 of the Law; legitimate interest; establishment and performance of a contract; establishment, use, and protection of a right; and receiving your explicit consent, if any.

4. AS A DATA SUBJECT, YOUR RIGHTS AS MENTIONED IN ARTICLE 11 OF THE LAW

We hereby notify that, as a data subject, you have the following rights according to article 11 of the Law:

• To learn whether your personal data are processed or not,
• If your personal data are processed, to request information in relation thereto,
• To learn the purpose of processing your personal data and whether they are used in compliance with the purpose,
• To know the third persons, to whom your personal data are transferred in Turkey and abroad,
• In case your personal data are processed incompletely or incorrectly, to request the correction thereof and to request that any operation carried out in this context is reported to the third persons, to whom your personal data is transferred,
• Despite being processed in compliance with the provisions of this Law and other relevant laws, to request that personal data shall be erased or destructed in the event that the reasons for the processing no longer exist and any operation carried out in this context is reported to the third persons, to whom your personal data is transferred,
• To object to the occurrence of a result against you, if any, by analyzing the data processed solely through automated systems,
• To claim compensation if you sustain damage due to unlawful processing of your personal data.

You can send, to our Company, your applications relating to your rights set forth above, by filling in the " TAV Milas-Bodrum Terminal Operations Co Data Owner Application Form" which you can reach at the address of [www.milas-bodrumairport.com]. Depending on the nature of your demand, your application shall be concluded within the shortest time and at the latest within thirty days and free of charge; however, if the action requires an extra cost, you may be charged based on the tariff determined by the Personal Data Protection Board.