Protection of Personal Data Announcement

Rev. 08/03/2021.

1. Controller

2. Scope, Purpose and Legal Basis of the Processing of Personal Data

2.1. On Our Website / Mobile App

2.1.1. Delivery of the Website / Mobile App and Creation of Log Files

2.1.2. Use of Cookies

2.1.3. Use of the Services Offered on Our Website / Mobile App

2.1.4. Newsletter 2.2. Processing for Bookings

2.3. Our Legitimate Interests in the Processing of Personal Data

2.4. Other Processing Grounds

2.5. The Obligation to Specify Personal Data

3. Duration of Data Processing

4. Transfer of Personal Data to Third Parties

5. Your Rights as the Data Subject

6. Consent

7. Information Regarding Commercial Electronic Messages

8. Disclaimer and Limits of This Protection of Personal Data Announcement

9. Additional Information for the Users from the European Union

9.1. International Transfers of Personal Data

9.2. Right to Object according to Art. 21 GDPR

9.3. Your Rights as the Data Subject

Extranetwork takes the protection of your personal data very seriously. In this Protection of Personal Data Announcement, we inform you about which personal data of yours we process: (i) When you use our website and/or mobile app (see in particular Section 2.1.), (ii) If you make a booking via us (see Section 2.2.).

1. Controller

Below, we, as the controller (Art. 4(7) GDPR, Art. 3(1) (ı) KVKK), AYT Technologies GmbH (Prinzessinnenstraße 8-14, 10969 Berlin, Germany) (hereinafter also referred to as “Extranetwork”, “we”, “us”, “our”), inform you about the processing of your personal data (Art. 4(2) GDPR, Art. 3(1) (e) KVKK) in connection with the sale of our products and services and/or as well as the use of our website https://www.extranetwork.com (“website”) or “Extranetwork” mobile app. Extranetwork EU/Turkey Representative: AYT Technologies GmbH (Prinzessinnenstraße 8-14, 10969 Berlin, Germany) If you need further information about the processing of your personal data in connection with the sale of our products and services as well as the use of our website / mobile app, please contact us: Data Protection Officer of AYT Technologies GmbH E-mail: [.] Your privacy matters to Extranetwork as much as it matters to you. Thus, we aim to inform you about Extranetwork’s purposes of processing and manner in which your personal data is processed and to whom Extranetwork transfers your personal data. Your personal data you share with Extranetwork via our website, mobile app and/or other electronic communication and sale channels will be processed in accordance with this information.

2. Scope, Purpose and Legal Basis of the Processing of Personal Data

The processing of your personal data is performed in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”) of T he Republic of Turkey and also the EU General Data Protection Regulation (Reg. EU 2016/679) (“GDPR”) and the German laws (especially BDSG 2018), if applicable, (“Data Protection Legislation”). In the following situations, we collect and use personal data directly from our users or from other sources (as presented below):

2.1. On Our Website / Mobile App

2.1.1. Delivery of the Website / Mobile App and Creation of Log Files

Every time you as a user access our website/mobile app, our system automatically records data and information from the requesting computer system. In this context, the following data (“technical information”) may be collected: (1) Information on the browser type and version, (2) The user’s operating system, (3) The user’s internet service provider, (4) The user’s IP address, (5) Date and time of the access, (6) Websites/mobile apps from which the user’s system accesses our website/mobile app, (7) Websites/mobile apps that are accessed by the user’s system via our website/mobile app. The data are also saved to our system’s log files. Such data will not be stored together with other personal data of the user. In this context, we collect and use this technical information for purposes related to (network) security (e.g. to be able to combat cyber-attacks), marketing, to gain a better understanding of our users‘ needs, to continually improve our website/mobile app and to enable the delivery of the website/mobile app to the respective user’s computer. The purpose of storage in log files is to ensure the operability of the website/mobile app. Moreover, we use the data to optimise the website/mobile app and to ensure the security of our information technology systems. In this context, the data is not analysed for any marketing purposes. The legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) GDPR.

2.1.2. Use of Cookies

Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s computer system. This cookie contains a specific character sequence that enables unique identification of the browser when the website is accessed again. Cookies are stored on the user’s computer, from where they are transmitted to us. You as the user have full control over the use of cookies. When you visit our website, a banner appears, which informs you about the use of cookies on our websites. If you click “Accept all cookies”, you agree to all cookies on our website. By clicking on “Cookie Settings” you can decide for yourself which types of cookies you agree to. You can withdraw your consent at any time and revise your cookie settings. You can change your cookie settings in our cookie policy or you can always find our cookie settings in the footer of our website. There are no cookies in our mobile app. Our mobile app uses your mobile phone's private identification information to identify your device. This mobile information is stored on the user's device and can be accessed by our mobile app. Our mobiile app may have our partners' widgets and/or tools and collects credentials to enable our app to work properly, to ensure certain functions, or to use these functions for advertising or analysis purposes. For further information on the cookies we use, their purpose and legal basis, please refer to our cookie policy stated on our Online Privacy Policy Document.

2.1.3. Use of the Services Offered on Our Website / Mobile App

On our website/mobile app, we offer various services. To render these, we need to collect and process personal data of the user or of our customer. Extranetwork may use your personal data for the following purposes: • Supporting you throughout the transactions you perform on our website/mobile app (via Live Chat etc.), • Sending you the newsletter (see Section 2.1.4.) and commercial messages through the communication channels you may have chosen, • Contacting you with regard to market research through the communication channels you may have been chosen, analysing these research and study results, using such results for statistical studies, • Sending direct-mailings, newsletters and personalized offers which may be carried out from time to time, • Transferring your personal data abroad in compliance with KVKK in order to be able to offer you our products and services on the basis of our contractual obligations or under consideration of our legitimate interests, and to fulfil our obligations arising from public and accommodation safety rules in the countries in which you will be travelling/staying, • Making you personalized offers, including personalized use of the website/mobile app and profiling, • Supporting you in the use of the website/mobile app, with reminder features, based on your given consent according to Art. 6(1) (a) GDPR, Art. 5(1) KVKK; • Providing you with the offers and services requested by you, • Rewarding members of our future or present loyalty programmes which may be carried out from time to time, accommodation and other Extranetwork services which can be paid with issued your benefits Points, based on a contractual obligation according to Art. 6(1) (b) GDPR, Art. 5(2) (c) KVKK; • Providing special accommodation and other related service offers, • Creating, listing, reporting, verifying, analysing and evaluating databases, producing statistical information, • Analysing how you use our website/mobile app and other communication and sales channels, making your communication channels unique to you for better service, contacting you through the communication channels that you have shared directly with us or through hotels and the other accommodation or extra service providers, • Investigating and improving our products and services and your personal choice possibilities related to these, promoting our services or related products, maintaining promotional commercial communication about new products, providing special accommodation offers, advantageous offers and other information that you may find interesting, • To contact you directly or through the company that we get service from, regarding customer satisfaction surveys and studies via the communication channels you chose and to analyze these surveys and study results and to use them for statistical study, • The provision of accommodation safety and security, the protection of life or property of Extranetwork, Extranetwork employees, Extranetwork service providers and their employees or Extranetwork guests, • The prevention of fraud, the performance of internal audits, the establishment of security as well as the management of legal and other claims; based on our legitimate interests according to Art. 6(1) (f) GDPR, Art. 5(2) (f) KVKK; and • The fulfilment of legal obligations including compliance with the rules to which Extranetwork is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in Extranetwork; based on the legal obligations according to Art. 6(1) (c) GDPR, Art. 5(2) (a), Art. 5(2) (ç) KVKK. For these purposes, we may collect the following data types from you: Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information, • Identification and passport information, Accommodation booking details, • Information about billing and payment instruments, • Your product order information, • Your personal interests, • Information that you have communicated to us in the context of your requests and complaints about our products and services, • Information about your use of our website/mobile app and other communication channels, • Your preferences for our products or services or your past choices.

2.1.4. Newsletter

You can subscribe to our free newsletter on our website/mobile app. For the processing of the data, your consent is obtained during the registration process for the purpose of using your e-mail address to send the newsletter. The legal basis for the processing of data after the user’s subscription to the newsletter with consent is Art. 6(1) (a) GDPR and Art. 5(1) KVKK. Your consent relates to the collection and processing of the following data you voluntarily provide during the subscription: (1) E-mail address (2) Name, Surname (3) Title (4) Country of residence (5) Citizenship (6) Preferred language of newsletter (7) Preferred departure airport (8) IP-address of the computer at the time of registration (9) Date and time of registration If you provide your e-mail address and the data listed above in order to receive a newsletter from our website/mobile app, we are able to use the information to send out the newsletter. Our newsletter contains regular offers and information from Extranetwork and its’ online and offline services. You can withdraw your consent at any time. You can find the “Unsubscribe-“ link within each newsletter. After the unsubscription, no more newsletters are send out to you. In connection with the data processing for sending the newsletter, no personal data is passed on to third parties apart from our system and technology provider. The data will be used exclusively for sending the newsletter. In each newsletter, we may analyze your usage behavior using cookies and similar technologies to individualize communication. E.g. openings, clicks and retention time.

2.2. Processing For Bookings

If make a booking from us (via the website/mobile app or through one of our partners), we process your personal data for the following purposes: • Better meet your accommodation and other travel needs, based on a contractual obligation according to Art. 6(1) (b) GDPR, Art. 5(2) (c) KVKK; • Also, the purposes stated in Section 2.1.3. above, based on our legitimate interests according to Art. 6(1) (f) GDPR, Art. 5(2) (f) KVKK. For these purposes, we may collect the following data types from you: Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information, • Identification and passport information, • Accommodation and/or travel booking details, • Information about billing and payment instruments, • Your product order information, • Your personal interests, • Information that you have communicated to us in the context of your requests and complaints about our products and services, • Information about your use of our website/mobile app and other communication channels, • Your preferences for our products or services or your past choices.

2.3. Our Legitimate Interests in the Processing of Personal Data

If Art. 6(1) (f) GDPR is the legal basis for the processing of data, our legitimate interests include the following points apart from the purposes listed above: • Protection of the company against property and non-property damages • Professionalization and improvement (of our products and services) • Cost optimisation (control and minimisation)

2.4. Other Processing Obligations

If we are required by law to do so, we may process your personal data e.g. in order to comply with retention obligations under commercial or tax law or to meet requirements under security law. For further information on retention periods, please see Section “Duration of the Data Processing”.

2.5. The Obligation to Specify Personal Data

According to mandatory legal or contractual requirements, we have indicated the mandatory fields that need to be filled in on our website/mobile app so that we can perform the contract or service you request.

3. Duration of the Data Processing

Your personal data will be erased as soon as they are no longer needed for the mentioned purposes. Personal data may be retained for the period during which legal claims may be brought against Extranetwork (the limitation period). Additionally, the personal data will be stored insofar as and for as long as Extranetwork is required to do so by law. The obligations of documentation and retention arise from the local commercial, tax and anti-money laundering laws.

4. Transfer of Personal Data to Third Parties

In order to be able to offer you our products and services on the basis of our contractual obligations or under consideration of our legitimate interests or to fulfil our obligations arising from public safety rules or accommodation regulations in the countries in which the travel occurs, we may need to transfer your personal data to third parties in or outside Extranetwork. These recipients can be categorised as follows: Extranetwork affiliates, Service providers, Transport Catering Marketing Information Technologies Payment services Credit agencies Customer Feedback Services Governmental authorities.

5. Your Rights as the Data Subject

Under Law No. 6698 on the Protection of Personal Data, you have the rights listed below: (a) Learn whether or not your personal data has been processed, (b) Request information as to the processing if your personal data has been processed, (c) Learn the purpose of processing your personal data and whether such data is used in accordance with this purpose, (ç) Know the third parties in the country or abroad to whom your personal data has been transferred, (d) Request rectification in case your personal data is processed incompletely or inaccurately, (e) Request deletion or anonymization of your personal data provided that the purposes for processing your personal data have disappeared, (f) Request notification of the transactions mentioned in points (d) and (e) to the third parties to whom your personal data has been transferred, (g) Object to any result against you that has emerged from the analysis of your personal data exclusively through automated systems, (ğ) Claim damages if you have suffered any damages due to the unlawful processing of your personal data. You may send your requests regarding your rights above by applying in writing to our postal address: Prinzessinnenstraße 8-14, 10969 Berlin, Germany or sending an e-mail to [.] from the e-mail address which is previously notified by you and registered in the Extranetwork system. According to KVKK, the information which is mandatory to be included in the application are; (a) Name, surname and if the application is made in writing, the signature, (b) Turkish I.D number or nationality along with passport number or foreign identity number, if any, (c) Residential or work address for notification, (d) E-mail address, telephone and fax number for notification, if any, (e) The subject of the request. Your application will be finalized as soon as possible (according to the nature of the request) and at the latest in 30 days. If your application is not answered at all or in time or the response is found insufficient, you may file a complaint with the Personal Data Protection Board (Art. 14 and 15 of KVKK). Kişisel Verileri Koruma Kurulu Nasuh Akar Mahallesi 1407. Sok. No:4, 06520 Çankaya/Ankara. Telephone : +90 312 216 5050 Website : http://www.kvkk.gov.tr

6. Consent

If you have given us your consent to process your personal data, we hereby inform you that you can withdraw this consent whenever you wish. If you have given your consent on this website/mobile app, please visit the web page, on which you originally gave your consent or log in to your registered account in order to withdraw your consent in the settings. If you have given your consent for the newsletter, you can withdraw it by clicking the “Unsubscribe” link directly in the newsletter. In all other cases or if you have any difficulties with withdrawing your consent on this website / mobile app, please feel free to contact [.]. Please note that your withdrawal of consent is only effective for the future and does not affect the legality of data processing that has taken place in the past. In some cases, we may be entitled to continue to process your personal data despite your withdrawal of consent on a different legal basis, e.g. to perform a contract.

7. Information Regarding Commercial Electronic Messages

According to the Law No. 6563 on the Regulation of Electronic Commerce, if you have given your communication consent for commercial electronic messages during booking and through any Extranetwork channels, you will be deemed to have accepted to receive commercial electronic messages about the promotion of products and services offered by Extranetwork and business partners, new products and services, special offers, information about your travel or any other information you may find interesting via your contact information you have chosen. Following the Regulation on Commercial Communication and Commercial Electronic Messages enforced by the Republic of Turkey, it has become a legal obligation for Extranetwork to register the consents/ consent withdrawals of the message recepients who are Turkish citizens or who are residents of Turkey to the Message Management System (IYS) which is the legal basis of sending the commercial electronic messages to the recipients‘ electronic communications addresses in order to market, promote own business or to increase its recognition. The personal data to be transferred to the IYS system will be limited only to your e-mail address, the date you gave your consent to receive commercial electronic messages and the source of consent (via the web). IYS system is managed by an organization authorized by the Ministry of Trade of the Republic of Turkey. Under the provisions of the Regulation, you will always have the right to withdraw your consent that you have given to receive commercial electronic messages, by following the link in the messages that have been sent to you, as well as via the following means (web, call center, etc.) provided by the IYS system. In this way, the use of your rights as a data subject is made more effective, the possibility of querying your consent through a central platform is provided, and the consent/consent withdrawal options are diversified. Within the scope of the information described above, we notify you that the organization that operates the  IYS system is authorized to send messages to your e-mail address regarding your consent or withdrawal of your consent. For further information about the IYS system, you can visit the website: “iys.org.tr”. You can change your communication preferences at any time by following the links in your messages and stop the transmission of such messages through some or all communication channels.

8. Disclaimer and Limits of This Protection of Personal Data Announcement

This Protection of Personal Data Announcement merely applies to the website of https://www.extranetwork.com and “Extranetwork” mobile app. Other websites / mobile apps are not covered by this Protection of Personal Data Announcement and have their own privacy policies.

9. Additional Information for the Users from the European Union

This Section applies only if people from a Member State of the European Union use services provided by Extranetwork.

9.1. International Transfers of Personal Data

Personal data may be transferred to third countries or international organisations. For your protection and the protection of your personal data, such data transfers are subject to appropriate safeguards pursuant to and in accordance with the statutory requirements (especially the application of EU standard contractual clauses), or an adequacy decision issued by the EU Commission (Art. 45 GDPR). For information on EU standard contractual clauses, refer to [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF]/. The EU Commission provides information about its adequacy decisions under the link: [https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en#dataprotectionincountriesoutsidetheeu]. You can request a copy of the applied security measures from [.]. Moreover, we are under the statutory obligation to provide personal data to German and international authorities (Art. 6(1) (c) GDPR as well as local and international regulations and treaties).

9.2. Right to Object according to Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

9.3. Your Rights as the Data Subject

Under the EU General Data Protection Regulation (Reg. EU 2016/679) and German laws (especially BDSG 2018), if applicable, you have the rights below: • Right of access • Right to rectification • Right to erasure (“right to be forgotten“) • Right to the restriction of processing • Right to data portability • Right to object as above (see Section 9.2.) To exercise your rights, you can write an e-mail to [.]. Please note that we will process your personal data based on the legal obligations in order to be able to process your request and for identification purposes. You may file a complaint with the supervisory authority to whose supervision Extranetwork is subject (Art. 77 GDPR): Berlin Commissioner for Data Protection and Freedom of Information Friedrichstr. 219 10969 Berlin Telephone: 030 13889-0 Fax: 030 2155050 Email: [email protected]