FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.
PERSONAL DATA PROCESSING AND PROTECTION POLICY

SECTION 1: INTRODUCTION

1.1. INTRODUCTION

With the Personal Data Protection Law, the protection of the data of individuals whose data are processed has become a fundamental necessity for every company. Therefore, especiallypaying utmost attention to access to individuals’ private lives and information, taking effectiveand deterrent measures in this regard, and being transparent to our customers, potentialcustomers, visitors, company officials, all parties and institutions we cooperate with, in short, to every person whose data we process that is directly or indirectly associated with ourcompany constitute the primary goal of our company’s data policy.

Our company, with this Policy, sets and implements our rules regarding the processing of personal data within the framework of transparency and openness principles.

1.2. PURPOSE AND SCOPE OF THE POLICY

The primary purpose of this policy is to protect the fundamental rights and freedoms of individuals whose data are processed, especially the privacy of private life, and in this sense, to ensure the transparency of every activity carried out by our company through publicenlightenment.

The scope of the provisions of this policy includes all personal data of individuals whose data we process directly or indirectly.

1.3. IMPLEMENTATION OF LEGISLATION

Relevant legal regulations in force regarding the processing and protection of personal data will primarily find application. In case of any discrepancy between the existing legislation andthe Policy, our Company accepts that the applicable legislation will take precedence. ThePolicy regulates the rules set forth by the relevant legislation within the scope of Companypractices by concretizing them.

SECTION 2: DEFINITIONS AND ABBREVIATIONS

The terms used in the implementation of this Policy express the meanings given below:

Employees: Refers to the employees of our Company.

Contact Person: Is the person responsible for individually monitoring the personal data processing activities within our Company and the implementation of the PDPL (Personal Data Protection Law) Policy and procedures. Acts as the contact person of our Company within thecontext of the PDPL Legislation in the registry of data controllers.

Personal Data: Refers to any information related to an identified or identifiable natural person. For example; name, surname, address, telephone number, date of birth, place of birth, eyecolor, Turkish Identification Number.

Personal Data Owner or Data Subject: Is the real person whose personal data is processed. For example; employee, visitor.

Processing of Personal Data: Refers to any operation performed on personal data, wholly orpartly by automated means or otherwise than by automated means provided that it forms partof a data recording system. For example; obtaining, recording, storing, modifying, transferring.

PDPL: Refers to the Law on the Protection of Personal Data No. 6698.

PDPL Board: Refers to the Personal Data Protection Board. It is the decision-making body of the PDPL Institution.

PDPL Institution: Refers to the Personal Data Protection Institution established by thePersonal Data Protection Law No. 6698.

PDPL Legislation: Refers to the legal regulations related to the protection of personal data and the decisions of the PDPL Board, primarily the Personal Data Protection Law No. 6698.

PDPL Policies and Procedures: Refers to the Personal Data Protection and Processing Policy, other policies and procedures of our company related to the protection and processing of personal data, and various documents referenced by these policies and procedures prepared byour company.

Special Categories of Personal Data: Data related to individuals’ race, ethnic origin, politicalopinions, philosophical beliefs, religion, sect or other beliefs, appearance and dressing, membership in associations, foundations, or unions, health, sexual life, criminal convictionsand security measures, and biometric and genetic data.

Data Recording System: A system where personal data are processed and organized accordingto specific criteria. For example, archiving documents in folders or files.

Data Controller: The real or legal person who determines the purposes and means of processing personal data, responsible for establishing and managing the data recordingsystem. Unless stated otherwise, within the scope of this Policy, the data controller is ourCompany and our company brands (Inspera).

SECTION 3: ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA

3.1. GENERAL PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

3.1.1 Being in Compliance with the Law and Integrity Rules

The processing of individuals’ data must be in compliance with the law and integrity rulesthroughout the processing operation. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes data with utmost sensitivity and control, in accordance with thelaw and integrity rules.

3.1.2 Being Accurate and When Necessary, Up to Date

The processed data must be accurate, and when necessary, kept up to date. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. ensures the accuracy of theprocessed data at every stage of processing and makes the necessary preparations to keep it upto date when required.

3.1.3 Being Processed for Specified, Explicit, and Legitimate Purposes

The data must be processed for specific, explicit, and legitimate purposes. It must be clearwhich data are being processed, to what extent, and for what purpose. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes data only for legitimatepurposes and ensures the data obtained during this process are specified. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes data clearly and explicitly toprevent misuse and misunderstanding.

3.1.4 Being Relevant, Limited, and Proportionate to the Purposes for Which They AreProcessed

The data must be processed in a way that is relevant, limited to, and proportionate with thepurposes they are processed for. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes data in a controlled manner, strictly related to and limited by thepurposes for which they are processed.

3.1.5 Retention for the Period Prescribed by the Relevant Legislation or Necessary for thePurpose for Which They Are Processed

Processed personal data must be retained for the period specified in the relevant legislation orthe period specified for the relevant purpose, acting with the intent of maximum protection. Inthis context, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. primarily retains personal data for the period prescribed in the relevant legislation. If noperiod is specified in the legislation or there is no legal reason requiring the data to be kept fora longer period, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. retains personal data for the period necessary for the purpose for which they are processed. Thus, the security of the data subjects is maximized.

3.2 CONDITIONS FOR PROCESSING PERSONAL DATA

3.2.1 Conditions for processing personal data

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes the data of the data subjects in accordance with the law and legal compliance, following the conditions of the relevant legislation stated below.

General Conditions for Processing Personal Data

General Category Data Concept: The concept of personal data processed by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC., which does not fall into thespecial category data mentioned in this section, constitutes the general category personal data.

General Condition: Personal data cannot be processed without the explicit consent of therelated person.

Exceptions: In the presence of one of the following conditions, personal data can be processedwithout seeking the explicit consent of the related person:

Explicitly foreseen by laws.

Necessary for the protection of life or physical integrity of the person who is physically orlegally incapable of giving consent or whose consent is not legally recognized.

Necessary for processing personal data belonging to the parties of a contract, provided that it is directly related to the establishment or execution of that contract.

Necessary for the data controller to fulfill its legal obligation.

Made public by the related person himself/herself.

Necessary for the establishment, exercise, or protection of a right.

Necessary for the data processing for the legitimate interests of the data controller, providedthat it does not harm the fundamental rights and freedoms of the related person.

Conditions for Processing Special Category Personal Data

Special Category Data Concept: Data related to individuals’ race, ethnic origin, politicalopinions, philosophical beliefs, religion, sect or other beliefs, appearance and dressing, membership in associations, foundations, or unions, health, sexual life, criminal convictionsand security measures, and biometric and genetic data are considered special categorypersonal data.

General Condition: Processing special category personal data without the explicit consent of the person concerned is prohibited.

Exceptions and Special Cases: Personal data, except for health and sexual life mentioned in the first paragraph, can be processed without seeking the explicit consent of the personconcerned in cases foreseen by laws.

Our company obtains explicit consent from the data subjects when processing and storingspecial category data related to specific health problems.

Personal data related to health and sexual life can only be processed for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the management of health services and financing, without the explicit consent of theperson concerned. for planning and management of financing, can be processed without theexplicit consent of the person concerned by individuals or authorized institutions andorganizations under the obligation of confidentiality.

Personal Data Protection Board Conditions: In the processing of special category personaldata, it is also mandatory to take adequate measures determined by the Board.

SECTION 4: PROTECTION OF PERSONAL DATA

4.1. SECURITY OF PERSONAL DATA

In accordance with Article 12 of the Personal Data Protection Law, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes all kinds of technical andadministrative measures according to technological possibilities and implementation costs toensure the lawful processing of personal data. Personal data learned by data controllers andprocessors cannot be disclosed to others in violation of this law and cannot be used forpurposes other than processing.

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. staff related totechnical issues have been trained; awareness among employees on this matter is being raised, and audits are conducted. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.’s relevant accounting and human resources department and contracted legal consultancyfirm work in coordination on this matter.

4.1.1. Measures Taken to Ensure Lawful Processing of Data

Main technical and administrative measures taken by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. to ensure the lawful processing of personal data:

Personal data processing activities within FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. are monitored through technical systems and reported to relevantindividuals.

Personal data processing activities carried out by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.’s business units are defined specifically for eachdepartment and related unit based on the requirements to comply with the conditions forpersonal data processing stipulated by Law No. 6698.

Ensuring compliance with the law and adherence to the procedures prepared for the relevantdepartments are implemented through administrative measures, company internal policies, and trainings.

4.1.2. Measures to Prevent Unlawful Access

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes technical andadministrative measures according to the nature of the data to be protected to prevent thecareless or unauthorized disclosure, access, transfer, or any other forms of unlawful access topersonal data. Main technical and administrative measures taken by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. to prevent unlawful access to personaldata:

Technical measures taken regarding access and authorization solutions are periodicallyreported, and issues posing risks are re-evaluated for necessary technological solutions. Software and hardware including logging, antivirus systems, and firewalls are installed.

Personnel knowledgeable in technical matters are employed.

Access and authorization processes for personal data within the company are designed andimplemented according to legal compliance requirements specific to the business unit.

Employees are informed that they cannot disclose personal data they learn to others in violation of the Personal Data Protection Law and other relevant legislation, nor can they useit for purposes other than processing. They are also informed that this obligation continuesafter they leave their positions, and the necessary commitments are obtained from them in thisregard.

Contracts concluded with individuals to whom personal data are lawfully transferred byFRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. include provisionsthat these individuals will take necessary security measures for the protection of personaldata, and/or mutual consent texts are signed.

4.1.3. Measures Taken for Storing Personal Data in Secure Environments

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes necessarytechnical and administrative measures to store personal data in secure environments and toprevent their unlawful destruction, loss, or alteration.

Main technical and administrative measures taken by our company for storing personal data in secure environments:

Systems compatible with technological advancements are used for storing personal data in secure environments.

Expert personnel in technical matters are employed.

Technical security systems for storage areas are established, technical measures taken arereported to the concerned, and necessary technological solutions are produced by re-evaluating issues posing risks.

Lawful backup programs are used to ensure the secure storage of personal data.

Non-digital data are kept in locked cabinets, accessible only by authorized individuals.

4.2. AUDIT

In accordance with paragraph 3 of Article 12 of the Personal Data Protection Law, the data controller is obliged to conduct or have conducted the necessary audits in their institution ororganization to ensure the implementation of the provisions of this law.

4.2.1. Audit of Measures to be Taken for the Protection of Personal Data

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. and our contractedlegal consultancy firm conduct and/or have conducted the necessary audits to establish data security described above and to ensure the regularity and continuity of the measures taken.

The results of these audits are reported to the relevant department or management within theinternal processes of our company, and activities necessary for the improvement of themeasures taken are carried out in accordance with the Personal Data Protection Law, otherlegislation, and this company policy.

4.2.2. Audit of Increasing Awareness of Business Units on the Protection and Processing of Personal Data

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. ensures theorganization of necessary trainings for business units to increase awareness aimed at preventing unlawful processing of personal data, unlawful access to data, and ensuring theprotection of data, through conducted trainings, seminars, and sessions. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. updates and renews its trainings in parallelwith the updates to the relevant legislation. Systems necessary for creating awareness on theprotection of personal data are established, and audits related to the matter are conducted byour company’s relevant department and contracted legal consultancy firm.

The results of the trainings conducted to increase awareness on the protection and processingof personal data are reported to our company, and participation in these trainings is mademandatory and monitored by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.

4.3. CONFIDENTIALITY

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes all necessarymeasures within its capabilities and according to the nature of the personal data to be protected to prevent the disclosure and transfer of personal data in violation of law and policyprovisions, unauthorized access to these data, and actions arising from other securitydeficiencies.

Necessary training has been provided to the personnel of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. on this subject, and personnel knowledgeable in thisarea have been employed. The personal data processing activities of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. are examined and audited in detail andperiodically. Necessary measures are taken in the activities of processing personal data as technology permits, and updating and improving these measures are essential. The relevantdepartment of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. andour contracted legal consultancy firm work in a coordinated manner in conducting andauditing these activities.

4.4. UNAUTHORIZED DISCLOSURE OF PERSONAL DATA

The provisions of Articles 135 to 140 of the Turkish Penal Code No. 5237 and all relatedlegislation apply in the case of crimes related to unauthorized disclosure of personal data. Allprovisions of the relevant legislation are communicated by our company to employees andrelevant individuals. Real persons who unlawfully record personal data, unlawfully disclosepersonal data to another person, disseminate or seize them, do not destroy the data within thesystem despite the expiration of the periods determined by laws, and do not delete oranonymize personal data contrary to the provision of Article 7 of the Personal Data ProtectionLaw, despite the disappearance of reasons legitimizing the storage or processing of personaldata, are punished with imprisonment according to Article 138 of the Turkish Penal Code. The procedures and principles related to the deletion, destruction, or anonymization of personal data are regulated by regulation.

According to the amendments made to the Turkish Penal Code, a person who unlawfullydiscloses personal data to another person, unlawfully disseminates or seizes these data, is punished with imprisonment from two to four years. Moreover, a person who commits thiscrime by taking advantage of the convenience provided by a certain profession and art is punished as aggravated. A company employee who views, obtains data without the authorityto process personal data, or commits a “hack” crime will be reported immediately to thepersonal data owner, the prosecutor’s office, and relevant authorities, and necessaryproceedings will be conducted, and they will be punished as aggravated.

Administrative fines are applied to those who do not fulfill the obligation of enlightenment orobligations related to data security, do not comply with the decisions given by the Board, oract contrary to the registration and notification obligation to the Registry of Data Controllers, according to the provision regulated under the title of Misdemeanors in the Personal Data Protection Law.

SECTION 5: ORGANIZATIONAL MEASURES FOR THE PROTECTION OF PERSONAL DATA BY THE COMPANY

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. establishes a management structure to ensure the implementation of the Personal Data Protection andProcessing Policy.

A committee is established within FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. to manage this Policy and other policies related and linked to this Policy. Theduties of the committee to be established are stated below. Besides these duties, thecommittee also performs other tasks given by the senior management. The committee carriesout all its activities with the approval of senior management.

To prepare the fundamental policies related to the Protection and Processing of Personal Data and, if necessary, to make changes to these policies,

To decide how the implementation and monitoring of the policies related to the Protection andProcessing of Personal Data will be carried out,

To assign tasks within the company and ensure coordination,

To identify matters that need to be done to ensure compliance with the Personal Data Protection Law and related legislation and to ensure the implementation of these matters,

To create awareness within the Company and among the institutions with which the Companycooperates on the Protection and Processing of Personal Data, and to organize trainings in thiscontext,

To identify risks that may arise in the Company’s personal data processing activities and toensure that necessary measures are taken,

To resolve the applications of personal data owners at the highest level,

To follow developments and regulations in the protection of personal data and to takenecessary actions.

The contact person, the contracted legal consultancy firm, and the individuals to be communicated with the institution are the real persons notified by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. during the registration to the registry. Thereal person or persons to be notified are members of our department assigned to perform thistask within our company.

According to the Regulation on the Data Controllers’ Registry, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. has limited the function of the contactperson to act as a communication point, to ensure the rapid and effective response to therequests directed to the data controller by the relevant persons. This way, it is aimed torespond to the problems or questions of the data owners whose personal data are processed in the fastest and most explanatory way, but the contact officer is not legally authorized torepresent the data controller. Therefore, apart from providing information, the contact officerhas no duty or authority other than responding to the questions of the data owner or the personcommunicating with the contact officer in a lawful manner and informing our company aboutthis matter. Once informed by the contact officer, the relevant department or institutionappointed by our company will conduct the necessary procedures related to the issue as soonas possible and carry out the required procedure. During these procedures, the personal data owner or the relevant person will be informed about all these processes and procedures, and ifnecessary, meetings will be conducted with the personal data owner or relevant persons byour company’s authorized department or institution.

SECTION 6: THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND THE PURPOSES OF TRANSFER

Our company, in accordance with Article 10 of the PDPL Law, notifies the personal data owner about the groups of persons to whom personal data is transferred.

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC., in accordance withArticles 8 and 9 of the PDPL Law and managed by the policy, can transfer the personal data of the data owners to the following categories of persons:

The Company’s;

(i) Business partners,

(ii) Suppliers,

(iii) Group companies,

(iv) Shareholders,

(v) Authorities,

(vi) Legally authorized public institutions and organizations,

(vii) Legally authorized private law persons

The scope of the persons mentioned above to whom the transfer is made and the purposes of data transfer are specified below.

SECTION 7: DELETION OF PERSONAL DATA, RETENTION PERIODS, AND DATA INVENTORY

7.1. Obligation of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.

In accordance with Article 7 of the Personal Data Protection Law No. 6698 and Article 138 of the Turkish Penal Code No. 5237, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. deletes, destroys, or anonymizes personal data that has been processed and thenwhose processing and storage purposes have ceased, based on the rights arising from theTurkish Commercial Code, all rights granted by the relevant legislation provisions, and theprinciples determined in this policy, either by decision it will make or at the explicit requestof the data subject, in a way that will not harm the commercial interests of our company.

7.2. Deletion, Destruction, or Anonymization of Personal Data

7.2.1. Deletion and Destruction of Personal Data

The deletion of personal data is defined in Article 8 of the regulation as “the process of making personal data completely inaccessible and unusable for the relevant users.”

The destruction of personal data is defined in Article 9 of the regulation as “the process of making personal data inaccessible, unrecoverable, and unusable by anyone in any way.”

7.2.2. Methods of Deleting Personal Data

a) Cloud Solutions as a Service Application Type

Data in the cloud system is deleted by issuing a deletion command. During this process, therelevant user does not have the authority to recover deleted data on the cloud system.

b) Personal Data in Paper Form

Personal data in paper form are deleted using the redaction method. The redaction methodinvolves making personal data on the relevant document invisible to the relevant users bycutting them out where possible, or using permanent ink in such a way that they cannot be reversed and cannot be read by technological solutions if cutting out is not possible.

c) Office Files Located on the Central Server

The deletion of a file via the delete command in the operating system or the removal of accessrights for the relevant user on the file or the directory where the file is located.

ç) Personal Data on Portable Media

Personal data stored on flash-based storage media are encrypted and deleted using appropriatesoftware for these media.

d) Databases

The deletion of the relevant rows containing personal data in databases through databasecommands. The person performing this operation is not the database administrator.

7.2.3. Methods of Destruction of Personal Data

a) Physical Destruction

Personal data, being part of any data recording system, can also be processed in non-automatic ways. In destroying such data, the method of physically destroying the personaldata in a way that it cannot be used afterwards is implemented.

b) Degaussing

The process of exposing magnetic media to a high magnetic field by passing it through a special device, rendering the data on it unreadable and indecipherable.

c) Paper Media

The destruction processes in this medium are the method of destroying papers by shreddingand cutting machines into indecipherable sizes.

7.2.4. Anonymization of Personal Data

The anonymization of personal data is defined in Article 10 of the regulation as “makingpersonal data unable to be associated with an identified or identifiable natural person underany circumstances, even if matched with other data.”

7.2.4.1. Methods of Anonymizing Personal Data

a) Masking

A method of anonymization achieved by removing or deleting distinct attributes orcharacteristics of the data subjects.

Example: Preventing the identification of the data subject by removing information such as the Turkish Identification Number that facilitates the identification of the Personal Data Owner.

b) Data Shuffling (Permutation)

This method aims to anonymize data by changing the location of some of the information of data subjects within the system.

Example: Ensuring that the Personal Data Owner is not recognized by swapping lesssignificant information alongside data considered as the main category in employeeinformation.

c) Data Derivation Method

This method involves making modifications such as additions or subtractions to variables in the data within the system to an extent that the information becomes unidentifiable orundetectable.

Example: Instead of detailing the personal data owner’s residence, mentioning theneighborhood or district they live in.

d) Aggregation Method

This method involves converting the specific personal data to a more general value. With thisapproach, data are generalized, making personal data unassociated with any individual.

Example: Instead of listing the neighborhoods where employees live individually, stating thata certain number of employees live in neighborhood X.

7.2.4.2. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.’s MethodSelection Procedure for Anonymization

One or several of the anonymization methods described above will be selected by a committee formed by the company to ensure the enforcement of this policy, in line with allrelevant legislation and the interests of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. in its business life. Detailed information about the committee has beenprovided in a previous section.

The method of anonymization to be selected will be determined by the committee, taking intoaccount the following factors:

The nature of the data

The size of the data

The structure of the physical presence of the data

The diversity of the data

The purpose of data processing

The anonymization process will be carried out in parallel with the principles stated in thestorage durations and personal data inventory sections of this policy.

7.3. STORAGE PERIODS

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. stores personal data in accordance with the durations specified in all relevant legislation.

In cases where no specific duration is set in the relevant legislation, the company storespersonal data for periods determined in accordance with customs arising from the sectorFRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. operates in, and in compliance with laws and regulations, aligning with the interests of the company. Upon nolonger being necessary, personal data are deleted, destroyed, or anonymized as describedabove.

If the purpose for processing and storing personal data has ceased, and the periods defined byall relevant legislation and by our company in this policy have elapsed, personal data can stillbe stored for use in potential legal disputes in the future. Personal data mentioned in thissection are stored solely for use in legal disputes and cannot be used for any other purpose. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes all foreseeableprecautions and measures in line with the above statements.

For example, using information in the data system to determine the residence area of an employee for determining the competent court in a lawsuit arising from wrongful terminationof the contract against an employee who has left the workplace can be considered within thisscope. (The scope of the above statements is not limited to the given example.)

7.4. PERSONAL DATA INVENTORY

In compliance with the Personal Data Protection Law (KVKK) and the Regulation on Data Controllers’ Registry, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. maintains an inventory of data processed separately in every department, where deletion, destruction, and anonymization processes are carried out in accordance with legislation andcompany policy and can be presented to the Personal Data Protection Authority whenrequired.

The inventory must include, according to the regulation:

i. Purposes of personal data processing

ii. Data category

iii. The maximum period necessary for the processing of personal data, related to the group of data recipients and the group of subjects

iv. Predicted periods for transferring to foreign countries

v. Measures taken for data security

Based on the criteria mentioned above, information related to personal data and the processesto be performed with this data will be collected in the relevant inventory. The inventorycontent can be stored in digital formats such as Word and Excel, in line with the company’sinterests and compliance with laws and regulations, and on paper if digital storage is not possible.

The deletion, destruction, and anonymization processes described in Section 6 are carried outin the personal data inventory by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. or an official authorized by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.

7.4.1. Preparation of the Personal Data Inventory

If there are relevant provisions in the legislation regarding the procedure for preparing thePersonal Data Inventory, it will be prepared by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. according to these provisions. In the absence of suchprovisions, the company is free to choose the method for preparing the personal data inventory, considering its internal discipline and work processes.

SECTION 8: RIGHTS OF THE DATA SUBJECT AND RULES FOR THE EXERCISE OF THESE RIGHTS

8.1. RIGHTS OF THE PERSONAL DATA OWNER

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. operates necessarychannels, internal mechanisms, and administrative and technical regulations to evaluate therights of personal data owners and provide them with the necessary information, in accordance with Article 13 of the Personal Data Protection Law.

Personal data owners can submit their requests regarding their rights in writing to ourcompany, which will conclude the request within thirty days at no cost, depending on thenature of the request. However, if the Personal Data Protection Board specifies a;

The right to know if personal data is being processed,

If personal data has been processed, the right to request information about this,

The right to learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,

The right to know the third parties to whom personal data is transferred, domestically orabroad,

In case personal data is processed incompletely or inaccurately, the right to request theircorrection and to request notification of the operation carried out in this context to the thirdparties to whom personal data has been transferred,

Even if personal data is processed in accordance with the provisions of the Law on Protectionof Personal Data and other relevant laws, the right to request the deletion or destruction of personal data in case the reasons necessitating their processing cease to exist, and to requestnotification of the operation carried out in this context to the third parties to whom personaldata has been transferred,

The right to object to the emergence of a result against the person himself through the analysisof the processed data exclusively by automated systems,

The right to demand compensation for the damage in case of loss due to the unlawfulprocessing of personal data.

Pursuant to Article 13 of the Law on the Protection of Personal Data, personal data ownerscan submit their requests related to the exercise of the aforementioned rights by filling out thePersonal Data Protection Law Application Form available on our company’s website andsubmitting it to our company by the methods specified below.

Personal Data Processing and Protection Policy Application Methods

8.1.1. Right to Access Personal Data

Individuals have the right to access their personal data without being subjected to a fee. The company’s interest and legitimate right to hold data are protected under the Personal Data Protection Law and related legislation; the rights to amend and delete are observed. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. informs the concerned individual that they have the right to:

Learn whether their personal data is processed,

Request information if their personal data has been processed,

Learn the purpose of their personal data processing and whether it is used in accordance with its purpose,

Request to know the third parties to whom their personal data is transferred, both domestically and internationally.

8.1.2. Right to Amend or Delete Personal Data

Individuals have the right to amend or delete their personal data without being subjected to a fee. In this context, the concerned individual has the right to:

Request correction if their personal data is processed incompletely or inaccurately,

Request the deletion or destruction of their personal data if the reasons necessitating their processing cease to exist,

Request that the operations of correction, deletion, or destruction are notified to the third parties to whom the personal data has been transferred, and

Object to any adverse result stemming from the analysis of the processed data exclusively by automated systems.

8.1.3. Ensuring the Accuracy of Personal Data

Under the Personal Data Protection Law, there is an obligation to ensure that personal data are accurate and up-to-date when necessary; therefore, it is necessary for the concerned party to notify the company of any changes in their current situation regarding keeping personal data accurate and up-to-date. If the data change is not reported in writing to FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. by the concerned individual, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. is not liable for any damage or sanctions that may arise or could arise due to the data not being updated.

8.2. Ensuring the Rights of the Data Subject

According to Article 12 of the Personal Data Protection Law, the data controller is required to:

Prevent unlawful processing of personal data,

Prevent unlawful access to personal data, and

Ensure the protection of personal data, by taking all necessary technical and administrative measures to maintain an appropriate level of security.

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. is jointly and severally responsible with those persons for taking the measures mentioned in the first paragraph when personal data is processed on its behalf by another real or legal person, in accordance with the relevant article of the law. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. conducts the necessary inspections to ensure the implementation of the provisions of this law within its institution or organization.

This provision has been added to all contracts, commitments, and consensus texts by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. and shared with people who can transfer data according to Section 5 of this policy; in cases where it is not possible to create a contract or consensus text due to factual impossibility or because it does not conform to the normal course of life, this policy has been made publicly available on the website www.insperabodrum.com, where it can be viewed by interested parties.

8.3. Cases Where the Personal Data Owner Cannot Assert Their Rights

Personal data owners, according to Article 28 of the Personal Data Protection Law, cannot assert the rights listed below in the following cases since these cases are excluded from the scope of the relevant law:

Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics,

Processing of personal data without infringing national defense, national security, public safety, public order, economic security, privacy of private life, or personal rights, or without constituting a crime, for purposes such as art, history, literature, or science, or within the scope of freedom of expression,

Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations assigned and authorized by law to ensure national defense, national security, public safety, public order, or economic security, and

Processing of personal data by judicial authorities or execution bodies in relation to investigation, prosecution, judicial, or execution processes.

Under Article 28 of the Personal Data Protection Law; in the cases listed below, personal data owners cannot assert their rights, except the right to request compensation for damages:

If the processing of personal data is necessary for the prevention of crime or crime investigation,

Processing of personal data made public by the personal data owner,

Processing of personal data necessary for carrying out supervision or regulatory duties and disciplinary investigation or prosecution by authorized and competent public institutions and organizations or public professional organizations, based on the authority given by the law.

SECTION 9: PERSONAL DATA PROCESSING ACTIVITIES WITHIN FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. PREMISES AND THROUGH THE WEBSITE

BUILDING AND FACILITY ENTRANCES AND PERSONAL DATA PROCESSING ACTIVITIES WITHIN THE BUILDING AND FACILITIES

Personal data processing activities at the entrances of buildings and facilities and within the premises by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. are conducted in compliance with the Constitution, Personal Data Protection Law (PDPL), and other relevant legislation.

To ensure security, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. conducts personal data processing activities through surveillance with security cameras and monitoring guest entries and exits in its buildings and facilities. The company carries out personal data processing activities by using security cameras and recording guest entries and exits.

SURVEILLANCE ACTIVITIES WITH CAMERAS AT THE ENTRANCES AND INSIDE THE BUILDINGS AND FACILITIES BELONGING TO FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.

This section will provide explanations related to the surveillance system with cameras by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. and inform about how the privacy of personal data and the fundamental rights of individuals are protected. The surveillance activity with security cameras aims to protect the interests related to ensuring the security of the company and other individuals.

Legal Basis for Surveillance Activities with Cameras

The surveillance activity with cameras is conducted by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC.

Conducting Surveillance Activities with Security Cameras According to PDPL

The surveillance activity with cameras for security purposes by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. is conducted in accordance with the regulations in the PDPL. FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC., for the purpose of ensuring security in its buildings and facilities, conducts surveillance activities with security cameras in accordance with the purposes provided in the relevant legislation in force and the conditions for processing personal data listed in the PDPL.

Announcement of the Surveillance Activity with Cameras

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. informs the personal data owner in accordance with Article 10 of the PDPL. It notifies about the surveillance activity through multiple methods related to general matters. The aim is to prevent harm to the fundamental rights and freedoms of the personal data owner, ensuring transparency and informed consent.

Regarding the surveillance activity, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. publishes this Policy on its website (online policy regulation) and places notification signs at the entrances of the monitored areas (on-site enlightenment).

Purpose and Limitation of Surveillance Activity

FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes personal data in a connected, limited, and measured manner in accordance with Article 4 of the PDPL. The purpose of the video surveillance activity is limited to the purposes listed in this policy. Accordingly, the areas, number, and timing of surveillance by security cameras are implemented sufficiently and limited to achieving the security objective. Areas that could infringe on a person’s privacy beyond security purposes (e.g., bathrooms) are not subject to surveillance.

Security of Obtained Data

In line with Article 12 of the PDPL, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. takes necessary technical and administrative measures to ensure the security of personal data obtained from surveillance activities.

Retention Period of Personal Data Obtained Through Surveillance Activity

Detailed information regarding the retention period of personal data obtained through surveillance activity is provided in Section 7.3 of this Policy, named Retention Periods of Personal Data.

Access to and Transfer of Information Obtained from Surveillance

Only a limited number of FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. employees have access to live camera images and digitally recorded and stored records. Those with access are required to sign confidentiality agreements to maintain the privacy of accessed data.

Monitoring of Guest Entries and Exits in Company Buildings and Facilities

To ensure security and for the purposes stated in this Policy, FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. processes personal data related to the monitoring of guest entries and exits in company buildings and facilities. Names and surnames of individuals coming as guests to FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. buildings are obtained, and these personal data owners are informed through texts placed or made available to guests by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. Data obtained for the purpose of tracking guest entries and exits are processed only for this purpose, and relevant personal data are recorded in a physical data recording system.

Records of Internet Access Provided to the Company’s Guests and Website Visitors

Internet Access Records for the Company’s Guests
FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. does not record log records related to internet accesses of guests staying within our facilities, in accordance withLaw No. 5651 and the regulations issued pursuant to this law, for the purposes of ensuringsecurity and as stated in this Policy.

Company’s Website Visitors
On the websites owned by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC., the movements of visitors to these sites are not recorded.

SECTION 10: ENFORCEMENT AND UPDATING
This policy has been enacted by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. Updates can be made to all or part of the Policy. This policy is published on theinternet site owned by FRAME BODRUM BUSINESS MANAGEMENT AND TRADE INC. (www.insperabodrum.com) and is made available to the relevant individuals uponrequest by the personal data owners.

APPENDIX 1: PURPOSES OF PERSONAL DATA

DEFINITIONS

PDPL Article 7

Turkish Penal Code (TPC) Article 138

Regulation: Regulation on the Deletion, Destruction, or Anonymization of Personal Data published in the Official Gazette on Saturday, 28 October 2017, numbered 30224.

ARTICLE 12- (1) The data controller is obligated to: a) Prevent unlawful processing of personal data, b) Prevent unlawful access to personal data, c) Ensure the protection of personal data, by taking all necessary technical and administrative measures to ensure an appropriate level of security.

(3) The data controller must conduct or have conducted the necessary audits within itsinstitution or organization to ensure the implementation of the provisions of this Law.

ARTICLE 7- Despite being processed in accordance with this Law and other relevant legal provisions, personal data shall be deleted, destroyed, or anonymized by the data controller, either ex officio or upon the request of the concerned person, when the reasons necessitatingtheir processing cease to exist. Provisions in other laws related to the deletion, destruction, oranonymization of personal data are reserved.

ARTICLE 10- (1)-c) The personal data processed can be transferred to whom and for whatpurposes,

ARTICLE 13- The related person can submit their requests related to the implementation of this Law to the data controller in writing or by other methods determined by the Board. Thedata controller concludes the requests included in the application as soon as possible andwithin thirty days at the latest, free of charge. However, if the procedure requires an additional cost, a fee determined by the tariff set by the Board may be charged. The data controller accepts the request, explains the reason for rejection, and notifies the related personin writing or via electronic means. If the request in the application is accepted, the data controller fulfills the necessary action. If the application is due to the data controller’s mistake, the fee taken is refunded to the related person.