DISCLOSURE STATEMENT ON THE PROCESSING AND PROTECTION OF PERSONAL DATA

Dear Guest,

As Kepler Dinlenme Hizmetleri Anonim Sirketi ("Kepler"), we attach a great deal of importance to the protection of your personal data. In this context and pursuant to the Law No. 6698 on Protection of Personal Data ("LPPD"), we, in the capacity of "data controller", process^[1] your personal data in accordance with the LPPD and within the scope of the below mentioned purposes and limitations, and in line with those purposes, we show ultimate attention to take the necessary administrative and technical measures. Within this framework, we would like to inform you about our data processing processes related to your personal data and your rights under the LPPD through this Disclosure Statement.

1. Which of Your Personal Data We Process

Within the scope of your registration to our website at www.keplerclub.com ("Website") and/or any purchase transactions made through this website, we process your personal data listed below:

• a. Identity Information: Your name, surname, Turkish ID number/passport number, nationality, sex, date of birth, tax office and tax ID number (if applicable).
• b. Contact Information: Your address, telephone number and e-mail address.
• c. Customer/Member Transaction Information: Information on transactions such as services purchased, purchase amount, transaction date and time, information on salon use (entry and exit date and time).
• d. Flight Information: If the passenger scans their boarding pass, flight date and time, destination airport, the airline company operating the flight.
• e. Internet Access Information: IP information related to the device you use and information related to websites you visit (This information shall only be processed if you use the Wi-Fi connection provided by Kepler).

(Hereinafter, all the data listed above will be referred to as "Personal Data" collectively.)

2. For Which Purpose We Process Your Personal Data

Your Personal Data is processed within the scope of the purposes listed below:

• Management and performance of the transactions and activities necessitated by the contractual relationship formed between Kepler and yourself, including reservation processes.
• Fulfilment of the legal obligations arising within the context of the contractual relationship.
• Fulfilment of our obligations in relation to the legislation and serving of legal notices to the relevant authorities within this scope.
• Getting in contact with you in relation to matters regarding your reservation (such as payment, cancellation, refund of payment).
• Performance of financial transactions within the scope of the contractual relationship such as tracking of payments and issuing of invoices.
• Preparation of all necessary records and documentation arising from the contractual relationship electronically or physically.
• Conduct of the evaluation, feedback and complaints processes regarding our services and the customer satisfaction studies.
• Execution of marketing activities, carrying out processes related to campaigns, promotions, and commercial communications, conducting sales and market research and analysis, and determining commercial policies within this scope.
• Conduct of financial and legal audits within Kepler's organization structure and performance of legal works and processes if required.
• Provision of responses to information requests from administrative and judicial authorities.
• Making necessary organizations to ensure that the data processed is up to date and accurate.

3. By Which Methods and on What Legal Grounds We Process Your Personal Data

Your Personal Data is automatically being collected and processed, partially or completely, through our website, mobile application, the kiosk device in our premises, telephone and e-mail within the scope of the reservation and purchase transactions you perform, with the purposes outlined in Article 2 of this Disclosure Statement, based on the following legal grounds located in Article 5 of the LPPD: "Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the conclusion or fulfilment of that contract.", "it is mandatory for the data controller to process personal data to fulfill its legal obligations", and "it is mandatory for the legitimate interests of the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject."

Additionally, based on your explicit consent, data processing activities related to marketing, campaigns, and international data transfers may also be carried out.

While processing your Personal Data, Kepler will act in compliance with the data processing principles and its obligations as specified under the relevant legislation, and particularly the Constitution of the Republic of Turkey, the international treaties to which our country is a party, the LPPD and secondary legislation on protection of personal data. In the event that processing of your Personal Data is required in addition to the aforementioned legal grounds, your data shall be processed based on the legal grounds set forth in Articles 5 and 6 of the LPPD and you shall be notified of such situation.

4. The Reason and to Whom We Transfer Your Personal Data

Your Personal Data is transferred within the framework of the personal data processing conditions and purposes specified in Article 8 of the LPPD in the following ways:

• For the purposes of conducting and developing our services and developing our infrastructure and security processes, to our business partners and performance assistants from whom we receive services.
• For the purpose of fulfilling our legal obligations, to the judicial bodies, law enforcement agencies, other legal authorities, regulatory and supervisory agencies and other public institutions or organizations authorized to request your personal data.
• For the purposes of conducting our business processes in accordance with the law and our legitimate interests and exercising our right to defense in a possible dispute process, to our legal advisors, auditors, tax advisors and other third parties from whom we receive services, judicial bodies, enforcement offices and arbitral tribunals.
• For the purposes of duly keeping the Company's financial records within the scope of proper operation of the Company activities, obtaining consultancy and audit services in areas such as information technologies, marketing and auditing, to our business partners and service providers with whom Kepler works on such matters.
• For the purpose of executing the services offered by Kepler Club and maintaining its technological infrastructure, your personal data may be shared with service providers located abroad, reservation systems, payment infrastructures, and cloud services. This transfer is carried out solely based on your explicit consent.

Your credit card information used for payment is transferred to third parties providing these services such as the bank or electronic payment institution without being recorded by Kepler.

In addition to the cases listed above, in the event that the transfer of your Personal Data with a third party is required, you will be further notified.

5. What are Your Rights under the LPPD

Within the framework of the LPPD and other legislation in force, your rights are as follows:

• i. To learn whether your Personal Data is processed or not.
• ii. If your Personal Data is processed, to request information related with such processing.
• iii. To learn the purpose of processing Personal Data, and whether Personal Data is used in accordance with the purpose.
• iv. To be informed about the third parties to whom your Personal Data is transferred domestically or abroad.
• v. If your Personal Data is processed in an incomplete and wrongful manner, to request remedy of the same.
• vi. To request for the deletion or destruction of your Personal Data pursuant to the conditions stipulated under the LPPD^[2].
• vii. To request that any transaction concluded within the scope of the articles v. and vi. would be notified to the third parties to whom your Personal Data is transferred.
• viii. To object to the occurrence of any consequences to your detriment as a result of the analysis of the processed data exclusively through automatic systems.
• ix. In case you incur any damages as a result of illegal processing of Personal Data, to request indemnification of such damages.

6. How Can You Convey Your Requests to Kepler

You can convey your requests related to the exercise of your rights under the LPPD as specified above to Kepler within the framework of the provisions of the LPPD and the Communique on the Procedures and Principles for Application to the Data Controller by either delivering the original signed request with the documents certifying your identity to the registered office of the company at the address of 19 Mayis Mahallesi, Dr. Husnu Ismet Ozturk Sokak, No:3, Sisli/Istanbul, or sending a registered electronic mail (REM) to keplerdinlenmehizmetleri@hs01.kep or to info@keplerclub.com signed with your secure electronic signature or mobile signature.

If any changes are made to the procedures of personal data processing under this Disclosure Statement, such changes will be reflected to the Disclosure Statement as soon as possible, and you may review the current version of the text on our website at all times.

7. Retention Period and Deletion / Destruction / Anonymization of Personal Data

As Kepler Dinlenme Hizmetleri Anonim Sirketi ("Kepler"), in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK") and the relevant legislation, when the purpose of processing personal data ceases to exist or the retention period stipulated in the relevant legislation expires, such data is deleted, destroyed, or anonymized either ex officio or upon the request of the data subject.

Data Retention Periods

Personal data is retained for the following periods and destroyed afterward:

• Customer reservation and accommodation information: 10 years
• Financial documents, invoices, and payment records: 10 years
• Security camera recordings: 30 days
• Contact forms / support requests: 5 years
• Marketing/communication data: During the period of explicit consent / until consent is withdrawn
• Personal Wi-Fi usage logs: 2 years

Deletion, Destruction, or Anonymization of Data

• Deletion: Making the data inaccessible and unusable for relevant users.
• Destruction: Physically or digitally erasing the data in a manner that makes it impossible to recover.
• Anonymization: Making the data unrelatable to an identifiable or identifiable real person, even when matched with other data.

Kepler carries out these actions within the framework of its personal data retention and destruction policy.

Deletion Upon Data Subject's Request

Pursuant to Article 11 of the KVKK, data subjects may request the deletion or destruction of their personal data under the following conditions:

• If the purpose for processing the data no longer exists
• If the retention period has expired
• If the data has been processed unlawfully
• If explicit consent has been withdrawn and no other legal basis for processing exists

We respectfully submit to your attention.

Kepler Dinlenme Hizmetleri Anonim Sirketi

---

^[1] ↑ Processing of personal data is defined under the LPPD as any operation performed on personal data such as its collection, recording, storage, retention, alteration, re-organization, disclosure, transfer, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or, provided that the process is a part of any data registry system, through non-automatic means.

^[2] ↑ In order to fulfill this request, it is necessary that the legal grounds for processing your Personal Data should no longer exist and the storage times for keeping the relevant data should be expired. Prior to expiration of these times, your request for deletion/destroying cannot be fulfilled.