Protection of Personal Data

This Policy on the Protection and Processing of Personal Data (in short, the “Policy”) has been prepared by Yeni Hisar Gazinosu (hereinafter “Yeni Hisar” or the “Company”) in order to set out the principles adopted in the processing of personal data, the rights of data subjects and the Company's obligations, within the framework of the Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the relevant secondary legislation.

This Policy covers the personal data of Yeni Hisar's employees, job applicants, customers, visitors, suppliers, business partners and all natural persons in a relationship with the Company, processed by wholly or partly automated means, or by non-automated means provided that it forms part of a data-recording system.

As a rule, personal data is not processed without the explicit consent of the relevant person. Explicit consent must be based on being informed, relate to a specific matter and be declared with free will. The relevant person has the right to withdraw the explicit consent they have given at any time.

Where one of the following conditions listed in the second paragraph of Article 5 of the Law exists, personal data may be processed without seeking the explicit consent of the relevant person:

• Being expressly provided for in the laws.
• Being necessary to protect the life or bodily integrity of the person themselves or of another, where that person is unable to give consent due to actual impossibility.
• Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract.
• Being necessary for the data controller to fulfil its legal obligation.
• Having been made public by the relevant person themselves.
• Data processing being necessary for the establishment, exercise or protection of a right.
• Data processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

Name, surname, T.C. identity number (where necessary), date of birth, gender, photocopy of identity document (for age verification; returned after presentation).

Telephone number, e-mail address, residence or delivery address (for reservation and contact purposes).

Reservation records, dates and times of visit, seating preference, number of guests and order information taken during the visit to the Venue. As a reservation is created without taking any fee or advance payment, no payment/bank-card data is processed in this context.

E-mail newsletter subscription status, campaign preferences, interest information obtained based on your explicit consent.

CCTV recordings for security purposes at the Venue entrance and in common areas; promotional photo/video recordings taken within the scope of events.

Feedback, requests and complaints submitted through contact forms, telephone calls and social-media channels.

The following data is processed when you visit the Company's website:

• Age-Verification Records: within the scope of the obligation to offer service only to visitors aged 18 and over, your declared date of birth, the calculated age, the verification result (passed/refused), IP address, browser information (user agent) and the time of verification are recorded. These records may be presented if requested by administrative/judicial authorities for the purpose of proving compliance with the age-check obligation.
• Traffic and Analytics Data: in order to understand use of the Site, the page visited, the time of visit, the country (via IP), browser information (user agent), the referring site (referrer) and a random session identifier (cookie) valid for the duration of the session are processed.
• Cookies: mandatory cookies are used to remember your age-verification status (hisar-age-verified), to hold your session identifier (hisar-session) and for the administration panel session (authjs.session-token).

The legal grounds for processing this data are based on the provisions of KVKK m.5/2-ç (fulfilment of a legal obligation — age check) and m.5/2-f (legitimate interest — analytics and security).

Within the framework of the conditions specified in Article 8 of the Law, your personal data may be transferred to authorised public institutions and organisations, audit firms, legal and financial advisory service providers, hosting and technology service providers and our business partners, only to the extent required by the relevant service.

Within the framework of Article 9 of the Law and the Board's decisions, your personal data may be transferred abroad to countries where adequate protection exists or to data controllers that undertake adequate protection in writing; otherwise only within the scope of your explicit consent. Our cloud-based infrastructure providers may fall within this scope.

Personal data is retained for the period foreseen in the relevant legislation or required for the purpose for which it is processed. Commercial and financial records are retained for a minimum of ten (10) years pursuant to the Turkish Commercial Code and the Tax Procedure Law; CCTV footage for thirty (30) days; reservation records for five (5) years from the end of the relationship; age-verification records for two (2) years; and traffic and analytics data for ninety (90) days. Records whose retention period has expired are deleted automatically.

Personal data whose retention period has expired is deleted, destroyed or anonymised pursuant to the provisions of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

Measures such as an authorisation matrix, password policies, penetration testing, network security, keeping log records, backup procedures, encryption and access control are applied.

Periodic KVKK awareness training is provided to employees, confidentiality undertakings are signed, obligations are set by entering into contracts with data processors, and internal audit activities are carried out.

Pursuant to Article 13 of the Law, data subjects may submit their requests regarding the rights listed above in writing in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, via registered electronic mail (KEP), secure electronic signature, mobile signature, or via the e-mail address previously notified to the Company and registered in our system.

Yeni Hisar concludes applications within thirty (30) days at the latest, free of charge according to the nature of the request. Where the process additionally requires a cost, a fee may be charged according to the tariff determined by the Board.

In cases where the application is refused, the response given is found insufficient, or no response is given to the application within the time limit, the data subject may lodge a complaint with the Personal Data Protection Board within thirty (30) days from the date they learn of the Company's response and, in any event, within sixty (60) days from the date of application.