CAREER

CLARIFICATION TEXT REGARDING PERSONAL DATA

Dear prospective employees,  

The nature of your personal data processed by our company, DİANA OTEL YATIRIMLARI VE İŞLETMECİLİĞİ A.Ş. ("Employer"), acting as the data controller under the Personal Data Protection legislation, the legal grounds for processing, the purposes and methods by which your data is obtained and processed, the recipients and purposes for which your data is transferred, as well as your rights concerning this data, are detailed below in accordance with the Personal Data Protection Law (“PDPL").

1. Principles Regarding Personal Data

The Employer processes personal data in accordance with Article 20 of the Constitution and the principles outlined in Article 4 of the LPPD, including:

• adherence to legal requirements and the principle of good faith,
• ensuring the accuracy and, when necessary, the currency of the data,
• processing data for specific, explicit, and legitimate purposes,
• ensuring that the data processed is relevant, limited, and proportionate to the purposes for which it is collected,
• retaining data only for the period prescribed by law or necessary for the purposes of processing personal data.

1. Processed Personal Data

The personal data processed by the employer are as follows:

1. Purposes, Legal Reasons and Methods of Collection of Personal Data

The personal data referenced above are gathered through the application forms made available in written or electronic formats, the CVs submitted by employee candidates to the Employer via email, postal services, website channels, references, or similar methods, and through employment or consultancy firms via electronic and/or physical media. These data are processed in accordance with the purposes and legal grounds previously mentioned.

The personal data of our employee candidates processed under this scope are deleted or destroyed within 2 years after the completion of their visits, or within 3 months if there is no legitimate purpose for their retention. However, data that the Employer may need to retain as evidence in potential disputes are preserved by the Employer for the duration of the statutory limitation periods for litigation.

1. Access Authorisation and Data Transfer

All personal data stored by the employer are accessible exclusively to personnel and managers with access authorization as defined by the company’s Authorisation Matrix. Unauthorized and unrelated individuals are strictly prohibited from accessing this information. Even those with access authorization are not permitted to copy personal data unless absolutely necessary. To safeguard the security of the personal data, the employer utilizes servers that undergo regular penetration testing and continuously monitors the physical security of server rooms and other locations where personal data are stored, as well as access to these areas. The Employer takes all necessary administrative and technical measures to prevent unauthorized personnel from accessing personal data, and provides training to key personnel to enhance the company’s awareness of personal data protection.

The Employer does not transfer the personal data it holds to third parties, except as provided in Articles 8 and 9 of the PDPL. Any data transfers carried out by the Employer under this scope are limited to its subsidiaries, affiliated companies, business partners, audit firms, insurance agencies, lawyers and accountants, banks, private legal entities, and authorized public institutions and organizations.

1. Rights of Data Subjects

In accordance with the Personal Data Protection legislation, we would like to inform you that you have various rights concerning your personal data, and we are committed to assisting you in exercising these rights. In this context, your rights include the following:

a) The right to learn whether your personal data is being processed,

b) The right to request information regarding the processing of your personal data,

c) The right to learn the purpose of processing your personal data and whether they are being used in accordance with that purpose,

d) The right to know the third parties to whom your personal data has been transferred, whether domestically or abroad,

e) The right to request the correction of your personal data if it has been processed incompletely or inaccurately,

f) The right to request the deletion or destruction of your personal data under the conditions outlined in Article 7 of the Law,

g) The right to request that third parties to whom your personal data has been transferred are notified of actions taken under subparagraphs (e) and (f),

h) The right to object to any outcomes that arise against you as a result of the analysis of your processed data exclusively through automated systems,

i) The right to seek compensation if you suffer damage due to the unlawful processing of your personal data.

To exercise these rights, please direct all your requests to the Employer by contacting the Human Resources Officer authorized by the Employer. (a) If you have a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or if you have an email address previously provided to the data controller and registered in the data controller's system, please send your request to the following email address:

kvkk@palomahotels.com.

(b) If you do not have any of these, we kindly ask that you submit your request in writing by mail to the following address.

Human Resources Department

DIANA OTEL YATIRIMLARI VE İŞLETMECİLİĞİ A.Ş. / PALOMA HOTELS

Yenigöl Mahallesi Serik Caddesi No: 64/2 Antalya / Türkiye

In compliance with the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must include the applicant's name, surname, Turkish ID number (or passport number and nationality if a foreign national), residential or workplace address for notifications, email address, telephone and fax number for notifications (if available), the subject of the request, and the signature of the data subject if the application is submitted in writing. Your inquiries and requests will be addressed within 30 days, and applications will be considered submitted on the date they are received.

We respectfully submit this for your information.

DİANA OTEL YATIRIMLARI VE İŞLETMECİLİĞİ A.Ş.

I have read and understood it.