CUSTOMER, CHILD AND PARENT/LEGAL GUARDIAN PRIVACY NOTICE

As Akasya Çocuk Dünyası A.Ş. (“Company” or “KidZania”), we exercise utmost care to ensure that your personal data is processed and protected in accordance with the Personal Data Protection Law No. 6698 (“Law”) and its secondary regulations. This Privacy Notice has been prepared by the Company, acting as the data controller, to fulfill its obligation to inform under Article 10 of the Law regarding the processing and transfer of personal data obtained from KidZania customers, children visiting KidZania, and the parents, legal guardians or accompanying persons of these children.

1. PURPOSES OF PROCESSING AND TRANSFER OF YOUR PERSONAL DATA

As the data controller, the Company processes your personal data for the purposes specified below and limited to those purposes, in accordance with the principles of lawfulness and fairness. Processing includes, but is not limited to, recording, storing, classifying, updating and transferring personal data to third parties where permitted by legislation or where such transfer is limited to the purposes for which the data is processed.

Customer and Reservation Processes: Your identity, contact, professional experience, signature and financial data, as well as the first and last name of the child for whom you are the parent/legal guardian or whom you accompany, are processed for the purposes of creating and tracking reservations for customers visiting KidZania, recording reservation and visit information, enabling customers to benefit from the products and services offered, carrying out sales and operational processes for goods and services, processing payments and managing customer relations. Such personal data is shared with our software service providers for the operation and technical support of information systems used in reservation, sales and customer processes, and with our information technology infrastructure and technical support service providers for the operation of relevant information systems and the provision of infrastructure, maintenance and technical support services.

Invoicing and Collection Processes: Your identity, contact and financial data are processed for the purposes of carrying out invoicing, payment and collection transactions relating to customers, issuing collection receipts, creating and monitoring financial and accounting records, conducting sales processes for goods and services, and fulfilling relevant financial and tax obligations. Such personal data is shared with our information technology infrastructure and technical support service providers for the operation of relevant information systems and the provision of infrastructure, maintenance and technical support services; with our service providers in the relevant fields for the execution of invoice, e-invoice, e-archive and electronic signature processes; with the Revenue Administration and other authorized public institutions and organizations for the fulfillment of relevant financial and tax obligations; with banks and financial institutions for the execution of payment and collection transactions; and with our financial advisors for the management of financial and accounting processes and the provision of financial consultancy services.

Entertainment and Activity Processes: Your identity and contact data, personal data relating to individual identifiers and transaction information used within KidZania, as well as the first name, last name, date of birth, gender, KidZania Pazzport number, KidZania bank card information and KidZania NFC wristband number of the child for whom you are the parent/legal guardian or whom you accompany, are processed for the purposes of enabling participation in activities and experiences offered at KidZania, managing activity processes, carrying out necessary identification and transactions through the systems used, conducting sales and operational processes for goods and services, and managing customer relations. Such personal data is shared with our information technology infrastructure and technical support service provider for the operation of relevant information systems and the provision of infrastructure, maintenance and technical support services, and with our relevant software and application service provider for the operation and technical support of the cash register and activity application used at KidZania.

Customer Surveys, Satisfaction and Marketing Processes: Your identity and contact data are processed for the purposes of conducting surveys for customers visiting KidZania, obtaining customer opinions and evaluations regarding events and services, evaluating customer feedback, managing customer relations, measuring and improving customer satisfaction, evaluating sales and event processes relating to the goods and services offered, and carrying out marketing analysis activities. In addition, your identity and contact data obtained through ticket purchases made via the KidZania website and KidZania App, as well as transactions carried out at the KidZania entrance, together with the first name, last name, gender and date of birth of the child for whom you are the parent/legal guardian or whom you accompany, are processed, subject to your explicit consent, for the purposes of conducting customer loyalty processes, carrying out advertising, promotional and marketing activities, and sending commercial electronic communications containing news, campaigns, events, announcements, advertisements, promotions and marketing content to you via email and other communication channels of your preference. Such personal data is shared with our information technology infrastructure and technical support service providers for the operation of information systems used in survey, customer satisfaction and marketing processes and the provision of infrastructure, maintenance and technical support services; with our website and mobile application service providers for their operation and technical support; and with our electronic communication and Message Management System (İYS) integration service providers for sending commercial electronic communications and managing consent and opt-out processes.

Information Requests, Communication and Call Center Processes: Your identity and contact data, as well as audio recordings of telephone conversations within the scope of visual and audio records, are processed for the purposes of receiving, evaluating, responding to and recording information requests, inquiries and applications submitted by telephone or email, establishing necessary communication with you, conducting call center activities, managing customer relations and monitoring request processes. Such personal data is shared with our information technology infrastructure and technical support service provider for the operation of relevant information systems and the provision of infrastructure, maintenance and technical support services in relation to requests submitted by email; and with our call center and telephone exchange service provider for providing telephone exchange services, managing calls and hosting call recordings in a cloud environment.

Infirmary Records and Healthcare Services Process: Your identity, signature and health data limited to information concerning health complaints and the interventions performed, as well as the identity and health data of the child for whom you are the parent/legal guardian or whom you accompany, limited to information concerning health complaints and the interventions performed, are processed for the purposes of managing emergency situations, providing infirmary services, recording interventions performed and conducting operational processes. Such personal data is shared with our healthcare service provider for the provision of infirmary and occupational healthcare services, and with our information technology infrastructure, software and technical support service providers for the operation of the information system in which infirmary records are maintained and the provision of related infrastructure, maintenance and technical support services. Your health data, which constitutes special categories of personal data, is processed and transferred with the necessary technical and administrative measures taken in accordance with applicable legislation.

BKidZanian Loyalty Program Process: Your identity and contact data, as well as the first name, last name, date of birth and gender of the child for whom you are the parent/legal guardian or whom you accompany, are processed for the purposes of establishing and operating the loyalty program offered to children, associating passports issued to children with the relevant users, monitoring transactions and achievements made through passports, assigning rewards and additional benefits based on transactions performed, conducting operational processes relating to the services offered and managing customer relations. Such personal data is shared with our information technology infrastructure and technical support service providers for the operation of information systems used in the loyalty program and the provision of infrastructure, maintenance and technical support services, and with our communication service providers for managing communication processes and sending relevant communications within the scope of the loyalty program.

Lost and Found Property Delivery Process: Your identity and contact data are processed for the purposes of identifying the owners of items found at KidZania, contacting the owners, delivering found items to their rightful owners, and creating and monitoring records relating to lost and found property processes. Such personal data is shared with our information technology infrastructure and technical support service providers for the operation of information systems and the provision of infrastructure, maintenance and technical support services, as well as with our relevant software service providers.

Event Management Processes: Your identity and contact data, personal data relating to photographs, videos and interview recordings within the scope of visual and audio records, as well as the first name, last name, photographs and video recordings of the child for whom you are the parent/legal guardian or whom you accompany, are processed for the purposes of planning and organizing openings, workshops, festivals and similar events, ensuring necessary communication within the scope of events, conducting organization and event management activities, and creating photographic, video and interview content relating to events. The use of your photographs, videos and interview recordings, as well as photographs and video recordings of the child, for advertising, campaign, promotional and marketing activities is carried out subject to explicit consent. Such personal data is shared with our creative service providers for preparing social media and creative content; with our photography and video service providers for conducting photography and video shoots; with our press and communication service providers for managing press relations and communication activities; and with our cloud storage and information technology service providers for storing and retaining data and operating the relevant information technology infrastructure.

Audit Processes: Your personal data is processed for the purposes of conducting audit and ethics activities, ensuring that operations are carried out in compliance with legislation, managing financial and accounting affairs, and conducting risk management processes. Such personal data is shared with audit organizations from which we receive services for conducting audit and independent audit activities.

Physical Security Process: Your physical premises security data, limited to camera recordings, as well as camera recordings of the child for whom you are the parent/legal guardian or whom you accompany, are processed for the purpose of ensuring physical premises security. Such recordings are retained for a period of one month. These data are shared with our security systems maintenance and technical support service provider for the purposes of carrying out periodic maintenance and technical support activities for camera systems.

Information Security, Crisis and Risk Management Processes: Your personal data is processed for the purposes of conducting information security and log management processes, carrying out risk management processes, ensuring the security of data controller operations and maintaining business continuity. Such personal data is shared with our information technology infrastructure, software, information security and technical support service providers for the purposes of conducting information security processes, managing access authorizations, operating and maintaining relevant information systems, and providing technical support services.

Communication, Hosting, Backup and Archiving Processes: Your personal data is processed for the purposes of conducting communication activities, carrying out business operations, ensuring business continuity and managing storage, backup and archiving processes. In addition, your visual and audio recording data obtained during activities carried out at the premises, as well as photographs and video recordings of the child for whom you are the parent/legal guardian or whom you accompany, are processed on the basis of explicit consent for the purposes of creating and maintaining a visual archive. Such personal data is shared with our service providers offering email, hosting, cloud storage, backup and archiving services for the provision of these services.

Personal data belonging to you and children is processed in accordance with the fundamental principles set forth in the Law and securely stored in physical or electronic environments for periods appropriate to the purposes of processing. Following the expiry of the retention periods determined in connection with the relevant purposes, such data is destroyed in accordance with the procedures prescribed by legislation and the methods specified in the Company's Data Retention and Destruction Policy. In carrying out these activities, the Company acts in compliance with all obligations regarding the protection of personal data, particularly those stipulated under the Law and other applicable legislation.

2. METHODS OF COLLECTION AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Personal data belonging to you and the children for whom you are the parent/legal guardian or whom you accompany is collected for the purposes specified above, directly from you and through service providers, via the website, mobile application, reservation and ticketing systems, registration and visitor admission procedures conducted at the KidZania entrance, entrance and access control systems, card and/or wristband systems, physical and electronic forms, surveys, email, telephone, invoices and collection documents, corporate information systems and similar channels, as well as through closed-circuit camera systems during your presence at KidZania. Such data is collected by automated, partially automated or non-automated methods, provided that non-automated processing forms part of a data recording system.

In this context, your personal data is processed in accordance with the principles stipulated under the Law, based on your explicit consent pursuant to Article 5/1 of the Law, or on the processing conditions set out in Article 5/2(a), where processing is “expressly provided for by law”; Article 5/2(c), where “the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract”; Article 5/2(ç), where processing is “necessary for the data controller to fulfill its legal obligations”; Article 5/2(e), where processing is “necessary for the establishment, exercise or protection of a right”; and Article 5/2(f), where processing is “necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.” Your health data and the health data of the child for whom you are the parent/legal guardian or whom you accompany, which constitute special categories of personal data, are processed solely in connection with the use of infirmary services, based on the processing conditions specified in Article 6/3(a) of the Law, where “the data subject has given explicit consent,” or Article 6/3(e), where processing is “necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services by persons subject to confidentiality obligations or authorized institutions and organizations.” Where your personal data is transferred, such transfers are carried out in accordance with the conditions stipulated under Articles 8 and 9 of the Law.

3. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

Pursuant to Article 11 of the Law, you have the right to apply to the Company and (i) learn whether your personal data has been processed; (ii) request information regarding such processing, if your personal data has been processed, and learn the purpose of processing and whether your personal data is used in accordance with that purpose; (iii) know the third parties to whom your personal data has been transferred domestically or abroad and request correction of your personal data if it has been processed incompletely or inaccurately; (iv) request deletion or destruction of your personal data under the conditions stipulated in Article 7 of the Law; (v) request that the deletion or destruction of your personal data pursuant to Article 7 of the Law, as well as the correction of incomplete or inaccurate personal data, be communicated to third parties to whom such data has been transferred; (vi) object to any result arising against you as a consequence of the analysis of your personal data exclusively through automated systems; and (vii) request compensation for damages suffered as a result of the unlawful processing of your personal data.

4. YOUR REQUESTS

You may submit your requests within the scope of Article 11 of the Law to our Company by using the Data Subject Application Form available on the Company's website, by submitting a written application to Akasya, Derin Sok. No: 8/A Acıbadem Üsküdar/İstanbul, by sending a registered electronic mail (KEP) to [email protected], or through other methods stipulated in the Communiqué on the Procedures and Principles of Application to the Data Controller.