PRIVACY POLICY

INTRODUCTION

Nova Cartago Travel Agency (operated by Touranos LLC.) -will be referred as Nova Cartago in this document- operates in the tourism market, specializing in the distribution of various tourism services across the country as an intermediary, including transportation ticket sales, private transfers, lodging and dining services, package tours, and all-day activities based in Orta Mah. Gençağa Sk. No:4/8 Avanos/NEVŞEHİR, TURKİYE. Nova Cartago adheres to Turkish legislation governing personal data protection, accessible at https://www.kvkk.gov.tr/en/ Personal Data Protection, along with its supplemental regulations. Hence, Nova Cartago is devoted to:

• Gathering and utilizing personal data.

• Guaranteeing the integrity and security of information.

• Upholding the rights of individuals concerning their information.

Nova Cartago pledges to uphold the protection, management, and appropriate handling of personal information it accesses during its business operations. This commitment entails ongoing evaluations and enhancements of the organization’s processes to secure such personal data effectively, alongside the guidelines set by Nova Cartago for collecting and processing personal information to honor the rights of their owners while complying with the existing regulatory framework. The Policy may be appended with additional procedures, regulations, and/or guidelines that elaborate on this document's provisions, aligning them with its core principles.

OBJECTIVE

This document aims to outline principles, standardized practices, and responsibilities regarding the processing of personal data in which Nova Cartago is involved.

SCOPE

This document applies to all processes within Nova Cartago that will utilize customer personal data contained in various Nova Cartago databases and their handling. The Policy will be thoroughly acknowledged and adhered to by all Nova Cartago employees and suppliers. For interpreting this Policy, definitions in the Law, especially those outlined below, are applicable.

DEFINITIONS

Personal data: Any details that can identify a natural person or can be identified using reasonable means. This includes, but is not limited to, ID numbers, physical addresses, and full names.

Sensitive data: Personal data including biometric data that uniquely identifies the individual; data regarding racial origin, economic status, political, religious, or philosophical beliefs; union affiliations; and health-related information.

Processing of personal data: Any operation or procedure, automated or otherwise, that enables the collection, recording, organization, storage, preservation, processing, modification, retrieval, consulting, use, blocking, erasure, communication by transfer or distribution or any other form of treatment that enhances access, correlation, or connection of personal data. Essentially, the processing encompasses all conceivable forms of use and management of personal data within the organization from initial entry to its eventual deletion or retention.

Consent: Prior, free, unequivocal, and explicit authorization must be granted by the individual to permit the processing of their personal data.

• Prior: Must be obtained before collection.

• Free: Must not be forced or conditional.

• Unequivocal and express: Must leave no doubt about its expression and must be recorded in a tangible medium.

Personal data bank: An organized collection of personal data, automated or manual, regardless of the format, including physical, magnetic, digital, optical, or others created in any form or mode of creation, formation, storage, organization, and access.

Holder of the personal data bank: The individual or legal entity, either private or public, that defines the purpose and content of the personal data bank, its processing, and the security measures.

Data Controller: Any individual or legal entity under private law or public authority that processes personal data, either alone or jointly with another entity, on behalf of the owner of the personal data bank.

Anonymization procedure: Processing personal data in such a way that the holder cannot be identified, with this process being irreversible.

Disassociation procedure: Processing personal data that prevents identification, which can revert the holder's identification.

COMPLIANCE OFFICERS

Nova Cartago will designate and communicate responsibilities to all personnel and suppliers regarding adherence to this Policy. The General Management will be responsible for annually reviewing the Policy and making necessary adjustments within Nova Cartago. Moreover, General Management will address any inquiries related to the implementation and scope of this Policy. Regardless, all Nova Cartago employees and all suppliers and third parties engaged in regular business with Nova Cartago and who have access to or process personal data must adhere to this Policy. Ultimately, no Nova Cartago employee shall act on behalf of the Company in ways that violate the Law.

CONFIDENTIALITY

This Policy is intended for internal use only by Nova Cartago and is therefore confidential. Any use outside of this context is prohibited unless explicitly authorized in writing by General Management. Personal data accessible to Nova Cartago employees and associated third parties or involved in its management may not be treated or utilized in any manner without the prior consent of the personal data owner, even after the cessation of their relationship with Nova Cartago, except for legally defined exceptions. For those employees whose roles grant access to confidential and sensitive personal information, Nova Cartago aims to implement specific training and awareness initiatives. Individuals involved in processing personal data are bound to maintain professional confidentiality concerning such data. This obligation persists even after exiting their relationship with Nova Cartago.

PRINCIPLES

All employees of Nova Cartago are required to consistently adhere to the principles established by the Law while performing their duties, detailed as follows:

a. Legality. Nova Cartago must process personal data following the Law. Collecting personal data through fraudulent, unfair, or unlawful means is strictly prohibited.

b. Consent. Personal data processing without prior, explicit, unambiguous, and freely given consent from the data owner is not permitted by Nova Cartago, except as established by law.

c. Purpose. Personal data collected by Nova Cartago will indicate a clear purpose for its collection, which must be specified, explicit, and lawful. The data processed will not serve different or incongruent purposes than those for which it was collected, unless consent from the owner is provided. In this matter, Nova Cartago will adhere to measures ensuring:

• The collection, storage, and conservation of personal data align with the principles of proportionality and purpose.

• The safeguarding of personal data meets adequate technical and legal security measures.

It is noted that Nova Cartago may not disclose personal data unless compelled by a judicial requirement or with the consent of the owner and with the protections mandated by law. Furthermore, Nova Cartago cannot refuse to provide personal data to a public entity if it is demanded for the lawful exercise of such entity's powers.

d. Proportionality. Any processing of personal data by Nova Cartago must be suitable, relevant, and non-excessive concerning the purpose for which it was collected.

e. Quality. Personal data processed by Nova Cartago must be accurate, truthful, up-to-date as feasible, relevant, adequate and align with the purpose for which it was collected. These data must be kept secure and only for the necessary duration to fulfill the intended processing, respecting applicable legal timeframes for document and information retention.

f. Security. Nova Cartago and the third parties entrusted with personal data processing must implement necessary technical, organizational, and legal safeguards to secure personal data against potential threats such as accidental loss, destruction, unauthorized access, unauthorized operations, or malware incidents. These measures will be established, communicated, and updated by Nova Cartago as required.

g. Adequate Level of Protection. If Nova Cartago engages in international transfers of personal data, it will ensure a level of protection comparable to that established by law for the data being processed.

h. Rights of the holders of personal data. Nova Cartago will provide a straightforward and cost-free process for addressing the rights of personal data holders as stated in the Law: (i) information, (ii) access, (iii) updates, (iv) additions, (v) corrections, (vi) deletions, (vii) prevention of provision, (viii) opposition, and (ix) objective processing. Consequently, Nova Cartago:

• Will take necessary steps to inform personal data holders regarding their rights as stipulated by Law.

• Will take measures to enable the data holder to keep their information updated.

• Will comply with demands and requests concerning the aforementioned rights of personal data holders promptly and within legally defined timeframes.

In managing responses to personal data holder rights, the following guidelines will be applied:

• Deleting or correcting personal data will not proceed if it compromises the rights or legitimate interests of Nova Cartago, its stakeholders, employees, directors, or third parties, or if there exists a legal requirement to retain personal data.

• Nova Cartago may refuse specific requests when disclosure of personal data hampers ongoing judicial or administrative investigations.

TRANSFERS OF PERSONAL DATA

Nova Cartago may only assign or transfer personal data to third parties for fulfilling purposes related to mutual legitimate interests of both the assignor and the assignee, with prior, explicit, uncategorical, free, and informed consent from the owner of the personal data. Such consent is not needed in scenarios permitted by law.

COLLECTION OF SENSITIVE DATA

Nova Cartago will only gather personal and/or sensitive data when absolutely essential and in alignment with purpose and proportionality principles. When collecting and processing such data stems from fulfilling a legal obligation, Nova Cartago will inform the data owner beforehand.

DISCLOSURE OF PERSONAL DATA

Nova Cartago will not disclose personal data to outside parties unless:

a) Necessary for the purpose originally established for the data collection, for instance, in providing services through third parties or suppliers.

b) The data owner has been informed prior to or at the time of data collection.

c) The data owner has provided prior express consent.

d) Consent is not mandated by law.

e) Disclosure is required by public entities as per their legal powers and responsibilities.

f) The data are necessary to meet legitimate requirements from companies interested in acquiring operations from Nova Cartago, provided prior consent from the owner is secured; or,

g) Access to personal data is sought by auditors, lawyers, and other professionals bound by confidentiality obligations.

DELETION OF PERSONAL DATA

Upon completing the processing of personal data, and once the purpose for its processing has been satisfied, and provided no legal obligation or reason exists requiring data retention, Nova Cartago will erase this data from its records. Alternatively, Nova Cartago may apply disassociation procedures or their equivalent for commercial, statistical, or analytical reasons justifying the retention of such data. Nova Cartago will outline the necessary procedures for the deletion of personal data promptly.

SANCTION REGIME

Serious violations of this Policy will be regarded as misconduct subject to disciplinary action against the offending employee. Nova Cartago will take appropriate disciplinary measures in instances of non-compliance with the obligations defined herein by employees.

DISSEMINATION AND ENFORCEMENT OF THE POLICY

Nova Cartago will strive to: I) ensure compliance with this Policy; II) promote the knowledge and observance of this Policy by each employee; III) publish this Policy in accessible areas; and IV) enter confidentiality agreements with employees, users, contractors, and third parties accessing personal data in the databases.

Contact Information

For inquiries concerning this Privacy Policy or for exercising data protection rights, please reach out to us:

Company: Nova Cartago Travel Agency

Corporate: Touranos Turizm Seyahat Acenteliği Tic. Ltd. Şti.

Email: info@novacartago.com

Phone: +90 533 493 01 50

Address: Orta Mah. Gençağa Sk. No:4/8 Avanos/NEVŞEHİR, TURKİYE