Privacy Policy and KVKK Information Notice

This English text is provided for information. The Turkish version is the authoritative text; in case of any conflict, the Turkish text prevails.

1. Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by the following data controllers:

Sindibad Turizm Ticaret A.Ş. (TÜRSAB Certificate No: 10028) Cumhuriyet Mah. Halaskargazi Cad. No: 93-9, 34371 Şişli / İstanbul Tax Office/No: Şişli Tax Office — 7701061307 Data processing activities relating to the performance of services in Türkiye.

Rate Extra Tourism L.L.C. (Licence No: 1253634, Registry No: 2115485) Office 105-A75, Al Markaz Al Tejari 1, Bur Dubai, Dubai, United Arab Emirates Data processing activities relating to the operation of the Platform, and sales and payment processes.

Contact: kvkk@tripxtra.co —

2. Personal Data Processed

2.1. Identity and Contact Data: Full name, nationality, date of birth (where required), passport/identity information (to the extent necessary for venue entries and performance of the service), e-mail address, telephone number.

2.2. Customer Transaction Data: Reservation and order records, selected services, entry/tour/transfer dates, passenger and luggage information, cancellation and refund records, agreement approval records (date, time, order number, text version, IP address).

2.3. Financial Data: Payment amount, currency, payment method, transaction reference number. Card numbers are not stored by us; card information is processed directly through the licensed payment institution's infrastructure.

2.4. Service-Specific Data:

• Transfer: Flight code and flight information, pick-up/destination address, location information (with the user's consent).
• Luggage Storage: Number and descriptive information of luggage, hand-over/return record data, photographs of luggage taken at the time of hand-over.
• Tours: Special circumstances that may affect participation and are notified by the User.

2.5. Transaction Security and Usage Data: IP address, device and browser information, in-app activity records, cookie data.

3. Purposes of Processing

• Providing the purchased services, creating reservations and procuring tickets,
• Carrying out payment, invoicing, cancellation and refund processes,
• Flight tracking and operational planning for transfers,
• Recording hand-over and return processes for the luggage storage service,
• Managing customer support requests and complaints,
• Proving agreement approvals and fulfilling legal obligations,
• Measuring and improving service quality,
• Sending commercial electronic messages where explicit consent has been given.

4. Legal Grounds

Your personal data is processed based on the legal grounds of: the establishment and performance of the agreement (KVKK Art. 5/2-c), fulfilment of a legal obligation (Art. 5/2-ç), establishment and protection of a right (Art. 5/2-e), the data controller's legitimate interest (Art. 5/2-f), and, where applicable, your explicit consent (Art. 5/1).

5. Transfer of Personal Data

5.1. Domestic Transfer:

• Partner suppliers required for the performance of the service (transfer and transportation companies, tour operators, guides, partner hotels where the luggage storage service is provided),
• The ticketing and entry systems of the venues visited,
• Licensed payment institutions and banks,
• Accounting, legal and information technology service providers,
• Upon request, authorised public institutions and organisations, judicial and administrative authorities, and law enforcement.

5.2. Cross-Border Transfer: Within the scope of the operation of the Platform and of the sales and payment processes, your personal data is transferred to Rate Extra Tourism L.L.C. (United Arab Emirates) and to cloud/infrastructure service providers located abroad. The transfer is made under Article 9 of the KVKK and is limited to the data necessary to provide the service, collect payment and meet legal obligations; payment instrument data such as card numbers is not transferred by us. Data transferred abroad is kept for the retention periods stated in Article 7. When that period expires, or the purpose of processing ceases, the data is deleted, destroyed or anonymised together with every copy held in Türkiye and abroad, and the parties it was transferred to are bound by the same deletion obligation. You may request deletion through the channels in Article 8.

5.3. Sharing with Law Enforcement: Where there is suspicion of a prohibited substance in the luggage storage service, all information and records relating to the User and the luggage shall be shared with the competent authorities.

6. Method of Collection

Your personal data is collected electronically through the transactions you carry out on the Platform, our support channels (e-mail, telephone, WhatsApp), notifications received from partner hotels and suppliers, the payment infrastructure, and cookies.

7. Retention Period

Your personal data is retained for the period required by the purpose of processing and for the statute of limitations and retention periods prescribed by the relevant legislation (as a rule, 10 years within the scope of commercial and fiscal legislation). Upon the expiry of the period, the data is deleted, destroyed or anonymised.

8. Rights of the Data Subject

Pursuant to KVKK Art. 11, you have the right to: learn whether your personal data is being processed, request information about it if it has been processed, learn the purpose of processing and whether it is used in accordance with that purpose, know the third parties to whom it has been transferred domestically or abroad, request correction if it has been processed incompletely or incorrectly, request its deletion or destruction, request that these transactions be notified to the third parties to whom the data has been transferred, object to the emergence of a result against you through analysis exclusively by automated systems, and request compensation for damage suffered as a result of unlawful processing.

You may submit your applications to kvkk@tripxtra.co. Your applications shall be concluded within at most thirty (30) days.

9. Cookies

On the Platform, mandatory (session and security), functional (language and preference), analytical, and — where explicit consent has been given — marketing cookies are used. You may update your cookie preferences through the cookie management tool on the Platform. Mandatory cookies are required for the provision of the service and cannot be disabled.

10. Data Security

Technical and administrative measures are taken to ensure an appropriate level of security in order to prevent unlawful processing of your personal data, prevent unlawful access to the data, and ensure the safekeeping of the data.

11. Children's Data

The Platform is not directed at persons under the age of 18. Data relating to children included in a reservation is provided by the adult carrying out the transaction and is processed solely for the purpose of performing the service.

12. Amendments

This text may be updated by being published on the Platform. The updated text enters into force upon publication.