Privacy and Cookie Policy

2. Purpose and Scope

This Policy explains how personal data and information obtained through cookies are processed when the website available under the domain name www.dijitalarena.com (“Website”) is visited and used.

The Policy applies to Website visitors, persons using the contact form, and other natural persons who communicate with the Company through the Website. Separate information notices and policies may apply to employees, job applicants, clients, suppliers, and processing activities carried out in connection with specific projects.

3. Relationship with the KVKK Information Notice

This Policy is a supplementary document describing the privacy and cookie practices applicable to the Website. Detailed information regarding the purposes and legal bases of processing, recipient groups, collection methods, and data-subject rights is provided in the separately published KVKK Information Notice.

This Policy does not replace the KVKK Information Notice or any separate consent mechanism required for processing activities based on explicit consent. Cookies and similar technologies requiring explicit consent are managed through a separate cookie-management mechanism based on the visitor’s active and freely given choice.

4. Definitions

For the purposes of this Policy, “personal data” means any information relating to an identified or identifiable natural person; “processing of personal data” means any operation performed on personal data, including collection, recording, storage, alteration, use, disclosure, classification, erasure, or destruction; “data subject” means the natural person whose personal data are processed; and “cookie” means a small text file stored on or read from a visitor’s device by the Website.

A “first-party cookie” is a cookie placed directly by the Website being visited. A “third-party cookie” is a cookie placed by a domain or service provider other than the Website being visited.

5. Data That May Be Processed Through the Website

When the Website is used, the Company may process IP addresses, device types, browser and operating-system information, screen resolution, preferred language, access dates and times, visited pages, referring websites, session information, error records, security logs, cookie identifiers, and online-interaction data.

Where the contact form is used, the Company may process the visitor’s name, surname, e-mail address, telephone number, subject, message content, and other information voluntarily entered into the form. Visitors should provide only the information necessary for the assessment of their communication request.

Visitors should not include health, biometric or genetic data, religious or philosophical beliefs, political opinions, criminal-conviction data, data concerning sex life, or other special categories of personal data in the message field. Where such data are submitted voluntarily, the Company assesses whether their processing is necessary and lawful. Data for which no legal processing condition exists, or which are not necessary to respond to the request, may be erased or destroyed.

6. Use of the Contact Form

Personal data submitted through the contact form may be processed to receive, review, and respond to the request; communicate with the visitor; assess requirements; arrange a meeting or discussion; prepare a quotation where requested; and conduct procedures aimed at establishing a potential business relationship.

Depending on the circumstances, such processing may be based on Article 5 of the Law, including necessity for processing personal data of the parties to a contract where processing is directly related to the establishment or performance of that contract, necessity for the establishment, exercise, or protection of a right, or necessity for the Company’s legitimate interests, provided that the fundamental rights and freedoms of the data subject are not prejudiced.

Submitting the contact form does not constitute consent to advertising or marketing. Where form data are to be used for commercial electronic communications, personalized marketing, or another purpose requiring explicit consent, the relevant approval or explicit consent will be obtained separately.

7. Technical Records and Information Security

Access records, IP addresses, error records, and security logs may be processed to operate the Website securely, identify technical errors, prevent attempted misuse, maintain network and system security, detect attacks, and establish evidence in legal disputes.

Such processing may be based on compliance with the Company’s legal obligations, necessity for the establishment, exercise, or protection of a right, or the Company’s legitimate interests, provided that the fundamental rights and freedoms of data subjects are not prejudiced.

8. What Is a Cookie?

Cookies are small text files stored on a visitor’s computer, telephone, tablet, or other terminal device through the browser when a website is visited. Cookies may be used to operate the Website, provide security functions, remember visitor preferences, prepare usage statistics, and, where the visitor has granted permission, conduct advertising or targeting activities.

Pixels, tags, local storage, software development kits, web beacons, and similar technologies may also be used. The principles relating to cookies under this Policy apply to such technologies to the extent permitted by their technical characteristics.

9. Cookies by Duration

Session cookies are temporary cookies used during a browser session and are generally erased when the browser is closed. They may be used to maintain session integrity or preserve form operations while a visitor moves between pages.

Persistent cookies remain on the visitor’s device for a specified period after the browser is closed or until erased by the visitor. They may be used to remember visitor preferences or, where permission has been granted, conduct analytics and targeting activities.

The duration of each cookie is determined in a manner that is relevant, limited, and proportionate to its purpose.

10. Cookies by Party

First-party cookies are placed directly through the www.dijitalarena.com domain and are primarily used to provide the functions of the Website.

Third-party cookies are placed by third parties providing analytics, video, mapping, advertising, security, social-media, or similar services integrated into the Website. Where third-party cookies are used, the relevant service provider may act as a separate data controller or data processor under its own privacy policies and processing practices.

11. Cookie Categories by Purpose

11.1. Strictly Necessary Cookies — Strictly necessary cookies are used to operate the Website securely and properly, maintain network communications, perform load balancing, remember cookie preferences, complete form operations, and provide a function expressly requested by the visitor. Depending on their specific characteristics, these cookies may rely on a processing condition other than explicit consent because they are required for the core functions of the Website. Strictly necessary cookies are not used for marketing or behavioural advertising.

11.2. Functional Cookies — Functional cookies may be used to remember language, region, appearance, video-playback, or similar user preferences and provide additional Website functions. Functional cookies that are not strictly necessary to provide a function expressly requested by the visitor are activated, where required, only after the visitor has given explicit consent.

11.3. Performance and Analytics Cookies — Performance and analytics cookies may be used to measure the number of Website visitors, pages viewed, how visitors navigate the Website, areas in which errors occur, and technical performance. Whether a first-party analytics cookie may rely on a processing condition other than explicit consent is assessed separately by considering its purpose, scope, duration, disclosure to third parties, and impact on visitors. Performance and analytics cookies requiring explicit consent are not activated unless accepted by the visitor.

11.4. Advertising, Marketing, and Targeting Cookies — Advertising, marketing, and targeting cookies may be used to monitor visitors’ online activity, infer interests, create statistical audience segments, display relevant advertising, limit advertising frequency, measure conversions, and conduct retargeting activities. As these cookies are not necessary for a core Website function expressly requested by the visitor, they are not activated without explicit consent unless another valid legal basis exists.

12. Legal Basis for Cookies

The applicable legal basis for processing personal data through cookies is determined separately by reference to the purpose and technical function of each cookie.

Strictly necessary cookies may rely on processing conditions other than explicit consent, including necessity to provide a service expressly requested by the user, compliance with a legal obligation, necessity for the establishment or protection of a right, or the Company’s legitimate interests, provided that the fundamental rights and freedoms of the data subject are not prejudiced.

Functional, analytics, advertising, marketing, and targeting cookies that cannot rely on another processing condition are used only after explicit consent that is specific, informed, and freely given.

13. Cookie-Management Panel

When a visitor first accesses the Website, a concise and intelligible notice concerning cookies is displayed. The cookie-management panel presents “Accept All”, “Reject All”, and “Manage Preferences” options with comparable visibility and without influencing the visitor’s free choice. Cookie categories requiring explicit consent are disabled by default. Merely accessing or browsing the Website, closing the cookie banner, or taking no action does not constitute explicit consent.

Visitors may make a separate choice for each cookie category through the preferences panel. Strictly necessary cookies may be shown as continuously active because they are required to provide core functions; however, they may not be used for advertising or marketing.

14. Current Cookie Inventory

The current list of cookies actually used on the Website is displayed in the cookie-management panel accessible through the “Cookie Preferences” link in the Website footer.

For each cookie, the inventory identifies the cookie name, provider, purpose, category, first- or third-party status, session or persistent nature, retention period, legal basis, and, where applicable, international-transfer status.

The current inventory displayed in the cookie-management panel forms an integral part of this Policy. Before a new cookie or similar technology is introduced, its purpose, legal basis, retention period, and data-transfer structure are assessed, and the inventory and preference mechanism are updated accordingly.

15. Giving and Withdrawing Explicit Consent

Cookies requiring explicit consent are activated only after the visitor has taken an active affirmative action through the cookie-management panel. Cookie boxes are not pre-selected, and silence, inactivity, or continued use of the Website is not treated as explicit consent.

Visitors may change or withdraw any previous consent at any time through the permanently accessible “Cookie Preferences” link in the Website footer. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal and takes effect in respect of future processing.

Limited records, including the preference category, date, time, approval method, and policy version, may be retained to demonstrate the visitor’s cookie preference and the version of the information presented.

16. Browser Settings

In addition to the cookie-preference panel, visitors may view, block, or erase cookies through their browser settings. Blocking all cookies through the browser may prevent certain Website functions from operating properly.

Browser-level settings may operate independently of the selections made through the Website’s cookie-management panel. Visitors are therefore advised to use the “Cookie Preferences” link on the Website first when changing their choices or withdrawing consent.

17. Third-Party Services and Embedded Content

The Website may contain video, mapping, social-media, security, font, analytics, or similar third-party services. These services may place cookies on the visitor’s device or process IP addresses, device information, engagement data, and viewed content.

Third-party content and tracking technologies requiring explicit consent are not loaded before the relevant consent is obtained. Where a visitor enables third-party content or accepts the relevant cookie category, data may be transmitted to the third party’s systems.

The current identities, purposes, and data-transfer status of third-party providers are described in the current inventory available through the cookie-management panel.

18. Transfers of Personal Data

Personal data obtained through the Website may be disclosed to hosting, software, information-technology, security, communications, and consultancy service providers for the purposes of operating the technical infrastructure, responding to communications, maintaining information security, complying with legal obligations, and protecting legal rights.

Transfers are carried out in a manner that is relevant, limited, and proportionate to the relevant purpose and in accordance with Article 8 of the Law. Personal data may also be disclosed to competent public bodies, courts, or administrative authorities where a lawful request is received.

19. Transfers of Personal Data Abroad

Personal data may be transferred abroad where cookie, analytics, cloud, hosting, security, video, mapping, social-media, or similar services are provided by service providers located outside Türkiye.

International transfers are carried out where a condition under Article 5 or Article 6 of the Law exists and on the basis of an adequacy decision or an appropriate safeguard under Article 9, including a standard contract, binding corporate rules, or a written undertaking authorized by the Personal Data Protection Board.

Where neither an adequacy decision nor an appropriate safeguard is available, the incidental-transfer circumstances exhaustively provided by the Law may be relied upon only for exceptional and non-continuous transfers. Regular and continuous cookie, analytics, advertising, or cloud transfers are not based solely on the incidental-transfer provisions.

20. Retention and Disposal

Personal data are retained for the period required for the relevant processing purpose and any retention period prescribed by applicable legislation. The nature of the data, processing purpose, technical requirements, security needs, legal obligations, and limitation periods are considered when determining retention periods.

Session cookies are generally erased when the browser session ends. Persistent cookies are automatically erased or expire at the end of the period stated in the cookie inventory. Cookie-preference records may be retained for a relevant and proportionate period to demonstrate whether explicit consent was given or refused.

Where all conditions requiring the processing of personal data cease to exist, the data are erased, destroyed, or anonymized ex officio or upon a valid request in accordance with applicable legislation and the Company’s retention and disposal procedures.

21. Data Security

The Company implements risk-based technical and organizational measures to prevent unlawful processing of and access to personal data and to ensure their secure retention.

Such measures may include access and authorization controls, strong-password requirements, multi-factor authentication, firewalls, updated software, encryption, logging and backups, security testing, staff training, confidentiality obligations, supplier controls, and incident-response procedures.

Although no data transmission over the internet or electronic storage method can provide absolute security, the Company applies the measures required to maintain a reasonable level of security appropriate to the existing risks.

22. Rights of the Data Subject

Under Article 11 of the Law, visitors have the right to learn whether their personal data are processed; request information concerning processing; learn the purposes of processing and whether the data are used in accordance with those purposes; know the third parties to whom the data are transferred; request rectification of incomplete or inaccurate data; and request erasure or destruction where the statutory conditions are met.

Visitors also have the right to request notification of rectification, erasure, or destruction operations to recipients; object to an adverse result arising from analysis conducted solely through automated systems; and claim compensation where they suffer damage due to unlawful processing of personal data.

23. Application to the Data Controller

Applications under the KVKK must be submitted in Turkish. Requests may be sent by delivering a written and signed application to Anadolus Turizm Medya ve Ticaret A.Ş., Küçükbakkalköy Mah. Dudullu Cad. No 23-25A, Brandium Residence R1 Blok, Kat 3, Daire 38, 34750 Ataşehir, İstanbul, Türkiye.

Applications may also be submitted through the registered electronic mail address anadolus@hs01.kep.tr, by secure electronic signature or mobile signature, or from an e-mail address previously notified to and registered in the Company’s systems to kurumsal@anadolus.com.

The application must contain the applicant’s name and surname; signature for written applications; Turkish identity number for Turkish citizens; passport number or foreign identity number, if any, for foreign applicants; an address suitable for notification; available e-mail and telephone details; the subject of the request; and supporting information and documents.

Applications are concluded as soon as possible and no later than thirty days, depending on the nature of the request, and are generally processed free of charge. Where the process entails an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

24. Third-Party Links

The Website may contain links to third-party websites or platforms that are not operated by the Company. When such links are used, the privacy and cookie practices of the relevant third party apply. The Company is not responsible for the content, security, accuracy, or personal data processing practices of third-party websites. Visitors are advised to review the relevant privacy and cookie notices before using third-party websites.

25. Amendments and Effective Date

This Policy may be amended following changes in applicable legislation, decisions of the Personal Data Protection Board, the technical structure of the Website, service providers, or personal data processing activities.

The current Policy becomes effective on the date it is published on the Website. Where amendments materially affect cookie use or visitor rights, visitors may be informed through the cookie panel, a Website notice, or another appropriate method.

Effective Date: 01.08.2026 — Version: 1.0. This English version is provided for information purposes. In the event of any inconsistency or difference in interpretation, the Turkish version shall prevail.