EMAAR GROUP POLICY ON PROTECTION OF SPECIAL QUALITY PERSONAL DATA

Objective

Hereby this Policy on Protection of Special Quality Personal Data (“Policy”), sets forth the approach of Emaar Libadiye Gayrimenkul Gelistirme Co.Inc., Emaar Properties Gayrimenkul Gelistirme Co. Inc., Emaar Gayrimenkul Gelistirme Co. Inc., Emaar Properties PJSC, being group companies and contact offices of Emaar Group (“Emaar Group”) on protection of Special Quality Personal Data and;  

• Personal data refers to: all kinds of information on real persons, identified or can be identified;
• Special Quality Personal Data refers to: race, ethnic origin, political opinion, philosophical belief, religion, communion or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal convictions and security measures etc. data and biometric and genetics data of people;
• Processing Special Quality Personal Data refers to: all kinds of transactions conducted on Special Quality Personal Data partially or completely such as acquisition, record, storage, maintain, alteration, re-arrengement, disclosure, transfer, take-over, making acquirable, classification or prevention of usage by automatic or non-automatic means, provided that being a part of any data recording system;
• Data Controller refers to: any legal or real person determining personal data processing tools and purposes and responsible for installation and management of data recording system or any Emaar Group company;
• Data Processor refers to: any Emaar Group company or any real or legal person processing personal data basing on the authority granted by and on behalf of Emaar Group company;
• Data Owner refers to: real person being subject matter of personal data;
• Data Recording System refers to: recoding system processing personal data utilized by any Emaar Group company by configuring personal data according to the criteria determined;
• Board refers to: Board of Protection of Personal Data;
• Institute refers to: Institute of Protection of Personal Data;
• Code refers to: Code on Personal Data Protection which was published in the Official Gazette with 29677 number on April 7, 2016;
• Verdict refers to: the verdict of Board related to measures required to be taken by data controller during processing of Special Quality Personal Data pursuant to 31.01.218 dated and 2018/10 numbered Code Article 6 (4) and 22 (1).

Policy pursues the goal of determination of the systems directed on security of related data during processing Special Quality Personal Data collected by Emaar Group.

In terms of employees during processing

Data policy to be implemented by Emaar Group during processing of Special Quality Personal Data in terms of Employees (“Employees”) is as follows:  

• Providing trainings on security of Personal Data to employees two times in a year within the scope of related legislation;
• Entering into confidentiality agreement with employees;
• Clear definition of scope and period of powers of employees;
• Controlling powers of employees periodically by Emaar Group;
• In case of changing position or ceasing employment, release of authorities immediately by Emaar Group. 

In terms of place of storage

Data policy to be implemented by Emaar Group in terms of electronic environments where Special Quality Personal Data is processed, stored and/or accessed is as in the following:  

• Maintaining related data through cryptographic methods and keeping cryptographic keys in safe and different areas;
• Logging transaction records of motions actualized on related data in safe manner;
• Regular controls on security updates of environments including related data, performance of security tests two times in a year regularly and recording test results;
• Authorizing users concerning the data accessed by means of a software, performance of security tests associated with these software two times in a year regularly and recording test results;
• Providing two-stage verification system related to the data remote accessed.

Data policy system to be implemented by Emaar Group in terms of physical environments where Special Quality Personal Data is processed, stored and/or accessed is as in the following:  

• Taking adequate safety precautions according to the property of physical environment;
• Preventing unauthorized entrance and exit to provide security of physical environment. 

With regard to the Transfer

Processing and transfer of Special Quality Personal Data is only possible with explicit consent of related people and can only be actualized in case of following conditions, if explicit consent is not provided:

• Personal Data not associated with health and sexual life can be processed without seeking for explicit consent of related person in the events foreseen in codes.
• Personal Data on health and sexual life can only be processed by authorized institutions and organizations or people under confidential obligation without requiring explicit consent of the concerned people for purposes of protection of public health, preventive medicine, medical diagnosis, carrying out treatment and care services, planning and management of financing and health services.

If Special Quality Personal Data will be transferred within the body of Emaar Group, the data policy to be implemented is as in the following:

• If related data will be transferred via electronic mail, transfer shall be carried out by using registered electronic mail or corporate electronic mail cryptically;
• If related data will be transferred via flash memory, CD, DVD etc. VPN shall be installed between servers or sFTP method shall be used;
• If related data shall be transferred in printed form, necessary precautions shall be taken against steal, loss or unauthorized observation and the document shall be sent with “confidential documents” format.

EMAAR GROUP POLICY ON DEMOLITION OF PERSONAL DATA

Objective

The objective of this Demolition Policy (“Demolition Policy”) is to perform methods and responsibilities on deletion, demolition and anonymization of personal data in Emaar Group in compliance with legislation on protection of related personal data and Emaar Group’s Policy on Protection of Personal Data, particularly, 6698 numbered Code on Protection of Personal Data (“CPPD”), Directive on deletion, demolition and anonymization of personal data (“Directive”).

Scope of Demolition Policy

Grounds and methods to be followed in preparation for anonymization, deletion or demolition of personal data are approached within the scope of this policy.

Definition and concepts 

• Demolition refers to: process of deletion, demolition and anonymization of personal data in a manner that those cannot be utilized afterwards.
• Deletion refers to: the process of making personal data processed by automatic means partially or wholly or maintained in digital environment in a manner that those cannot be used or accessed again by related users.
• Related user refers to: the users processing personal data within the direction of power and instruction taken from Emaar Group or within the organization of Emaar Group apart from the person or unit responsible for storage, protection and backup of personal data technically.

Method for Demolition of Personal Data

The method of deletion was adopted for demolition of personal data held in the body of Emaar Group among the demolition methods within the scope of directive. An access power and control matrix will be established by Emaar Group [IT / Department of Information Technologies] regarding the personal data held in the body of Emaar Group for deletion procedures, and the people having the power of access and control of each personal data in question will be determined (“related user/s”).

Basic principles on Demolition of Personal Data

The personal data held in the body of Emaar Group shall be deleted in 3 months at the latest after disappearing of the reason for processing each personal data. In any case, Emaar Group IT / Department of Information Technologies shall scan all personal data held in the body of Emaar Group in yearly periods and personal data that are required to have been deleted but mistakenly conserved shall immediately be deleted. The process to be followed in deletion of personal data held in the body of Emaar Group is as follows:  

• Determination of the personal data to be subjected to deletion;
• Determination of related users for each personal data by using access power and control matrix;
• Determination of powers and methods of related users such as access, return and reusage; and
• Closing and removal of powers and methods of related users such as access, return and reusage within the scope of personal data.

Emaar Group IT / Information Technologies Department shall take all kinds of technical and administrative precautions to make deleted personal data inaccessible and not usable again by related user. Emaar Group IT / Information Technologies Department may delete or demolish personal data upon disappear of the reasons for processing data referring to its own decision or upon request of personal data owner, despite the fact that those data are processed complying with the provisions of related code. All kinds of procedures conducted in association with deletion, demolition or anonymization of personal data is recorded by Emaar Group IT / Information Technologies Department and aforementioned records are withheld for at least three years excluding other legal liabilities.

Changes to be made on Demolition Policy

Emaar Group may make alterations in this Demolition Policy from time to time to the extent its activities require and required by law. Aforementioned alterations will gain validity upon sharing altered Demolition Policy text on “http://www.emaarsquaremall.com”, “http://www.emaarakvaryum.com” and “https://tr.emaar.com”. Moreover, customers, employees and authorities shall be informed on the alterations to be made by means of electronic mail.

INFORMATION ON THE PROCESSING AND PROTECTION OF PERSONAL DATA

As Emaar, we attach importance to the privacy and security of your personal data. In this context, as Emaar Libadiye Gayrimenkul Geliştirme A.Ş. (“Emaar” and/or the “Company“) in the capacity of Data Supervisor with this Clarification Text (“Clarification Text“), we would like to inform you about the processing of your personal data in accordance with the provisions of the relevant legislation in force (“Legislation“), especially the Law on the Protection of Personal Data No.6698 (“KVKK“) and the Law on the Regulation of Electronic Commerce No.6563 (“ETK“). You may find further information about the purposes of processing your personal data from the Emaar Group Personal Data Protection Policy at “https://tr.emaar.com”

Your Processed Personal Data, Processing Purposes and Legal Reason

Your identity data (name, surname), contact data (mobile phone number, e-mail address) and location and processing security information (consent records, IP address, pixel tags, clickstream, traffic data) will be processed in accordance with Paragraph 2 of the Article 5 of KVKK based on the legal reasons of, (i) “It is clearly stipulated in the laws”, (ii) “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or execution of a contract” and (iii) “Data processing is mandatory for the establishment, exercise or protection of a right.” within the scope of the following purposes:  

• If you request a product/service within the scope of the real estate in the Emaar portfolio, our Company’s making you an offer and provide information in accordance with your request, and carry out studies in order to fulfill your request and communicate with you in this context,
• Our company’s fulfilling its administrative and legal obligations within the scope of all applicable legal regulations,
• Conducting our business relations within our company, with our affiliates, business partners and third parties with whom we have business relations, ensuring the legal and commercial security of the said persons, following legal processes and establishing, using and protecting the rights arising from the legislation.

Your collected personal data may be processed by Emaar for the following purposes in accordance with Paragraph 1 of the Article 5 of KVKK in the case of your explicit consent:  

• Identifying potential buyers/tenants in terms of real estate in the Emaar portfolio and conducting targeted marketing activities for these customers,
• Determining the commercial and business strategies of our company, conducting our customer services/relations and evaluating your satisfaction and conducting statistical studies in this context,
• If you give permission, communicating with you in any way regarding real estate in the Emaar portfolio through your contact information, and informing, transferring data and information for promotional and marketing purposes via telephone, SMS (short message), e-mail and digital channels,
• Keeping statistics on customers in order to increase efficiency in terms of sales, marketing and customer service.

Parties to which Your Personal Data are Transferred and Transfer Purposes

Your personal data processed by Emaar may be transferred to the persons and institutions, their suppliers, service providers, and business partners from which Emaar receives services and/or consultancy services in Turkey and who are obliged to comply with confidentiality obligations for the purpose of Emaar’s providing the service and product or for the performance of the contract in accordance with the basic principles stipulated in KVKK and in accordance with Article 8/1 of KVKK in the presence of your explicit consent, in cases where your explicit consent is needed within the scope of the above-mentioned purposes. Besides, within the scope of the activities, we have explained above, your personal data shall be transferred to legally authorized public institutions and authorized private persons in accordance with KVKK Art.8/2. Besides, in line with the realization of the above-mentioned objectives; In accordance with KVKK article 8/1, in the presence of your explicit consent, they may be shared with Emaar’s domestic group companies Emaar Properties Gayrimenkul Geliştirme A.Ş. (“Emaar Properties“) and Emaar Gayrimenkul Geliştirme A.Ş. (“Emaar Gayrimenkul“) and in accordance with KVKK Art.9/1 in the presence of your explicit consent, and with Emaar group companies abroad; Emaar Properties PJSC (“Emaar PJSC“) and affiliated group companies (Emaar Properties, Emaar Gayrimenkul and Emaar PJSC and affiliated group companies will be referred to as “Emaar Group Companies” hereinafter), our business partners and suppliers residing abroad, from whom we receive services and who are obliged to comply with confidentiality obligations.

Our Method Of Collecting Your Personal Data

Your personal data shall be collected and processed through the cookies we use if you visit our website (https://tr.emaar.com), or in case you fill and send the form on our “Get In Touch” and/or “Sign Up” pages or the electronic forms we provide through our social media channels within the scope of the Legislation by Emaar via e-mail, online communication systems, customer relations management systems (CRM, SAP etc.) or other automatic methods, or within the scope of the Legislation by Emaar from the suppliers with whom Emaar has a contractual relationship, provided that it is not contrary to the Legislation.

What Are Your Rights Under KVKK as a Data Owner?

By applying to our Company in terms of your personal data processed by our company, you have the right to request (i) to learn whether your personal data has been processed, (ii) to request information if they have been processed, (iii) to learn the purpose of processing and whether they have been used in accordance with its purpose (iv) to know the third parties to whom they were transferred at home / abroad, (v) if they have been processed incompletely/incorrectly, to ask for correction, (vi) to request their deletion/destruction within the framework of the conditions stipulated in article 7 of KVKK (vii) to request the third parties to whom your data is transferred to be notified of the transactions in subparagraphs (v) and (vi), (viii) to object to a result against you because it is analyzed exclusively by automated systems, and (ix), to demand the compensation of the damage, in case you suffer damage due to unlawful processing. If you wish to exercise your mentioned rights, you may submit your applications to Emaar AVM, after filling out the Emaar Turkey KVKK application form to which you can access via our website https://tr.emaar.com and printing it out, by sending to the application address Ünalan Mah. Libadiye Cad. No:82F, K:1, Üsküdar/Istanbul with the words “Request for Information under the Personal Data Protection Law” written on the envelope or by sending an e-mail to the [email protected] address. Depending on the nature of your request, your applications will be concluded free of charge as soon as possible and within thirty days at the latest; whereas, if the transaction requires an additional cost, you may be charged according to the tariff determined by the Personal Data Protection Board.