User Privacy Notice

AILA
USER PRIVACY NOTICE

With this privacy notice, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the "Law"), you are informed, by Humion Teknoloji Anonim Şirketi (the "Company"), located at Esentepe Mah. Talatpaşa Cad. No: 5 İç Kapı No: 1 Şişli / İstanbul, acting as data controller, about the processing of your personal data obtained if you become a member of the Company's AILA application.

This text provides information mainly about your personal data that will be processed, the purposes of processing, the legal grounds for processing, the method of collecting your personal data, the parties to whom your personal data will be transferred and the reasons for such transfers, and your rights.

1. Your Personal Data to Be Processed and the Purposes of Processing

If you become a member of the Company's AILA application, your personal data that is obtained from you and processed is as follows:

1. Identity Information: Such as your name, surname, date of birth and age
2. Contact Information: Such as your e-mail address, telephone number and residence address
3. Information on Family and Relatives: Personal data, such as identity and contact information of your family members, relatives or persons of whom you are the guardian/legal custodian, that you share while using the features within the AILA application or while inviting third parties to the application. (Important Note: If data relating to such third parties is transferred to AILA by the User, it is exclusively and entirely the User's responsibility to inform those persons about the processing activity in accordance with Law No. 6698 and to obtain all legal permissions, approvals or explicit consents required by the legislation, including for persons of whom the User is the guardian/legal custodian. The Company accepts that this data is shared in accordance with the law and legislation; any administrative, legal or criminal sanctions, damages and compensation claims that the Company may be exposed to as a result of the User acting in breach of this obligation will be recoursed to the User.)
4. Image and Audio Information: Such as audio information for voice commands
5. Health Information: Health information such as allergen, gluten sensitivity and lactose intolerance information
6. Location Information: GPS location information
7. Customer Transaction Information: Such as order information, reservation information, recommendation history, in-app preference information, usage history information, and request/complaint information
8. Payment Information: Such as your credit and/or debit card information (Payment transactions are carried out through licensed payment institutions independent of our Company, and your credit card information is not stored in our Company's systems.)
9. Marketing and Notification Information: Such as notification preferences for advertising and campaign permission information
10. Customer Transaction and Preference Information: Data required for the provision of the service, such as order and reservation information, reservation date, eating and drinking habits and preference information, in-app usage history, and request/complaint information.
11. Business Partners Marketing and Profiling Information (Explicit Consent): Your preference, habit and user interaction data that is shared with business partners, even if your name and surname are masked (hidden), for the purpose of personalizing joint campaigns, discounts and promotions carried out with our B2B business partners (restaurants, cafes, etc.).
12. Artificial Intelligence Interaction and Content Information: The conversation contents (dialogues) you have with AILA, voice command data, interaction records analyzed by the artificial intelligence memory system, and the textual content shared in this process.
13. AILA Social Data: Username, profile picture, unique friendship code, saved/favorite venue preferences, general interests, calendar and time availability data, real-time/last known location data, and information on community events you take part in.

Your personal data is processed by our Company in accordance with the fundamental principles of data protection law and only for the purposes of which you have been informed. Provided that they are relevant to, limited to and proportionate to each of your personal data, the purposes of processing your personal data are as follows:

• Providing personalized recommendations and experiences supported by artificial intelligence

• Creating the user profile

• User Profile and Experience Analysis: In order to improve the quality of our services and personalize your usage experience in the AILA application, profile groupings may be made in line with the preferences you enter into the system and your usage dynamics. This activity is limited to providing you with more accurate recommendations and does not include any scoring or automated decision-making mechanism that would create discrimination or deprivation of rights among our users.

• Providing the voice artificial intelligence assistant service

• Providing location-based recommendations

• Making restaurant and event reservations

• Personalizing the user experience

• Developing and improving the services

• Improving Application Performance and Algorithms: In order to increase AILA's response quality, optimize system errors and provide you with more accurate assistant services, your usage dynamics and technical interaction data in the application may be analyzed in an anonymized or masked manner. You reserve the right to stop (opt out of) this data processing activity at any time from the 'Settings' section within the application.

• Carrying out account management and authentication processes

• Recording billing transactions

• Carrying out marketing activities

• Carrying out business activities, ensuring audit and continuity, carrying out and evaluating management activities, and ensuring audit, optimization and sustainability

• Carrying out communication activities

• Enabling our Company to undergo independent audit and internal audit processes, to receive legal, accounting and consultancy services, and to follow up finance, accounting and legal affairs,

• Carrying out activities in accordance with the relevant legislation and, where necessary, providing information to authorized persons, institutions and organizations,

• Carrying out information security operations and ensuring that data is accurate, up to date and usable,

• Ensuring the security of the data controller's operations,

• Establishing and implementing our Company's commercial strategies

• Carrying out processes established with business partners, service providers and suppliers so that our Company can perform its business activities and fulfill its obligations to you,

• Ensuring that commercial and/or business relationships with the agencies with which our Company has agreements are properly maintained

• Carrying out electronic storage and archiving activities so that our Company can ensure that the user experience is sustainable.

• AILA Social and Joint Planning Processes:

  Your data collected within the scope of the AILA Social features is processed for the purposes of making joint venue/event plans with the friends you add through the friendship code, matching your calendar availabilities, enabling your real-time location to be viewed by the friends you have added, and creating the participant list for the community events you attend.

  Legal Grounds: This data is processed on the legal grounds of "the establishment and performance of the User Agreement" pursuant to Article 5/2-c of Law No. 6698 (KVKK) and "the legitimate interests of the data controller" pursuant to Article 5/2-f.

If the above-mentioned purposes of data processing change, the privacy notice will be updated and shared by our Company in a way that allows you to be informed.

2. Legal Grounds for Processing Your Personal Data and the Method of Collecting Your Personal Data

In order to achieve the purposes mentioned above, your personal data is collected by our Company, verbally, in writing or in the electronic environment, in physical or digital formats, through the system presented to you or by automated means through companies with which we have a business/commercial relationship, through a reservation request created by a person close to you, or by non-automated means provided that it is part of the data recording system.

Your collected personal data is processed, in a manner limited and proportionate to the processing purposes specified in the above heading, on the basis of the following legal grounds:

Your personal data other than Artificial Intelligence Interaction and Content Information (Dialogues), Audio Recordings, Health Data, Location Information, and Marketing and Notification Information (Identity, Contact, Information on Family and Relatives, and Customer Transaction and Preference Information) is processed on the basis of the following grounds listed in Article 5 of the Law:

• It being expressly provided for by the laws,
• It being necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract (particularly for reservation, order and preference management processes),
• It being mandatory for our Company to fulfill its legal obligation,
• Data processing being mandatory for the establishment, exercise or protection of a right,
• Data processing being mandatory for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms.

Audio Recordings, Health Data, Location Information, and Marketing and Notification Information, on the other hand, will be processed if you give your explicit consent, pursuant to Article 5/1 and Article 6 of the Law. If you do not give explicit consent, the relevant personal data will not be processed; if you withdraw your explicit consent, this data will be destroyed within the destruction period under the Company's Retention and Destruction Policy. Explicit consent is entirely voluntary, and not giving this consent may restrict the use of certain features other than the application's core functions (personalized recommendations, voice commands, etc.).

3. Parties to Whom Your Processed Personal Data Is Transferred and the Purpose of Transfer
Within the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, and on the legal grounds of the establishment or performance of a contract, our Company's ability to fulfill its legal obligations, the establishment, exercise or protection of a right, and our Company's legitimate interests provided that your fundamental rights and freedoms are not harmed, your personal data may be transferred to the parties specified below for the purposes of providing the services in the AILA application without interruption, providing the payment infrastructure and carrying out operational processes:

• Financial and Payment Institutions: To independent and licensed payment institutions (e.g., iyzico, etc.) so that collection transactions within the scope of your distance contract can be carried out securely,

• Service and Restaurant Partners: To the relevant restaurants and service providers that are our business partners so that the orders and reservations you place through the application, or the personalized services you receive, can be fulfilled,

• Technical Infrastructure and Consultants: To the expert firms from which we receive server, cloud computing, legal and financial consultancy services,

• Authorized Public Institutions and Organizations: To the relevant public institutions, organizations and judicial authorities, for the purpose of fulfilling our legal obligations and limited to legal requests.

• Transfers within the Scope of AILA Social:

  If you choose to use the AILA Social module, your profile picture, username, interests, favorite venues, calendar availability status and real-time location data are shared only with the friends whom you have approved/added by entering a friendship code.

  In addition, if you take part in community events, your username and profile picture are displayed to the other participants of the relevant event (within the scope of the "Event Participant List"). Your AILA Social data is not shared with other third parties or advertising/marketing partners without your approval or request.

4. Transfer of Personal Data Abroad

In order to ensure the uninterrupted operation of the artificial intelligence-based infrastructure of the AILA application, to ensure data security at global standards and to optimize the user experience, your personal data may be transferred, in accordance with Article 9 of the Law, to the parties established abroad specified below:

• Artificial Intelligence Service Providers (USA): To the relevant global artificial intelligence infrastructure providers (e.g., OpenAI, etc.) so that the artificial intelligence model within the application can be operated, your queries can be answered and assistant services can be provided,
• Cloud and Server Infrastructure Providers (USA / EU): To our cloud computing and data center providers for the purposes of securely storing and hosting application data and maintaining system performance,
• Analytics and Optimization Providers (USA / EU): To our business partners from which analytics services are received for the purposes of detecting in-app errors, measuring technical performance and improving the user experience.

Legal Safeguards in Transfers Abroad: Our Company undertakes to protect the security of your data at the highest level in the transfer activities listed above. Accordingly, where a transfer abroad is concerned, Transfer Impact Assessments (TIA) are carried out for the relevant service providers by carefully examining the legal legislation, data subject rights and technical data security measures in the country to which the transfer will be made. The transfer processes are carried out through the conclusion of Standard Contractual Clauses, which is one of the appropriate safeguard methods specified in Article 9 of the Law; and these standard contracts are notified to the Personal Data Protection Board within the legal time limits.

5. Ways of Applying to the Data Controller and Your Rights

Pursuant to Article 11 of the Law, by applying to our Company, you have the right to:

1. Learn whether your personal data is being processed

2. Request information if it has been processed,

3. Learn the purpose of processing and whether it is used in accordance with its purpose,

4. Learn the third parties to whom it is transferred in Turkey or abroad,

5. Request correction if it has been processed incompletely / incorrectly

6. Request deletion / destruction within the framework of the conditions stipulated in Article 7 of the Law

7. Request that the transactions carried out pursuant to items (e) and (f) listed above be notified to the third parties to whom the data has been transferred

8. Object to the occurrence of a result against you due to analysis exclusively by automated systems

9. Request compensation for the damage if you suffer damage due to unlawful processing of your data under the Law.

You may submit your rights and applications arising from the Law regarding the personal data processing activities notified to you under this text to the Company's address at Esentepe Mah. Talatpaşa Cad. No: 5 İç Kapı No: 1 Şişli / İstanbul, in person or through a notary public, or to info@myai.la via the e-mail address registered with our Company. Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, applications must include: name, surname and, if the application is in writing, signature; Turkish Republic ID number (for foreign nationals, nationality, passport number or ID number, if any); the residence or workplace address for notification; the e-mail address for notification, if any; telephone number; and the subject of the request. Your application will be reviewed by the Company and you will be responded to within a reasonable time, but in any case within 30 (thirty) days at the latest.

You can access more detailed information about your Personal Data, as well as the application form for requesting information about personal data, on our Company's website at www.myai.la.