1. OBJECTIVE AND SCOPE

This Confidentiality and Personal Data Protection Policy ("POLICY") specifies the principles adopted by Selmarin Turizm ve Ticaret A.Ş. (hereinafter referred to as “SELMARİN”, “Company” or “Data Controller”) regarding the protection of personal data, and aims at informing customers, potential customers and online visitors (“Individuals Groups”) regarding processing of their personal data.

2. PRINCIPLES IN RELATION TO PROCESSING OF PERSONAL DATA

As SELMARİN, we process your personal data in the capacity of Data Controller according to the following principles.

2.1 Processing in Compliance with Law and Principles of Honesty

Your personal data are processed in accordance with the principles which are introduced by legal regulations, and the rule of general trust and honesty.

2.2 Ensuring that Personal Data are Accurate, and Up-To-Date, when Necessary

By taking your legitimate interests into consideration, periodical verifications and updates are made in order to ensure that the data processed are accurate and up-to-date, and the necessary measures are taken accordingly. In this context, systems for controlling the correctness of personal data and making necessary corrections are set up within the corporate body of SELMARİN.

2.3 Processing for Specific, Clear and Legitimate Purposes

Your personal data are processed in accordance with clear, specific and legitimate data processing purposes.

2.4 Personal Data Being Relevant, Limited and Proportionate to their Purpose of Processing

Your personal data are processed proportionately to the extent necessary for achieving the envisaged purpose/purposes, and in a manner that is relevant and limited to the purpose, and we abstain from processing any personal data which are not related to achieving the purpose or which are not needed in that respect.

2.5 Retaining the Personal Data for the Period Stipulated in the Relevant Legislation or the Period Required for the Purpose of Processing Thereof

Your personal data are preserved only for the period prescribed in the relevant legislation or the period required for the purpose of processing thereof. In this context, first of all we identify whether a period is stipulated in the relevant legislation for the preservation of personal data, and if such a period is prescribed, we act in accordance with it, and if no such period is prescribed, we preserve the personal data for the period required for the purpose of processing thereof. In case of expiry of such period or in case the reasons requiring them to be processed cease to exist, provided there is no legal reason for allowing them to be processed for longer periods, your personal data are deleted, destroyed or anonymized in accordance with SELMARİN’s Policy on Preservation and Destruction of Personal Data.

3. TERMS AND CONDITIONS IN RELATION TO PROCESSING OF PERSONAL DATA

Your personal data is processed by SELMARİN in accordance with the following conditions.

3.1 Being Explicitly Stipulated by the Laws

Your personal data may be processed if it is explicitly required by the law to process such personal data.

3.2 Inability to Obtain Express Consent of the Relevant Person Due to Actual Impossibility

Where the relevant person cannot give his/her consent or his/her consent is deemed non-admissible due to actual impossibility, but his/her personal data must be processed in order to protect the life or body integrity of such person or any other person, then the personal data of such person may be processed.

3.3 Direct Relationship with Conclusion or Performance of a Contract

Where the processing of personal data belonging to the parties to a contract is necessary, such personal data may be processed provided that it is directly related to the conclusion or performance of the said contract.

3.4 Performance by SELMARİN of its Legal Obligation

Your personal data may be processed, if the processing thereof is compulsory in order for us, as the Data Controller, to fulfil our legal obligations.

3.5 Personal Data that Became Public

If your personal data has been made public by you, we will be able to process them.

3.6 Obligation to Process Data for Securing or Protecting a Right

In case data processing is mandatory for securing, exercising or protecting a right, your personal data may be processed.

3.7 Processing of Data Based on Legitimate Interest

Your personal data may be processed if it is necessary based on legitimate interests of SELMARİN.

3.8 Processing of the Data Based on Express Consent

Your personal data may be processed on the basis of express consent in cases where they cannot be processed based on any of the conditions specified in this policy.

4. CATEGORIZATION OF PERSONAL DATA

5. PURPOSE OF PROCESSING OF PERSONAL DATA

SELMARİN may process personal data for the purposes set out below and based on the relevant individuals group, under the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698.

5.1 SECOND-HAND BOAT/YACHT SELLER AND/OR BUYER

Personal data of second-hand boat/yacht sellers and/or buyers may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary efforts for realizing the commercial activities of the Company and for the execution of the related work processes; for carrying out necessary works and related business processes for ensuring that products and services offered by the Company can be benefited from, for performing sales processes of goods and services, performing marketing analysis works, carrying out communication works, and for conducting product warranty service works.

5.2 CUSTOMER

Personal data of customers may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out purchase operations of goods and services, after-sales support services for goods and service, sales processes of goods and services, production and operation processes of goods and services, company/product/service loyalty processes, to conduct the activities in line with the legislation, to conduct finance and accounting works, to ensure request and complaint follow-up, to conduct and inspect business activities, to receive suggestions for the improvement of business processes and for evaluation thereof, to conduct activities for ensuring business continuity, to conduct customer relations management processes, to carry out activities for customer satisfaction, to conduct marketing analysis works, to conduct advertisement/campaign/promotion processes and communication activities, to conduct activities for development of products and services, to conduct activities for prizes and draws, and to product warranty service processes.

5.3 POTENTIAL CUSTOMER

Personal data of potential customers may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary efforts for realizing the commercial activities of the Company and to execute the related work processes; to carry out the necessary works and related business processes for ensuring that products and services offered by the Company can be benefited from, to plan and execute the necessary activities for customizing the products and services to be offered by the Company and for their promotion, and to plan and execute customer relations management processes.

5.4 THIRD PARTIES

Personal data of third parties may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary efforts for realizing the commercial activities of the Company and to execute the related work processes; to carry out the necessary works and related business processes for ensuring that products and services offered by the Company can be benefited from, and to plan and execute the necessary activities for customizing the products and services to be offered by the Company and for their promotion.

5.5 ONLINE VISITOR

Personal data of online visitors may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out marketing analysis works, advertisement/campaign/promotion processes, communication works, to conduct product and service development works, and to perform legal obligations.

6. TRANSFER OF PERSONAL DATA

Your personal data may be transferred in a restricted manner to our domestic or overseas business partners, suppliers, group companies, legally authorized public institutions and private persons, according to personal data processing conditions and purposes specified in Article 8 and 9 of the Law no. 6698.

7. METHOD OF AND LEGAL GROUNDS FOR COLLECTION OF PERSONAL DATA

Your personal data transmitted to SELMARİN electronically or physically are processed as follows based on the relevant individuals groups.

7.1 SECOND-HAND BOAT/YACHT SELLER AND/OR BUYER

The personal data of the second-hand boat/yacht sellers and/or buyers are processed by automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the stipulations of Article 5 of the Law no. 6698, in the context of potential sale/intermediary contracts there is a “necessity to process personal data belonging to the parties of a contract, provided that it is directly related to the formation or performance of the contract”, and “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”.

7.2 CUSTOMER

The personal data of the Customers are processed by automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the stipulations of Article 5 of the Law no. 6698, in the context of sale contracts there is a “necessity to process personal data belonging to the parties of a contract, provided that it is directly related to the formation or performance of the contract”, “data processing is mandatory for data controller’s fulfilment of its legal obligation”, and “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”.

7.3 POTENTIAL CUSTOMER

The personal data of the Potential Customers are processed by automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the stipulations of Article 5 of the Law no. 6698, “the personal data has been made public by the relevant person itself”, “data processing is mandatory for securing, exercising or protection of a right”, “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”, and “data processing is mandatory for data controller’s fulfilment of its legal obligation”.

7.4 THIRD PARTIES

The personal data of the Third Parties are processed by automated or non-automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the stipulations of Article 5 of the Law no. 6698, “data processing is mandatory for data controller’s fulfilment of its legal obligation”, and “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”.

7.5 ONLINE VISITOR

The personal data of the Online Visitors are processed by automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the stipulations of Article 5 of the Law no. 6698, “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”, and “data processing is mandatory for data controller’s fulfilment of its legal obligation”.

8. SECURITY OF PERSONAL DATA

In order to ensure the safety of personal data and prevent unlawful processing thereof, Selmarin takes reasonable measures, which will prevent risks of unauthorized access, accidents and data losses, deliberate deletion of data or damages to data.

For prevention of access to personal data by the persons other than those who are authorized to access thereto, all the necessary technical and physical measures are taken. In this context, the authorization system is designed in such a way that it will be impossible for anyone to access personal data to an extent which is more than required.

Selmarin performs and procures the performance of necessary audits within its own organization in order to ensure implementation of the provisions of the Law no. 6698.

9. UNDERTAKINGS WITH REGARDS TO THIRD PARTY PERSONAL DATA

The relevant Individuals Groups agree and consent to processing by Selmarin of their 3rd party personal data delivered by them to Selmarin. The relevant Individuals Groups also undertake that they have performed the necessary information duties and have received the required consents with respect to the persons whose information has been transferred, and their information, pursuant to the Law No. 6698 on the Protection of Personal Data. Otherwise, all damages to be incurred shall belong to the relevant Individuals Group.

10. APPLICATION PROCEDURES AND PRINCIPLES

As the relevant person, you may submit an application to SELMARİN in relation to your requests under article 11 of the Law No. 6698 regulating the rights of the relevant persons, in line with the conditions determined under “SELMARİN - RELEVANT PERSONS (PERSONAL DATA OWNERS/SUBJECTS) APPLICATION FORM FOR THE PROTECTION OF PERSONAL DATA”, by submitting a written application bearing wet signature in person or through the notary public to the address Hacıahmet Mahallesi, Irmak Caddesi, DLP İş Merkezi, No: 1-9, İç Kapı No: 19, 34440 Beyoğlu, İstanbul and to the e-mail address kvkk@selmarin.com by using mobile signature/e-signature. “SELMARİN - RELEVANT PERSONS (PERSONAL DATA OWNERS/SUBJECTS) APPLICATION FORM FOR THE PROTECTION OF PERSONAL DATA” can be found on the website www.selmarin.com or can be requested directly via the contact e-mail.

Within this scope, as the relevant person, you have the right:

• To learn whether or not your personal data are being processed,
• To request information on the procedure, if your personal data are being processed,
• To obtain information on the purpose of processing of personal data and find out whether personal data is being used in line with the purpose of their collection,
• To obtain information about third persons to whom personal data are being transferred domestically or abroad,
• To request the correction of personal data that may be incompletely or inaccurately processed,
• To request the deletion or destruction of personal data within the framework of the conditions set forth in the applicable legislation,
• To request notification of the procedures set out under the last two sub-paragraphs above to third parties to whom the personal data has been transferred,
• To object to the occurrence of a result which is detrimental to the relevant person as a result of analysing of the processed data exclusively through automated systems,
• To request indemnification for damages in the case that damages are sustained as a result of unlawful processing of personal data.

---

INFORMATION DISCLOSURE STATEMENT REGARDING PROCESSING THE PERSONAL DATA OF VISITORS

1. Data Controller and Personal Data Categories:
Pursuant to the Law on the Protection of Personal Data No. 6698 (“Law No. 6698”), your personal data in the form of identity information and CCTV camera recordings may be processed by Selmarin Turizm ve Ticaret A.Ş. (“Company”) in its capacity as the data controller within the scope described below.

2. Purpose of Processing Personal Data:
Your personal data that is collected by the Company may be processed to ensure the safety of buildings, establishments, and/or plants, to create and monitor the visitor records, to ensure the safety of fixtures and/or resources, to ensure the technical and commercial occupational safety, to ensure the safety of organizational operations, and to inform the authorized institutions and organizations.

3. Transfer of Personal Data:
Your personal data may be transferred to our partners, suppliers, affiliates, and legally authorized public institutions and organizations in cases where the data controller must fulfill its legal obligations, such as making necessary notifications to public institutions, and where data processing is compulsory for the legitimate interests of the data controller, such as outsourcing to keep the camera records.

4. Sources and Legal Grounds:
Your personal data is collected by us through the information and documents you provided physically or sent to us electronically, or from third parties in written or verbal form using physical and electronic tools. As our processing activities are limited to the specified purposes, pursuant to Article 5 of Law No. 6698, data is processed based on legal obligations, legitimate interests, and explicitly stipulated legal grounds.

5. Application Procedures and Principles:
As a data subject, you may submit an application concerning your requests regarding your rights under Article 11 of Law No. 6698 by filling in the Application Form for Protection of Personal Data available on www.selmarin.com in a way that satisfies the minimum requirements stipulated by the Communique on the Procedures and Principles for Application to the Data Controller by all means, and sending it to kvkk@selmarin.com by using e-signature with an email address you notified to us before or submitting it as a written application in person or via the notary public to the address Hacıahmet Mahallesi, Irmak Caddesi, DLP İş Merkezi, No: 1-9, İç Kapı No: 19, 34440 Beyoğlu, İstanbul. We, as the Company will conclude your application on a free-of-charge basis as soon as possible depending on the nature of the request, but in any event within no later than thirty days. However, in case the process requires any additional cost, the fee in the tariff determined by the Board of Protection of Personal Data shall be collected by the Company.