Personal Data Protection

TERSANE ISTANBUL WEBSITE PRIVACY NOTICE

As Haliç Altın Boynuz Marina Tourism Real Estate Construction Investment Trade Joint Stock Company (“Our Company”), the privacy and security of your personal data are among our top priorities. Our Company processes your personal data in compliance with the provisions of the Personal Data Protection Law No. 6698 (“Law”) and secondary legislation. Personal data refers to any information that identifies or makes you identifiable.

We wish to inform you, via this Privacy Notice (“Privacy Notice”), about the personal data processed when you use the services provided on our website at https://tersaneistanbul.com.tr (“Website”).

YOUR PERSONAL DATA PROCESSED

When you use the Website, the following personal data is processed:

Identity Information: Your first name, surname, date of birth, gender, and Turkish ID number or passport number, provided when you register as a user on the Website, create your user profile, and manage it;

Your Contact Information: Your telephone number and email address, provided when you register as a user and manage your user profile;

Cookie Data: Your online behaviour and preference data collected via cookies and similar tracking technologies when you visit the Website;

Your Membership Information: Verification and security records created in relation to your membership details and password when you become a user via the Website and create and manage your user profile;

Your Financial Information: Payment details relating to hotel, restaurant, experience and event bookings made via the Website;

Guest Information: Name, surname, email address, telephone number, date of birth, gender and ID/passport number details of additional guests you add during hotel, restaurant, experience or event bookings via the Website;

Transaction Security Information: Your session duration on the Website, IP address, browser type, operating system and other device-identifying data collected during your use of the Website and our online services, for the purposes of developing products and services and enhancing the functionality of the Website;

Your Enquiry and Interest Form Information: Your name, surname, email address, telephone number, estimated purchase price range and message content, which you provide via the interest form or similar contact forms on the Website;

Customer Transaction Information: Details of where and when the transaction took place, the information you provided in your feedback message, your satisfaction level, and your correspondence with the support team;

Marketing Data: Information regarding your shopping history, segment information, and data obtained through marketing campaigns.

LEGAL BASIS, PURPOSES AND METHODS OF PROCESSING YOUR PERSONAL DATA

Your personal data is processed by our Company through fully or partially automated means, or through non-automated means provided that they form part of a data recording system, electronically via the Website you use under the User Agreement; via cookies and similar tracking technologies; and electronically via the channel through which you communicate when using live chat, the call centre or email channels; and physically via printed forms, notifications or post sent to our Company, or where notified by legal authorities.

The personal data processed, along with the purposes and legal grounds for processing, are set out below.

2.1. Membership Registration Processes

Your Personal Data Processed in This Process: Your first name, surname, email address, telephone number, date of birth, gender information, and Turkish ID number or passport number, which you provide for the establishment and continuation of the membership relationship.

Purposes:

To carry out processes related to the establishment and performance of the User Agreement,
Conducting customer relationship management processes,
The use of services,
Tracking requests and complaints,
Receiving and evaluating suggestions for the improvement of business processes,
The provision of post-transaction support services,
The conduct and supervision of our company’s business activities,
Ensuring the security of our company’s operations,
Conducting activities in compliance with legislation,
Fulfilment of data sharing and retention obligations by our company in accordance with our legal obligations arising from legislation.

Legal Grounds: Where expressly provided for by law; where necessary to fulfil our legal obligations; where necessary for the performance of the User Agreement between us; where processing is necessary for our legitimate interests, provided that this does not infringe upon your rights.

2.2. Customer Experience and Communication Processes

Your Personal Data Processed in This Process: Your first name, surname, telephone number, email address, gender, feedback message, satisfaction status, and correspondence with the support line.

Purposes:

To carry out customer relationship management processes,
Tracking requests and complaints,
Receiving and evaluating suggestions for improving business processes,
Delivering post-transaction support services,
The conduct and monitoring of our company’s business operations,
Ensuring the security of our company’s operations,
The management of financial and accounting matters,
Conducting activities in compliance with legislation,
Fulfilling our data sharing and retention obligations in accordance with our legal obligations.

Legal Grounds: Necessary for the performance of the User Agreement between us; processing is necessary for the legitimate interests of our company, provided it does not infringe upon your rights; and processing is necessary for the fulfilment of our company’s legal obligations.

Within the scope of establishing and maintaining the membership relationship, to keep the membership active, ensure account and transaction security, provide information regarding the use of the Website, and communicate announcements, reminders and system update information regarding the services, your telephone number and email address may be processed via messages and emails without requiring your explicit consent, in accordance with Articles 5/2(c) and (f) of the Law. Messages sent under this scope are directly related to the user agreement and the services provided, and do not constitute commercial electronic communications for advertising or marketing purposes.

Online Booking and Payment Processes

Your Personal Data Processed in This Process: Your first name, surname, email address, telephone number, date of birth, gender, Turkish ID number or passport number, payment details, and guest details added to the booking.

Purposes:

Tracking requests and complaints,
Provision of post-transaction support services,
Ensuring the security of our company’s operations,
Conducting financial and accounting operations,
Conducting activities in compliance with legislation,
Fulfilment of data sharing and retention obligations by our company in accordance with our legal obligations arising from legislation.

Legal Grounds: Where expressly provided for by law; where necessary to fulfil our legal obligations; where processing is necessary for our legitimate interests, provided that this does not infringe upon your rights; and where necessary for the performance of the User Agreement and/or Distance Selling Agreement between us.

Our Company’s Information Security, Risk, Audit and Control Processes

Personal Data Processed in This Process: Your IP address, cookie data and browser information generated when you use the Website as a member.

Purposes:

Tracking requests and complaints,
Provision of post-transaction support services,
Auditing our company’s business operations,
Ensuring the security of our company’s operations,
Conducting activities in compliance with legislation,
Implementation of information security processes,
Monitoring and managing legal matters,
Conducting audit, investigation and intelligence activities,
Conducting risk management processes,
Ensuring the security of data controller operations,
Providing information to authorised individuals, institutions and organisations.

Legal Grounds: Where expressly provided for by law, or where it is necessary to fulfil our company’s legal obligations.

2.5. Request and Enquiry Form Processes

Personal Data Processed in This Process: Your first name, surname, email address, telephone number, preferred estimated purchase price range and message content.

Purposes:

To assess and respond to requests and applications,
Conducting customer relationship management processes,
Conducting and monitoring our company’s business operations,
Conducting activities in compliance with legislation.

Legal Grounds: The necessity of processing for the legitimate interests of our company, provided that this does not infringe upon your rights, and the necessity of processing to fulfil our company’s legal obligations.

2.6. Processes Carried Out Based on Explicit Consent

Your Personal Data Processed During This Process: Your identity, contact, customer transaction, marketing, membership and financial data.

Purposes:

Conducting marketing, advertising and promotional activities,
Conducting financial offer processes,
To be able to offer you personalised advantageous offers, to carry out activities aimed at increasing your satisfaction by getting to know you better, and to send commercial electronic communications within this scope.

Legal Grounds: Your explicit consent.

Should you wish to withdraw your consent, you may submit your request to the Company using the methods outlined under the heading “Contact for Your Rights and Requests”.

TRANSFER OF YOUR PERSONAL DATA TO THIRD PARTIES

Your personal data may be transferred by our Company within the country in accordance with Article 8 of the Law, where: it is necessary for the Company to fulfil its legal obligations, it is necessary for the conclusion or performance of a contract, data processing is necessary for the establishment, exercise or defence of a legal claim, and/or it is necessary for the Company’s legitimate interests.

We may transfer your personal data to group companies, our shareholders, authorised institutions and organisations, our business partners, our suppliers and third parties, provided that we comply with the conditions set out in the Law and take the necessary security measures, and limited to the purposes specified in Section 2 of this Privacy Notice.

In cases where your personal data is transferred abroad by our company, the transfer is based on the legal grounds set out in Article 9 of the Law and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, namely “the provision of appropriate safeguards through a standard contract or, provided it is occasional, the existence of one of the circumstances set out in paragraph 6 of Article 9 of the Law”.

DATA SECURITY MEASURES

Personal data shared with our Company is under our Company’s supervision and control. As the data controller, our Company has assumed responsibility for establishing the necessary organisational structure and implementing and adapting technical measures to protect the confidentiality and integrity of information, in accordance with the provisions of applicable legislation. In full awareness of this obligation;

Penetration tests are conducted at regular intervals in accordance with international and national technical standards relating to data privacy.
Regular risk analyses are carried out regarding personal data processing activities, and actions are taken to mitigate risks.
Access and authorisation controls are implemented to prevent unauthorised access to personal data.
Data processing policies are updated at regular intervals.

YOUR RIGHTS REGARDING THE PROTECTION OF YOUR PERSONAL DATA

By contacting the Company using the methods set out in the "Contact for Your Rights and Requests" section of this Privacy Notice,

Find out whether your personal data has been processed,
Request information regarding such processing if it has taken place,
To find out the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
To know the third parties to whom your personal data has been transferred within or outside the country,
Request the rectification of your personal data if it has been processed inaccurately or incompletely,
To request the erasure or destruction of your personal data in accordance with the conditions set out in the Law,
To request that the third parties to whom your personal data has been transferred be informed of the actions taken in accordance with your rights to rectification, erasure and destruction as set out above,
To object to a decision being made solely through the automated processing of your personal data that adversely affects you,
You have the right to claim compensation for any damage suffered as a result of the processing of your personal data in breach of the relevant legislation.

CONTACT FOR YOUR RIGHTS AND REQUESTS

Pursuant to Article 13 of the Law, should you wish to exercise any of the rights outlined above as a data subject, you may submit your request by completing the Data Subject Request Form available on our Company’s website in accordance with the instructions provided therein;

“[.]” in person or via a notary public, or
via registered electronic mail (KEP) to our registered email address “[.]” or
You may submit your request to our company at using a secure electronic signature, a mobile signature, or the email address you have previously provided to us and which is registered in our system.

As a data subject, should you submit requests regarding your rights to our Company, we will process your request free of charge within a maximum of 30 (thirty) days. However, should the response to your request entail a cost in accordance with the relevant legislation, our Company may charge the fee set by the Personal Data Protection Board.

ABOUT THIS PRIVACY NOTICE

Our Company reserves the right to update this Information Notice at any time in line with changes to the applicable legislation.

Date of Update: May 2026

Haliç Altın Boynuz Marina Tourism Real Estate Construction Investment Trade Joint Stock Company

DATA SUBJECT REQUEST FORM

Haliç Altın Boynuz Marina Tourism Real Estate Construction Investment Trade Joint Stock Company (“the Company”) has created this Application Form to enable it to assess applications submitted by data subjects under Article 11 of the Law on the Protection of Personal Data No. 6698 (“the Law”) more efficiently and effectively.

If you have any questions regarding the completion of this form, please contact us during office hours on [●].

I.Data Subject’s Rights

Before completing this Application Form, you may read the Website Privacy Notice available at https://tersaneistanbul.com.tr to familiarise yourself with your rights as set out in Article 11 of the Law and the Company’s data processing activities.

II.Application Method

Should you wish to exercise any of the rights set out in Article 11 of the Law, you must complete this Application Form and, together with the attachments specified under heading IV,

submit a signed copy of the Form in person to the address [●], or
submit a signed copy of the Form to the address [●] via a notary public, or
send the Form to the registered email address [●] via registered electronic mail (KEP), or
send it to the email address [●] using a secure electronic signature, mobile signature, or the email address previously notified to us and registered in our system.

III.Information Regarding the Data Subject

Please provide the information and documents requested below in full and accurately. This information must be included in your application in accordance with the Regulation on the Procedures and Principles for Applications to the Data Controller.

First Name and Surname: __________________________________________________

Turkish ID Number: __________________________________________________

Passport/ID Number: __________________________________________________

(For Foreign Nationals)

Nationality (For Foreign Nationals): __________________________________________________

Address: __________________________________________________

Telephone Number (if applicable): __________________________________________________

Email Address (if available): __________________________________________________

Please select the appropriate option below regarding your relationship with the Company and state in the space provided whether the relationship is still ongoing, if it has ended, the periods during which it was active, and, if applicable, the details of the authorised representative with whom you were in contact within the scope of your relationship with the Company.

Customer		Prospective Customer
Employee		Job Applicant
Supplier/Business Partner/Subcontractor		Visitor
Partner		Other (________________)

__________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

IV.Data Subject’s Requests

Please indicate your request or requests regarding personal data by ticking the relevant box (X) below. If you make a request by selecting the relevant box, you will also be required to submit the information and documents required in relation to the subject of the request to the Company, together with this Form, as specified under heading II.

Request	Selection	Information/Documentation Required
I wish to find out whether my personal data is being processed by the Company.		If there is a specific piece of data you believe is being processed, please specify it in the space provided at the end of this table.
If my personal data is being processed by the Company, I would like to know for what purpose it is being processed.		If there is a specific piece of data for which you wish to know the purpose of processing, please specify it in the space provided at the end of this table.
If my personal data is being processed by the Company, I would like to know the purpose of the processing and whether the Company is using it in accordance with that purpose.		If your request relates to a specific piece of data, please specify this in the space provided at the end of this table.
If my personal data is transferred to third parties within or outside the country by the Company, I would like to know the third parties to whom my personal data has been transferred by the Company.		If your request relates to a specific piece of data, please specify it in the space provided at the end of this table.
I would like the Company to rectify any personal data that has been processed inaccurately or incompletely.		Please specify the personal data you believe to be incomplete or incorrect and how you wish it to be corrected in the space provided at the end of this table or in the Form attachment, and submit documents such as a copy of your identity card, an invoice or a residence certificate to verify your request for correction.
I also wish for the correction of my personal data that I believe has been processed inaccurately or incompletely by third parties to whom it has been transferred.		Please specify the personal data you believe to be incomplete or incorrect and how you wish it to be corrected in the space provided at the end of this table or in the Form annex, and submit documents such as a copy of your identity card, an invoice or a residence certificate to verify your request for correction in the Form annex.
I request that my personal data be erased/destroyed as the reasons necessitating its processing no longer apply.		Please specify in the space provided at the end of this table or in the Form annex why you believe the grounds for processing have ceased to exist, and which data you wish to be deleted/destroyed, and, if available, submit any other supporting information or documents in the Form annex.
I request that my personal data be deleted/destroyed by third parties to whom it has been transferred, as the grounds for processing have ceased to exist.		Please state why you believe the basis for processing has ceased to exist, and specify the data you wish to have deleted or destroyed in the space provided at the end of this table or in the Form annex, and if available, submit any other information or documents supporting your request in the Form annex.
I believe that my personal data processed by the company has been analysed exclusively by automated systems and that this analysis has resulted in a decision adverse to me, and I object to this decision.		Please specify the data you believe has been analysed via automated systems and the outcome you believe is detrimental to you in the space provided at the end of this table or in the Form annex, and if available, please submit any supporting information or documents for your request in the Form annex.
I am claiming compensation for the damage I have suffered as a result of the unlawful processing of my personal data.		Please state in the space provided at the end of this table or in the Form annex why you believe your personal data has been processed unlawfully, along with details of the unlawful processing activity and the damage you have suffered. You may also submit decisions from the Personal Data Protection Board or the courts supporting your claim in the Form annex.

Please list the information requested regarding the claims you have outlined above and the documents you have submitted in the form appendix below.

________________________________________________________________________________

______________________________________________________________________________

V.Finalisation of the Application and Notification of the Outcome

The Company will assess and finalise your request within a maximum of thirty days, depending on the nature of the request. Responses to your request, whether positive or negative, may be communicated to you in writing or electronically. If you have a preference regarding the method of communication (post or email), you must specify this preference below, along with the postal address or email address to which the correspondence should be sent:

I would like the response to my application to be sent by email.
I would like the response to my application to be sent by post.

Whilst your requests will generally be processed free of charge, should the processing of your request incur additional costs, a fee may be charged in accordance with the amounts specified under the relevant legislation.

Should the Company require further information to process your request, or if it cannot be verified that the application was made by the data subject, we may contact you via the contact details provided in this Form or held by the Company.

VI.Declaration

I request that the application I have made in accordance with the Law be assessed and resolved in line with the requests I have set out in this Application Form.

Data Subject

First Name and Surname:

Date of Application:

Signature: