TERSANE ISTANBUL WEBSITE PRIVACY NOTICE

As Haliç Altın Boynuz Marina Tourism Real Estate Construction Investment Trade Joint Stock Company (“Our Company”), the privacy and security of your personal data are among our top priorities. Our Company processes your personal data in compliance with the provisions of the Personal Data Protection Law No. 6698 (“Law”) and secondary legislation. Personal data refers to any information that identifies or makes you identifiable.

We wish to inform you, via this Privacy Notice (“Privacy Notice”), about the personal data processed when you use the services provided on our website at https://tersaneistanbul.com.tr (“Website”).

• YOUR PERSONAL DATA PROCESSED

When you use the Website, the following personal data is processed:

Identity Information: Your first name, surname, date of birth, gender, and Turkish ID number or passport number, provided when you register as a user on the Website, create your user profile, and manage it;

Your Contact Information: Your telephone number and email address, provided when you register as a user and manage your user profile;

Cookie Data: Your online behaviour and preference data collected via cookies and similar tracking technologies when you visit the Website;

Your Membership Information: Verification and security records created in relation to your membership details and password when you become a user via the Website and create and manage your user profile;

Your Financial Information: Payment details relating to hotel, restaurant, experience and event bookings made via the Website;

Guest Information: Name, surname, email address, telephone number, date of birth, gender and ID/passport number details of additional guests you add during hotel, restaurant, experience or event bookings via the Website;

Transaction Security Information: Your session duration on the Website, IP address, browser type, operating system and other device-identifying data collected during your use of the Website and our online services, for the purposes of developing products and services and enhancing the functionality of the Website;

Your Enquiry and Interest Form Information: Your name, surname, email address, telephone number, estimated purchase price range and message content, which you provide via the interest form or similar contact forms on the Website;

Customer Transaction Information: Details of where and when the transaction took place, the information you provided in your feedback message, your satisfaction level, and your correspondence with the support team;

Marketing Data: Information regarding your shopping history, segment information, and data obtained through marketing campaigns.

• LEGAL BASIS, PURPOSES AND METHODS OF PROCESSING YOUR PERSONAL DATA

Your personal data is processed by our Company through fully or partially automated means, or through non-automated means provided that they form part of a data recording system, electronically via the Website you use under the User Agreement; via cookies and similar tracking technologies; and electronically via the channel through which you communicate when using live chat, the call centre or email channels; and physically via printed forms, notifications or post sent to our Company, or where notified by legal authorities.

The personal data processed, along with the purposes and legal grounds for processing, are set out below.

2.1. Membership Registration Processes

Your Personal Data Processed in This Process: Your first name, surname, email address, telephone number, date of birth, gender information, and Turkish ID number or passport number, which you provide for the establishment and continuation of the membership relationship.

Purposes:

• To carry out processes related to the establishment and performance of the User Agreement,
• Conducting customer relationship management processes,
• The use of services,
• Tracking requests and complaints,
• Receiving and evaluating suggestions for the improvement of business processes,
• The provision of post-transaction support services,
• The conduct and supervision of our company’s business activities,
• Ensuring the security of our company’s operations,
• Conducting activities in compliance with legislation,
• Fulfilment of data sharing and retention obligations by our company in accordance with our legal obligations arising from legislation.

Legal Grounds: Where expressly provided for by law; where necessary to fulfil our legal obligations; where necessary for the performance of the User Agreement between us; where processing is necessary for our legitimate interests, provided that this does not infringe upon your rights.

2.2. Customer Experience and Communication Processes

Your Personal Data Processed in This Process: Your first name, surname, telephone number, email address, gender, feedback message, satisfaction status, and correspondence with the support line.

Purposes:

• To carry out customer relationship management processes,
• Tracking requests and complaints,
• Receiving and evaluating suggestions for improving business processes,
• Delivering post-transaction support services,
• The conduct and monitoring of our company’s business operations,
• Ensuring the security of our company’s operations,
• The management of financial and accounting matters,
• Conducting activities in compliance with legislation,
• Fulfilling our data sharing and retention obligations in accordance with our legal obligations.

Legal Grounds: Necessary for the performance of the User Agreement between us; processing is necessary for the legitimate interests of our company, provided it does not infringe upon your rights; and processing is necessary for the fulfilment of our company’s legal obligations.

Within the scope of establishing and maintaining the membership relationship, to keep the membership active, ensure account and transaction security, provide information regarding the use of the Website, and communicate announcements, reminders and system update information regarding the services, your telephone number and email address may be processed via messages and emails without requiring your explicit consent, in accordance with Articles 5/2(c) and (f) of the Law. Messages sent under this scope are directly related to the user agreement and the services provided, and do not constitute commercial electronic communications for advertising or marketing purposes.

• Online Booking and Payment Processes

Your Personal Data Processed in This Process: Your first name, surname, email address, telephone number, date of birth, gender, Turkish ID number or passport number, payment details, and guest details added to the booking.

Purposes:

• Tracking requests and complaints,
• Provision of post-transaction support services,
• Ensuring the security of our company’s operations,
• Conducting financial and accounting operations,
• Conducting activities in compliance with legislation,
• Fulfilment of data sharing and retention obligations by our company in accordance with our legal obligations arising from legislation.

Legal Grounds: Where expressly provided for by law; where necessary to fulfil our legal obligations; where processing is necessary for our legitimate interests, provided that this does not infringe upon your rights; and where necessary for the performance of the User Agreement and/or Distance Selling Agreement between us.

• Our Company’s Information Security, Risk, Audit and Control Processes

Personal Data Processed in This Process: Your IP address, cookie data and browser information generated when you use the Website as a member.

Purposes:

• Tracking requests and complaints,
• Provision of post-transaction support services,
• Auditing our company’s business operations,
• Ensuring the security of our company’s operations,
• Conducting activities in compliance with legislation,
• Implementation of information security processes,
• Monitoring and managing legal matters,
• Conducting audit, investigation and intelligence activities,
• Conducting risk management processes,
• Ensuring the security of data controller operations,
• Providing information to authorised individuals, institutions and organisations.

Legal Grounds: Where expressly provided for by law, or where it is necessary to fulfil our company’s legal obligations.

2.5. Request and Enquiry Form Processes

Personal Data Processed in This Process: Your first name, surname, email address, telephone number, preferred estimated purchase price range and message content.

Purposes:

• To assess and respond to requests and applications,
• Conducting customer relationship management processes,
• Conducting and monitoring our company’s business operations,
• Conducting activities in compliance with legislation.

Legal Grounds: The necessity of processing for the legitimate interests of our company, provided that this does not infringe upon your rights, and the necessity of processing to fulfil our company’s legal obligations.

2.6. Processes Carried Out Based on Explicit Consent

Your Personal Data Processed During This Process: Your identity, contact, customer transaction, marketing, membership and financial data.

Purposes:

• Conducting marketing, advertising and promotional activities,
• Conducting financial offer processes,
• To be able to offer you personalised advantageous offers, to carry out activities aimed at increasing your satisfaction by getting to know you better, and to send commercial electronic communications within this scope.

Legal Grounds: Your explicit consent.

Should you wish to withdraw your consent, you may submit your request to the Company using the methods outlined under the heading “Contact for Your Rights and Requests”.

• TRANSFER OF YOUR PERSONAL DATA TO THIRD PARTIES

Your personal data may be transferred by our Company within the country in accordance with Article 8 of the Law, where: it is necessary for the Company to fulfil its legal obligations, it is necessary for the conclusion or performance of a contract, data processing is necessary for the establishment, exercise or defence of a legal claim, and/or it is necessary for the Company’s legitimate interests.

We may transfer your personal data to group companies, our shareholders, authorised institutions and organisations, our business partners, our suppliers and third parties, provided that we comply with the conditions set out in the Law and take the necessary security measures, and limited to the purposes specified in Section 2 of this Privacy Notice.

In cases where your personal data is transferred abroad by our company, the transfer is based on the legal grounds set out in Article 9 of the Law and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, namely “the provision of appropriate safeguards through a standard contract or, provided it is occasional, the existence of one of the circumstances set out in paragraph 6 of Article 9 of the Law”.

• DATA SECURITY MEASURES

Personal data shared with our Company is under our Company’s supervision and control. As the data controller, our Company has assumed responsibility for establishing the necessary organisational structure and implementing and adapting technical measures to protect the confidentiality and integrity of information, in accordance with the provisions of applicable legislation. In full awareness of this obligation;

• Penetration tests are conducted at regular intervals in accordance with international and national technical standards relating to data privacy.
• Regular risk analyses are carried out regarding personal data processing activities, and actions are taken to mitigate risks.
• Access and authorisation controls are implemented to prevent unauthorised access to personal data.
• Data processing policies are updated at regular intervals.

• YOUR RIGHTS REGARDING THE PROTECTION OF YOUR PERSONAL DATA

By contacting the Company using the methods set out in the "Contact for Your Rights and Requests" section of this Privacy Notice,

• Find out whether your personal data has been processed,
• Request information regarding such processing if it has taken place,
• To find out the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
• To know the third parties to whom your personal data has been transferred within or outside the country,
• Request the rectification of your personal data if it has been processed inaccurately or incompletely,
• To request the erasure or destruction of your personal data in accordance with the conditions set out in the Law,
• To request that the third parties to whom your personal data has been transferred be informed of the actions taken in accordance with your rights to rectification, erasure and destruction as set out above,
• To object to a decision being made solely through the automated processing of your personal data that adversely affects you,
• You have the right to claim compensation for any damage suffered as a result of the processing of your personal data in breach of the relevant legislation.

• CONTACT FOR YOUR RIGHTS AND REQUESTS

Pursuant to Article 13 of the Law, should you wish to exercise any of the rights outlined above as a data subject, you may submit your request by completing the Data Subject Request Form available on our Company’s website in accordance with the instructions provided therein;

• “[.]” in person or via a notary public, or
• via registered electronic mail (KEP) to our registered email address “[.]” or
• You may submit your request to our company at using a secure electronic signature, a mobile signature, or the email address you have previously provided to us and which is registered in our system.

As a data subject, should you submit requests regarding your rights to our Company, we will process your request free of charge within a maximum of 30 (thirty) days. However, should the response to your request entail a cost in accordance with the relevant legislation, our Company may charge the fee set by the Personal Data Protection Board.

• ABOUT THIS PRIVACY NOTICE

Our Company reserves the right to update this Information Notice at any time in line with changes to the applicable legislation.

Date of Update: May 2026

Haliç Altın Boynuz Marina Tourism Real Estate Construction Investment Trade Joint Stock Company