PURPOSE OF THIS INFORMATION NOTICE ABOUT PERSONAL DATA PROCESSING AND PRIVACY POLICY

As Neptün Turizm ve Ticaret Anonim Şirketi (“Company”), we place the utmost importance on the security of your personal data. Accordingly, we attach great importance to the processing, recording, transfer, sharing and storage of all personal data relating to individuals associated with our Company, including persons who benefit from our products and services, in compliance with Law No. 6698 on the Protection of Personal Data (“PPD Law”).

The protection of personal data is one of the fundamental policies of our Company. Throughout our existence, we have given priority to the confidentiality of personal data, adopted this as a fundamental working principle and instructed our employees to act accordingly. Our Company accepts and undertakes to comply with all obligations arising under the PPD Law.

With full awareness of these responsibilities and acting in our capacity as Data Controller, we process, record, transfer, share and store your personal data in the manner described below and within the limits prescribed by applicable legislation.

A. IDENTITY OF THE DATA CONTROLLER

You can contact us using the information below if you have any questions regarding our “Information Notice on the Processing of Personal Data”.

Neptün Turizm ve Ticaret Anonim Şirketi

(Club Resort Atlantis Holiday Resort, Maya Bistro Hotel Beach) Sığacık Mahallesi, Akkum Caddesi No:175, 35400-Seferihisar-İzmir / Türkiye

Contact Information:

E-mail: kvkk@neptunclubhotels.com

Phone: +90 (232) 745 74 55

Our Company reserves the right to update this “Information Notice on the Protection of Personal Data” at any time in line with amendments to the applicable legislation.

B. COLLECTION, PROCESSING AND PURPOSES OF PROCESSING PERSONAL DATA

Our policy on the protection of personal data and privacy has been prepared in accordance with the PPD Law. Accordingly, depending on the services, products or commercial activities provided by our Company, your personal data may be collected through automatic or non-automatic means, including our offices, branches, dealers, call centre, website, social media channels, mobile applications and similar channels, either verbally, in writing or electronically.

As long as you use our products or services, your personal data may be processed through the creation and updating of records.

In addition, your personal data may be processed when, for the purpose of using our services:

a. You contact our call centre or use our website,

b. You visit our Company, website or social media channels,

c. You receive services from our hotel.

Personal data obtained with your consent or on other lawful grounds provided for under the laws of the Republic of Türkiye may be processed for the following purposes:

d. Enabling our business units to carry out the necessary activities to provide you with the products and services offered by our Company, and tailoring and recommending these products and services according to your preferences, usage habits and needs,

e. Ensuring the legal and commercial security of our Company and persons with whom our Company has business relationships, including administrative operations relating to communications, the physical security and supervision of Company locations, the assessment of business partners, customers and suppliers and their authorised representatives or employees, legal compliance processes, financial affairs and similar matters,

f. Improving the quality of the services offered by our Company and developing our quality policy,

g. Informing you about and enabling you to benefit from general and special campaigns, promotions, publicity, discounts and similar advantages offered by our Company,

h. Processing the personal data, preferences, transactions and browsing information obtained through the channels offered by our Company when you log in using your username and password, in order to provide you with the information and services you have requested,

i. Sending notifications concerning loyalty cards issued or to be issued by our Company and its affiliated companies and organisations, as well as memberships on the websites of our Company and its affiliated companies and organisations, including renewal and expiry notifications, and informing you about communications with you, newly introduced services and products, and changes or developments concerning personal data policies and membership terms,

j. Providing you with information about information, events and services requested from our Company,

k. Determining and implementing our commercial and business strategies,

l. Ensuring the implementation of our human resources policies and, where expressly provided for or required by applicable legislation, fulfilling our legal obligations, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the PPD Law, by our Company, our affiliated companies and organisations, and the other natural and/or legal persons specified under Section E below.

Customer and Prospective Customer Data

The categories of personal data processed in this context and the relevant explanations are as follows:

• Identification Data: Name and surname; name and surname of accompanying guest(s); nationality; place and date of birth; Turkish identity card, driving licence and passport numbers, including the date and place of issue.
• Contact Data: Address, telephone number and e-mail address.
• Customer Transaction Data: Payment information and information relating to purchased products or services.
• Marketing Data: Personal preferences concerning accommodation, marketing and communications; evaluations of brands and facilities; website cookie information; opinions and complaints.
• Physical Premises Security: Security camera footage is recorded at our facilities in order to fulfil our obligations relating to the legal and commercial security of individuals.
• Other Data: Reservation information; travel history; participation in competitions, prize draws or marketing programmes; information concerning vehicles used to access the facility; booked hotel, airline and car-rental packages; and groups with which individuals are associated for the purpose of staying at our facilities.

Employee and Intern Data

• Identification, Contact and Employment Data: Processing data for planning and carrying out our human resources processes, including recruitment, the employment relationship, performance assessment and evaluation, the creation and retention of personnel files, and exit interviews.
• Legal Proceedings: Obtaining legal support to fulfil our legal obligations arising from applicable legislation and to protect and exercise our rights in the event of potential disputes.
• Professional Experience: Processing education, diploma, certificate and training information for the conduct of internal operational activities and the provision of higher-quality services.
• Financial Data: Employees’ IBAN and bank account information for the payment of salaries.
• Health Data: Processing employees’ health information under Law No. 6331 on Occupational Health and Safety and in connection with emergencies, as well as processing information concerning employees’ disability status and blood groups.
• Criminal Convictions and Security Measures: Processing criminal record information for recruitment and human resources processes.
• Physical Premises Security: Security camera footage recorded at our facilities for the purpose of fulfilling our obligations concerning the legal and commercial security of individuals.
• Processing Security: Corporate e-mail accounts are assigned to employees solely for business purposes. Records relating to these accounts are stored and monitored on Company servers; internet access logs and password information are retained; and, where an employee leaves the Company, the relevant e-mail accounts may be accessed and used. Portable and/or desktop computers provided by the Company are also assigned solely for business purposes and are processed within the scope of the personal data processing conditions set out in Articles 5 and 6 of the PPD Law for the purposes of monitoring, supervising and controlling their use in connection with Company activities and services provided.

Job Applicants

• Identification and Contact Data: Processing identification and contact information for planning and carrying out recruitment and human resources processes.
• Professional Experience: Processing education, diploma, certificate and training information for recruitment purposes.
• Health Data: Processing information concerning applicants’ disability status and blood groups.
• Criminal Convictions and Security Measures: Processing criminal record information for recruitment and human resources processes.
• Physical Premises Security: Security camera footage recorded at our facilities for the purpose of fulfilling our obligations concerning the legal and commercial security of individuals.

Visitor Data

• Physical Premises Security: Security camera footage is recorded at our facilities in order to fulfil our obligations concerning the legal and commercial security of individuals.

Collection and Processing of Data for Contractual Relationships

Where a contractual relationship has been established with a customer or prospective customer, the personal data collected may be used without obtaining the customer’s consent, provided that such use is for contractual purposes. The data may be used to the extent necessary for the proper performance of the contract and the provision of the relevant services and may be updated, where necessary, by contacting the customer.

Business Partner and Solution Partner Data

NEPTÜN TURİZM acts in compliance with applicable law when sharing data with business partners and solution partners. Data is shared with such parties subject to confidentiality commitments and only to the extent required for the relevant service. These parties are also required to take the necessary measures to ensure data security.

Processing of Data for Advertising Purposes

In accordance with the Law on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, commercial electronic messages may be sent for advertising purposes only to persons whose prior consent has been obtained. The recipient’s express consent to receive such advertising is required.

NEPTÜN TURİZM also complies with the requirements concerning “consent” established under the relevant legislation. Such consent must cover commercial electronic messages sent to recipients’ electronic communication addresses for the purposes of promoting and marketing the Company’s goods and services, promoting the business, or increasing recognition through celebratory and goodwill messages. Consent may be obtained in writing in a physical environment or through any electronic means of communication.

The important requirement is that the recipient’s name, electronic communication address and affirmative declaration of consent to receiving commercial electronic messages are recorded.

Processing of Data Due to the Company’s Legal Obligations or an Express Provision of Law

Personal data may be processed without obtaining additional consent where the processing is expressly provided for by applicable legislation or is necessary to fulfil a legal obligation imposed by legislation. The type and scope of processing must be necessary for the legally permitted processing activity and comply with the relevant legal provisions.

C. METHOD AND LEGAL BASIS FOR THE COLLECTION OF PERSONAL DATA

Your personal data is collected verbally, in writing or electronically for the purposes described above, in order to provide our products and services within the applicable legal framework and to enable our Company to fulfil its contractual and statutory obligations fully and accurately.

Personal data collected on these legal grounds is processed, recorded, transferred, shared and stored for the purposes set out in Section B of this notice in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the PPD Law.

D. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

Under the PPD Law, data concerning an individual’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitutes special categories of personal data.

Our Company takes the measures determined by the Personal Data Protection Board at an adequate level when processing special categories of personal data.

For the purpose of providing better services, our Company processes special categories of personal data only with the consent of the relevant individual and solely for the purpose for which such data was collected.

E. RECIPIENTS AND PURPOSES OF TRANSFER OF PERSONAL DATA

Your personal data may be transferred, for the purposes specified in Section B, to the following entities belonging to Neptün Turizm ve Ticaret Anonim Şirketi:

Club Resort Atlantis Hotel

Maya Bistro Hotel Beach

Your personal data may also be transferred to our shareholders, business partners, suppliers, legally authorised public institutions and legally authorised private persons within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the PPD Law.

F. TRANSFER OF PERSONAL DATA ABROAD

Our Company is entitled to transfer personal data abroad in accordance with the conditions established under the PPD Law and by the Personal Data Protection Board, provided that the other conditions stipulated by law are met and the explicit consent of the relevant individual has been obtained for this purpose.

At present, our Company does not transfer personal data abroad.

G. RIGHTS OF PERSONAL DATA SUBJECTS UNDER ARTICLE 11 OF THE PPD LAW

Under the PPD Law, we acknowledge the right of the relevant individual to be informed and, where required, to provide consent before their personal data is processed, recorded, transferred, shared or stored, as well as their right to exercise control over their personal data following such processing.

If you submit a request concerning your rights as a personal data subject through the methods specified below in this “Information Notice on Personal Data Processing and Privacy Policy”, our Company will conclude your request free of charge within a maximum of thirty days, depending on its nature.

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller published by the Personal Data Protection Board:

i. Where your application is answered in writing, no fee will be charged for up to ten pages. A processing fee of TRY 1 may be charged for each page exceeding ten pages.

ii. Where the response is provided on a recording medium such as a CD or flash drive, any fee charged by our Company as Data Controller may not exceed the cost of the recording medium.

Personal data subjects have the right:

a. To learn whether their personal data has been processed,

b. To request information about the processing if their personal data has been processed,

c. To learn the purpose of processing their personal data and whether it has been used in accordance with that purpose,

d. To know the third parties to whom their personal data has been transferred within or outside Türkiye,

e. To request the correction of incomplete or inaccurate personal data and the notification of such correction to third parties to whom the data has been transferred,

f. To request the deletion, destruction or anonymisation of their personal data under the conditions specified in Article 7 of the PPD Law and the notification of such action to third parties to whom the data has been transferred,

g. To object to any result arising against them from the analysis of their processed data exclusively through automated systems,

h. To request compensation for damages arising from the unlawful processing of their personal data.

Individuals have no rights in relation to data that has been anonymised within the Company. Our Company may share personal data with relevant institutions and organisations where required in connection with business or contractual relationships, the performance of judicial duties or the exercise of statutory powers by public authorities.

H. RETENTION PERIODS FOR PERSONAL DATA

In accordance with the PPD Law, personal data processed for the purposes specified in this “Information Notice on Personal Data Processing and Privacy Policy” will be deleted, destroyed or anonymised when the purpose requiring its processing under Article 7/f.1 of the PPD Law ceases to exist and/or the applicable statutory limitation periods requiring the processing of the data expire.

I. CIRCUMSTANCES IN WHICH OUR COMPANY MAY PROCESS YOUR PERSONAL DATA WITHOUT YOUR EXPLICIT CONSENT

Pursuant to Article 5 of the PPD Law, our Company may process personal data lawfully obtained as described above without seeking explicit consent in the following circumstances:

Situations expressly provided for by law;

i. Where processing is necessary to protect the life or physical integrity of the data subject or another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,

ii. Where processing is necessary for the establishment or performance of a contract to which you are a party and is directly related to that contract, including contracts with our Company, its affiliated companies and organisations, or other natural and/or legal persons specified in Section C,

iii. Where processing is necessary for our Company to fulfil a legal obligation,

iv. Where the personal data has been made public by the data subject,

v. Where processing is necessary for the establishment, exercise or protection of a right,

vi. Where processing is necessary for the legitimate interests of our Company, provided that this does not adversely affect your fundamental rights and freedoms.

MAXIMUM SAVINGS / DATA MINIMISATION PRINCIPLE

Under our principle of maximum savings, also referred to as the principle of parsimony, data received by NEPTÜN TURİZM is entered into our systems only to the extent necessary. Accordingly, the data to be collected is determined according to the relevant purpose. Unnecessary data is not collected.

Other data received by our Company is likewise transferred to our corporate information systems. Excess information is not recorded and is instead deleted or anonymised. Such data may be used for statistical purposes.

DELETION OF PERSONAL DATA

When legally required retention periods expire, judicial proceedings are concluded or other requirements cease to apply, our Company deletes, destroys or anonymises personal data automatically or upon the request of the relevant individual.

ACCURACY AND UP-TO-DATENESS OF DATA

As a rule, data held by NEPTÜN TURİZM is processed as declared by the relevant individuals. NEPTÜN TURİZM is not obliged to verify the accuracy of information declared by customers or persons who contact NEPTÜN TURİZM, and such verification is neither carried out as a matter of legal obligation nor under our working principles. Declared information is therefore deemed to be accurate.

NEPTÜN TURİZM also adopts the principle that personal data must be accurate and up to date.

Our Company updates personal data on the basis of official documents received or at the request of the relevant individual and takes the necessary measures for this purpose.

PRIVACY AND DATA SECURITY PRINCIPLE

The data held by NEPTÜN TURİZM, whether relating to employees or other individuals, is confidential. No person may use, copy, reproduce or transfer such data to others, or use it for purposes other than business purposes, except where permitted by contract or law.

Personal data is confidential, and NEPTÜN TURİZM respects this confidentiality. Only authorised personnel within the Company may access personal data. All necessary technical and administrative measures are taken to protect personal data collected by NEPTÜN TURİZM, prevent unauthorised access and prevent data subjects from suffering any loss or harm.

Accordingly, we ensure that software complies with applicable standards, third parties are selected carefully and the Privacy Policy is observed within the Company.

We also require companies with which we lawfully share personal data to protect such data.

PROCESS SECURITY

NEPTÜN TURİZM takes all necessary technical and administrative measures to protect personal data collected by the Company, prevent unauthorised access and prevent customers and prospective customers from suffering any loss or harm.

Accordingly, we ensure that software complies with applicable standards, third parties are selected carefully and Information Security rules are observed within the Company. Security measures are continuously reviewed, renewed and improved.

AUDIT

NEPTÜN TURİZM ensures that the necessary internal and external audits concerning the protection of personal data are carried out.

NOTIFICATION OF DATA BREACHES

Where NEPTÜN TURİZM is notified of any breach concerning personal data, it immediately takes action to remedy the breach. It takes measures to minimise any harm suffered by the relevant individual and compensates such harm.

Where personal data is obtained by unauthorised persons from outside the Company, NEPTÜN TURİZM immediately notifies the Personal Data Protection Board.

J. HOW TO SUBMIT REQUESTS UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

Pursuant to paragraph 1 of Article 13 of the PPD Law, you may submit requests concerning the exercise of your rights listed above to our Company using the method(s) determined or to be determined by the Personal Data Protection Board. Alternatively, you may submit your application to our Company in writing in accordance with the PPD Law.

To do so, first complete and sign the form available at:

https://www.clubresortatlantis.com/

https://www.mayabistrohotelbeach.com/

Then send the form to our Company, in our capacity as Data Controller, using one of the following methods:

i. You may personally deliver a signed copy of the form containing your explanations regarding the right you wish to exercise to:

Club Resort Atlantis Hotel, Maya BHB
Sığacık Mahallesi Büyükakkum Caddesi No:175, Seferihisar-İzmir / Türkiye

together with official documentation verifying your identity, such as a copy of your identity card.

ii. You may send the completed form and official documentation verifying your identity through a Notary Public; or

iii. You may send the completed form and official documentation verifying your identity electronically to kvkk@neptunclubhotels.com using a secure electronic signature or mobile signature; or

iv. You may send the completed form and official documentation verifying your identity using the e-mail address that you have previously notified to our Company and that is registered in our systems.

You may submit your request to our Company in its capacity as Data Controller. Depending on the nature of your request, our Company will ensure that it is concluded within a maximum period of 30 days.

Rights concerning personal data may only be exercised in relation to the personal data belonging to the individual concerned. Requests concerning the personal data of another individual will not be considered where the applicant is not the person who completed the form and whose identity is verified by the attached official documentation.

Forms submitted without official documentation verifying the applicant’s identity will not be considered.

Please note that even where a request for deletion of personal data has been fulfilled, we remain legally obliged to provide such data to official authorities upon request.