PERSONAL DATA PROTECTION POLICY

​

1. INTRODUCTION

Law No. 6698 on the Protection of Personal Data (“Law”) regulates the processing of all information relating to identified or identifiable natural persons (“data subject”).

As Ottomarin Turizm İnşaat Anonim Şirketi (“Company”), we attach utmost importance to processing and protecting personal data in compliance with the Law and act with this awareness in all our planning and activities.

With this understanding, our Company takes all necessary administrative and technical measures to ensure the protection and processing of personal data. The most important pillar of this matter is the protection of personal data of job applicants, company shareholders, company officials, visitors, customers, institutions we cooperate with, and third parties, as governed by this Personal Data Processing and Protection Policy (“Policy”).

​

2. SCOPE

The provisions and principles set forth in this Policy cover all kinds of information and documents that can be associated with an identified or identifiable natural person, as well as the measures and regulations taken in relation thereto.

​

3. DEFINITIONS

• Explicit Consent: Consent that is related to a specific subject, based on information, and expressed with free will.

• Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person, even when matched with other data.

• Law: Law No. 6698 on the Protection of Personal Data.

• Processing of Personal Data: Any operation performed on personal data, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or preventing the use of personal data, whether fully or partially by automatic means or non-automatic means provided that it is part of a data recording system.

• Company: Ottomarin Turizm İnşaat Anonim Şirketi.

• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

​

4. RESPONSIBILITIES

Ottomarin Turizm İnşaat A.Ş. is responsible for the preparation, updating, and submission of this Policy to the approval of the Board of Directors. The implementation of this Policy is the responsibility of the departments and relevant employees who use/manage the systems in which personal data is stored, processed, and/or transferred within the Company.

​

5. DATA PROCESSING UNITS AND DUTIES

5.1. Finance – Accounting and Human Resources Unit:

• Recording salary and payment information required within the scope of employees’ personal rights.

• Recording expense information related to company activities.

• Conducting interviews with job candidates and storing personnel files.

• Managing systems used to monitor employee entry and exit.

5.2. Information Technologies Unit:

• Taking necessary measures to ensure the security of devices used in the Company.

• Managing authorization for access to devices, software, and databases.

• Keeping log records in compliance with Law No. 5651.

5.3. Operations, Sales and Service Units:

• Recording details of contracts made with customers.

• Preventing unauthorized transfer of customer information (boat owners, tenants, or other service recipients) to third parties.

• Storing payment information and documents of serviced customers.

• Recording information of individuals and institutions requesting rental or services.

​​

6. PRINCIPLES OF PERSONAL DATA PROCESSING

Our Company processes personal data in accordance with the following principles:

• Compliance with the law and good faith,

• Accuracy and, where necessary, up-to-date,

• Processing for specific, explicit, and legitimate purposes,

• Being relevant, limited, and proportionate to the purposes for which they are processed,

• Retention for the period stipulated in the relevant legislation or necessary for the purpose of processing.

​​

7. PURPOSES OF PROCESSING PERSONAL DATA

Personal data collected by our Company is processed for the following purposes:

• Conducting Business Activities: Performing commercial activities, improving service standards, and providing customized services.

• Legal Obligations: Fulfillment of obligations arising from Law No. 5651, Law No. 6563 on the Regulation of Electronic Commerce, Tax Procedure Law, Law No. 6698, and other relevant legislation.

• Service Improvement: Evaluating requests and complaints and ensuring customer satisfaction.

• Security: Ensuring physical premises security and transaction security.

​

8. TRANSFER OF PERSONAL DATA

Our Company may transfer personal data, in the presence of explicit consent of the data subject or legal grounds (Articles 5 and 6 of the Law), to public institutions, service providers (IT support, financial advisors, etc.), or third parties with whom we cooperate. Transferred third parties are obliged to ensure data security.

​

9. OUR OBLIGATIONS

9.1. Obligation to Inform: 

At the time of obtaining personal data, our Company informs data subjects about the identity of the data controller, purpose of processing, transferred parties, method and legal basis of collection, and their rights.

9.2. Data Security Obligations

Our Company takes necessary technical (firewalls, encryption, etc.) and administrative (authorization matrices, confidentiality agreements, etc.) measures to prevent unauthorized access, loss, or alteration of personal data.

9.3. Obligation to Respond to Applications:

Data subjects may apply to our Company to exercise their rights under Article 11 of the Law. Our Company concludes such applications within 30 days at the latest.

​

10. CATEGORIZATION OF PERSONAL DATA

The categories of personal data processed by our Company are as follows:

• Identity Information: Name-surname, Turkish ID number, signature, passport, etc.

• Contact Information: Phone number, address, email, registered electronic mail (KEP).

• Location Data: Location data obtained during the use of service vehicles (if any).

• Physical Premises Security Information: Camera recordings, visitor entry-exit records.

• Financial Information: Bank account number, IBAN, invoice details, payment history.

• Contract Data: Customer/supplier contracts, lease agreements, etc.

• Personnel Information: Payroll, CV, social security information of employees.

​

11. SECURITY-BASED DATA PROCESSING ACTIVITIES

Our Company conducts monitoring activities through security cameras at its headquarters located at Konutkent Mahallesi 3028. Cad. No:6/81 Çankaya/Ankara and at its workplace in Göcek Mahallesi Sahilyolu Cd.No:1 Fethiye/Muğla and other working areas for security purposes.

Personal data may also be processed to monitor visitor entries and exits. These records are kept solely for security purposes and are not shared with third parties except for legal obligations.

 

İContact Information:
Title: Ottomarin Turizm İnşaat Anonim Şirketi
Address: Konutkent Mahallesi 3028. Cad. No:6/81 Çankaya/Ankara
Tax ID: 6490924952

​

​

​

​​

​

​

CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

​

1. Data Controller and Identity

Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”), Ottomarin Turizm İnşaat Anonim Şirketi (“Company”), acting in the capacity of Data Controller, processes your personal data within the scope of the purposes described below, in accordance with the law and the principles of good faith.

Address: Konutkent Mahallesi 3028. Cad. No:6/81 Çankaya/Ankara
Tax Office / No: 6490924952

 

2. Your Processed Personal Data

When you visit our website, fill in contact/application forms on the website, or through cookie applications, your personal data within the following categories may be processed:

• Identity Information: Name and surname (if you fill out contact forms).

• Contact Information: E-mail address, phone number, address information (if declared in contact forms).

• Transaction Security Information: IP address, website login-logout log records, connection time, browser information (traffic data required to be retained under Law No. 5651).

• Request/Communication Information: Personal data included in the content of messages you send to our Company, as well as details of your requests and complaints.

 

3. Purposes of Processing Personal Data

Your collected personal data are processed in compliance with the general principles set forth in Article 4 of the Law and within the personal data processing conditions specified in Articles 5 and 6 of the Law, for the following purposes:

• Customizing and recommending/promoting the products and services offered by our Company in line with the preferences, usage habits, and needs of the relevant persons,

• Evaluating requests, suggestions, and complaints submitted via the website, processing them by the relevant departments, and responding to you,

• Recording and retaining traffic (log) records in accordance with Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications and related legislation,

• Planning and execution of information security processes and ensuring system security,

• Providing information to authorized public institutions and organizations as required by legislation,

• Fulfilling the burden of proof in potential legal disputes.

​

4. Method and Legal Basis for Collecting Personal Data

Your personal data are collected electronically through automatic means when you visit our website, fill out the “Contact” or “Contact Us” forms, and via our servers. These data are processed based on the following legal grounds set forth in Article 5 of the Law:

• Explicitly stipulated by laws,

• Necessary for the establishment or performance of a contract,

• Compliance with the legal obligation of the data controller,

• Legitimate interests of the data controller.

 

5. Transfer of Personal Data

Your personal data may be transferred, in line with the purposes stated above and in accordance with Article 8 of the Law, to:

• Legally Authorized Public Institutions: For the purpose of fulfilling our legal obligations (Information and Communication Technologies Authority, General Directorate of Security, Courts, Enforcement Offices, etc.),

• Suppliers and Business Partners: IT companies from which we receive website infrastructure, server hosting, maintenance-repair, and archiving services (preference is given to domestic servers; otherwise, explicit consent or contractual safeguards shall apply).

 

6. Rights of the Data Subject

As a personal data owner, pursuant to Article 11 of the Law, you have the following rights:

• To learn whether your personal data are processed,

• To request information if your personal data have been processed,

• To learn the purpose of processing and whether they are used in accordance with that purpose,

• To know the third parties to whom personal data are transferred domestically or abroad,

• To request correction of incomplete or inaccurate data,

• To request deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the Law,

• To request notification of correction, deletion, or destruction processes to third parties to whom personal data have been transferred,

• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,

• To request compensation for damages in case you suffer damage due to unlawful processing of personal data.

 

7. Application Procedure

You may submit your requests regarding the above-mentioned rights in accordance with the Communiqué on the Principles and Procedures for the Request to the Data Controller:

• By submitting a wet-signed petition in person or through a notary to the address: Konutkent Mahallesi 3028. Cad. No:6/81 Çankaya/Ankara,

• Via Registered Electronic Mail (KEP), secure electronic signature, mobile signature, or by using the electronic mail address previously notified to our Company and registered in our system, by sending it to the e-mail address specified in the contact section of this website.

       Our Company shall finalize your request as soon as possible and within thirty (30) days at the latest, free of charge, depending on the nature of the request. However, if the process requires additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

​​