Personal Data Protection and Processing Policy

At NG PHASELIS TURİZM A.Ş. ("the Company", "we"), we act as the "Data Controller" under the Turkish Personal Data Protection Law No. 6698 ("the Law"). We may process your personal data as explained below. You can find more details about why we process your personal data at https://ngphaselisbay.com/en/personal-data-protection-law/.

1. DATA CONTROLLER

2. OUR PRIVACY NOTICES

Article 10 of the Law and the regulation on how to meet the duty to inform ("the Communiqué") say that we must inform people about certain points. We must do this before we process their personal data, or at the latest while we process it. We give this information to each group of people in a privacy notice written for that group. Each notice explains these points:

• which categories and types of personal data we process;
• why we process your data and our legal reason for doing so;
• how we collect your data;
• who we may share your data with, why we share it, and our legal reason for sharing it.

Please choose the notice that fits your situation:

Website Visitor Privacy Notice

Reservation and Accommodation Privacy Notice

Call Center Privacy Notice

Cookie Policy Privacy Notice

For our employees, job candidates and interns, we give the information in the separate Employee Privacy Notice. We give it to them during our Human Resources processes.

3. BASIC PRINCIPLES

Under Article 4 of the Law, we process personal data in these ways:

• lawfully and fairly;
• accurately and, when needed, up to date;
• for specific, clear and legitimate purposes;
• only as much as the purpose needs, and in a way that is connected and proportionate to that purpose;
• we keep it only for the time the law requires, or for as long as the purpose needs.

Protecting personal data is one of our main principles and priorities. Because of the nature of our work, we collect personal data from our guests and potential guests. We process all of it in line with international information security standards. We do not process or share personal data unless there is a legal reason under Law No. 6698 and related legislation.

Our main principle is to follow the Law and related legislation fully. We work to prevent unlawful processing and sharing of personal data. To do this, we take the necessary technical and administrative measures, and we regularly inform our employees about these principles. We also carry out regular audits to check that we follow the Law. "Processing personal data" means any activity with personal data, such as collecting, using, storing, destroying, updating and sharing it. We process the personal data of all individuals connected to NG PHASELIS TURİZM A.Ş., including guests, potential guests, employees, business partners, suppliers and third parties. We follow the rules for processing, protecting and securing this data in line with the Law and related legislation.

Sharing of Personal Data

We and our Data Processors may share personal data with third parties. We do this only when the conditions in Articles 5/2 and 6/3 of the Law are met, and when we take the measures required by the Personal Data Protection Board ("the Board"). If these conditions are met, we may also share special categories of personal data without the explicit consent of the data subject, again with the measures required by the Board. We always process personal data confidentially. We do not share it with third parties who do not act on our behalf, unless one of these applies: you have given written or electronic consent; one of the reasons in Articles 5/2 and 6/3 of the Law applies; or the law requires it.

Transfer of Data Abroad

We work with agencies, global booking platforms and cloud service providers based outside Türkiye. For this reason, your data may be transferred abroad. Under Articles 8 and 9 of the Law, we can do this only if the conditions in the Law are met and the necessary security measures are in place. Your data may be transferred to countries that offer enough protection. If a country does not offer enough protection, your data may be transferred only if the data controllers there promise enough protection and the Personal Data Protection Board gives permission.

Purposes and Legal Reasons for Processing and Sharing Personal Data

We can process personal data only with the data subject's "explicit consent". We can also process and share it without explicit consent if one of these conditions applies:

The law clearly says so.

A person cannot give consent because of a real impossibility, or their consent is not legally valid, and processing is necessary to protect the life or physical safety of that person or someone else.

Processing the personal data of the parties to a contract is necessary, as long as it is directly related to making or carrying out that contract.

It is necessary for the data controller to meet a legal duty.

The data subject has made the data public themselves.

Processing is necessary to establish, use or protect a legal right.

Processing is necessary for the legitimate interests of the data controller, as long as it does not harm the fundamental rights and freedoms of the data subject.

For special categories of personal data, we also consider these cases: it is needed by people under a duty of confidentiality or by authorized bodies for public health, medical diagnosis, treatment and care, or for planning, managing and financing health services; and it is required to meet legal duties in employment, occupational health and safety, social security, social services and social aid.

Inventory and VERBIS Obligations

We record information about our personal data processing activities in an Inventory. We review the Inventory at regular intervals and update it when needed. If one of our current processing activities changes, we update it in the Inventory. If we start a new processing activity, we add it to the Inventory.

Data Security Obligations

When we process personal data, we take all the technical and administrative measures needed for a suitable level of security. Their aims are to prevent unlawful processing of personal data, to prevent unlawful access to it, and to keep it safe. The measures include the following:

Checking the Measures We Take to Protect Personal Data

Under Article 12 of the Law, NG PHASELIS TURİZM A.Ş. carries out and reports regular internal audits. We review any problems and risks found in these audits as part of our corrective actions, and we apply preventive actions. We also audit our Data Processor service providers on data security at regular intervals.

Retention Period and Destruction of Personal Data

Under Article 7 of the Law and Article 5 of the Regulation on the Deletion, Destruction or Anonymization of Personal Data, we keep personal data and special categories of personal data for the periods set by Law No. 6698 and related legislation. If the legislation does not set a clear period, we keep the data for a period we decide. To decide it, we consider the purpose of processing, common practice in our sector, the length of the legal relationship, our legitimate interest, possible risks and duties, and limitation periods. When these periods end, we delete, destroy or anonymize the personal data in line with the legislation.

Sometimes the purpose of processing has ended, and the retention periods set by legislation and by NG PHASELIS TURİZM A.Ş. have also ended. In that case, we keep the data only for one of two reasons: to use it as evidence in a possible legal dispute, or to be able to claim a right or to defend ourselves. We set these retention periods by looking at two things: the limitation periods for claiming the right, and examples of earlier requests made to NG PHASELIS TURİZM A.Ş. on the same subjects, even after limitation periods ended. In this case, we do not access the stored personal data for any other purpose. We access it only when we need to use it in the legal dispute. When this period ends, we delete, destroy or anonymize the personal data.

4. YOUR RIGHTS AND HOW TO APPLY

Under Article 11 of the Law, you have the right to:

• find out whether your personal data is processed;
• ask for information if it has been processed;
• find out why it is processed and whether it is used for that purpose;
• know the third parties it is shared with, in Türkiye or abroad;
• ask for correction if it is incomplete or wrong;
• ask for deletion or destruction when the conditions are met;
• ask us to tell the third parties about corrections and deletions;
• object if an analysis made only by automated systems gives a result against you;
• ask for compensation if you suffer a loss because of unlawful processing.

Please fill in the Data Subject Application Form and send your request in one of these ways:

• In writing: Göynük Mah. 3160. Sok. No: 31 Kemer / ANTALYA, Türkiye (in person or through a notary)
• From your KEP address: [email protected]
• With a secure electronic signature or mobile signature: [email protected]
• From the email address registered in our system: [email protected]

We answer your request free of charge, as soon as possible and within thirty days at the latest, depending on the type of request. If our answer contains personal data, we send it after we verify your identity. We send it to your KEP address, to your email address registered in our system, or by registered mail with return receipt.

You can complain to the Personal Data Protection Board in these cases: your application is rejected, you find our answer insufficient, or we do not answer in time. You must complain within thirty days of learning our answer, and in any case within sixty days of your application date (Article 14 of the Law).

5. UPDATES

We update this page and our privacy notices when the legislation or our business processes change. You can always find the current version on this page. The date of the last update is shown at the top of the text.

NG PHASELIS TURİZM A.Ş. (NG Phaselis Bay)

Göynük Mah. 3160. Sok. No: 31 Kemer / ANTALYA, Türkiye · +90 242 824 07 07 · [email protected]

Version history