PERSONAL DATA PROTECTION AND PRIVACY POLICY

(KVKK / GDPR – SANDA TIME / SANDA TUR. TIC. ITH. IHR. LTD. STI.)

This Personal Data Protection and Privacy Policy (“Policy”) explains how
Sanda Tur. Tic. İth. İhr. Ltd. Şti. (hereinafter “Company”, “Sanda Time”, “Sanda Yachting” or “we”)
collects, uses, stores and protects personal data within the scope of its services and websites.

Our Company acts in compliance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR) and attaches great importance to the protection of the personal data of its guests, business partners and candidates.

1. DATA CONTROLLER

Data Controller: Sanda Turizm Ticaret İthalat İhracat Limited Şirketi
Trade name: Sanda Tur. Tic. İth. İhr. Ltd. Şti.
Commercial brands: Sanda Time, Sanda Yachting and related group brands

Registered office: Marmaris, Muğla, Türkiye
(Additional contact details such as address, phone and e-mail are provided on our website and other official communication channels.)

Within the meaning of KVKK and GDPR, the Company is the data controller responsible for the processing of your personal data under this Policy.

2. SCOPE OF THE POLICY

This Policy applies to personal data obtained through:

Contact, meeting request, B2B, reservation, quotation and career/CV forms on our websites,
E-mails, phone calls, WhatsApp and social media messages you send to us,
Information shared during visits to our offices or yachts,
Business cards and information shared with us at fairs, workshops, conferences and other events,
Online booking and enquiry systems used by us and our business partners.

3. CATEGORIES OF PERSONAL DATA WE PROCESS

Depending on your relationship with Sanda Time, we may process the following categories of personal data:

Identity Information: Name, surname, date/year of birth, nationality, etc.
Contact Information: E-mail address, phone / WhatsApp number, country, city, address.
Professional Information: Job title, company, professional experience, skills, languages, references (for career applications).
Transaction and Contract Information: Reservation details, yacht details, charter dates, prices, payment and invoicing information (to the extent necessary).
Marketing and Communication Preferences: Newsletter subscription, consent for campaigns and promotional messages, preferred communication channel.
Digital Usage Data: IP address, device and browser information, cookie data and website usage statistics (processed mostly in aggregated or pseudonymised form).

As a rule, we do not process special categories of personal data (such as health, religion, political opinion, etc.). However, for the safety and comfort of our guests, we may, with your explicit consent, request limited health information such as allergies or chronic conditions relevant to the cruise.

4. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data may be processed for the following purposes:

Execution of reservations and contracts
- Planning and management of yacht charters, cabin charters, private cruises and package tours
- Establishment and performance of contracts with boat owners, agencies and investors
Communication and guest relations
- Responding to your questions, requests and meeting forms
- Managing guest satisfaction, feedback and complaints
Business development and B2B relations
- Managing cooperation with agencies, hotels, tour operators and other partners
- Evaluating yacht sales, brokerage, partnership and investment projects
Human resources and recruitment
- Receiving and evaluating career applications and CVs
- Planning and managing interview and hiring processes
Marketing and promotion
- With your explicit consent, informing you about campaigns, fairs, new routes and products
- Preparing statistics and reports to improve our websites and services
Compliance with legal obligations
- Fulfilling obligations arising from tax, tourism, maritime and other relevant legislation
- Responding to requests from competent public authorities
Information security and prevention of misuse
- Ensuring the security of our IT systems and infrastructure
- Detecting and preventing fraud, abuse and unauthorised access attempts.

5. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed on one or more of the following legal bases under KVKK and GDPR:

It is necessary for the establishment or performance of a contract,
It is necessary for us to comply with our legal obligations,
It is necessary for the establishment, exercise or protection of a right,
It is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed,
In cases where required by law, it is processed on the basis of your explicit consent.

6. METHODS OF COLLECTING PERSONAL DATA

We may collect personal data through:

Online forms on our websites (contact, meeting request, B2B, reservation, career),
E-mails, telephone calls, messaging applications and social media platforms,
Physical forms and documents filled out in our offices or on board,
Business cards and online registrations at fairs and events,
Notifications and reservation details shared by our business partners and agencies,
IT systems such as booking engines, CRM tools and website analytics.

Personal data may be collected by automatic or partially automatic means, or in some cases non-automatic ways when provided in writing or verbally.

7. TRANSFER OF PERSONAL DATA AND INTERNATIONAL TRANSFERS

For the purposes described above and to the extent necessary, your personal data may be shared with:

Our group companies and brands,
Business partners (agencies, boat owners, captains and crew, accommodation and transportation partners),
Financial and accounting consultants for tax and invoicing processes,
IT and infrastructure providers (hosting, e-mail, reservation and CRM systems),
Legal advisers and lawyers in case of disputes,
Competent public authorities and institutions when required by law.

If our servers, booking systems or e-mail infrastructure are located abroad, your personal data may be transferred to countries outside Türkiye (including EU member states and other jurisdictions). In such cases, we ensure that the transfer is carried out in compliance with KVKK and GDPR, using appropriate safeguards such as contractual clauses and other protective measures.

8. RETENTION PERIODS

Your personal data is retained:

For the duration required by applicable laws and regulations,
For the period necessary for the performance of contracts and the management of reservations,
For the relevant statute of limitations in the event of possible disputes,
For the period required by our legitimate interests (e.g. keeping records as evidence).

At the end of these periods, your personal data is deleted, destroyed or anonymised in accordance with internal procedures and legal requirements.

CVs and job application information may be stored for a reasonable period (for example up to 2 years) in order to consider your profile for future opportunities, unless you request their earlier deletion or a longer period is required/allowed by law.

9. YOUR RIGHTS UNDER KVKK AND GDPR

Within the scope of KVKK and, where applicable, GDPR, you have the following rights regarding your personal data:

To learn whether your personal data is being processed,
To request information about the processing,
To learn the purposes of processing and whether they are used in accordance with these purposes,
To know the third parties to whom your personal data is transferred at home or abroad,
To request correction of incomplete or inaccurate data,
To request deletion or destruction of your personal data in cases where the reasons for processing no longer exist,
To request notification of these corrections, deletions or destructions to third parties to whom your data has been transferred,
To object to a result against you that is obtained solely through automated processing,
To request compensation for damages if you suffer harm due to unlawful processing,
Under GDPR, to request data portability, to object to processing, and not to be subject to decisions based solely on automated processing in certain cases.

10. EXERCISING YOUR RIGHTS

To exercise your rights or submit any request regarding your personal data, you may contact the Company:

In writing, to our registered office address in Marmaris / Muğla / Türkiye, or
By using the contact channels (e-mail, phone, contact forms) published on our official websites.

Your applications will be evaluated and concluded as soon as possible and in any case within the periods set out in the applicable legislation. In principle, no fee will be charged; however, if the process requires an additional cost, a fee may be requested in accordance with the tariff determined by the competent authority.

11. COOKIES

Our websites use cookies and similar technologies to improve user experience, analyse site performance and develop our services. You can manage your cookie preferences through your browser settings. More detailed information is provided in our separate Cookie Policy, where applicable.

12. UPDATES TO THIS POLICY

This Policy may be updated from time to time in line with changes in legislation, our services or internal practices. The most recent version is always available on our website. In case of material changes, we will try to inform you through appropriate communication channels.