Personal Data Protection Clarification Text

This Clarification Text has been prepared by Samira Resort, acting as the data controller, in accordance with the Personal Data Protection Law No. 6698 ("KVKK") and relevant legislation. Security measures for the protection of your personal data are provided at an appropriate level against possible risks, considering the latest technological capabilities.

As the data controller under the KVKK and relevant legislation, your following personal data shared with Samira Resort via digital platforms (website, mobile applications, etc.), social media channels (Facebook, Instagram, LinkedIn, etc.), and online communication channels (contact forms, support centers, live chat, video calls, etc.) are processed:

• Identity Data: Name, surname, Turkish ID number (if necessary).
• Contact Data: Phone number, e-mail address, address information.
• Customer Transaction and Marketing Data: Product/service preferences, purchase history, campaign participation, survey responses.
• Transaction Security Data: IP address, device information, cookies.

Purposes of Processing Your Personal Data

Your personal data specified above is processed limited to the following purposes:

• To respond to your requests and suggestions, and to offer tailored solutions.
• To provide information about our products, services, and projects, and to communicate with you.
• To carry out pre-sales, reservation, sales, and post-sales/support processes.
• To manage operational processes (request management, survey activities, etc.).
• To carry out marketing activities (sending personalized offers, campaigns, and informative commercial electronic messages).
• To fulfill our obligations arising from legal legislation.

Transfer of Your Personal Data

Your shared personal data may be transferred to our business partners, suppliers (such as agencies, technology infrastructure providers, live support platforms, digital platforms), and affiliated group companies for the purposes stated above and under the conditions stipulated by the KVKK. Your personal data may be processed and stored on servers located domestically or abroad or in other electronic environments, provided that the necessary security measures are taken.

Legal Grounds for Collecting Personal Data

Your personal data is collected and processed based on the legal grounds specified in Article 5, Paragraph 2 of the KVKK:

• Establishment and Performance of the Contract: Being directly related to the establishment or performance of a contract (e.g., offering, contract processes).
• Legitimate Interest: The legitimate interest of the data controller (e.g., conducting business processes, operational efficiency).
• Explicit Consent: Having your explicit consent for specific processes such as marketing activities.

Your personal data is retained in accordance with the aforementioned legal grounds for the duration required by the relevant legal ground, the period stipulated in the legal legislation, or the period during which your explicit consent is valid.

Your Rights as a Data Subject

In accordance with Article 11 of the KVKK, you can submit your requests regarding your rights in writing to us according to the "Communiqué on the Procedures and Principles of Application to the Data Controller" or by other methods specified in the KVKK. Your request will be evaluated and concluded as soon as possible and within thirty (30) days at the latest.

Your rights are as follows:

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose.
• To know the third parties to whom your personal data is transferred domestically or abroad.
• To request correction of your personal data if it is incomplete or incorrectly processed.
• To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK.
• To request notification of the operations carried out pursuant to subparagraphs (d) and (e) of Article 11 of the KVKK to third parties to whom your personal data has been transferred.
• To object to the occurrence of a result against you by analyzing your personal data exclusively through automated systems.
• To claim compensation for the damage arising from the unlawful processing of your personal data.