POLICY ON THE STORAGE AND DESTRUCTION OF PERSONAL DATA

1. Purpose : As Mar Yapı Turizm İnşaat San. Ve Tic. A.Ş (Mar Yapı); it is our priority that the personal data pertaining to all natural persons including our customers, visitors, suppliers and employees in accordance with the applicable legislation, in particular, the Constitution of the Republic of Turkey, international treaties on human rights to which Turkey is a party and the Law on the Protection of Personal Data No. 6698 (the “LPPD”) and the data subjects may exercise their rights effectively. This policy will be followed in order to regulate the operations regarding the processing, storage and transfer of all personal data which are acquired during our activities, to protect the fundamental rights and freedoms, in particular the privacy of personal life and to set the obligations of the natural and legal persons who/which process personal data and the procedures and rules to be abided thereby.

2. Scope : This policy covers personal data or special categories of personal data which enable the identification of the data subject, pursuant to the processing of all kinds of data pertaining to an identified or identifiable natural person by wholly or partly automatic means or otherwise than by automatic means which form part of a filing system during the operations conducted by Mar Yapı. All personal data which are processed by Mar Yapı including our customers, visitors, business partners, employees, suppliers, third parties fall within the scope of this Policy.

Our Policy is applicable to all operations of Mar Yapı regarding the processing of personal data and it has been devised and drawn up by observing the LPPD, other applicable legislation on personal data and the international standards in this area.

3. DEFINITIONS AND ABBREVIATIONS :

3.1. LPPD: The Law on the Protection of Personal Data No. 6698 (as promulgated in the Official Gazette dated April 7, 2016 and numbered 29677)

3.2. Personal Data: Data which are recorded and processed concerning an identified or identifiable natural person (such as TR ID number, IP address, name-surname, contact details – such as mobile phone number, home phone number, address etc.) as well as reports (such as, customer complaint reports, employee performance rating reports, interview assessment reports), records (audio and image records, photographs, user transaction records), documents (such as resumes, payroll slips, invoices, bank receipts, credit card statements, identification card photocopies), correspondences (such as letters, invitations) that are associated with an identified or identifiable natural person.

3.3. Special Categories of Personal Data: Data which carries the risk of giving rise to distribution against the owners thereof if processed. Therefore, they are required to be protected more stringently than other personal data. As per Article 6 of the LPPD, special categories of personal data are “data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire, membership of association, foundation or trade union, health, sexual life, criminal conviction and security measures, and biometrics and genetics”.

3.4. Personal health data: All kinds of health data pertaining to an identified or identifiable natural person. For instance, the data such as all kinds of test results, past illnesses, medication used constitute personal health data. Personal health data is a special category of personal data.

3.5. Processing of Personal Data: Any operation which is performed upon personal data such as collection, recording, storage, preservation, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization or blocking its use by wholly or partly automatic means or otherwise than by automatic means which form part of a filing system;

3.6. Employee: : the personnel of Mar Yapı Turizm İnşaat San. ve Tic. A.Ş.

3.7.Data Processor: Natural or legal person who/which processes personal data based on the authority granted by and on behalf of the data controller.

3.8.Data Controller: Natural or legal person who/which determines the purposes and means of the processing of personal data, and who/which is responsible for establishment and management of the filing system. Pursuant to the Law on the Protection of Personal Data No. 6698 your personal data may be processed by the “Data Controller” Mar Yapı Turizm İnşaat San. Ve Tic. A.Ş. (“Mar Yapı”).

3.9.Service Provider: Personnel from which Mar Yapı receives services or to which Mar Yapı furnishes services (Supplier, sub-contractor, customer etc.).

3.10. Data Subject: Natural person whose personal data are processed.

4. ROLES AND RESPONSIBILITIES

4.1. Board of Directors::

The Board of Directors is responsible for the supervision of the determination and execution of the notice, examination and sanction mechanisms in case of the non-compliance with the policy, rules and regulations. The authority in the formation, publication, updating, if necessary, and the repealing of this policy is the approval mechanism.

4.2. Employees:
*Employees are responsible for the following:
*adherence to Mar Yapı policies, regulations and procedures and compliance therewith,
*carrying out of work in compliance with the applicable legislation,
*notifying the Human Resources in case of encountering any acts, activities or practices which are in violation of this document.

4.3. Companies Providing Outsourced Services and Business Partners:
It is mandatory for companies providing outsources services and business partners to comply with the principles of the Policy and other applicable regulations and businesses with the persons or organizations that do not abide thereby will be terminated. It is expected that the sub-contractors, suppliers, customers, joint ventures and other partners to respect the human rights whilst carrying out works. It is essential that the compliance with the implementation principles and legislation concerning the matter are monitored.

5. LEGAL OBLIGATIONS

5.1. Our obligation to inform
While collecting personal data as a data controller:
• The purposes for which your personal data will be processed,
• Our identity and information on our representative, if any,
• Recipients to whom processed personal data may be transferred and the purposes thereof,
• Our method of and legal ground for our collection of data,
• Our obligation to inform the Data Subject regarding his/her rights arising under the law.

5.2. Our obligation regarding data security
As a data controller, we take the administrative and technical measures which are stipulated under the legislation for security of personal data. The obligations and the measures adopted for data security are detailed in Sections 9 and 10.

6. CATEGORIZATION OF PERSONAL DATA

6.1. Personal Data
Personal data are any information relating to an identified or identifiable natural person.
The protection of personal data concerns only natural persons and information which pertain to legal persons and which do not contain any information relating to a natural person are excluded from the protection of personal data. Thus, this Policy will not be applicable to data pertaining to legal persons.

6.2. Special categories of personal data

Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire membership of association, foundation or trade union, health, sexual life, criminal conviction and security measures, and biometrics and genetics are special categories of personal data.
7. PROCESSING OF PERSONAL DATA

7.1. Our principles for processing of personal data

We process personal data according to the following principles:

7.1.1. Being in conformity with the law and principles of good faith

We process personal data in conformity with the principles of good faith, in a transparent manner and pursuant to our obligation to inform.

7.1.2. Being accurate and, if necessary, up to date

We adopt the necessary measures in our data processing procedures in order to ensure that the data which are processed are accurate and up to date. We provide the Data Subject with the opportunity to update his/her data and to correct the errors in the data which are processed, if any.

7.1.3. Being processed for specified, explicit and legitimate purposes

As Mar Yapı, we process personal data within the scope of our specified legitimate interests in order to maintain our activities, the scope and content of which are expressly identified and pursuant to the legislation and the ordinary course of commercial life.

7.1.4. Being relevant, limited and proportionate to the purposes for which personal data are processed

We process personal data in a manner which is relevant, limited and proportionate to the purpose which we have clearly and definitely specified.
We refrain from processing personal data which are not relevant or which are not required to be processed. For this reason, we do not process special categories of personal data unless there is a legal requirement or obtain explicit consent on the matter when we are required to process special categories of personal data.

7.1.5. Being stored only for the time stipulated under the legislation and during our commercial legitimate interests

Many regulations under the legislation require personal data to be stored for a specific period. Therefore, we store personal data which we process for a period which is stipulated under the applicable legislation or which is required for the purposes for which personal data are processed.
If the retention period which is stipulated under the legislation expires or the purposes for which personal data are processed cease to exist, we delete, destroy or anonymize personal data. Our principles and procedures on retention periods are detailed in Article 9.1 of this Policy.

7.2. Method of Collection of Personal Data

Your personal data may be obtained from different channels (such as through offices and other physical environments, call centers, websites, mobile applications and similar electronic trading platforms, social media or other public media from which you may interact with the headquarters, branches, agencies, sales offices and other sub-contractors and business partners of Mar Yapı, your participation to the training, conferences and similar occasions to be organized thereby, through the method of inquiries and via the channels of other group companies and other contracted persons and organizations, in writing, orally, audio and image recordings and other physical and electronic media etc.).
Pursuant to the LPPD, we collect your Personal Data as audio, orally, in writing and electronically through automatic means or otherwise than by automatic means via the following channels and the channels which may be added to these and process them in accordance with Article 5.1, Article 5.2, Article 6.2 and Article 6.3 of the LPPD, depending on the purpose for processing:
via the websites which are referred to in Annex 1 (Mar Yapı and Group Companies) and which include but are not limited thereto and which concern Mar Yapı and brands to be updated within the scope of this policy at various times and where the personal data are processed, primarily the Mar Yapı website and other websites which are administered by Mar Yapı Group Companies (“Websites”), mobile and other applications and cookies belonging to Mar Yapı or third parties as specified below, (“Cookies”) which enable interaction over Mar Yapı’s online media and/or other online media pertaining to Group Companies (“Media Tools”) or with your devices over the Websites,
within the scope of sales and marketing through all sales and marketing network (Mar Yapı Sales Offices) which are set up or operated by Mar Yapı and which are administered under the name of Mar Yapı Brands,
through accounts which are operated for Mar Yapı and Mar Yapı Brands over various social media channels (“Social Media”),
through other methods of communication including correspondences over e-mail addresses (“e-mail”), short messages (“SMS”) and multimedia messages (“MMS”) which are sent for other purposes regarding Mar Yapı and Mar Yapı Brands and all kinds of means of communication (“Means of Communication”),
through our call centers which are operated by Mar Yapı or other companies from which Mar Yapı receives services (“Call Centers”),
through third parties such as group companies to which Mar Yapı renders services or from which Mar Yapı receives services, business partners, manufacturing companies and companies from which services/products are purchased.
The Personal Data which are attained may be collected, processed, transferred and stored for the purposes set forth in Article 7.3 of this text, pursuant to the conditions and purposes of processing of personal data as set forth in Articles 5 and 6 of the LPPD.

7.3. Our purposes for processing personal data

As a rule, we process your Personal Data with your explicit consent. Nevertheless, in exceptional cases which are permitted under the LPPD, your Personal Data may be processed without the attainment of your explicit consent (Art. 5.2 and Art. 6.3 of the LPPD). Within this scope, we process your Personal Data, in order to perform our legal obligations; in case you are unable to give consent due to actual impossibility; for the delivery of the products and services which are ordered or purchased over the Websites; getting into contact, in cases so required, within this scope; carrying out of purchase-sale transactions at Mar Yapı Sales Offices; returns, sale or procurement of products or services, the receipt of your inquiries and complaints; responding to your party; the use thereof in a potential dispute, if so required; the execution and performance of a contract or the fulfillment of our legal obligations or establishment or protection of any rights, provided not to impair your fundamental rights and freedoms as well as for the purposes of the protection of our legitimate interests such as decrease of costs, efficient use of resources and monitoring of the call center service quality. Furthermore, we may process your Personal Data which you make public through the contests in which you participate or means such as Social Media channels, to the extent as permitted under the LPPD, without further seeking your consent again.
As Mar Yapı, we process your personal data for the following purposes upon the attainment of your explicit consent:

• To carry out our activities,
• To provide support service under contract and within the framework of service standards,
• To identify the preferences and needs of our customers/visitors and to shape and update our services within this scope,
• To ensure the fulfillment of our legal obligations, as required and necessitated by legal regulations,
• To conduct studies within the scope of Advertising and Marketing activities,
• To customers with opportunities on special products and services such as such as internet advertising, targeting, re-targeting, cross sales, campaigns, opportunities and product/service advertisements and to use Cookies for these purposes,
• To present commercial offers by taking into account of customer preferences and recent purchases,
• To determine how you heard about our Websites, to create non-anonymized traffic statistics over a single user record,
• To identify customers during customer visit to the Websites and to process them in order to offer content which is suitable to their expectations and areas of interest and a personalized browsing opportunity and to use Cookies for such purposes,
• To track the habits of use according to the previous customer records during visits to Mar Yapı Sales Offices and to offer products exclusive to the customer, to present advertising, campaigns, advantages and other benefits, especially to the customers, for sales and marketing activities and to carry out other marketing and CRM studies, and to use Cookies for such purposes,
• To process personal data for the creation of new product and service models, to use cookies for such purpose,
• To carry out market researches and statistical studies,
• To conduct surveys, contests, promotions and sponsorships,
• To identify product, projects and services which are suitable to our customers, to personalize them for the customer and to develop such, to offer an efficient customer service,
• To notify our Customers, employees, suppliers and business partners of the changes in the legislation and internal policies which concern them and to make other notifications that are of concern to them,
• To send birthday celebrations, to include them in draws and contests, to present gifts and to carry out similar other activities, promotions and campaigns in their favor,
• To provide information via electronic mail, SMS and facsimile, to notify campaigns,
• To send electronic commercial messages (such as campaigns, newsletters, customer satisfaction surveys, product and service advertisements), gifts and promotions and other magazines/periodical publications, corporate communications and to organize events and other parties/receptions and to notify thereof, to send printed bulletins, magazines and other correspondences regarding campaigns,
• To identify visitor profiles, to evaluate requests, demands and complaints,
• To assess job applications,
• To communicate with the persons who are in business relations with the company,
• To conduct compliance management,
• To carry out vendor/supplier management,
• To make legal reporting,
• To undertake invoicing,
• To communicate with our customers for Mar Yapı,
• To administer the switchboard operator processes,
• To generate corporate communications,
• To personalize job postings according to the search criteria and to ensure posting management,
• To present suitable job postings and information on recruitment that have been customized,
• To send bulletins or notices through electronic mail.

7.4. Processing of special categories of personal data

We process special categories of personal data by adopting the administrative and technical measures which are stipulated under the law and which are prescribed by the Board of Protection of Personal Data.
Given that the special categories of personal data relating to the health and sexual life of the Data Subject may be processed by persons who are under the obligation of secrecy and competent bodies and organizations, solely for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and care services, planning and management of healthcare services; we do not process special categories of personal data apart from those pertaining to our employees. Such type of data pertaining to our employees may be processed by persons who are prescribed under the law.

7.5. Processing of personal data for human resources and recruitment purposes

We process, store and transfer your personal data in your resume, diploma etc. and other documents which we share with our party during your applications as an employee candidate, for the purpose of the evaluation of the job application. The processing, transfer and storage of personal data which you share as an employee candidate fall within the scope of this Policy.
The identification and contact information are processed for employment, formation of a resume, contact, business development and information. Social network information, existing social information pertaining to the members and the personal data which are collected over the social network accounts are processed for the conduct and development of operational activities such as business development and marketing and to improve user experience.
Mar Yapı stores the identification, educational and professional information of the candidates in accordance with the applicable legislation and may transfer such information to the managers of the department where the candidates will work.
The deletion, destruction or anonymization of personal data under this platform falls within the scope of Article 9 of this Policy. If the job application process is unsuccessful, the processing of the personal data which are disclosed to the employer and the data security are under the employer’s responsibility.

7.6. Personal data pertaining to the employees

Apart from this Policy, personal data pertaining to the employees are collected, processed and stored pursuant to Mar Yapı Human Resources Policy.

7.7. Processing of job applications over the website of Mar Yapı Turizm İnşaat San. ve Tic. A.Ş.

The details of the candidates who fill in the form in order to apply for jobs over our website are recorded.
The candidates create their resumes by sharing their identification information (name, surname, date of birth, TR ID no), contact details (address, electronic mail address, phone number etc.), Educational information (schools graduated from etc.), Work experiences, Foreign languages, Certificates, References. Depending on the nature of the application made, health data may additionally be requested from the member who creates a resume, in order to assess whether (s)he is eligible for the job in question. Health information which are requested are processed solely for recruitment purposes.

7.8. Exceptional circumstances in which explicit consent is not sought for the processing of personal data -

We may process your personal data without obtaining your explicit consent in the following conditions and exceptional circumstances arising under the law:

• It is expressly permitted by any law;
• It is necessary to process personal data pertaining to the contracting parties provided that processing is directly related to the execution or performance of a contract;
• It is necessary for the institution, exercise or protection of a right;
• It is necessary for our legitimate interests as the data controller, provided that the fundamental rights and freedoms are not impaired.
• The exceptional circumstances in which the special categories of personal data may be processed without the explicit consent of the Data Subject are enumerated in Article 7.3 of this Policy.

8. TRANSFER OF PERSONAL DATA

8.1. Transfer of personal data

As Mar Yapı, we act in compliance with the decisions and regulations which are stipulated under the LPPD and which are adopted by the Board of Protection of Personal Data.
Save for the exceptional circumstances set forth in the legislation, we will not transfer personal data or special categories of personal data to any natural or legal persons, without the explicit consent of the Data Subject.
In the exceptional circumstances which are stipulated under the LPPD and other legislation, data may be transferred to competent administrative and judicial bodies and organizations, in the manner as stipulated in and within the boundaries of the legislation.
Upon the taking of the measures as stipulated by the Board of Protection of Personal Data and the applicable legislation, the special categories of personal data relating to the health and sexual life of the Data Subject may be transferred to the persons who are under the obligation of secrecy and competent bodies and organizations, solely for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and care services, planning and management of healthcare services.

8.3. Bodies and organizations to which personal data are transferred

Personal data may be transferred to the following according to the foregoing principles and rules:

• Our suppliers,
• Business partners and business connections,
• Group companies,
• Legally authorized public bodies and organizations,
• Legally authorized private law persons,
• Our shareholders

8.4. Measures which we have adopted for the transfer of personal data in accordance with the law

As Mar Yapı, we place emphasis on observing all rights of our employees by adopting international declarations, policies, treaties and principles to which Turkey is a party in all our activities, primarily the Human Rights provisions set forth in the Constitution.
The protection of personal data and the observation of fundamental rights and freedoms of the natural persons whose personal data are collected constitute our fundamental principle regarding the processing of personal data. Accordingly, we carry out all of our activities in which personal data are processed, by observing the protection of right of privacy, privacy of communication, freedom of thought and faith and right of exercise of effective remedies.
For the protection of personal data, we take all administrative and technical safeguards which are required by the nature of the relevant data, in compliance with the legislation on the current technologies.
Pursuant to Article 13(1) of the LPPD, you may communicate your request for the exercise of your above rights, to our Company in writing. You may send your request regarding the explanations on your right which you ask to exercise among the rights enumerated in Article 11 of the LPPD by filling in the form at www.maryapi.com.tr, delivering the original signed copy of the form by hand at the address of “Yalçın Koreş Caddesi Bağlar Mahallesi No:44 / B D: 257 G Plus Residence Güneşi Bağcılar - Istanbul” to the attention of Mar Yapı Marketing Department, accompanied by identifying documents or by serving it through the notary public.
Our company reserves the right to make amendments in this privacy policy due to the changes in the LPPD and the methods to be determined by the Board of Protection of Personal Data.

9. COOKIES POLICY

9.1. What are Cookies?
Cookies are small text files which pertain to Mar Yapı or third parties and which are retained on devices with network access through browsers when you visit websites over the internet. As described in this text, Cookies are used on Websites.
9.2. Why Do We Use Cookies?
Depending on your device, we use Cookies in particular for the purposes below:

• To optimize the use and functionality of the Websites by making your visit to the Websites more enjoyable,
• To identify you on your next visit to the Websites and to offer you content which is suitable to your expectations and areas of interest and a personalized browsing opportunity,
• To present you with opportunities on products and services that are exclusive to you such as internet advertising, targeting, re-targeting, cross sales, campaigns, opportunities and product/service advertisements and to make commercial offers by taking into account of your preferences and most recent purchases,
• To create traffic statistics,
• To determine how you heard about the Websites.

9.3. Which Cookies Do We Use?

For further information on the Cookies that are used on this Website, please click here.

9.4. How can You Manage your Cookies Settings on your Internet Browser?

The default settings of your internet browser are generally programmed to accept Cookies, yet you may easily change this by changing the settings of your browser. However, if you choose to disable Cookies on your browser, you may not fully benefit from the functional features which are offered on our Websites.
For further information on the cookies settings, please refer to the following links:

• http://www.aboutcookies.org/
• For Internet Explorer™: http://windows.microsoft.com/en-us/windows7/how-to-manage-cookies-in-int...
• For Safari™: http://support.apple.com/kb/HT1677?viewlocale=en_US
• For Chrome™: https://support.google.com/chrome/answer/95647?hl=en
• For Firefox™: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-...
• For Opera™: http://help.opera.com/Windows/10.20/en/cookies.html

We would like to remind you that by disabling the Cookies on your Internet browser, you would disable all Cookies, including the Cookies which are required for our Websites to function properly.

9.5. Do We Accept Cookies from Third Parties?
The following Cookies from third party websites may be stored on your device in order to personalize and improve the content – including advertising – that may be offered to you during your visit to the Websites:

• Social Network Contents: We may publish contents from social networks on our support pages. Therefore, when you refer to such content on our support pages, a corresponding social network Cookie may be retained on your device. For further information, we recommend that you read the cookies policy of such networks.
• Flash Cookies: Flash Cookies are files that are stored by the Flash software. This tool is often installed as a browser plug-in to view dynamic objects such as graphical animations or video sequences. Accordingly, due to the use of this application, Flash Cookies may be installed. For further information, we recommend that you read the cookies policy on www.adobe.com.

9.6. Do We Place Cookies from Third Parties on Support Pages?

We may place our Cookies on the websites of our business partners that display advertising for our brands and/or our products.
This Cookies are used to present you with content adapted to your areas of interest and to evaluate the duration of your browsing of our content (including advertising).

9.7. Which Cookies are Placed on this Website?

The following Cookies are used on this Website and this chart may be updated from time to time

Status	Name of Cookie	Purpose	Feature	Description
Active	Google Analytics	Attendance and use of the site	Performance	Each visitor is allotted a unique identifier via the utm cookie whereby the same visitor will not be recorded twice.
Active	Doubleclick.net	Evaluation of the advertising impact	Advertising	This cookie is used to understand how Internet users react to advertising campaigns. It allows us to understand and evaluate the clicks on our advertisements to help us improve our offers.
Active	Google Tag Manager	Tags	Functional	It is a code group which enables you to track visitor movements and to determine whether the user behaviors which are based on your preference have materialized or not.
Active	Google Adwords	Evaluation of the advertising impact	Advertising	The advertisements of the users which advertise with Google AdWords are associated with the words searched.
Active	Google Dynamic Remarketing	Attendance and use of the site	Advertising	It shows advertisements to the users who have visited your website or used your mobile application. When people leave your website without buying anything, for example, it helps you reconnect with such users through remarketing or by showing relevant advertisements across different devices.
Active	Facebook Custom Audience	Identification of Target Audiences	Performance	Processing of codes linked to social media for the identification of target audiences.