Privacy Policy

At SU Yachts Tourism and Trade Limited Company ("Company", "We", "SU Yachts"), we take the utmost care regarding the security and privacy of your personal data. This Privacy Policy explains how we collect, process, protect, and your rights regarding your personal data as a data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. DEFINITIONS

Personal Data	Any information relating to an identified or identifiable natural person.
Sensitive Personal Data	Race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance, association/foundation/union membership, health, sexual life, criminal conviction, biometric and genetic data.
Data Subject	The natural person whose personal data is processed (you).
Data Controller	The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system (SU Yachts).
Data Processor	The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.
Explicit Consent	Consent that is specific to a particular matter, based on information, and expressed with free will.

2. PERSONAL DATA WE COLLECT

2.1. Identity Information

• Name, surname
• Turkish ID number (if invoice is requested)
• Passport number (for foreign guests)

2.2. Contact Information

• Phone number
• Email address
• Address information (for invoice)

2.3. Financial Information

• Bank account information (for wire transfers)
• Credit card information (only during payment processing, not stored)
• Invoice information

2.4. Reservation Information

• Reservation date and time
• Selected yacht and services
• Number of guests
• Special requests (diet, allergy, celebration info, etc.)
• Departure and arrival points

2.5. Technical Information

• IP address
• Browser type and version
• Operating system
• Device information
• Cookie data
• Pages visited and click data

2.6. Visual and Audio Data

• Photos taken during the tour (for marketing purposes)
• Security camera recordings (if applicable)

3. PURPOSES OF PERSONAL DATA PROCESSING

Your personal data is processed for the following purposes:

3.1. Service Delivery

• Receiving and managing yacht rental reservations
• Planning tour organization
• Coordinating additional services (catering, DJ, etc.)
• Meeting customer requests

3.2. Contract Performance

• Establishing and performing the reservation contract
• Processing payments
• Issuing invoices
• Processing cancellation and change requests

3.3. Communication

• Reservation confirmation and reminders
• Tour details and notifications
• Customer service
• Evaluation of complaints and suggestions

3.4. Marketing (With Explicit Consent)

• Campaign and promotion notifications
• New service announcements
• Special occasion greetings
• Satisfaction surveys

3.5. Legal Obligations

• Invoicing and record keeping under tax legislation
• Responding to official authority requests
• Audit and compliance processes

3.6. Security and Improvement

• Ensuring website security
• Preventing fraud and misuse
• Improving service quality
• Statistical analysis

4. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed under Article 5 of KVKK based on the following legal grounds:

Legal Ground	Example Processing Purpose
Contract establishment or performance (Art. 5/2-c)	Reservation transactions, service delivery, payment
Explicitly provided by law (Art. 5/2-a)	Invoicing under tax laws
Legal obligation (Art. 5/2-ç)	Responding to official authority requests
Legitimate interest (Art. 5/2-f)	Service improvement, fraud prevention
Explicit consent (Art. 5/1)	Marketing communication, photo sharing

5. TRANSFER OF PERSONAL DATA

5.1. Domestic Transfer

Your personal data may be transferred to the following parties for service delivery and our legal obligations:

• Business partners: Partner yacht companies, catering companies, DJ service providers
• Payment service providers: Banks and payment institutions (Iyzico, etc.)
• Legal authorities: Courts, enforcement offices, tax offices
• Regulatory bodies: KVKK, relevant ministries
• Technical service providers: Hosting, email, SMS services

5.2. International Transfer

Your personal data may be transferred abroad in the following situations:

• Cloud service providers (with servers located abroad)
• International payment systems
• Analytics and marketing tools (Google Analytics, Meta, etc.)

International transfers are made under Article 9 of KVKK, to countries with adequate protection or where the data controller commits to adequate protection.

6. RETENTION PERIOD OF PERSONAL DATA

Data Type	Retention Period
Reservation records	10 years (Turkish Commercial Code)
Invoice and payment information	10 years (Tax Procedure Law)
Communication records	3 years (statute of limitations)
Marketing consents	Until consent is withdrawn
Cookie data	According to cookie type (see Cookie Policy)
Website log records	2 years (Law No. 5651)

After the retention period expires, your personal data is deleted, destroyed, or anonymized under Article 7 of KVKK.

7. COOKIE POLICY

7.1. What Are Cookies?

Cookies are small text files placed on your device through your browser when you visit our website. Cookies help us understand how you use the site and improve your experience.

7.2. Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Necessary for basic website functions (session management, security)	Session
Functional Cookies	Remember your preferences such as language, location	1 year
Analytics Cookies	Visitor statistics, site performance analysis (Google Analytics)	2 years
Marketing Cookies	Personalized ads, remarketing (Meta Pixel, Google Ads)	90 days - 2 years

7.3. Cookie Management

You can manage or delete cookies from your browser settings:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Note: Disabling essential cookies may prevent the website from functioning properly.

8. SECURITY OF PERSONAL DATA

We implement the following technical and administrative measures to ensure the security of your personal data:

8.1. Technical Measures

• SSL/TLS encryption (256-bit)
• Firewall protection
• Regular security updates
• Access control and authorization systems
• Data backup and disaster recovery plans
• Penetration testing and security audits

8.2. Administrative Measures

• Employee confidentiality agreements
• Data processing policies and procedures
• Staff training
• Access authorization limitation (need-to-know principle)
• Data processor agreements
• Regular internal audits

8.3. Data Breach Notification

In case of a personal data breach, under Article 12 of KVKK:

• The Personal Data Protection Board is notified within 72 hours.
• Data subjects are informed as soon as possible.
• Necessary measures are taken to mitigate the effects of the breach.

9. DATA SUBJECT RIGHTS

Under Article 11 of KVKK, you have the following rights:

10. APPLICATION METHOD

To exercise your rights above, you can apply through one of the following methods:

Application Method	Address/Information
Written Application	SU Yachts Tourism and Trade Ltd. Istanbul, Turkey
Email	kvkk@suyachts.com (Registered Email: KEP address if available)
Via Notary	Through notary to the above address

10.1. Application Content

Your application must include the following information:

• Name, surname, and signature (for written applications)
• Turkish ID number (passport number for foreigners)
• Address or email address for notification
• Subject of request

10.2. Application Evaluation Period

Your applications are processed free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. If the process requires additional cost, the fee determined by the Personal Data Protection Board may be charged.

10.3. Right to Complain to the Board

If your application is rejected, the response is found insufficient, or no response is given within the period, you may file a complaint with the Personal Data Protection Board:

Web: www.kvkk.gov.tr

11. COMMERCIAL ELECTRONIC MESSAGES

11.1. Marketing Consent

Your explicit consent is obtained for sending commercial electronic messages (email, SMS). Marketing messages include:

• Campaign and discount announcements
• New service introductions
• Special occasion greetings
• Satisfaction surveys

11.2. Withdrawing Consent

To opt out of marketing messages:

• Click the "Unsubscribe" link in emails
• Follow the instructions in SMS
• Send an email to kvkk@suyachts.com

12. CHILDREN'S PRIVACY

Our website and services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from individuals under 18. Parents or guardians should contact us if they notice that personal data of a minor has been processed.

13. THIRD-PARTY LINKS

Our website may contain links to third-party websites (social media platforms, payment providers, etc.). We are not responsible for the privacy practices of these sites. We recommend reviewing their privacy policies before visiting third-party sites.

14. POLICY CHANGES

We may update this Privacy Policy from time to time. When significant changes are made:

• An announcement is published on the website
• Email notification may be sent
• "Last updated" date is changed

We recommend checking for changes regularly.

15. CONTACT

For questions about the Privacy Policy:

---

Last updated: January 2026