PRIVACY AND PERSONAL DATA PROTECTION PRINCIPLES

PURPOSE AND SCOPE

These Privacy and Personal Data Protection Principles (hereinafter referred to as the "Principles") determine the principles adopted by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (hereinafter referred to as the "Company") regarding the protection of personal data and aim to inform all relevant groups of individuals within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as "Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR").

PRINCIPLES REGARDING THE PROCESSING OF YOUR PERSONAL DATA

As the Company, in our capacity as Data Controller, we process your personal data within the framework of the following principles:

Lawful and Fair Processing

In processing your personal data, we act in accordance with the principles introduced by legal regulations and the rules of general trust and fairness. In accordance with this principle, we take into account your interests and reasonable expectations while trying to achieve our personal data processing purposes, do not abuse our rights, and act in accordance with the principle of transparency in our data processing activities.

Ensuring Personal Data is Accurate and Up-to-Date When Necessary

In line with this principle, which emphasizes the importance of the accuracy and currency of personal data, periodic checks and updates are made to ensure that the processed data is accurate and current, taking into account your legitimate interests, and necessary measures are taken accordingly. In this context, systems are being established within the Company to check the accuracy of personal data and make necessary corrections. Additionally, the accuracy of the sources from which personal data is collected is checked, and requests arising from inaccurate personal data are taken into consideration. Therefore, this principle is applied in accordance with your right to request the correction of your personal data under Law No. 6698.

Processing for Specific, Clear, and Legitimate Purposes

Your personal data is processed based on clear, specific, and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by the relevant persons, and we determine and clearly express the purposes and legal processing conditions on which they are based in Article 3 of these Principles.

Being Relevant, Limited, and Proportionate to the Purpose for Which They Are Processed

Your personal data is processed in a proportionate, relevant, and limited manner to achieve the intended purpose(s), and we avoid processing personal data that is not related to or unnecessary for achieving the purpose. Also within the scope of this principle, personal data is not collected or processed for purposes that do not currently exist and are thought to be realized later.

Retention for the Period Required by Relevant Legislation or for the Purpose for Which They Are Processed

Your personal data is only retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which it is processed. In this regard, the Company takes and implements the relevant administrative and technical measures. In this context, first, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data; if a period is determined, this period is complied with; if no period is determined, personal data is stored for as long as necessary for the purpose for which it is processed. When the necessity of the relevant processes ceases, access to your personal data by irrelevant departments is prevented within the scope of the deletion action specified in Law No. 6698. Upon expiration of the period or cessation of the reasons requiring processing, in the absence of a legal reason allowing longer processing, your personal data is destroyed or anonymized in accordance with personal data protection legislation.

CONDITIONS FOR PROCESSING YOUR PERSONAL DATA

Your personal data, including your personal and special categories of personal data within the scope of Law No. 6698, can be processed within the framework of the conditions stipulated below:

Explicit Provision in Laws

The basic rule is that personal data cannot be processed without the explicit consent of the relevant persons; according to this exception, your personal data may be processed in cases where personal data processing is explicitly stipulated in laws.

Impossibility of Obtaining the Explicit Consent of the Data Subject Due to Factual Impossibility

In cases where it is necessary to process the personal data of the data subject who is unable to express consent due to factual impossibility or whose consent cannot be considered valid, in order to protect the life or physical integrity of the data subject or another person, your personal data may be processed.

Direct Relevance to the Establishment or Performance of a Contract

Your personal data may be processed if processing personal data belonging to the parties to the contract is necessary, provided that it is directly related to the establishment or performance of the contract.

Fulfillment of the Company's Legal Obligation

Your personal data may be processed if processing is mandatory for the Company to fulfill its legal obligations under the legislation, contracts, and similar legal obligations to which it is bound and for which it is responsible.

Disclosure of Personal Data by the Data Subject

If your personal data has been disclosed by you, that is, shared with the public by you, it may be processed in a manner relevant and proportionate to the purpose of disclosure.

Necessity of Data Processing for the Establishment or Protection of a Right

Your personal data may be processed if data processing is necessary for the establishment, exercise, or protection of the right within the scope of conducting and managing processes related to the Company's legal and commercial rights.

Processing of Data Based on Legitimate Interest

Your personal data may be processed if data processing is necessary for the legitimate interests of the Company. When our Company needs to process data based on this processing condition, it makes an assessment taking into account your fundamental rights and freedoms and makes a decision based on the results of the assessment.

Processing Based on Explicit Consent

Although processing personal data based on explicit consent is the main rule, in the presence of other conditions specified in this article, the explicit consent of the data subjects is not relied upon. Otherwise, abuse of rights may be mentioned. In this context, your personal data is processed based on your explicit consent in cases where it is not processed based on any of the conditions specified in these Principles.

Processing of Special Categories of Personal Data

Special categories of personal data are processed only under the following conditions in accordance with Article 6 of Law No. 6698: a) Having the explicit consent of the data subject, b) Explicit provision in laws, c) Being necessary for the protection of the life or physical integrity of the person who is unable to express consent due to factual impossibility or whose consent is not legally recognized, or another person, d) Relating to personal data disclosed by the data subject and in accordance with the intention to disclose, e) Being necessary for the establishment, exercise, or protection of a right, f) Being necessary for persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of health services, g) Being mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, h) Being directed towards current or former members and affiliates of foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or union purposes, or persons who are in regular contact with these organizations and formations, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their field of activity, and not disclosed to third parties.

TRANSFER OF PERSONAL DATA

Your personal and special categories of data may be transferred to our domestic business partners, public institutions and organizations and similar entities, or to our foreign business partners within the scope of Article 2 of these Principles. When making such transfers, compliance with Articles 8 and 9 of Law No. 6698 is observed. If necessary, your explicit consent is obtained and the transfer is provided within this framework.

SECURITY OF PERSONAL DATA

The Company takes all reasonable administrative and technical measures to ensure the security of personal data, to prevent unlawful processing, to prevent the risks of unauthorized access, accidental data loss, intentional deletion of data, or damage to data.

All reasonable technical and physical measures are taken to prevent access to personal data by persons other than those authorized to access it. In this context, the authorization system is designed in such a way that persons and systems cannot access more personal data than necessary.

The Company conducts and has conducted the necessary audits to ensure the implementation of the provisions of Law No. 6698 in its own institution or organization.

The measures taken are as follows:

Network security and application security are ensured.
Closed system networks are used for personal data transfers via networks.
Security measures are taken within the scope of procurement, development, and maintenance of information technology systems.
Disciplinary regulations containing data security provisions exist for employees.
Training and awareness studies on data security are conducted for employees at regular intervals.
An authorization matrix has been created for employees.
Corporate policies have been prepared and implemented on access, information security, use, storage, and destruction.
Confidentiality undertakings are made.
The authorities of employees who change positions or leave their jobs in this area are revoked.
Signed contracts contain data security provisions.
Extra security measures are taken for personal data transferred via paper, and the relevant documents are sent in a confidential document format.
Personal data security policies and procedures have been determined.
Personal data security issues are reported quickly.
Personal data security is monitored.
Necessary security measures are taken regarding the entry and exit of physical environments containing personal data.
The security of environments containing personal data is ensured.
Personal data is minimized as much as possible.
User account management and authority control systems are applied and monitored.
Periodic and/or random audits are conducted and commissioned within the institution.
Current risks and threats have been identified.
Protocols and procedures for the security of special categories of personal data have been determined and implemented.
Cyber security measures have been taken and their implementation is continuously monitored.
Special categories of personal data transferred on portable memory, CD, DVD media are transferred encrypted.
Data processing service providers are audited at regular intervals regarding data security.
Awareness of data processing service providers on data security is ensured.

RIGHTS OF THE DATA SUBJECT

Rights Regarding Personal Data Under Law No. 6698

The rights that groups of persons can exercise regarding their personal data are included in Article 11 of Law No. 6698 and are as follows:

Learning whether personal data is processed,
Requesting information about it if personal data has been processed,
Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
Knowing the third parties to whom personal data is transferred domestically or abroad,
Requesting the correction of personal data if it has been processed incompletely or incorrectly,
Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the GDPR and requesting that the operations performed in accordance with these provisions be notified to third parties to whom personal data has been transferred,
Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
Requesting compensation for damages if damaged due to the unlawful processing of personal data.

Rights Regarding Personal Data Under GDPR

The rights that groups of persons can exercise regarding their personal data are included in Chapter 3 of GDPR (Articles 12-23) and are listed below:

Withdrawing consent if your personal data is processed based on your explicit consent;
Requesting the restriction of the processing of your personal data in the following cases;
For a period during which we can verify the accuracy if the accuracy of your personal data has been objected to by you,
If data processing is unlawful but you prefer to restrict the use of your data rather than delete it,
If the processing of your personal data is no longer necessary for the relevant data processing purpose but is necessary for the establishment, application, or presentation of your legal claims or demands, or
During the examination of whether the objection is invalid due to our interests following your right of objection exercised in accordance with Article 21 of GDPR;
Objecting to the processing of your personal data, including profiling applications, if your personal data is processed based on the public interest or the authority given to the data controller by law or the legitimate interest of the data controller or a third party;
Accessing the following information;
Confirming that personal data about you is being processed and, in this case, your relevant personal data and the purposes and categories of data processing,
Data recipients or their categories with whom your personal data is shared or will be shared, if possible, the period for which your personal data will be stored, if this is not possible, the criteria used to determine this period,
The existence of the right to request the restriction, deletion, or destruction of the processing of personal data, to object to the processing of personal data, and to apply to the supervisory authority, and
Information that personal data was obtained from the data subject or a third party, and
Accessing information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for you;
If your personal data is processed based on your explicit consent or a contract provision and data processing is carried out through automated mechanisms, transferring the version of your data in a regular, usable, and machine-readable format to you or, if technically reasonable, to another data controller;
You have the right to obtain information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for the data subject.

APPLICATION PROCEDURE AND PRINCIPLES

As a data subject, if you have a request regarding your rights related to your personal data, you can send it to us by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our website, or by your application that meets the minimum conditions stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the following methods. As the Company, we will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company. Upon your application to us, you can inform us if your application is rejected, if the response is found insufficient, or if the application is not answered in time. Additionally, as a data subject, you have the right to apply to the competent data protection authority in your country within thirty days from the date you learn of our response and in any case within sixty days from the date you make your proper application.

PRIVACY AND PERSONAL DATA PROTECTION PRINCIPLES

PURPOSE AND SCOPE

These Privacy and Personal Data Protection Principles (hereinafter referred to as the "Principles") determine the principles adopted by INFINIA TURİZM TİCARET ANONİM ŞİRKETİ (hereinafter referred to as the "Company") regarding the protection of personal data and aim to inform all relevant groups of individuals within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as "Law No. 6698") and, if you are a citizen of the European Union, the European Union General Data Protection Regulation No. 2016/679 ("GDPR").

PRINCIPLES REGARDING THE PROCESSING OF YOUR PERSONAL DATA

As the Company, in our capacity as Data Controller, we process your personal data within the framework of the following principles:

Lawful and Fair Processing

In processing your personal data, we act in accordance with the principles introduced by legal regulations and the rules of general trust and fairness. In accordance with this principle, we take into account your interests and reasonable expectations while trying to achieve our personal data processing purposes, do not abuse our rights, and act in accordance with the principle of transparency in our data processing activities.

Ensuring Personal Data is Accurate and Up-to-Date When Necessary

In line with this principle, which emphasizes the importance of the accuracy and currency of personal data, periodic checks and updates are made to ensure that the processed data is accurate and current, taking into account your legitimate interests, and necessary measures are taken accordingly. In this context, systems are being established within the Company to check the accuracy of personal data and make necessary corrections. Additionally, the accuracy of the sources from which personal data is collected is checked, and requests arising from inaccurate personal data are taken into consideration. Therefore, this principle is applied in accordance with your right to request the correction of your personal data under Law No. 6698.

Processing for Specific, Clear, and Legitimate Purposes

Your personal data is processed based on clear, specific, and legitimate data processing purposes. In this context, we ensure that our personal data processing activities are clearly understandable by the relevant persons, and we determine and clearly express the purposes and legal processing conditions on which they are based in Article 3 of these Principles.

Being Relevant, Limited, and Proportionate to the Purpose for Which They Are Processed

Your personal data is processed in a proportionate, relevant, and limited manner to achieve the intended purpose(s), and we avoid processing personal data that is not related to or unnecessary for achieving the purpose. Also within the scope of this principle, personal data is not collected or processed for purposes that do not currently exist and are thought to be realized later.

Retention for the Period Required by Relevant Legislation or for the Purpose for Which They Are Processed

Your personal data is only retained for the period stipulated in the relevant legislation or for the period necessary for the purpose for which it is processed. In this regard, the Company takes and implements the relevant administrative and technical measures. In this context, first, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data; if a period is determined, this period is complied with; if no period is determined, personal data is stored for as long as necessary for the purpose for which it is processed. When the necessity of the relevant processes ceases, access to your personal data by irrelevant departments is prevented within the scope of the deletion action specified in Law No. 6698. Upon expiration of the period or cessation of the reasons requiring processing, in the absence of a legal reason allowing longer processing, your personal data is destroyed or anonymized in accordance with personal data protection legislation.

CONDITIONS FOR PROCESSING YOUR PERSONAL DATA

Your personal data, including your personal and special categories of personal data within the scope of Law No. 6698, can be processed within the framework of the conditions stipulated below:

Explicit Provision in Laws

The basic rule is that personal data cannot be processed without the explicit consent of the relevant persons; according to this exception, your personal data may be processed in cases where personal data processing is explicitly stipulated in laws.

Impossibility of Obtaining the Explicit Consent of the Data Subject Due to Factual Impossibility

In cases where it is necessary to process the personal data of the data subject who is unable to express consent due to factual impossibility or whose consent cannot be considered valid, in order to protect the life or physical integrity of the data subject or another person, your personal data may be processed.

Direct Relevance to the Establishment or Performance of a Contract

Your personal data may be processed if processing personal data belonging to the parties to the contract is necessary, provided that it is directly related to the establishment or performance of the contract.

Fulfillment of the Company's Legal Obligation

Your personal data may be processed if processing is mandatory for the Company to fulfill its legal obligations under the legislation, contracts, and similar legal obligations to which it is bound and for which it is responsible.

Disclosure of Personal Data by the Data Subject

If your personal data has been disclosed by you, that is, shared with the public by you, it may be processed in a manner relevant and proportionate to the purpose of disclosure.

Necessity of Data Processing for the Establishment or Protection of a Right

Your personal data may be processed if data processing is necessary for the establishment, exercise, or protection of the right within the scope of conducting and managing processes related to the Company's legal and commercial rights.

Processing of Data Based on Legitimate Interest

Your personal data may be processed if data processing is necessary for the legitimate interests of the Company. When our Company needs to process data based on this processing condition, it makes an assessment taking into account your fundamental rights and freedoms and makes a decision based on the results of the assessment.

Processing Based on Explicit Consent

Although processing personal data based on explicit consent is the main rule, in the presence of other conditions specified in this article, the explicit consent of the data subjects is not relied upon. Otherwise, abuse of rights may be mentioned. In this context, your personal data is processed based on your explicit consent in cases where it is not processed based on any of the conditions specified in these Principles.

Processing of Special Categories of Personal Data

Special categories of personal data are processed only under the following conditions in accordance with Article 6 of Law No. 6698: a) Having the explicit consent of the data subject, b) Explicit provision in laws, c) Being necessary for the protection of the life or physical integrity of the person who is unable to express consent due to factual impossibility or whose consent is not legally recognized, or another person, d) Relating to personal data disclosed by the data subject and in accordance with the intention to disclose, e) Being necessary for the establishment, exercise, or protection of a right, f) Being necessary for persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of health services, g) Being mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, h) Being directed towards current or former members and affiliates of foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or union purposes, or persons who are in regular contact with these organizations and formations, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their field of activity, and not disclosed to third parties.

TRANSFER OF PERSONAL DATA

Your personal and special categories of data may be transferred to our domestic business partners, public institutions and organizations and similar entities, or to our foreign business partners within the scope of Article 2 of these Principles. When making such transfers, compliance with Articles 8 and 9 of Law No. 6698 is observed. If necessary, your explicit consent is obtained and the transfer is provided within this framework.

SECURITY OF PERSONAL DATA

The Company takes all reasonable administrative and technical measures to ensure the security of personal data, to prevent unlawful processing, to prevent the risks of unauthorized access, accidental data loss, intentional deletion of data, or damage to data.

All reasonable technical and physical measures are taken to prevent access to personal data by persons other than those authorized to access it. In this context, the authorization system is designed in such a way that persons and systems cannot access more personal data than necessary.

The Company conducts and has conducted the necessary audits to ensure the implementation of the provisions of Law No. 6698 in its own institution or organization.

The measures taken are as follows:

Network security and application security are ensured.
Closed system networks are used for personal data transfers via networks.
Security measures are taken within the scope of procurement, development, and maintenance of information technology systems.
Disciplinary regulations containing data security provisions exist for employees.
Training and awareness studies on data security are conducted for employees at regular intervals.
An authorization matrix has been created for employees.
Corporate policies have been prepared and implemented on access, information security, use, storage, and destruction.
Confidentiality undertakings are made.
The authorities of employees who change positions or leave their jobs in this area are revoked.
Signed contracts contain data security provisions.
Extra security measures are taken for personal data transferred via paper, and the relevant documents are sent in a confidential document format.
Personal data security policies and procedures have been determined.
Personal data security issues are reported quickly.
Personal data security is monitored.
Necessary security measures are taken regarding the entry and exit of physical environments containing personal data.
The security of environments containing personal data is ensured.
Personal data is minimized as much as possible.
User account management and authority control systems are applied and monitored.
Periodic and/or random audits are conducted and commissioned within the institution.
Current risks and threats have been identified.
Protocols and procedures for the security of special categories of personal data have been determined and implemented.
Cyber security measures have been taken and their implementation is continuously monitored.
Special categories of personal data transferred on portable memory, CD, DVD media are transferred encrypted.
Data processing service providers are audited at regular intervals regarding data security.
Awareness of data processing service providers on data security is ensured.

RIGHTS OF THE DATA SUBJECT

Rights Regarding Personal Data Under Law No. 6698

The rights that groups of persons can exercise regarding their personal data are included in Article 11 of Law No. 6698 and are as follows:

Learning whether personal data is processed,
Requesting information about it if personal data has been processed,
Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
Knowing the third parties to whom personal data is transferred domestically or abroad,
Requesting the correction of personal data if it has been processed incompletely or incorrectly,
Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the GDPR and requesting that the operations performed in accordance with these provisions be notified to third parties to whom personal data has been transferred,
Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
Requesting compensation for damages if damaged due to the unlawful processing of personal data.

Rights Regarding Personal Data Under GDPR

The rights that groups of persons can exercise regarding their personal data are included in Chapter 3 of GDPR (Articles 12-23) and are listed below:

Withdrawing consent if your personal data is processed based on your explicit consent;
Requesting the restriction of the processing of your personal data in the following cases;
For a period during which we can verify the accuracy if the accuracy of your personal data has been objected to by you,
If data processing is unlawful but you prefer to restrict the use of your data rather than delete it,
If the processing of your personal data is no longer necessary for the relevant data processing purpose but is necessary for the establishment, application, or presentation of your legal claims or demands, or
During the examination of whether the objection is invalid due to our interests following your right of objection exercised in accordance with Article 21 of GDPR;
Objecting to the processing of your personal data, including profiling applications, if your personal data is processed based on the public interest or the authority given to the data controller by law or the legitimate interest of the data controller or a third party;
Accessing the following information;
Confirming that personal data about you is being processed and, in this case, your relevant personal data and the purposes and categories of data processing,
Data recipients or their categories with whom your personal data is shared or will be shared, if possible, the period for which your personal data will be stored, if this is not possible, the criteria used to determine this period,
The existence of the right to request the restriction, deletion, or destruction of the processing of personal data, to object to the processing of personal data, and to apply to the supervisory authority, and
Information that personal data was obtained from the data subject or a third party, and
Accessing information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for you;
If your personal data is processed based on your explicit consent or a contract provision and data processing is carried out through automated mechanisms, transferring the version of your data in a regular, usable, and machine-readable format to you or, if technically reasonable, to another data controller;
You have the right to obtain information about the existence of automated decision-making mechanisms we use, including profiling, and the logic behind them and the possible consequences and significance of this for the data subject.

APPLICATION PROCEDURE AND PRINCIPLES

As a data subject, if you have a request regarding your rights related to your personal data, you can send it to us by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our website, or by your application that meets the minimum conditions stipulated by the Communiqué on the Procedures and Principles of Application to the Data Controller, using the following methods. As the Company, we will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company. Upon your application to us, you can inform us if your application is rejected, if the response is found insufficient, or if the application is not answered in time. Additionally, as a data subject, you have the right to apply to the competent data protection authority in your country within thirty days from the date you learn of our response and in any case within sixty days from the date you make your proper application.

Application Procedure	Application Address
Electronic message you will send via KEP	infiniaturizmticaret@hs01.kep.tr
The message you send will be sent via the email address registered in our system or with a secure electronic signature or mobile signature	dataprivacy@infiniavacationclub.com
Application that you submit in writing, either in person or through a notary public	Fabrikalar Mah. Namık Kemal Blv. DalgakulePlaza / 51 B/28

8. Effectiveness and Updatability

This Information Policy entered into force on the date of its publication. The Policy is updated to adapt to changing conditions and legislation. Updated in light of current Board decisions and requirements, the Policy is monitored by the Company and published on its website.

8. Effectiveness and Updatability

This Information Policy entered into force on the date of its publication. The Policy is updated to adapt to changing conditions and legislation. Updated in light of current Board decisions and requirements, the Policy is monitored by the Company and published on its website.

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul

Rixos Tersane Istanbul