1. Data Controller

Pursuant to the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR), the data controller is:

Çimen Yatçılık

Website: www.cimenyatcilik.com

1. Personal Data Processed

We may process the following categories of personal data:

• Identity information (name, surname)

• Contact information (phone number, email address)

• Digital behavior data (website visits, click activities, cookie data)

• Technical data (IP address, device and browser information)

• Requests and message contents

1. Methods of Collecting Personal Data

Your personal data may be collected through the following channels:

• Website contact and quotation forms

• Cookies and similar tracking technologies

• Third-party tools such as Google Ads and Google Analytics

• Communications via email and telephone

1. Purposes of Processing Personal Data

Collected personal data is processed for the following purposes:

• Providing services and managing quotation processes

• Communicating with users

• Managing customer relationships

• Conducting advertising and marketing activities

• Analyzing website performance

• Improving user experience

• Fulfilling legal obligations

1. Legal Grounds for Processing

Your personal data is processed based on the following legal grounds:

• Your explicit consent

• Necessity for the establishment or performance of a contract

• Compliance with the legal obligations of the data controller

• Necessity for the legitimate interests pursued by the data controller

1. Transfer of Personal Data

Your personal data may be shared only with the following parties:

• Google Ads (advertising and remarketing services)

• Google Analytics (traffic and user analytics)

• Hosting and infrastructure service providers

• Authorized public institutions and authorities (where legally required)

Data transfers are carried out in compliance with KVKK and GDPR provisions. Due to the use of services such as Google Ads and Google Analytics, personal data may be transferred abroad, and such transfers are conducted in accordance with GDPR standards.

1. Data Retention Period

Your personal data will be retained:

• For as long as necessary to fulfill the purposes of processing

• Within the retention periods prescribed by applicable legislation

At the end of the relevant retention period, personal data will be deleted, destroyed, or anonymized in accordance with applicable legal requirements.

1. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• SSL and data encryption technologies

• Role-based access controls

• System security measures and regular updates

1. Rights of Data Subjects

Under Article 11 of KVKK and the GDPR, data subjects have the right to:

• Learn whether their personal data is being processed

• Access their processed personal data

• Request correction of inaccurate or incomplete data

• Request deletion or destruction of personal data

• Object to the processing of personal data

• Request data portability (under GDPR)

1. Applications and Contact

You may submit any requests regarding your personal data through our contact channels.

Contact

Your requests will be reviewed and responded to within a maximum period of 30 days.