As Rizom Beach Hotel, we want to offer our guests superior products and services. We attach great importance to our guests, their loyalty and privacy. "Rizom Beach Hotel Privacy Statement" has been prepared to provide information on how we use the personal information we collect from you or about you, either through this site or through your written and verbal communications with us. Our company requests some of your personal information (name, e-mail, etc.) from you via forms in order to provide better service to you, users. It is used only within our company (in the "categorization" studies of the member profile for the construction of promotional activities and the transmission of unsolicited e-mails). Sharing this information with us, being included in the mailing list, will be at your request and consent. Your e-mail address must be a valid postal address for all of these transactions and for us to communicate with you. The information we collect is kept reliably in our company's database. All rights of the website www.rizombeach.com (hereinafter referred to as the "Website") belong to "SAFİR THERMAL TURİZM INS". PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş.” It belongs to SAFİR THERMAL TOURISM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. , will not disclose to third parties the personal information transmitted to it electronically by the users through the Website, except for the purposes and scope determined by the human resources department, the contracts it has made with its members and customers, or this Privacy Policy, as required by the recruitment procedure. Personal information to be collected within the scope of Human Resources studies will only be provided by SAFİR THERMAL TURİZM İNŞ. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. will be used and stored. SAFİR THERMAL TURİZM İNŞ. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. It is presumed that the personal information it conveys to . SAFİR THERMAL TURİZM İNŞ. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. cannot be held responsible. SAFİR THERMAL TOURISM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. information collected on their computers; Only SAFİR THERMAL TURİZM İNŞ. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. used within. If the Client/Applicant does not want to be informed about the promotions and notification e-mails in question, they can stop this activity at any time by sending an e-mail to ik@rizombeach.com and/or info@rizombeach.com. Personal information can also be used to contact the user when necessary. SAFİR THERMAL TOURISM INS. ÖZEL EĞİTİM GIDA SAN.VE TİC.A.Ş. may provide links to other sites within its Web Site. SAFİR THERMAL TOURISM INS. ÖZEL EĞİTİM GIDA SAN.VE TİC.A.Ş. does not bear any responsibility for the privacy practices and contents of the site accessed via the link. SAFİR THERMAL TOURISM INS. ÖZEL EĞİTİM GIDA SAN.VE TİC.A.Ş. will not disclose the information of users to companies and third parties with which it is not in cooperation, unless otherwise stated in this Privacy Policy and in the limited cases specified below. These situations are; a. Law, Decree Law, Regulation etc. enacted and in force by authorized legal authorities. complying with the obligations imposed by the rules of law; b. SAFİR THERMAL TOURISM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. Fulfilling the requirements of the contracts made with customers and putting them into practice; c. Requesting information about users for the purpose of conducting a duly conducted investigation or investigation by authorized administrative or judicial authorities; D. It is the cases where information is given to protect the rights or security of the users. SAFİR THERMAL TOURISM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. , to keep personal information strictly private and confidential, to consider it a confidentiality obligation, and to take all necessary measures and take all necessary care to ensure and maintain confidentiality, prevent all or any part of confidential information from entering the public domain or unauthorized use or disclosure to a third party. commits. SAFİR THERMAL TOURISM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. Despite taking the necessary information security measures, in case confidential information is damaged or in the hands of third parties as a result of attacks on the Web Site and the system, SAFİR THERMAL TURİZM INS. PRIVATE EDUCATION GIDA SAN.VE TİC.A.Ş. will not have any liability. SAFİR THERMAL TOURISM INS. SPECIAL EDUCATION FOOD IND.VE

As Rizom Beach Hotel, we are aware of the importance of personal data of our valued guests; Therefore, we take high security measures to protect your personal data from unauthorized access. In order to protect your fundamental rights and freedoms, especially the privacy of your private life, the Law on the Protection of Personal Data No. 6698 and the secondary regulations enacted in accordance with this law, the Law on Identification No. 1774, the Tax Procedure Law No. 213, the Turkish Commercial Code No. 6102 and We process your personal data as explained below within the limits ordered by other relevant legislation. The identity of the data controller; In accordance with the Law on Protection of Personal Data No. 6698, Turkuaz Turizm has the title of "data controller". Within the scope of the "Information Obligation of the Data Controller" in article 10 of KVKK and "Rights of the Related Person" in article 11 of the KVKK; Regarding the purpose for which your personal data will be processed, to whom and for what purpose your processed personal data can be transferred, the method and legal reason for the collection of your personal data, and your rights, as "Turkuaz Turizm" data controller, we are in contact with our guests, visitors, business partners and real or legal persons with whom we communicate. We would like to inform you with this "Clarification and Consent Text on the Protection of Personal Data", which has been prepared with the aim of fulfilling our obligation to inform. Our Institution reserves the right to revise this "Clarification and Consent Text on the Protection of Personal Data" at any time within the framework of the changes that may occur in the current legislation. Your personal data we process; Your identity information (such as name, surname, TR identity number), contact information (such as e-mail address, telephone number), location information (such as address), Information about your children (such as age – date of birth), financial information (information about your payment transactions), Your wishes, complaints or comments while staying at our hotels or after your stay. We can obtain name, surname, nationality information and date of birth information from you in accordance with the limited number principle regarding minors under the age of 18 with you. The moments of collection of your personal data; Your personal data; are collected in all kinds of verbal, written or electronic media. During hotel activities; Realizing the room reservation process, establishing dialogues with tour operators and travel agencies, your stages of checking in and making payments to the hotel, reporting your requests and complaints, filling out customer satisfaction and survey forms, participating in training, seminars or organizations organized by the hotel for any purpose, and using our internet website. Your personal data may be collected during your visit. Method of collection of personal data and legal reason Your personal data can be processed in the following cases, which are included in Article 5 of the Personal Data Protection Law No. 6698; 1. Having express consent, 2. It is clearly stipulated in the laws. 3. It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized. 4. It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract. 5. It is mandatory for the data controller to fulfill its legal obligation. 6. Being made public by the person concerned. 7. Data processing is mandatory for the establishment, exercise or protection of a right. 8. Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Your health data, which is in the category of special personal data, can be processed depending on the fulfillment of the conditions in Article 6 of the Personal Data Protection Law No. 6698 or your express consent. Processing of your personal data of special nature Special categories of personal data are data that can lead to victimization in case of disclosure. Data regarding race, ethnicity, political thought, philosophical belief, religious sect or other beliefs, disguise and dress, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data of these persons are of special nature. is personal data. As a rule, sensitive personal data can only be processed with the consent of the person concerned. Your personal data, as stated in Article 6 of the Personal Data Protection Law No. 6698, Personal data other than health and sexual life may be processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws. Blood group, allergen information, information on past diseases and personal data on health and sexual life, which are your special personal data, are only for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing, It can be processed by persons or authorized institutions and organizations that are under the obligation to keep secrets without seeking the explicit consent of the person concerned. Adequate measures determined by the board must be taken in the processing of special categories of personal data. Purposes of processing your personal data • Carrying out room reservation transactions • Fulfilling legal and regulatory requirements, • Providing quality improvement activities, • Ensuring risk management, • Ensuring the management of guest relations, • Determination and implementation of commercial business and strategies, • Realization of marketing and sales transactions, • Performing routine inspections, • Execution and supervision of financial transactions, • Planning, auditing and execution of information security processes, • To prevent abuse and unauthorized transactions that may arise from employees, • Evaluating and responding to suggestions, requests and complaints to be conveyed by customers through all kinds of channels, and carrying out improvement studies in accordance with the notifications. Retention period of personal data In cases where the purpose for processing is no longer present or when the timeout for processing data is completed within the scope of the relevant legislation, your personal data will be deleted, destroyed or anonymized and continued to be used. Rights of personal data owner Anyone concerned can apply to the data controller and request the rights listed below; I. Learning whether personal data is processed or not, II. If personal data has been processed, requesting information about it, III. Learning the purpose of processing personal data and whether they are used in accordance with its purpose, IV. Knowing the third parties to whom personal data is transferred at home or abroad, (In order to fulfill this request, the legal purpose of processing personal data must have disappeared, the legal retention periods must have expired or the relevant statute of limitations must have expired. Your request for deletion will not be provided before these periods expire.) V. Requesting correction of personal data in case of incomplete or incorrect processing, VI. Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7, VII. Requesting notification of the transactions made pursuant to Articles 5 and 6 to third parties to whom personal data has been transferred, VIII. Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems, IX. To request the compensation of the damage in case of loss due to unlawful processing of personal data.

The principles followed by TURKUAZ TURİZM when collecting and using the personal data obtained through the website ("Website") at the request of the users ("User(s)") are regulated in this Privacy Policy. Personal Data That Can Be Collected Turkuaz Turizm, on the Website, depending on the User's access to the Website and the actions they will take; • Identity Information • Transaction Security Information • IP Information • Legal Process and Compliance Information • Contact Information • Request/Complaint Management Information • User Information • Incident Management Information • User Transaction Information It will be able to collect other information that may be necessary for the performance of the services subject to the Website and which is considered personal data in accordance with the Law on the Protection of Personal Data and all relevant legislation. The user expressly consents to the processing of the data that he may share with Turkuaz Turizm at his own request, within the scope specified in this Privacy Policy, for the stated purposes. Pursuant to Articles 3 and 7 of the Personal Data Protection Law, data that has been irreversibly anonymized will not be considered as personal data in accordance with the provisions of the aforementioned law, and the processing activities regarding this data will be carried out without being bound by the provisions of this Privacy Policy. Use of "Cookie" Turkuaz Tourism automatically collects data such as the sections visited and the areas clicked by the Users during their navigation on the Website. These data obtained using the technology called "Cookie" are statistical information. The aim of this technology is to make the content of the sections visited by the users more easily accessible for the user from their first visit to the site. Most of the browsers are designed to accept these "cookies", which are technical communication files, but Users can always change their browser settings so that the technical communication file does not arrive or a warning is given when the technical communication file is sent. Turkuaz Turizm has the right to associate the behavior of the users on the Website with a "cookie" in the browser for the purpose of online behavioral advertising and marketing, and to define remarketing lists based on metrics such as the number of pages viewed, the duration of the visit and the number of target completions. Afterwards, targeted advertising content may be shown to the User on the Website or other sites in the display network, based on their interests. Purpose of Data Use Turkuaz Tourism provides the user with the collected personal data to benefit from the Website, if there is a membership to the Website, to register for membership, to improve the services offered, to develop the service, to promote and inform the new services, to inform the user in this context, to contact the user and may operate in order to fulfill its obligations arising from the nature of the services it provides. Said personal data may be processed within the scope of Turkuaz Turizm reporting and business development activities, and may also be used for the purposes of making various statistical evaluations, creating a database and conducting market research without disclosing the identity of the user. If the user also gives his/her consent, the said information may be processed, stored, transmitted to third parties for direct marketing by Turkuaz Turizm and its collaborators, and to communicate with the User in order to make notifications regarding the promotion, maintenance and support activities of various applications, products and services through the said information. can be passed. Turkuaz Turizm will also be able to process and share personal data with third parties without obtaining the User's separate consent, in accordance with Articles 5 and 8 of the Personal Data Protection Law and/or in case of exceptions in the relevant legislation. The main of these situations are listed below: clearly stipulated in the law, The processing of personal data is necessary, provided that it is necessary for the protection of the life or bodily integrity of the person or someone else, who is unable to express his consent due to actual impossibility or whose consent is not legally valid, provided that it is directly related to the establishment or performance of any contract between the user and Turkuaz Turizm, It is mandatory for the fulfillment of legal obligations, the User has made it public by himself, Data processing is mandatory for the establishment, exercise or protection of a right, Data processing is mandatory for the legitimate interests of Turkuaz Turizm, provided that it does not harm the fundamental rights and freedoms of the User. Sharing of Data Turkuaz Turizm will be able to transfer the personal data of the users and the new data obtained by using this personal data to the third parties whose services it uses for the purpose of performing the services offered to the user within the scope of the Website, limited to the provision of the said services. In this context, Turkuaz Turizm aims to improve the user experience (including improvement and personalization), to ensure the security of the user, to detect fraudulent or unauthorized use, to investigate operational evaluation, to correct errors related to the Website or Turkuaz Turizm services, and in this Privacy Policy or other privacy texts presented to the User. The User may share their data with third parties such as outsourcing service providers, hosting service providers ("hosting" services), law firms, research companies, call centers, in order to achieve any of the purposes set out above. The user agrees that the aforementioned third parties may store the user's personal data on their servers located anywhere in the world, provided that they are limited to the above-mentioned purposes, and they consent to this in advance. User's Right to Access Data and Correction Requests By applying to Turkuaz Turizm, the user: • Learning whether personal data is processed or not, • If personal data has been processed, requesting information about it, • To learn the purpose of processing personal data and whether they are used in accordance with the purpose, • Knowing the third parties to whom personal data is transferred in the country or abroad, • Requesting correction of personal data if it is incomplete or incorrectly processed, • Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation, • Requesting notification of the correction, deletion and destruction of personal data to third parties in accordance with the relevant legislation, • Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems, • It has the right to demand the compensation of the damage in case of loss due to unlawful processing of personal data. The user will be able to submit the above-mentioned requests through the methods included in the Data Owner Application Form. Turkuaz Turizm may give its reasoned positive/negative response in written or digital form in accordance with the above-mentioned requests. It is essential that no fee is charged for the necessary transactions regarding the requests. However, if the transactions require a cost, it is possible to charge a fee based on the tariff determined by the Personal Data Protection Board in accordance with Article 13 of the Personal Data Protection Law. The user undertakes that the information provided to Turkuaz Tourism, subject to this Privacy Policy, is complete, accurate and up-to-date, and that he will immediately update them in case of any changes in this information. Turkuaz Turizm will not have any responsibility if the user does not provide up-to-date information. The user accepts and declares that if he makes a request that will result in the inability to use any of his personal data by Turkuaz Turizm, he may not be able to fully benefit from the services that Turkuaz Turizm has committed to him, and that any responsibility that may arise in this context will belong to him. Retention Period of Personal Data Turkuaz Turizm will keep the personal data provided by the User for the duration of the services in order to fulfill the obligations arising from the nature of the services it provides. In addition, Turkuaz Turizm will be able to keep personal data in case of any dispute that may arise between the User and the user, limited to the purpose of making the necessary defenses within the scope of the dispute, and during the statute of limitations determined in accordance with the relevant legislation. Data Security Measures, Commitments and Responsibility Turkuaz Turizm, under the conditions determined in the relevant legislation or expressed in this Privacy Policy: • Personal data is not processed unlawfully, • That personal data is not accessed unlawfully, and •undertakes to take the necessary technical and administrative measures to ensure the appropriate level of security and to carry out the necessary audits in order to ensure the protection of personal data. • In case of linking to other applications on the site, Turkuaz Tourism does not bear any responsibility for the privacy policies and contents of the applications. Turkuaz Tourism does not accept any responsibility for the damages that may occur as a result of the use of personal data within the framework of the above conditions. Changes to the Privacy Policy Those who benefit from the services offered on the Website are deemed to have read and accepted all these terms. Turkuaz Tourism reserves the right to change the provisions of the Privacy Policy without prior notice. The current Privacy Policy becomes effective on the date it is presented to the User by any means.