To Whom It May Concern,

In accordance with Law No. 6698 on the Personal Data Protection (“the Law”) and acting in our capacity as Data Controller, MRA TURİZM VE OTEL İŞLETMECİLİĞİ A.Ş. (“Caja by Maxx Royal” or “MRA”) hereby informs you that your personal data will be processed in the event that you complete and submit our Contact Form to request that we get in touch with you.

1. Methods of Collecting Your Personal Data, Categories of Data Processed, Purposes of Processing and Legal Grounds

CONTACT FORM PROCESSES

Your personal data is collected by partially automated means when you submit the contact form via our website or social media channels. This includes your Identity Information (name, surname), Contact Information (email address, mobile phone number), Customer Transaction Information (subject of your request) and Transaction Security Information (IP address details, log records). Your data is processed for the purposes of responding to your request as stated in the contact form, following up on the status of your request, and managing the sales and marketing processes for the residences/villas you have expressed interest in. The legal basis for processing is “where it is necessary for the processing of personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of the contract” and “where it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” under Law No. 6698 on the Personal Data Protection.

COMMERCIAL COMMUNICATION PROCESSES

Your personal data is collected by partially automated means when you submit the contact form via our website or social media channels. This includes your Contact Information (email address, telephone number) for the purposes of establishing commercial communication, conducting communication processes and carrying out advertising, information and marketing activities, where you have provided your explicit consent. In such cases, we may also process your Contact Information (email address, telephone number) and Legal Transaction Information (commercial communication consent/withdrawal details, date and time of consent, communication method such as SMS, call or email) for the purposes of managing commercial communication permission processes in compliance with our legal obligations, following up and conducting legal affairs, and providing information to authorised persons, institutions and organisations. The legal basis for processing in this respect is “where it is necessary for compliance with the data controller’s legal obligation” under Law No. 6698 on the Personal Data Protection.

2.To Whom and for What Purposes May Your Personal Data Be Disclosed?

We may transfer your personal data:

• To our thirdparty business partner from whom we receive sales and marketing strategy support, for the purposes of receiving sales and marketing services and conducting communication processes, where you have provided your explicit consent,
• To our domestic suppliers and service providers (such as database and server service providers) for the purposes of obtaining product and service support in areas such as information technologies and specialised consultancy, based on the legal ground of “where it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” under Law No. 6698 on the Personal Data Protection

You may withdraw your explicit consent at any time and without providing any reason, thereby bringing to an end any personal data processing activities based on such consent. In such cases, your request will also be communicated to the persons and organisations to whom your data has been transferred.

3.What Are Your Rights?

You may submit a request to MRA in relation to your rights set out in Article 11 of the Law. Please note that your application must comply with the conditions specified in the Communiqué on Procedures and Principles of the Application to Data Controller.

You may submit your applications using any of the methods listed below: