Personal Data Protection and Privacy Policy

1. Purpose of the Policy

Protecting personal data has always been a fundamental principle of Costa Türkiye. In line with the sensitivity of the services provided, all data obtained from customers, prospective customers, business partners, and other related persons is handled with confidentiality and care. This policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data and reflects Costa Türkiye’s commitment to complying with all applicable legal obligations concerning personal data protection.

2. Scope of the Policy

This policy applies to the processing and protection of personal data belonging to customers, prospective customers, employees, business and solution partners, and other individuals whose data may be obtained automatically or by other lawful means within the course of Costa Türkiye’s operations. Costa Türkiye reserves the right to amend this policy, provided that any such amendment remains compliant with applicable law and supports a higher standard of data protection.

3. Principles of Personal Data Processing

Costa Türkiye processes personal data in accordance with the principles of lawfulness, fairness, accuracy, and transparency. Data is collected for specific, explicit, and legitimate purposes; processed only in a manner related to those purposes; kept limited, proportionate, and relevant; and retained only for the period required by the relevant legislation or by the purpose of processing. Once the relevant retention grounds cease to exist, the data is deleted, destroyed, or anonymised.

Costa Türkiye also applies a principle of data minimisation. Only the data strictly necessary for the relevant purpose is collected and recorded. Any unnecessary information is not processed, is deleted, or is anonymised where appropriate. Certain anonymised data may be used for statistical purposes outside the scope of personal data legislation.

4. Processing Purposes

Personal data is collected and processed for purposes related to the establishment and performance of contractual relationships, the provision of services, the improvement of service quality, operational communication, and the management of customer relations. Where permitted by law and subject to the applicable consent requirements, personal data may also be processed for information notices, campaigns, and commercial communication activities.

5. Customer, Prospective Customer, and Business Partner Data

Where a contractual relationship exists, personal data may be processed without separate consent to the extent necessary for the performance of that contract. Personal data voluntarily submitted by prospective customers may be processed in order to provide more effective and higher-quality services and may be deleted where no contractual relationship is ultimately established and where there is no further lawful basis for retention.

Costa Türkiye may share limited personal data with business and solution partners only to the extent required for the provision of services and only in accordance with lawful processing principles, confidentiality obligations, and data security requirements.

6. Newsletter and Commercial Communication

Persons who subscribe to the e-mail newsletter through the Costa Türkiye website are deemed to have accepted the receipt of informational messages relating to offers and campaigns. In relation to advertising and promotional electronic communication, Costa Türkiye acts in accordance with the applicable legal framework governing commercial electronic messages and only sends such communications where the relevant approval or other lawful basis exists.

7. Special Categories of Personal Data

Costa Türkiye does not seek to process special categories of personal data unless this is necessary for the proper delivery of services, required for the protection of customers, or otherwise permitted by law. Health data and other sensitive information, where lawfully obtained, are handled with enhanced care and protected through appropriate technical and administrative measures.

8. Data Accuracy, Updating, and Retention

Personal data is generally processed on the basis of the information declared by the data subject. Costa Türkiye adopts the principle of keeping data accurate and up to date and updates personal data when notified by the relevant person or when supported by official documentation. Personal data is retained for the period required under applicable legal obligations, commercial practices, tax law, contractual limitation periods, or other legitimate grounds, and is subsequently deleted, destroyed, or anonymised where appropriate.

9. Confidentiality and Data Security

Personal data is treated as confidential. Access is restricted to authorised personnel only. Costa Türkiye undertakes the necessary technical and administrative measures to protect personal data against unauthorised access, unlawful processing, accidental loss, disclosure, or misuse. This includes internal compliance practices, secure systems, careful supplier selection, and adherence to corporate data protection procedures.

10. Rights of Data Subjects

In accordance with Article 11 of Law No. 6698, data subjects may apply to Costa Türkiye in order to learn whether their personal data is being processed, request information regarding such processing, learn the purpose of processing and whether the data is used in accordance with that purpose, learn the third parties to whom the data has been transferred domestically or abroad, request rectification of incomplete or inaccurate data, request deletion or destruction of data under the conditions set out by law, request notification of such rectification or deletion to third parties to whom the data has been transferred, object to adverse results arising from automated analysis, and request compensation for damages arising from unlawful processing.

11. Policy Updates

Costa Türkiye may revise this policy from time to time in order to reflect legal, operational, or technical developments. The most up-to-date version published on the website shall prevail. Continued use of the website and its services following any update shall constitute acceptance of the revised policy.