I. DATA CONTROLLER

In accordance with Article 3 of the Law on the Protection of Personal Data No. 6698 ("KVKK"), the data controller determining the purposes and means of processing your personal data, and responsible for the establishment and management of the data recording system, is the FACILITY whose identification and contact details are provided below:

The MEMBER acknowledges and declares that the obligation of clarification has been fulfilled upon the delivery of this document.

II. PROCESSED PERSONAL DATA

The personal data processed by the FACILITY consists of data obtained within the scope of establishing and executing the membership relationship, as well as data processed within the framework of legitimate interests and legal obligations of the FACILITY, mainly including the following:

• Identity Information: Name, surname, Turkish ID number (or passport number for foreign nationals), date of birth, gender, signature, and identity document information,
• Contact Information: Phone number, e-mail address, residential address, and other contact details,
• Customer Transaction Information: Membership start and end dates, membership package and type, course and activity attendance records, requests, complaints, and information records,
• Financial Information: Payment and collection records regarding the membership fee, billing information, last six digits of credit card, and bank account information,
• Physical Space Security Information: Visual recordings captured by security cameras for the purpose of ensuring security in and around the FACILITY premises,
• Audio and Visual Records: Photographs and video recordings taken during tournaments, camps, events, and personal training (PT) sessions,
• CRM and Mobile Application Data: Membership and communication records maintained on the FACILITY customer relationship management (CRM) system, usage, check-in/check-out, reservation, and preference data obtained via mobile applications,
• Special Categories of Personal Data: Health data within the scope of Article 6 of the KVKK (health declaration stating that there is no obstacle to sports activities, medical reports, and health information contained in similar documents) and biometric data if utilized for identity verification at membership entrances.

III. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed for the following purposes:

• Establishment, execution, and management of the membership contract, performance of membership procedures and registrations,
• Collection of membership fees, invoicing, and execution of accounting procedures,
• Enabling utilization of the FACILITY premises and services, planning and conducting course and activity schedules,
• Ensuring life and property security within the FACILITY,
• Fulfillment of the FACILITY's legal obligations and responding to requests from authorized public institutions and organizations,
• Receiving, evaluating, and concluding requests and complaints, and enhancing customer satisfaction,
• Planning, auditing, and reporting of business operations and workflows,
• Subject to the explicit consent of the Member, using photograph and video recordings taken at tournaments, camps, and events on the FACILITY's social media accounts and promotional materials for marketing and advertising purposes,
• Subject to the explicit consent of the Member, sending commercial electronic messages for campaigns, discounts, and promotional activities.

IV. CONDITIONS AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

1. Your personal data is processed based on your explicit consent pursuant to paragraph 1 of Article 5 of the KVKK; or, in the absence of explicit consent, on the presence of one of the following legal grounds stipulated in paragraph 2 of Article 5 of the KVKK:
   • Explicitly provided for in laws and regulations,
   • Necessary for processing personal data of contract parties, provided that it is directly related to the establishment or performance of a contract,
   • Mandatory for the data controller to fulfill its legal obligations,
   • Necessary for the establishment, exercise, or protection of a right,
   • Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
2. Conditions for Processing Special Categories of Personal Data: Processing of special categories of personal data is prohibited pursuant to Article 6 of the KVKK. However;
   • Your health data is processed solely with your explicit consent or by persons or authorized institutions under confidentiality obligations for purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, as well as planning, managing, and financing health services;
   • Your biometric data, if utilized at membership entrances, is processed solely with your explicit consent and subject to the implementation of adequate safeguards specified by the Personal Data Protection Board.

V. TRANSFER OF PERSONAL DATA

1. Your personal data may be transferred in compliance with the conditions specified in Articles 8 and 9 of the KVKK and limited to the following purposes:
   • To legally authorized public institutions and organizations in cases stipulated by law and limited to the purpose of the request,
   • To service providers, payment service providers, IT infrastructure providers, and professional consulting firms contracted for the execution of the membership relationship,
   • Subject to the explicit consent of the Member, to social media platforms and business partners for conducting marketing activities.
2. Transfer of personal data abroad is conducted only with the explicit consent of the Member or upon fulfillment of the other conditions stipulated in Article 9 of the KVKK.
3. All processed personal data is retained by taking all necessary administrative and technical measures in accordance with the periods mandated by the KVKK and relevant legislation, and in any case as long as the legitimate purposes above persist.

VI. METHODS OF COLLECTING PERSONAL DATA

Your personal data is collected through membership forms and contracts, via the website and mobile applications, through security cameras located within the FACILITY, through photographs and video recordings taken at tournaments, camps, and events, via call center and email communication channels, and through social media platforms, by automated or non-automated methods.

VII. RETENTION PERIOD OF PERSONAL DATA

• Your personal data is retained in accordance with the principles of "being relevant, limited, and proportionate to the purpose of processing" and "being retained for the period stipulated in relevant legislation or necessary for the purpose of processing" pursuant to Article 4 of the KVKK, throughout the retention and statutory limitation periods stipulated by law. Following the expiration of these periods, your personal data will be deleted, destroyed, or anonymized in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
• Security camera recordings are stored solely for ensuring life and property security and for the maximum duration prescribed by relevant legislation; they are destroyed upon the expiration of this period.

VIII. RIGHTS OF THE DATA SUBJECT UNDER ARTICLE 11 OF THE LAW

Pursuant to Article 11 of the KVKK, as the personal data subject, the MEMBER has the following rights:

• To learn whether personal data is processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of personal data if it is incomplete or incorrectly processed,
• To request deletion or destruction of personal data within the framework of conditions stipulated in Article 7 of the KVKK,
• To request notification of the transactions made pursuant to the correction, deletion, or destruction to third parties to whom personal data has been transferred,
• To object to any result to your detriment arising from the analysis of processed data exclusively through automated systems,
• To demand compensation for damages in case you suffer damage due to unlawful processing of personal data.

You may submit your requests regarding the rights listed above in writing, together with identifying documentation, to [FACILITY's e-mail address] or to [FACILITY's physical address]. Your applications will be concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request.

Pursuant to Article 10 of the Law No. 6698 on the Protection of Personal Data titled "Data Controller's Obligation of Clarification", I have read and understood this "OVER BLUE RESORT TURİZM OTELCİLİK VE ORGANİZASYON LİMİTED ŞİRKETİ KVKK CLARIFICATION TEXT" prepared regarding who will process my personal data, for what purpose, to whom and for what purpose it may be transferred, the method and legal grounds for collecting personal data, and my rights under Article 11 of the Law, and I have been thoroughly informed by the data controller OVER BLUE RESORT TURİZM OTELCİLİK VE ORGANİZASYON LİMİTED ŞİRKETİ.

EXPLICIT CONSENT AND APPROVAL STATEMENT

I accept and declare that by registering with the membership system of OVER BLUE RESORT TURİZM OTELCİLİK VE ORGANİZASYON LİMİTED ŞİRKETİ, I have created a membership; that in this context, all my personal data is subject to the provisions of the Law on the Protection of Personal Data No. 6698 ("KVKK") and related legislation, and that the company has provided me with complete and clear information regarding my rights under the relevant law and legislation (Clarification Text). I accept and declare that within the scope of the relevant clarification, the company will fully and completely fulfill its obligations regarding data security under the legislation.

My personal data is collected by the company in connection with the receipt of my membership application and the establishment and performance of the membership agreement. Said personal data is processed for the purpose of establishing and executing the membership agreement, retained for the duration required by the performance of the agreement and by applicable laws, and transferred to third parties to the extent required by the performance of the agreement and by law.

This explicit consent and approval statement is an integral part of the membership agreement; I accept and declare that I give explicit consent to the processing and storage of my special categories of personal data, including my health data, and, if necessitated by membership processes, to the transfer of all my personal data to domestic company partners and business associates, IT service providers (servers, software, cloud computing, etc.), publication on the website and social media (strictly limited to photo and video recordings), to company consultants and relevant public institutions, and to third-party service providers, lawyers, financial advisors, mediators, and banks as necessitated by the nature of the contract, for situations requiring explicit consent where the processing conditions in Articles 5/2 and 6/3 of the KVKK cannot be met.

Within the scope of the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages; I hereby give my explicit consent to the sending of commercial electronic messages containing campaigns, opportunities, discounts, promotions, and advertising via e-mail and SMS for direct marketing purposes by the company, without prejudice to informative messages regarding my membership process and membership account. This approval constitutes an informed, explicit consent given by my own free will concerning a specific matter, and my positive declaration of will has been freely granted without any pre-selected (pre-checked) box. I accept and declare that commercial electronic message consent cannot be asserted as a prerequisite for concluding the membership contract or benefiting from membership services; and that my membership and service provision will in no way be affected if I do not grant or subsequently withdraw this approval. Furthermore, I accept and declare that I may refuse to receive commercial electronic messages at any time without stating any reason and free of charge through the opt-out mechanism provided in each commercial electronic message or via communication channels notified by the company; and that upon receipt of my refusal notice by the company, message delivery to the relevant channel will cease within three business days at the latest.

I accept and declare that the explicit consent granted herein may be revoked at any time; that the revocation of consent shall not retroactively affect processing activities carried out in compliance with the KVKK up to the moment of revocation; and that I possess all legal rights under the KVKK, primarily the rights to obtain information, rectification, erasure, destruction, and objection to processing.

I declare that I have read and understood this explicit consent and approval statement within the scope of the membership agreement, and that I consent completely and by my own free will to its contents.

ENTRY INTO FORCE AND ACCEPTANCE

This Clarification and Explicit Consent Text enters into force as an integral annex to the Over Blue Resort Membership Agreement upon being delivered to the MEMBER and being read and understood by the MEMBER.

The MEMBER accepts and declares that they have read, understood, and received the clarification information contained in this text, and that they have granted the explicit consent statement regarding a specific subject, based on informed and free will.

This text has been executed in two counterparts on [contract date] together with the Over Blue Resort Membership Agreement, and one counterpart has been delivered to the MEMBER.