Personal Data Protection and Processing Policy

PERSONAL DATA PROTECTION AND PROCESSING POLICY

ARTICLE 1 – PURPOSE

Neo Kraken Maritime and Ship Services Limited Company (hereinafter referred to as "Neo Kraken" or the "Company"), within the scope of its social and legal responsibilities, undertakes to comply with all regulations regarding the protection, processing, storage, and destruction of personal data.

This Personal Data Protection and Processing Policy ("Policy") has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK") and relevant secondary legislation. The Policy applies to all personal data processed by the Company and sets out the principles and procedures regarding the lawful processing, protection, and destruction of personal data.

Pursuant to Article 7/3 of the KVKK, the procedures and principles regarding the deletion, destruction, or anonymization of personal data are regulated by secondary legislation. Accordingly, this Policy aims to determine the procedures and principles for the deletion, destruction, or anonymization of personal data processed by the Company in compliance with applicable legislation.

ARTICLE 2 – SUBJECT

In accordance with the Law on the Protection of Personal Data No. 6698, all kinds of information relating to an identified or identifiable natural person are considered personal data and are processed by Neo Kraken in its capacity as the Data Controller.

Neo Kraken attaches great importance to the protection of personal data and takes all necessary administrative and technical measures to ensure the security of personal data processed through its website and business activities. The Company also aims to protect the privacy, fundamental rights, and freedoms of individuals whose personal data are processed.

ARTICLE 3 – DEFINITIONS

Explicit Consent: Consent on a specific subject, based on adequate information and expressed with free will.

Processing of Personal Data: Any operation performed on personal data such as collection, recording, storage, preservation, alteration, disclosure, transfer, classification, or prevention of use.

Personal Data Owner (Data Subject): The natural person whose personal data is processed.

Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, surname, e-mail address, phone number, address).

User: The natural person visiting or using the Company's website.

Sensitive Personal Data: Personal data relating to race, ethnicity, political opinion, philosophical belief, religion, sect, health, sexual life, criminal convictions, biometric and genetic data, as defined under Article 6 of the KVKK.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and manages the data recording system.

Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on its authority.

Data Recording System: The system in which personal data are processed by being structured according to specific criteria.

Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances.

ARTICLE 4 – PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

4.1 General Principles

Neo Kraken processes personal data in accordance with the Constitution of the Republic of Turkey and KVKK, based on the following principles:

• Compliance with the law and principles of honesty,
• Accuracy and keeping data up to date where necessary,
• Processing for specific, explicit, and legitimate purposes,
• Being relevant, limited, and proportionate to the purpose of processing,
• Retaining personal data only for the period required by relevant legislation or the purpose of processing.

4.2 Conditions for Processing Personal Data

Personal data may be processed by Neo Kraken in cases expressly stipulated by law or with the explicit consent of the data subject.

In addition to explicit consent, personal data may be processed without consent where:

• It is expressly permitted by law,
• It is necessary to protect the life or physical integrity of the data subject or another person,
• It is necessary for the establishment or performance of a contract,
• The data has been made public by the data subject,
• Data processing is necessary for the establishment, exercise, or protection of a right,
• Processing is necessary for the legitimate interests of the Company, provided that fundamental rights and freedoms are not harmed.

Sensitive personal data are processed only in accordance with Article 6 of KVKK and subject to adequate safeguards determined by the Personal Data Protection Board.

ARTICLE 5 – OBLIGATION TO INFORM

In accordance with Article 10 of KVKK, Neo Kraken informs personal data owners about:

• The identity of the data controller,
• The purposes of processing personal data,
• To whom and for what purposes personal data may be transferred,
• The method and legal basis of data collection,
• The rights of data subjects under Article 11 of KVKK.

This information is provided through this Policy and other relevant disclosure texts.

ARTICLE 6 – PROCESSING OF PERSONAL DATA

Personal data may be collected verbally, in writing, or electronically through the Company's website, e-mail, phone calls, forms, and similar communication channels.

Collected personal data may be processed for purposes including but not limited to:

• Carrying out the Company's commercial and operational activities,
• Establishment and execution of contracts,
• Communication with customers and business partners,
• Fulfillment of legal obligations,
• Ensuring operational security and continuity,
• Managing customer relations and responding to requests.

ARTICLE 7 – TRANSFER OF PERSONAL DATA

Personal data may be transferred to:

• Authorized public institutions and organizations,
• Courts, regulatory and supervisory authorities,
• Business partners, suppliers, service providers,
• Domestic and foreign institutions, only within the limits permitted by applicable legislation.

All transfers are carried out in compliance with KVKK and relevant legal requirements.

ARTICLE 8 – RIGHTS OF DATA SUBJECTS

Pursuant to Article 11 of KVKK, data subjects have the right to:

• Learn whether personal data are processed,
• Request information if personal data have been processed,
• Learn the purpose of processing and whether data are used accordingly,
• Know third parties to whom personal data are transferred,
• Request correction or deletion of personal data,
• Object to processing resulting in adverse outcomes,
• Request compensation for damages arising from unlawful processing.

ARTICLE 9 – CONTACT INFORMATION

Requests regarding personal data may be submitted to the Company through the following contact details:

Neo Kraken Maritime and Ship Services Limited Company
Evliya Çelebi Mah. Küme Sokak
Tuzla Trade Center
No: 2B, Interior Door No: 18
Tuzla – Istanbul / Turkey

E-mail: info@krakenshipping.com, agency@krakenshipping.com

ARTICLE 10 – FINAL PROVISIONS

In case of any inconsistency between this Policy and applicable legislation, the provisions of the legislation shall prevail.

Neo Kraken reserves the right to amend this Policy at any time. The updated Policy shall enter into force upon publication on the Company's website.