Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

Note: This is an English translation of our Turkish KVKK Aydınlatma Metni, provided for convenience. If the two versions differ, the Turkish text prevails.

This notice explains how Bravus Denizcilik Ticaret Limited Şirketi ("Bravus Marine" or "we") processes your personal data. It covers people who visit the www.bravusmarine.com website and contact us through the contact form, by e-mail or by phone, as well as our customers, prospective customers, and their authorised representatives and employees. It has been prepared under Article 10 of the Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. Details of the cookies used on our website are set out in our Cookie Policy.

1. Data controller

The data controller for your personal data is Bravus Denizcilik Ticaret Limited Şirketi (Bravus Denizcilik Tic. Ltd. Şti.), which trades under the Bravus Marine brand.

• Address: Esentepe Mah. Milangaz Cad. No:77, Dumankaya Vizyon Residence A2 Blok, Kat 30, Daire 212, 34870 Kartal / İstanbul, Türkiye
• Phone: +90 555 980 51 36
• E-mail: info@bravusmarine.com
• Website: www.bravusmarine.com

2. What personal data do we process?

We process the following categories of data to the extent necessary for the purposes listed in Section 3:

• Identity: your first name and surname; your Turkish ID number if an invoice is to be issued in your personal name; if you submit a request to us under the Law, the Turkish ID number in your request or, if you are a foreign national, your nationality and your passport number or, if you have one, your identity number.
• Contact: your e-mail address and phone number; your billing address or address for official notices if you place an order or submit a request.
• Customer transaction: the company or vessel you represent, the brand you are interested in, the content of your message and of our correspondence; records of quotations, orders, deliveries, installation, training, warranty and technical support.
• Finance: if you place an order, invoice details (name or trade name on the invoice, billing address, tax office and tax number), and the payment amount and payment date.
• Transaction security: your IP address, the date and time of your visit, the pages you view, your browser and device information; the technical browser signals checked by the spam protection on the contact form.
• Site preferences: the site language you choose (Turkish or English) and your cookie choice.
• Legal transaction: correspondence and documents relating to a dispute or to a request from a competent authority.

On the contact form, the Name, Email and Message fields are required; without them we cannot answer your enquiry. The Company / vessel and Phone fields are optional.

We do not need any special categories of personal data listed in Article 6 of the Law to answer your enquiry. Please do not share such data in the form or in correspondence. If such data is shared by mistake, we delete it without using it.

3. For what purposes and on what legal grounds do we process your personal data?

We base each purpose on one of the processing conditions in Article 5 of the Law:

Whether you fill in the form in your own name or on behalf of a company only determines which legal ground applies; in both cases your data is processed for the same purpose and to the same extent. Where we rely on legitimate interest, we make sure that our interest does not harm your fundamental rights and freedoms, and we process only the data that is needed.

We ask for your explicit consent in only two cases: for Google Maps, and, in the exceptional case described in Section 5, for a transfer to a manufacturer or service partner abroad for a specific request of yours. All other processing is based on another legal ground listed in the Law, so we do not ask for your explicit consent for it. The checkbox on the contact form is not a declaration of explicit consent; it only confirms that you have read this notice.

We do not use your personal data for any purpose other than these. We do not use analytics, advertising, marketing or social media tracking cookies on the website, and we do not send newsletters.

4. How do we collect your personal data?

• Directly from you: partly by automated means through the contact and quotation form on the website; by non-automated means through e-mail, phone calls and documents you send us during the ordering process.
• By automated means: through the access logs kept by the hosting server when you visit the site, the spam protection on the form, and cookies stored in your browser.

We collect this data on the legal grounds stated for each purpose in Section 3.

Contact form

When you submit the form, your information is sent by e-mail to info@bravusmarine.com and you receive an automatic thank-you e-mail. Form submissions are not stored in the website's database; they are stored in our mailbox.

To protect the form against automated submissions we use Cloudflare Turnstile. To tell whether the form is being submitted by a person or by software, Turnstile processes your IP address and technical signals about your browser when the page containing the form loads and when you submit the form. If this check prevents you from submitting the form, you can reach us by e-mail or phone.

Cookies and Google Maps

Our site uses strictly necessary cookies (for your language choice and your cookie choice) and, only if you allow it, external content cookies belonging to Google Maps. Strictly necessary cookies do not require explicit consent. Google Maps does not load unless you choose "Accept all" in the cookie banner, switch on "External content (Google Maps)" under "Preferences", or click the "Show map" button in the map area. As long as the map is not loaded, no data goes to Google; not loading the map does not affect your use of the form or the rest of the site.

The cookie banner shows "Accept all" and "Reject" with equal prominence, with "Preferences" next to them, and no option is pre-selected. You can change your choice at any time through the "Cookie preferences" link at the bottom of the page; you can delete Google cookies already set through your browser settings. The names, purposes and retention periods of cookies are set out in our Cookie Policy.

5. To whom do we transfer your personal data, and why?

We do not sell your personal data or share it with anyone for marketing. We transfer it only to the recipient groups below, for the stated purpose and limited to the data needed for that purpose, in line with Articles 8 and 9 of the Law. The legal ground for each transfer is the one stated for the relevant purpose in Section 3.

• IT service providers (web hosting, e-mail and e-mail delivery service): to run the site and to deliver and store form messages and correspondence (purposes 1, 2, 3 and 5). These providers process the data only on our behalf and on our instructions. Data transferred: identity, contact, customer transaction, finance, transaction security. Their servers may be located in Türkiye or abroad.
• Cloudflare (Turnstile spam protection): to protect the form against automated submissions (purpose 5). Data transferred: your IP address and technical browser signals. This data is processed on Cloudflare's systems abroad.
• Google (Google Ireland Limited and Google LLC; Google Maps): only if you choose to load the map, your browser connects directly to Google's servers and your IP address and browser and device information are sent to Google (purpose 7). Google processes this data under its own privacy policy; this data does not reach us.
• Manufacturers of the brands we represent and their authorised service partners: we are the authorised reseller in Türkiye for Teledyne Raymarine Commercial and the authorised dealer for North Invent and Massive Marine AI, and we carry out installation and training together with the manufacturers and authorised service partners. When we need price, lead-time or technical suitability information for a quotation, or when needed for installation, training, warranty or technical support you have requested (purposes 1 and 2), we share only the information needed. Vessel and equipment details are usually enough for a quotation; we share your name, company or vessel, contact details and the content of your request when the manufacturer or service partner needs to contact you directly or carry out the work. Some of these companies are established abroad.
• Our financial adviser (mali müşavir): to meet our invoicing, accounting and tax obligations (purpose 3). Data transferred: order and invoice information within the identity, contact, finance and customer transaction categories.
• Courts, enforcement offices and public authorities legally authorised to request information and documents: only where there is a request or obligation based on law, or where needed to establish, exercise or protect a right (purposes 4 and 8). Data transferred: the data that is the subject of the request or dispute.

What rules do we follow for transfers abroad?

Under Article 9 of the Law, provided that one of the processing conditions in Article 5 is met, personal data may be transferred abroad only in one of the following ways:

1. Adequacy decision (Art. 9(1)): the Personal Data Protection Board has issued an adequacy decision for the destination country, a sector within that country, or the international organisation.
2. Appropriate safeguards (Art. 9(4)): where there is no adequacy decision, one of the appropriate safeguards listed in the Law is provided by the parties, provided that you can also exercise your rights and have access to effective legal remedies in the destination country. The safeguards that can apply to our company are the standard contract announced by the Board (notified to the Authority within five business days of signature, Art. 9(5)) and a written undertaking for which the Board has authorised the transfer.
3. Incidental transfer cases (Art. 9(6)): where there is neither an adequacy decision nor an appropriate safeguard, one of the exceptions listed in the Law, and only for incidental transfers, that is, transfers that are not regular or continuous and fall outside our ordinary course of business. The relevant ones for this notice are: your explicit consent, provided you have been informed of the possible risks (Art. 9(6)(a)); the transfer is necessary for the performance of a contract between you and us or for pre-contractual measures taken at your request (Art. 9(6)(b)); the transfer is necessary for the formation or performance of a contract to be concluded in your interest between us and another natural or legal person (Art. 9(6)(c)); the transfer is necessary for the establishment, exercise or protection of a right (Art. 9(6)(d)).

We apply these rules as follows:

• E-mail, hosting and Cloudflare: as these transfers are regular, we do not rely on the incidental transfer cases. Where we use these services through servers abroad, we base the transfer on an adequacy decision or, where there is none, on a standard contract signed with the service provider or a written undertaking authorised by the Board.
• Google Maps: the map does not load by itself. Only when you consent does your browser connect to Google; your IP address and browser information go directly to Google without passing through us, and we do not collect, store or send this data to Google. Because the transfer depends on your own decision and is not part of our business processes, we consider it incidental. It is based on your explicit consent, given after you have been informed of the risks below next to the map and in the cookie banner (Art. 9(6)(a)). Google may process the data on its servers in various countries, including the United States of America. The level of personal data protection in those countries may not be the same as in Türkiye, and it may be harder for you to exercise your rights there. If you do not consent, the map does not load and no data is transferred to Google.
• Manufacturers and service partners: if we need to transfer personal data regularly to a manufacturer or service partner abroad, we base the transfer on an adequacy decision or on a standard contract signed with that company. Where there is no such basis, we transfer your data only for a specific request of yours and on an incidental basis, if one of the cases in Art. 9(6)(b), 9(6)(c) or 9(6)(d) applies. If none of these cases applies, we explain the possible risks to you and ask for your explicit consent separately before the transfer (Art. 9(6)(a)); if you do not consent, we do not transfer your data.

6. How long do we keep your personal data?

We keep your data for as long as necessary for the purpose of processing and for the retention and limitation periods set by law:

If there is a dispute, an official investigation or a request from a competent authority, we keep the relevant records until that process is concluded. When the period ends, we delete, destroy or anonymise your data.

7. Your rights under the Law

Under Article 11 of the Law, you can apply to us to:

• learn whether your personal data is processed,
• request information about the processing if your personal data has been processed,
• learn the purpose of processing and whether your data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data is transferred,
• request correction if your personal data is incomplete or inaccurate,
• request deletion or destruction of your personal data under the conditions in Article 7 of the Law,
• request that correction, deletion or destruction be notified to the third parties to whom your personal data has been transferred,
• object to a result against you arising from the analysis of your data exclusively by automated systems,
• claim compensation if you suffer damage because your personal data has been processed unlawfully.

You can withdraw the explicit consent you gave for Google Maps at any time through the "Cookie preferences" link at the bottom of the page; withdrawal does not affect processing carried out before it. If you believe the spam protection on the form has wrongly blocked you, you can object to this result by contacting us by e-mail or phone.

8. How can you exercise your rights?

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in one of the following ways:

• In writing: by delivering your request with a wet-ink signature by hand, or by sending it by post or through a notary public to Esentepe Mah. Milangaz Cad. No:77, Dumankaya Vizyon Residence A2 Blok, Kat 30, Daire 212, 34870 Kartal / İstanbul.
• With a secure electronic signature or mobile signature: by e-mailing your request, signed with one of these methods, to info@bravusmarine.com.
• From the e-mail address you have previously given us: by sending an e-mail to info@bravusmarine.com from the e-mail address registered in our records.

Your request must include:

• your first name, surname and, for written requests, your signature,
• your Turkish ID number if you are a Turkish citizen; if you are a foreign national, your nationality, your passport number or, if you have one, your identity number,
• your residential or business address for official notices,
• if available, your e-mail address, phone and fax number for notifications,
• the subject of your request.

Please attach any relevant information and documents to your request. When applying by e-mail, writing "KVKK Başvurusu" (KVKK Request) in the subject line helps us handle your request quickly.

For written requests, the date of the request is the date it is served on us; for other methods, it is the date the request reaches us. We may ask you for additional information to verify that the request is yours or to clarify it.

We conclude your request free of charge as soon as possible according to its nature and within 30 days at the latest (Law Art. 13). We either accept your request or reject it with reasons, and we notify you of our reply in writing or electronically. If the process involves an additional cost, a fee may be charged under the tariff set by the Board: if a written reply exceeds ten pages, TRY 1 for each page after the tenth; if the reply is given on a recording medium such as a CD or USB stick, the cost of that medium. If the request arises from our error, any fee charged is refunded.

If your request is rejected, if you find our reply insufficient, or if we do not reply in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning our reply and in any case within 60 days of the date of your request (Law Art. 14).

9. Changes to this notice

We update this notice when our personal data processing activities or the relevant legislation change; the current version is always on this page. If we decide to add analytics, advertising or marketing cookies, social media plug-ins or a newsletter to our site, we will run them only with your explicit consent, and we will update this notice, the Cookie Policy and the cookie banner before they go live.

Last updated: 9 October 2026