General Provisions
As Hotel Altınöz, we attach utmost importance to the lawful processing and protection of personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (the "Law").
For this reason, in order to provide better services to our guests in terms of guest safety and satisfaction, we act in accordance with the Personal Data Processing and Protection Policy, the general principles of which are set out below, regarding the protection, storage, processing, use and destruction of personal data, commercial electronic communications, and other related matters.
In this context, we present this Personal Data Processing and Protection Policy (the "Policy") for your information in order to fulfill our disclosure obligation under Article 10 of the Law and to inform you about the administrative and technical measures we have taken regarding the processing and protection of personal data.
Purpose and Scope of the Policy
The primary purpose of this Policy is to provide information regarding the systems established for the processing and protection of personal data in accordance with the law and the purpose of the Law, and to inform individuals about personal data processed by Hotel Altınöz through fully or partially automated means or non-automated means, provided that such data forms part of a data recording system.
Personal Data Owner / Data Subject
This term refers to our employees, hotel guests, potential customers, visitors, business partners, suppliers, and other third parties whose personal data we process.
Definition of Personal Data
The types of data processed by Hotel Altınöz and considered personal data under the Law are listed below.
Unless expressly stated otherwise, the term "personal data" within the scope of this Policy shall include the following information:
1. Personal Data You Share With Us
This includes your name and surname, date of birth, Turkish Republic identification number, passport information, telephone number, email address, address information, reservation details, accommodation preferences, payment and billing information, information provided through surveys and campaigns, and other personal data you may have shared with us in any manner.
2. Other Information, Including Personal Data Collected Automatically
This includes information that may be collected automatically when you visit our website or use our digital services, such as IP address, cookie information, number of visits, time spent on the website, pages viewed, device information, and browser information.
3. Personal Data and Other Information Obtained from Other Sources
Contact, reservation, and customer information shared with us lawfully and, where necessary, with the required permissions by social media platforms, our business partners, travel agencies, online reservation platforms, and other third parties may also be processed within this scope.
Special Categories of Personal Data
Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health information, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data.
If the data being processed constitutes special categories of personal data as defined under the Law, such processing is carried out in accordance with the conditions stipulated by the applicable legislation, with the necessary administrative and technical measures being taken.
Data Controller
The data controller is the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Under the Law, the data controller is the person who determines the purposes and methods of processing personal data.
Accordingly, Hotel Altınöz acts as the data controller with respect to personal data processed within the scope of its activities.
Obligations of the Data Controller
1. Disclosure Obligation
The Law grants data subjects the right to obtain information about who processes their personal data, for what purposes and on which legal grounds such data may be processed, and to whom and for what purposes such data may be transferred.
Accordingly, within the scope of Article 10 of the Law, Hotel Altınöz provides data subjects with the following information when collecting personal data:
-
The identity of the data controller and, where applicable, its representative,
-
The purposes for which personal data will be processed,
-
The persons or entities to whom personal data may be transferred and the purposes of such transfers,
-
The method and legal basis for collecting personal data,
-
Other rights listed under Article 11 of the Law.
The rights of data subjects under Article 11 of the Law are as follows:
-
To learn whether their personal data has been processed,
-
To request information regarding the processing of their personal data,
-
To learn the purpose of processing their personal data and whether such data is used in accordance with its purpose,
-
To know the third parties to whom their personal data has been transferred domestically or internationally,
-
To request correction of their personal data if it has been processed incompletely or inaccurately,
-
To request the deletion or destruction of their personal data under the conditions stipulated by the Law,
-
To request notification of third parties to whom their personal data has been transferred regarding the correction, deletion, or destruction of such data,
-
To object to a result arising against them as a result of the analysis of their processed data exclusively through automated systems,
-
To request compensation for damages if they suffer damage due to unlawful processing of their personal data.
The data controller's obligation to inform the data subject continues even where data processing is carried out based on the data subject's explicit consent or on other legal grounds specified under the Law.
2. Obligations Regarding Data Security
Within the scope of the provisions of the Law concerning data security, Hotel Altınöz takes the necessary technical and administrative measures to:
-
Prevent the unlawful processing of personal data,
-
Prevent unlawful access to personal data,
-
Ensure the secure storage and protection of personal data.
Where personal data is processed on behalf of Hotel Altınöz by other natural or legal persons, Hotel Altınöz also takes the necessary measures to ensure data security.
Employees, business partners, and service providers who have access to personal data are subject to the necessary obligations regarding the confidentiality and security of personal data.
3. Responding to Applications Made by Data Subjects
Hotel Altınöz evaluates and concludes requests submitted by data subjects regarding the implementation of the Law as soon as possible and within the periods prescribed by the applicable legislation, depending on the nature of the request.
If an application is accepted or rejected with an explanation of the reasons, the data subject is informed in writing or electronically.
4. Compliance with Decisions of the Board
Decisions issued by the Turkish Personal Data Protection Board that concern Hotel Altınöz are implemented within the periods stipulated by the applicable legislation.
5. Obligation to Register with the Data Controllers Registry
Where required under applicable legislation, Hotel Altınöz fulfills its obligations to register with the Data Controllers Registry (VERBIS) and makes the necessary notifications regarding its data processing activities.
Data Processor
A data processor is a natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
In carrying out its activities, Hotel Altınöz works in compliance with applicable legislation with information technology companies, reservation systems, consultancy firms, and other service providers from which it receives services in personal data processing processes.
Processing of Personal Data
Processing of personal data refers to any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of such data, whether carried out wholly or partly by automated means or by non-automated means provided that the data forms part of a data recording system.
The purposes for which personal data will be processed by Hotel Altınöz are determined before the relevant data processing activity begins.
Personal data is processed by Hotel Altınöz in connection with accommodation, reservation, customer relations, security, and other services provided by the hotel, to the extent necessary.
Principles We Follow When Processing Personal Data
Hotel Altınöz acts in accordance with the following fundamental principles when processing personal data:
-
Being in compliance with the law and the principles of good faith,
-
Being accurate and, where necessary, kept up to date,
-
Being processed for specified, explicit, and legitimate purposes,
-
Being connected with, limited to, and proportionate to the purposes for which they are processed,
-
Being retained for the period stipulated by the applicable legislation or for the period necessary for the purposes for which they are processed.
Under What Circumstances May Your Personal Data Be Processed?
Your personal data may be processed on the following legal grounds:
-
Your explicit consent,
-
Where expressly provided for by law,
-
Where you are unable to give consent due to actual impossibility and processing is necessary for the protection of your life or physical integrity,
-
Where processing is directly related to the establishment or performance of a contract,
-
Where processing is necessary for Hotel Altınöz to fulfill its legal obligations,
-
Where the personal data has been made public by the data subject,
-
Where processing is necessary for the establishment, exercise, or protection of a right,
-
Where processing is necessary for the legitimate interests of Hotel Altınöz, provided that such processing does not adversely affect the fundamental rights and freedoms of the data subject.
How Long Will Your Personal Data Be Retained?
In accordance with the Turkish Personal Data Protection Law No. 6698, your personal data processed for the purposes specified in this Personal Data Processing and Protection Policy will be deleted, destroyed, or anonymized by Hotel Altınöz when the purpose requiring its processing ceases to exist and when the statutory retention periods stipulated by the applicable legislation expire.
Security of Personal Data
Hotel Altınöz takes appropriate technical and administrative measures in accordance with the relevant provisions of the Turkish Personal Data Protection Law in order to:
-
Prevent the unlawful processing of personal data,
-
Prevent unlawful access to personal data,
-
Ensure the secure storage and protection of personal data.
Hotel Altınöz continuously reviews its information security processes and implements necessary improvements in line with technological developments and current security risks.
Personal Data of Children and Minors
As the legal and factual capacity of our customers and visitors may not always be known, particular care is taken when processing the personal data of children and other minors.
Where necessary, the rights relating to the personal data of minors may be exercised through their legal representatives.
Periodic Destruction and Statutory Retention Periods
Physical and digital data for which the statutory retention and destruction periods have expired are periodically deleted, destroyed, or anonymized in accordance with applicable legislation.
Where Hotel Altınöz becomes subject to an obligation to delete, destroy, or anonymize personal data, the necessary procedures are carried out within the periods prescribed by applicable legislation.
Deletion and Destruction Process Upon Request by Data Subjects
If data subjects apply to Hotel Altınöz and request the deletion or destruction of their personal data, Hotel Altınöz first evaluates whether the legal conditions for processing the relevant personal data continue to exist.
If all conditions for processing the personal data cease to exist, the personal data subject to the request shall be deleted, destroyed, or anonymized.
If the conditions for processing continue to exist, the data subject shall be informed of the reasons for rejecting the request in accordance with applicable legislation.
Amendments to the Policy
This Policy may be amended in accordance with changes in applicable legislation and updates to Hotel Altınöz's personal data processing processes.
The current version of the Policy may be made available to data subjects through the Hotel Altınöz website and other communication channels deemed necessary.
Effective Date of the Policy
This Personal Data Processing and Protection Policy shall enter into force on the date it is published by Hotel Altınöz.
The Policy is made available to data subjects through the official Hotel Altınöz website.
This Policy has been prepared in accordance with the disclosure obligations of the data controller and the fundamental principles regarding the protection of personal data under the Turkish Personal Data Protection Law No. 6698.
