Privacy Notice (KVKK)

DOĞALARA TURİZM VE İNŞAAT TİCARET LİMİTED ŞİRKETİ

LAW ON THE PROTECTION OF PERSONAL DATA

PRIVACY NOTICE FOR INDIVIDUAL CUSTOMERS, GUESTS, VISITORS, SUPPLIERS AND BUSINESS PARTNERS

As DOĞALARA TURİZM VE İNŞAAT TİCARET LİMİTED ŞİRKETİ (referred to as “MD BARBAROS Hotel” or the company), protecting the fundamental rights and freedoms of our customers, guests and visitors, protecting the privacy of their private lives and ensuring information security are among our priority principles, and we would like to inform you about “The Protection of Personal Data”. MD BARBAROS Hotel reserves the right to update this Privacy Notice at any time in line with changes that may be made to the legislation in force.

Since your personal data may be collected pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 (the “Law”) and the European Union General Data Protection Regulation (“GDPR”), we have an obligation to inform you about the method and legal basis of collecting personal data, the purposes for which your personal data is processed by our Company, the third parties to whom your personal data is disclosed/transferred and for what purposes, and your rights as a data subject.

The target audience of this notice is all natural persons whose personal data is processed by our Company, other than our employees or job applicants.

Personal Data Processed:

If you are a hotel guest or visitor whose personal data we obtain and process, the personal data we obtain and process is as follows:

Identity Data: Name, surname, Turkish ID number, passport number, vehicle plate, marital status, date, gender,

• Contact Data: Email address, address and telephone number,

Physical Premises Security Information: Camera recordings taken at the entrance to the physical premises and during the stay inside, etc.

• Visual and Audio Data: Camera recordings,
• Financial Information: IBAN number,
• Transaction Security Information: IP address information, website login and logout information, password information,
• Customer Transaction Information: Call centre records, invoice, promissory note and cheque information, order information, request information,
• Risk Management: Information processed to manage commercial, technical and administrative risks,

How and Why Do We Collect Your Personal Data? What Are the Legal Grounds?

Your personal data is stored by various methods, verbally, in writing or electronically, through various channels such as our call centre, our corporate website, email or other means, technical communication files called “cookies” (small files placed on your hard drive) that allow our computers to recognise you automatically when you visit our website, and physical forms at guest check-in.

It may be processed based on the grounds stated in Articles 5 and 6 of the Law on the Protection of Personal Data No. 6698 and the lawful grounds given below.

Processing of data being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

• Processing of the personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract,
• Providing the requested products and services and fulfilling the requirements of the contracts you have concluded,
• Being mandatory for the fulfilment of a legal obligation,
• Data processing being mandatory for the establishment, exercise or protection of a right,

For What Purposes Do We Process Your Personal Data?

Your personal data lawfully obtained by us is processed in order to fulfil our legal obligations and, within the scope of the Company’s legitimate interests and without harming your rights, to carry out the service procurement processes of guests and visitors.

Your personal data will be kept for the maximum period stated in the relevant legislation or necessary for the purpose for which it is processed, and for the statutory limitation periods. The retention period may vary according to the categories of personal data and the purposes of processing.

• Carrying out emergency management processes
• Carrying out access authorisations
• Carrying out activities in compliance with the legislation
• Carrying out finance and accounting affairs
• Ensuring physical premises security
• Following up and carrying out legal affairs
• Carrying out communication activities
• Carrying out / auditing business activities
• Carrying out occupational health / safety activities
• Carrying out business continuity activities
• Carrying out after-sales support services for goods / services
• Carrying out sales processes for goods / services
• Carrying out production and operation processes for goods / services
• Carrying out customer relationship management processes
• Carrying out storage and archive activities
• Carrying out contract processes
• Following up requests / complaints
• Carrying out marketing processes for products / services
• Ensuring the security of data controller operations
• Providing information to authorised persons, institutions and organisations
• Carrying out management activities
• Creating visitor records
• Carrying out processes related to accommodation services

Where Do We Transfer Your Personal Data?

Your data is not shared with unrelated third parties. The personal data of our guests is shared with the Police Department pursuant to the Law on Notification of Identity, and may be shared with private persons and authorised public institutions and organisations if requested under other legislation.

• Your Rights
• Under Article 11 of the KVKK, by applying to us in person and proving your identity, regarding your personal data;

You can learn whether we process personal data about you and, if we do or have done so, request information about it.

You can learn the purpose of processing your personal data and whether it is used in accordance with that purpose.

You can learn whether your personal data is transferred domestically or abroad and to whom.

You can request the correction of incorrect or incomplete personal data and that the recipients to whom this data has been or may have been transferred be informed.

You can request the destruction (deletion, destruction or anonymisation) of your personal data within the conditions set out in Article 7 of the KVKK. However, which method is appropriate will be assessed by us according to the circumstances of the specific case when evaluating your destruction request. In this context, you can always ask us why we chose the destruction method we selected.

You can request that the third parties to whom your personal data has been or may be transferred be informed about your destruction request.

You can object to the results of an analysis of your personal data produced exclusively by an automated system if the results are against your interests.

If you suffer damage because your personal data has been processed unlawfully, you can request compensation for the damage.

The requests in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, if the process requires an additional cost for the Company, the fee in the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged.

• Method of Making a Request Under the Law on the Protection of Personal Data

Pursuant to the first paragraph of Article 13 of the KVK Law, you can submit your request regarding the exercise of the rights mentioned above to our Company by the methods determined/to be determined by the Personal Data Protection Board. To exercise these rights in Article 11 of Law No. 6698, you can always contact DOĞALARA TURİZM VE İNŞAAT TİCARET LİMİTED ŞİRKETİ by sending an email. On matters concerning your personal data, only the email address info@mdbarbaroshotel.com

should be used. Rights relating to personal data can only be exercised by persons regarding their own data. Forms without official documents identifying you attached will not be considered.

DATA CONTROLLER CONTACT DETAILS

DOĞALARA TURİZM VE İNŞAAT TİCARET LİMİTED ŞİRKETİ

• Mersis No: 0302052861000018
• Website: http://www.mdbarbaroshotel.com/
• Email: info@mdbarbaroshotel.com
• Address: BARBAROS MAH. TROYA CAD. BARBAROS HOTEL BLOK NO: 20-22 MERKEZ / ÇANAKKALE