Personal Data Protection Notice

1. Who is responsible for your data

This notice is given under article 10 of the Turkish Personal Data Protection Law no. 6698 ("KVKK"). The data controller is the company operating Salapurya Hotel:

Data controller

Eyka Saygın Gıda İnş. Turz. Tem. Hiz. Tic. ve San. Ltd. Şti.

Trading as

Salapurya Otel

Address

Memiş Mah., Murat Yenigün Cd. No: 67, 37600 Cide / Kastamonu

Telephone

+90 542 366 18 13

E-mail

otel@salapurya.com

Accommodation licence

Basic Accommodation — 2022-37-0028

2. What we process

Depending on whether you enquire, book or stay with us, we may process:

• Identity data — name and surname, and for guests who stay, the identity or passport details we are obliged to record.
• Contact data — telephone number, e-mail address, and billing address where an invoice is requested.
• Reservation data — arrival and departure dates, room, number of guests, and any request or note you give us.
• Financial data — the bank transfer details of the payment, and the information needed to issue an invoice.
• Correspondence — the content of e-mails, messages and requests you send us.

3. Why we process it

• To take, confirm and hold your reservation, and to perform the accommodation contract.
• To meet the guest notification obligations imposed on accommodation businesses by law no. 1774 on Identity Notification.
• To issue invoices and meet our obligations under tax and accounting legislation.
• To take payment and, where a booking is cancelled, to make the refund.
• To answer your questions, requests and complaints.
• To resolve any dispute and to establish or defend a legal claim.

4. On what legal grounds

We rely on the grounds in article 5(2) of KVKK, namely:

• Article 5(2)(c) — processing is necessary for the conclusion or performance of a contract, for reservation and accommodation data.
• Article 5(2)(ç) — processing is necessary for compliance with a legal obligation, for the identity records and notifications required by law no. 1774 and for tax and accounting records.
• Article 5(2)(e) — processing is necessary for the establishment, exercise or defence of a right, where a dispute arises.
• Article 5(2)(f) — processing is necessary for our legitimate interests, without prejudice to your fundamental rights, for keeping records of guest requests and correspondence.

5. Who we share it with

We share personal data only where we have to, and only to the extent required:

• Law enforcement and authorised public authorities, under the notification obligation in law no. 1774 and in response to lawful requests.
• Our accountant and financial advisers, for invoicing and statutory bookkeeping.
• Banks, to the extent needed to receive a payment or make a refund.

6. Transfers abroad

We do not transfer guest personal data abroad. Reservation and guest records are kept in Türkiye.

7. How we collect it

Personal data is collected by wholly or partly non-automated means: over the telephone when you call to book, in writing by e-mail or messaging, and in person at the desk on arrival. This website has no booking form, no account and no payment screen, so no personal data is collected through the site itself. What the site does is described in the privacy policy.

8. How long we keep it

We keep personal data for as long as the purpose requires and for the periods prescribed by legislation — in particular the retention periods under tax legislation and the record-keeping obligations under law no. 1774 — and for the limitation period applicable to any claim. When those periods expire the data is deleted, destroyed or anonymised.

9. Your rights

Under article 11 of KVKK you have the right to:

• learn whether your personal data is being processed;
• request information about it if it has been processed;
• learn the purpose of the processing and whether the data is used in accordance with that purpose;
• know the third parties to whom the data has been transferred, in Türkiye or abroad;
• request that incomplete or inaccurate data be corrected, and that the correction be notified to those it was transferred to;
• request deletion or destruction where the grounds for processing have ceased, and that this be notified to those it was transferred to;
• object to a result reached solely by automated analysis of your data which is to your detriment;
• claim compensation for damage suffered as a result of unlawful processing.

10. How to exercise them

Write to us at the address above, or e-mail us, using the methods in the Communiqué on the Procedures and Principles of Application to the Data Controller. Please state your name, your Turkish ID or passport number, an address for the reply, and what you are asking for, clearly enough for us to identify your records. We will answer within thirty days at the latest, and free of charge unless the request requires a separate cost.

By post

Memiş Mah., Murat Yenigün Cd. No: 67, 37600 Cide / Kastamonu

By e-mail

otel@salapurya.com