As Marmaris Turistik ve Hotel İşletmeciliği A.Ş., we attach great importance to ensuring the security of your personal data. In this context, in accordance with the “Personal Data Protection Law” No. 6698, we take the necessary measures to ensure the appropriate level of security in order to prevent unlawful processing and access to your personal data and to ensure its preservation during the processing and transfer of your personal data to third parties. For this reason, this declaration has been prepared to inform the relevant persons whose personal data is obtained within the scope of Marmaris Turistik ve Hotel İşletmeciliği A.Ş. activities.
This declaration issued by our Company is dated 08.04.2016. In the event that the entirety or certain articles of the Declaration are renewed, the effective date and version of the Declaration will be updated. The Declaration is published on our Company’s website [www.elegancehotels.com.] and made accessible to the relevant persons.
1. PERSON PROCESSING YOUR DATA:
Our Company will start processing your personal data by ensuring data security once you give your explicit consent to the processing of your personal data or, in cases where explicit consent is not required, upon notification. While processing your personal data, we may authorize one or more data processors and process your data for them by providing the necessary level of security.
2. LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA, METHODS THAT CAN BE OBTAINED AND WHICH DATA WILL BE PROCESSED:
Your personal data will be used in accordance with the provisions of the Identity Notification Law No. 1774 and Regulation, the Population Services Law No. 5490 and Regulation, the Turkish Civil Code, occupational health and safety legislation and other legislation, for your accommodation in our hotel in a legally compliant and safe manner, to provide services related to our Company’s fields of activity, to increase the quality of these services and to fulfill other activities and to comply with information obligations. In addition, your personal data in ANNEX-1 is processed for the purposes of allowing you to visit our hotel, protecting security and legitimate interests related to your visit, providing the necessary services in the best way possible, communicating about the products and services you have received/will receive in this regard, and also using them in marketing activities, offering products/services, increasing customer satisfaction, providing better service in your next stays, modeling, reporting, scoring, risk monitoring, current or new product studies and identifying potential customers.
For this purpose, we share your personal data that we process with our affiliates and business partners located in Turkey and abroad. The current list of our affiliates and business partners is available at [www.elegancehotels.com].
3. SHARING YOUR PERSONAL DATA:
Your personal data; through our company, our affiliates, business partners and employees, through other forms filled out before accommodation, our digital marketing and call centers, our website, our social media channels, information sent by e-mail and all other channels, it can be collected verbally, in writing or electronically with your consent.
This information form is an attachment and an integral part of all kinds of contracts and service requests that you have signed with Marmaris Turistik ve Hotel İşletmeciliği A.Ş. on behalf of our company and our company.
4. DESTRUCTION OF YOUR PERSONAL DATA:
Our company stores the personal data it processes for the periods specified by the legislation, and if no period is specified in the legislation; personal data is stored for the period required to be processed in accordance with the practices and customs of our company’s commercial life, depending on the services provided by our company while processing that data, and after this period, only for the periods determined to be necessary in practice in order to constitute evidence in possible legal disputes. After the expiration of the specified periods, the personal data in question is deleted, destroyed or anonymized on the first destruction date in accordance with Article 7 of the Personal Data Protection Law.
5. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA:
You can contact our company within the framework of Article 11 of the PDP Law and convey the following requests to us;
a. To learn whether your personal data has been processed, and if so, to request information about it,
b. To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
c. To learn the third parties to whom your personal data has been transferred domestically or abroad,
d. To request correction of personal data if it has been processed incompletely or incorrectly,
e. To request deletion, destruction or anonymization of your personal data in the event that the reasons requiring the processing of your personal data within the scope of Article 7 of the PDP Law are eliminated,
f. To request notification of the transactions carried out pursuant to subparagraphs (d) and (e) to third parties to whom your personal data has been transferred,
To object to the emergence of a result against you by analyzing the processed data exclusively through automated systems,
g. Requesting compensation for damages in case of damages due to unlawful processing of your personal data.
Personal data owners may submit their requests regarding the above-mentioned rights to our Company by filling out the form at [www.elegancehotels.com] completely, signing it with a wet signature and sending it to [209 Sokak. No:4 48700 Marmaris / Muğla] by registered letter. Requests submitted to our Company in accordance with the procedure will be finalized within thirty days at the latest. If the completion of such requests requires an additional cost, our Company will charge the applicant the fee specified in the tariff determined by the Personal Data Protection Board.
Our Company may request information from the relevant person in order to determine whether the applicant is the personal data owner and may ask questions to the personal data owner regarding his/her application in order to clarify the issues specified in the application.
Our Company may reject the application of the applicant by explaining the reason in the following cases:
• Processing of personal data for purposes such as research, planning and statistics by making them anonymous with official statistics.
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy or personal rights or does not constitute a crime.
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order or economic security.
• Processing of personal data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial or execution procedures.
• Processing of personal data is necessary for preventing a crime or for criminal investigation.
• Processing of personal data made public by the personal data owner.
• Processing of personal data is necessary for the performance of supervisory or regulatory duties and disciplinary investigation or prosecution by authorized public institutions and organizations and professional organizations with the status of public institution based on the authority granted by law.
• Personal data processing is necessary to protect the economic and financial interests of the State in relation to budget, tax and financial matters.
• The request of the personal data owner is likely to impede the rights and freedoms of other persons.
• Requests requiring disproportionate effort have been made.
• The requested information is public information.
In the event that the application is rejected, the response is found insufficient or the application is not responded to in a timely manner in accordance with Article 14 of the Personal Data Protection Law, the personal data owner may file a complaint with the Board within thirty days from the date of learning of our Company’s response and, in any case, within sixty days from the date of application.
ANNEX-1: Categories of Personal Data
Identity information All information included in documents such as Driver’s License, Identity Card, Residence, Passport, Attorney’s ID, Marriage Certificate, which is clearly identified as belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Contact information Information such as telephone number, address, email, which is clearly identified as belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Customer information Information obtained and produced about the relevant person, authorized or employee of the customer, as a result of our commercial activities and the operations carried out by our business units within this framework; Customer transaction information Information clearly identified as belonging to an identified or identifiable natural person and included in the data recording system; information such as records regarding the use of our products and services and the instructions and requests required for the use of the products and services by the customer Physical location security information Personal data clearly belonging to an identified or identifiable natural person and included in the data recording system; related to the records and documents received upon entering the physical location and during your stay in the physical location Transaction security information Your personal data clearly belonging to an identified or identifiable natural person and included in the data recording system; processed for the purposes of ensuring the fulfilment of technical, administrative, legal and commercial obligations while carrying out our commercial activities Risk management information Personal data clearly belonging to an identified or identifiable natural person and included in the data recording system; processed through methods used in accordance with generally accepted legal, commercial practices and the rule of good faith in these areas in order to manage our commercial, technical and administrative risks Financial information clearly belonging to an identified or identifiable natural person and processed partially or fully automatically or non-automatically as part of the data recording system; Personal data of the customer’s authorized or employee regarding information, documents and records showing all kinds of financial results of the customer
Identity information
All information included in documents such as Driver’s License, Identity Card, Residence, Passport, Lawyer’s ID, Marriage Certificate, which are clearly related to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system;
Contact information
All information such as telephone number, address, email, which are clearly related to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system;
Customer information
All information such as telephone number, address, email, which are clearly related to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; information obtained and produced about the relevant person, authorized or employee of the customer, as a result of our commercial activities and the operations carried out by our business units within this framework
Customer transaction information
Information such as records regarding the use of our products and services, which are clearly related to an identified or identifiable natural person and are included in the data recording system, and the instructions and requests required for the use of the products and services by the customer
Physical location security information
Personal data regarding records and documents taken at the entrance to the physical location, during the stay in the physical location, which are clearly related to an identified or identifiable natural person and are included in the data recording system
Transaction security information
Your personal data, which is clearly related to an identified or identifiable natural person and is included in the data recording system; processed for the purposes of ensuring the fulfillment of technical, administrative, legal and commercial obligations while conducting our commercial activities
Risk management information
Personal data, which is clearly related to an identified or identifiable natural person and is included in the data recording system; processed through methods used in accordance with generally accepted legal, commercial practices and rules of integrity in these areas in order to manage our commercial, technical and administrative risks
Financial information
Personal data of the authorized person or employee of the customer regarding information, documents and records showing all kinds of financial results of the customer, which is clearly related to an identified or identifiable natural person and is processed partially or fully automatically or non-automatically as part of the data recording system