A. Purpose of the Protection and Processing of Personal Data Policy:
Doradus Turizm Gıda Sanayi ve Ticaret A.Ş. (the "Company"), a leading brand in the Tourism, Hotel Management and Accommodation sector in Turkey, shows maximum sensitivity to the security of your personal data as the data controller. As the result of this awareness and culture, we attach great importance to the processing, recording, transferring, sharing and storing of all personal data belonging to all persons associated with our Company, including those who benefit from our products and services, in accordance with the Law no. 6698 on Protection of Personal Data ("Law on Protection of Personal Data - LPPD")
Protection of personal data is among the fundamental mission and policies of our Company and our Company has always attached the utmost importance to the privacy of personal data and has adopted this as a work principle. Our Company accepts and declares to comply with all responsibilities stipulated by the Law on Protection of Personal Data. With full awareness of this responsibility and with the title of data controller, we process, record, transfer, share and store your personal data as explained below and within the limits set forth by the relevant legislation.
B. Collection, Processing and Purposes of Personal Data Processing
This Disclosure Statement regarding the protection of personal data and privacy by our Company has been issued in accordance with the Law on Protection of Personal Data. In this framework, although it may vary depending on the commercial activities and services and products provided by our Company, your personal data such as your identity information (name-surname, place and date of birth, nationality, TR ID. number, accompanying guest name-surname, place and date of birth), contact information (address, telephone number, e-mail address), financial information (bank account information), sensitive personal data (photo, health status, drug use information), other information (room number, vehicle license plate information, smoking information, allergen status information, etc.) may be collected verbally, in writing or electronically by transmission and other means using automatic or non-automatic methods through offices, call centers, website, sending e-mails, social media channels, mobile applications, online sales platforms, tourism agencies, organization companies, business card sharing in fair or seminar visits, solution partner institutions or organizations. As long as you benefit from our Company's products and services, whenever you visit our website or social media channels, and you use our call center or website, and whenever you participate in seminars or organizations organized by our Company, they can be processed by upon being created and updated. In this framework, your personal data obtained from you with your consent or due to the reasons of compliance with the law as stated in the relevant legislation may be processed by our Company and its associated Companies/affiliates and other natural and/or legal entities specified in Article (F) below in line with the purposes listed below and within the scope of the personal data processing terms and purposes specified in Articles 5 and 6 of the Law on Protection of Personal Data.
a. Ensuring that you can benefit from the products and services offered by our Company, customizing the services offered by our company according to your preferences, usage habits and needs, offering them and making their quality much better,
b. Informing you regarding the general and special campaigns, promotions, discounts and similar advantages offered by our Company, and ensuring that you can benefit from them,
e. When you log in to the website with your username and password in order to receive services from the channels offered by our Company, your personal data in the relevant channels, your preferences, transactions, together with your browsing time may be processed in order to provide the information and services you request,
f. To make notifications about the website memberships of our Company and its associated companies/affiliates and any loyalty card issued and/or to be issued by our Company and its associated Companies affiliates, and for all kinds of communication that may be established with you, and to inform your about new services and products to be offered, and changes, innovations and similar issues that may occur in personal data policies and membership conditions,
g. Ensuring the legal and commercial security of our Company and those who have business relations with our company,
h. Ensuring safety and managing accidents or other similar incidents for medical-insurance purposes,
i. Developing and improving our product range, services, information technology systems and security systems,
j. Ensuring the safety of those in our facilities by using video camera (CCTV) images and to establish or defend our legal rights by helping to prevent, detect and prosecute criminal offenses by also taking into account the relevant photographs,
k. Determining and implementing our Company's commercial and business strategies,
l. Informing you about the information, activities and services you might request from our company,
m. Fulfilling a legal obligation stipulated by legislation, if clearly stated in the legislation or if necessary, and
n. Combating force majeure, including infectious pandemics such as COVID-19.
C. The Method and Legal Reason of Collection of Personal Data
Your personal data may be collected in any verbal, written or electronic environment in order to provide our products and services within the legal framework determined for the purposes stated in the above-listed articles and to fulfill our Company's responsibilities arising from the contract and/or legislation in a complete and correct manner. Your personal data acquired for the above-listed legal reasons are processed, recorded, transferred, shared and stored for the purposes specified in Article (B) of this Statement within the scope of the personal data processing terms and purposes specified in Articles 5 and 6 of the Law on Protection of Personal Data.
D. Processing of Sensitive Data
In Article 6 of the Law on Protection of Personal Data, certain personal data bearing the risk of causing victimization or discrimination of the individual when processed illegally are specified as "sensitive data". Such data include any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures. Our Company acts in accordance with the regulations set forth in Article 6 of the Law on Protection of Personal Data in terms of processing sensitive personal data and acts in a sensitive and confidential manner in the protection of these data.
Our Company processes sensitive personal data in accordance with the Law on Protection of Personal Data in the following cases, provided that adequate measures are taken by the Protection of Personal Data Board:
a. If there is explicit consent of the personal data owner,
Our guests can request customized services by sharing their conditions with our Company, and share their sensitive data with us for this purpose (For example, different pillow requests to be used due to an illness, special food requests due to allergies, etc.). Our company will only process the sensitive data of the persons who have granted their express consent in this regard and only for the purpose of collecting them, so that we can provide special services in line with the needs of our guests they defined by sharing their sensitive data and to be able to remember their preferences in the future and provide the same services to them again.
b. If there is no explicit consent of the personal data owner:
• Sensitive personal data apart from those relating to health and sexual life of the Personal Data Owner may be processed in cases set forth in the Law,
• Sensitive personal data relating to health and sexual life of the Personal Data Owner may only be processed by persons who is subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.
E. Force Majeure
Personal and sensitive personal data may be processed within the scope of measures taken or to be taken for force majeure events such as, but not limited to, COVID-19 and similar global or regional pandemics, infectious diseases, earthquakes, floods, wars, and state of emergency.
F. To whom and for what purposes the processed data may be transferred:
Your collected personal data may be transferred to our group companies, shareholders, business partners, suppliers, legally authorized institutions and persons in accordance with the personal data processing terms and purposes specified in Articles 8 and 9 of the Law on Protection of Personal Data in order to serve the purposes specified in Article (B).
Your personal data will also be transferred without seeking the explicit consent of the person concerned in accordance with Article 8(2)(a) of the Law on Protection of Personal Data for the following purposes:
• They will be disclosed to the General Directorate of Security in order to fulfill our legal obligations arising from the relevant legislation
• They may be disclosed to notary, enforcement offices and/or courts, if necessary, in order to carry out financial and/or accounting affairs within the scope of the collection of fees for products and services.
• They may be disclosed to the relevant public institutions and organizations, if required or requested, in order to fulfill legal obligations in accordance with the relevant legislation.
• They will be shared with the contracted cargo company in order to deliver the belongings left and forgotten at the hotel.
• They may be shared with our lawyers as required within the framework of the confidentiality obligation in order to follow-up the legal proceedings.
G. Transferring Personal Data Abroad:
Our company, in accordance with the terms determined by the Personal Data Protection Board as per the Law on Protection of Personal Data, may transfer personal data abroad in accordance with other terms in the Law and after obtaining the express consent of the person for this purpose, or in cases where the conditions stipulated in the Law on Protection of Personal Data are present and there is sufficient protection in the country to be transferred or in cases where the conditions stipulated in the Law on Protection of Personal Data are present and where sufficient protection is undertaken by the relevant country despite the absence of sufficient protection in the country to be transferred and where the Personal Data Protection Board has the permission.
For instance; if you receive a service through a certain service provider such as an agency abroad, online reservation service, etc., or if you have made the payment to us through a bank abroad, we may transfer your personal data abroad without obtaining your consent, limited to processing purposes.
H. Your Data Protection Rights and Freedoms
Within the scope of the Law on Protection of Personal Data, we acknowledge that the person concerned has the right to be informed and to consent/not to consent prior to the processing, recording, transferring, sharing and storage of his/her personal data, and that he/she has the right to determine the fate of his/her data after the data is processed, recorded, transferred, shared and stored. In this framework, if you submit your requests regarding your rights as personal data owners to our Company with the manners set out below in the Disclosure Statement on Processing of Personal Data, our Company will fulfill such request free of charge within thirty days at the latest, depending on the nature of the request. However, if the procedure requires an additional cost, we will charge the fee indicated in the price list determined by the Personal Data Protection Board.
Within the scope of the current Data Protection Legislation data owners have the following rights:
a. To learn whether his/her personal data are processed or not;
b. To demand for information as to if his/her personal data have been processed;
c. To learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose;
ç. To know the third parties to whom his personal data are transferred in country or abroad;
d. To request the rectification of the incomplete or inaccurate data, if any;
e. To request the erasure or destruction of his/her personal data;
f. to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred;
g. To object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems, and
h. To claim compensation for the damage arising from the unlawful processing of his/her personal data.
On the other hand, within the scope of Article 28 (1) of the Law on Protection of Personal Data, data owners may not exercise the abovementioned rights listed in Article 11 of the Law on Protection of Personal Data in the following cases where:
a. Personal data are processed by natural persons within the scope of purely personal activities of the data owner or of family members living together with him/her in the same dwelling provided that it is not to be disclosed to third parties and the obligations about data security is to be complied with;
b. Personal data are processed for official statistics and provided that they are being anonymized for the purposes for such as research, planning and statistics;
c. Personal data are processed with artistic, historical, literary or scientific purposes, or within the scope of freedom of expression provided that national defense, national security, public security, public order, economic security, right to privacy or personal rights are not violated or the process doesn’t constitute a crime;
d. Personal data are processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorized and assigned by law to maintain national defense, national security, public security, public order or economic security;
e. Personal data are processed by judicial authorities or execution authorities with regard to investigation, prosecution, judicial or execution proceedings.
However, within the framework of Article 28(2) of the Law on Protection of Personal Data, and excluding the right to claim compensation, the rights listed in Article 11 of LPPD shall not be applied in the following cases where personal data processing:
a. is necessary for the prevention of committing a crime or for crime investigation;
b. is carried out on the data which are made public by the data owner himself/herself;
c. is necessary for performance of supervision or regulatory duties and disciplinary investigation and prosecution to be carried out by the assigned and authorized public institutions and organizations and by public professional organizations, in accordance with the power conferred on them by the law;
d. is necessary for protection of economic and financial interests of State related to budget, tax and financial matters.
I. Periods for Processing Your Personal Data:
In case a certain period is stipulated under the respective law/regulations for the storage of the personal data, the data in question have to be stored for a period no shorter than such period. Due to the possibility of late delivery of the requests from courts or administrative authorities authorized by law or occurrence of a dispute that we might directly be a party to, a period of 6 months - 1 year is added to the periods stipulated in the legislation for the storage of your data, and the storage period of the data is determined in this manner and the said data is deleted at the end of such specified period.
In case no specific period is stipulated for the storage of the data we process in the respective regulations, your data are stored for a period that is determined as per of our relationship with you, and respectively stipulated under the contract we enter into with you. According to Article 7/f1 of the Law on Protection of Personal Data, when the purpose of processing your personal data ceases to exist and the periods of limitation within which we are required to process your data in accordance with the legislation have expired, your personal data will be deleted, destroyed or continued to be used upon being anonymized by us.
J. Conditions Where Your Personal Data Can Be Processed Without Your Explicit Consent As Per The Laws:
Pursuant to Article 5 of the Law on Protection of Personal Data, our Company may process your above-mentioned personal data, which it has received in accordance with the Law, without seeking your explicit consent only in cases where one of the following conditions is met:
• It is expressly provided for by the laws,
• It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent as the data owner due to the physical disability or whose consent is not deemed legally valid,
• Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract executed by our Companies and associated Companies/affiliates and other natural and/or legal entities specified under this Statement;
• It is necessary for compliance with a legal obligation to which our Companies are subject;
• Personal data have been made public by the data owner himself/herself;
• Data processing is necessary for the establishment, exercise or protection of any right;
• Processing of data is necessary for the legitimate interests pursued by our Company, provided that this processing shall not violate the fundamental rights and freedoms of the data owner.
K. To make a request in accordance with the Law on Protection of Personal Data:
Pursuant to the 1st paragraph of Article 13 of the Law on Protection of Personal Data, you can send your request to exercise your rights mentioned above to our Company using the manners specified in the Law on Protection of Personal Data and as set forth under the relevant legislation and as determined by the Personal Data Protection Board or you can make a request by filling and signing the Application Form by clicking here using one of the following methods. The personal data we collect must be accurate and, when necessary, up to date. Therefore, in the event of any change in your personal data, please notify this matter to the relevant department of our Company. You can submit any of your questions or comments regarding this data privacy statement and our confidentiality practices to the Company's data protection officer. (e-mail address: kvkk@mardiushotel.com)
a. You may deliver a signed copy of the form containing your explanations regarding your requested right to: Teker Mah., 94. Şirin Sok., No:16 Artuklu – Mardin / Türkiye together with official documents (for example, identity card, driver's license, passport, etc.) personnally.
b. You can send the form you fill out and official documents identifying you through a Notary public.
c. You can send the form you fill out and the documents identifying you electronically to kvkk@mardiushotel.com with secure electronic signature or mobile signature.
d. You can submit the form you fill out and the documents identifying you to our Company as the Data Controller by using the e-mail address you previously notified to our Company which is registered in our Company's system.
Our company will ensure that the request is concluded free of charge within 30 days at the latest, depending on the nature of your request. However, if the procedure requires an additional cost, we will charge the fee indicated in the price list determined by the Personal Data Protection Board.
Rights regarding personal data can only be used for personal data of the respective person. Requests regarding data of persons other than of those who filled out the form and has official identification documents attached to the request will not be taken into consideration. Forms sent without any official documents identifying you will not be taken into consideration. We would like to inform you that we are obliged to share the data with the official authorities if requested by the official authorities, even after data deletion requests are fulfilled.
In applications to be made by third parties on behalf of the data owner, a copy of the notarized power of attorney is required to be sent to us together with the Form, and for applications to be made on behalf of children under custody/guardianship, copy of the documents proving the custody/guardianship relationship are required to be sent to our Company together with the Form.
Within seven (7) days from the date your request for obtaining information is received by our Company, the Company may contact you to confirm that you are the data owner and may request some information and documents from you in order to ensure the security of your personal data.
If the requested information and documents are incomplete, the information and documents need to be completed and forwarded to us upon our request. Until such information and documents are fully sent to us, the thirty (30) days period specified in article 13/2 of the LPPD for the finalization of the request will be suspended.
L. Internet Access
Internet access is provided to our visitors who request it, throughout the period of time they spend in our premises and workplaces.
In that case, the log records relating to your internet access are recorded in accordance with the Law No. 5651 and the mandatory provisions of the legislation enacted on the basis of the said Law, and these records are processed if required by the authorized public institutions and entities or to fulfill our legal obligation during the inspection processes to be carried out in-house
The company employees who have access to such records access these in order to use them upon demands from the competent public authorities and entities or during audit processes and disclose these only to legally authorized persons.
M. Processing of Personal Data Collected Via Cookies
You consent to the use of personal data obtained and collected through our website by using our website. When you share your personal data, our Company may send press releases or notifications to you via e-mail, send printed publications or other correspondence, process your reservation requests and create commercial statistics and analysis regarding the use of the website.
Our company uses certain cookies to remember the preferences you make on our website and mobile applications, thereby providing you with an enhanced and personalized experience in line with your preferences. Your personal data are processed and transferred through the cookies used on our digital platforms, and our Company also uses cookies to improve the functioning and use of our internet pages and/or mobile applications. Cookies may also be used to change our products and services that you are interested in and need, or to help you perform your transactions faster when you visit our website again.
Necessary technical and administrative measures are taken by our Company to ensure the security and confidentiality of personal data collected through cookies, in accordance with Article 12 of the Law on Protection of Personal Data.
Our Company reserves the right to update this “Disclosure Statement on Protection of Personal Data” at any time within the framework of the changes that can be made in the current official legislation.
EXPLICIT CONSENT WITHIN THE SCOPE OF THE LAW ON THE PROTECTION OF PERSONAL DATA
I hereby accept and declare that our personal data belonging to me and other persons data/information of whom I have provided to the Company, as well as private or sensitive personal information/data can be directly or indirectly processed in accordance with the general principles and regulations stated in the Data Protection Legislation and the Disclosure Statement; and they can also be obtained, recorded, securely stored in physical or electronic media for an appropriate period of time for processing, maintained, changed, reissued, disclosed and transferred in accordance with the legislation, taken over, classified, processed or the use of data may be prevented in accordance with the relevant provisions of the Law no. 6698 on Protection of Personal Data ("LPPD") and the secondary legislation taking its legal basis from it and the decisions of the Personal Data Protection Board (collectively referred to as "Data Protection Legislation") and within the framework of the Disclosure Statement on Processing of Personal Data ("Disclosure Statement") prepared for the protection of our personal data submitted to our information and review by Doradus Turizm Gıda Sanayi ve Ticaret AŞ ("Company") and also announced on the website of the Company, in order to carry out the works and actions specified in the Disclosure Statement by the Company as the data controller or by the data processors authorized ensuring that the necessary security measures are taken, and that I have been informed by the Company about the above-mentioned issues and that I hereby grant my explicit consent in this regard within the framework of the Data Protection Legislation.
I hereby acknowledge that, in accordance with the Disclosure Statement prepared by the company as per the Data Protection Legislation and Article 11 of the LPPD and submitted to my information, I have the right to submit my written request regarding my rights and the explanations about my right/rights I request to exercise to kvkk@mardiushotel.com as stated in the Disclosure Statement or to the Company by other means as specified in the LPPD or in the Disclosure Statement. In addition, I agree and declare that the personal data I have shared with the Company are accurate and up-to-date, and in the event of a change in this information, I will immediately notify the Company of the changes.