Personal Data Protection

Dear guests and visitors,

As Macartaşı Hotel ("Company"), we prioritize the security of your personal data. With this awareness, we process all kinds of personal data belonging to all our guests and visitors related to the Company, including those benefiting from our products and services, in accordance with the Law on Protection of Personal Data numbered 6698 ("PDPL"), and attach great importance to their preservation.

1. Collection, Processing, and Processing Purposes of Personal Data

Our company primarily processes the personal data of guests and visitors specified in this Information Note during the establishment of contracts. In this context, the processed personal data are limited to identity information, contact information, and bank account information, as well as 24-hour camera recordings within the facility for the general security of our guests. These data are processed based on the legal reasons of obtaining and performing the relevant contract or fulfilling legal obligations, and are stored for the purpose of carrying out service procurement processes, contract management, accounting transactions, and security purposes. Personal data processed within this scope are deleted or destroyed if there is no legitimate purpose for their retention after the termination of the underlying commercial contract. However, data that may need to be kept by our Company as a means of proof in possible commercial disputes are kept by our Company for the statutory prescription periods. The principles and procedures determined in the Decision No. 2018/10 of the Personal Data Protection Board are complied with in the retention of special category data.

The identity information of individuals who enter our company's administrative headquarters and facilities as visitors and guests, entry and exit times to the headquarters and facilities, vehicle license plates, the purpose of the visit, and the names of the individuals they visited, as well as the image recordings on security cameras, are processed based on the legal reason of protecting the legitimate interests of our Company, ensuring the security of both our Company and our guests and visitors. The data are also processed for the purpose of ensuring the security of the facilities and employees, and are stored in part in written, part in electronic, and part in digital form, in compliance with the legislation. Personal data collected within this scope are not used for purposes other than those specified; they are processed based on the legal reason of the legitimate interest of the data controller, as regulated in the PDPL.

Our Company obtains and may store personal data in the form of name, phone number, e-mail address, date of birth, and other population information, workplace information, contact person information, and credit card information shared by guests and visitors via the website. Our Company takes all administrative and technical measures to ensure the security of the personal data shared through the website. All personal data collected through our Company's website are collected and processed only for the following purposes:

• Facilitating service procurement, making reservations, and establishing contracts through our website, conducting customer service activities related to purchased or requested services,
• Responding to questions about our services and website,
• Sending information about advertisements, drawings, promotions, announcements, and campaigns that we think may be of interest to our guests with the consent of our guest, conducting analyses to ensure that only content that may be of interest to our guest reaches them,
• Activities aimed at improving the functionality of our website, such as data analysis, security, testing, improving, enhancing, or changing our services, determining usage trends,
• Performing accounting, billing, reconciliation, and collection activities.

In addition, the collected personal data will be processed within the scope of the purposes specified in articles (1) and (2) of this text, in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL, for the purpose of fulfilling legal obligations, establishing and maintaining the service contract, and ensuring the protection of legitimate interests by the guests and visitors through the website, such as communication, administrative operations related to communication carried out by our Company, ensuring the physical security and supervision of our premises, evaluation processes for business partners/customers/suppliers (authorized or employees), legal compliance process, financial affairs, etc.

1. To Whom and for What Purpose Processed Personal Data Can Be Transferred

All personal data stored by the Company can only be accessed by personnel and managers who have access permission within the Company, as determined within the Authority Matrix. Personal data held by the Company cannot be copied unless absolutely necessary, even by those who have access permission. To ensure the security of the personal data it holds, the Company uses servers subject to periodic penetration tests, continuously monitors the physical security of server rooms and other places where personal data is located. All necessary administrative and technical measures to prevent unauthorized personnel from accessing personal data are taken by the Company, and all key personnel receive training to increase sensitivity to personal data for the Company. The Company does not transfer personal data to third parties except in cases stipulated in Articles 8 and 9 of the PDPL, except for third parties. Data transfers made by the Company in this context are limited to business partners, suppliers, Ania Tourism Investments Inc. Group companies, shareholders, legally authorized public institutions and individuals, audit firms, insurance agencies, lawyers and accountants, banks, and public institutions and organizations, including those abroad.

1. Method and Legal Reason for Collecting Personal Data

Your personal data are collected within the legal framework defined for the purposes mentioned above, with the aim of offering the products and services we offer as the Company in every kind of oral, written, or electronic environment, and ensuring that the Company fulfills its contractual and legal responsibilities completely and accurately. Personal data collected for these legal reasons can be processed and transferred within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL, and the purposes specified in paragraphs (1) and (2) of this text.

1. Rights of Personal Data Subject under Article 11 of the PDPL

As personal data owners, if you submit your requests regarding your rights within the scope of Article 11 of the PDPL, to our Company with the methods set out below in this Information Note, our Company will conclude your requests within thirty days at the latest, free of charge, depending on the nature of your request. However, if a fee is stipulated by the Personal Data Protection Board, the fee set by our Company will be charged. Within this framework, personal data owners;

- Learning whether personal data is processed,

- Requesting information if personal data has been processed,

- Learning the purpose of processing personal data and whether they are used appropriately for their purpose,

- Knowing third parties to whom personal data is transferred in the country or abroad,

- Requesting correction of personal data in case of incomplete or incorrect processing and notification of the transaction made to third parties to whom personal data has been transferred,

- Requesting the deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the PDPL, and notification of the transaction made to third parties to whom personal data has been transferred,

- Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,

- In case personal data is processed unlawfully and causes damage, demanding the compensation of the damage;

they have the right. Pursuant to Article 13, paragraph 1 of the PDPL, you can submit your requests regarding the use of these rights, in writing or through other methods to be determined by the Personal Data Protection Board, to our Company.

In this context, channels and methods to be used in applications to be made to our Company within the scope of Article 11 of the PDPL are explained below.

To use your above-mentioned rights, you can send your request to info@macartasi.com address with secure electronic signature, including your explanations regarding the right you want to use, with identity information that identifies you.

Macartaşı Hotel