PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA

1
İstanbul Ephesus Hotel
EPHESUS OTELCİLİK VE TURİZM ANONİM ŞİRKETİ
PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA
This Privacy Notice ("Privacy Notice") has been prepared by Ephesus Otelcilik ve Turizm Anonim
Şirketi ("Ephesus", "Ephesus Hotel" or briefly the "COMPANY") in its capacity as data controller
within the scope of Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data (the
"Law" – KVKK) and the "Communiqué on the Procedures and Principles to be Followed in Fulfilling
the Obligation to Inform" issued by the Personal Data Protection Board ("Communiqué").
This Privacy Notice may be updated at any time by the Company within the framework of
possible changes in the applicable legislation.
As the Company, we reserve the right to update the relevant texts at any time within the
framework of changes in the purposes of processing and transferring personal data and in the
collection methods.
You can find other detailed information about your personal data on our website and VERBİS
records. Our personal data processing activities may also change depending on the changes that
may occur in our commercial activities and corporate structure. You can follow the updates regarding
the changes through our public information channels. We also regularly check and modify our
VERBİS Registry information in line with the updates.
This "Privacy Notice" is presented to you as the actual owner of your personal data – in a broader
sense, to our employees, the persons and institutions to whom we provide services, our customers
(including potential ones), and everyone with whom we have a legal relationship – for the purpose of
providing information and reminding you of your rights.
Please read this text before transferring your personal data / special category personal data to
our Company.
Our Company processes certain personal data / special category personal data of yours within
the scope of the services it will provide in its capacity as "Data Controller", in accordance with the
principles set out in Law No. 6698.
The obligation to inform may be fulfilled by the "Data Controller" or a natural/legal person
authorized by it, orally, in writing, or through physical or electronic environments such as call centers,
in accordance with the legal regulations. As the Company, we fulfill our obligation to inform with this
text. In addition to this text, we also fulfill our obligation to inform through a QR code application at our
hotels.
For more information on the subject and to convey your requests in the field of KVKK, you can
visit our website at https://hotelephesus.com/ and reach our authorized units through the contact
channels below.
2
A – Identity of the Data Controller and its Representative, if any
Data Controller: Ephesus Otelcilik ve Turizm Anonim Şirketi
MERSİS No: 0476001504500013
Phone: +90 212 518 5130
E-mail: info@hotelephesus.com
KEP (E-mail): ephesus@hs01.kep.tr
Web: https://www.hotelephesus.com
Address: Mesih Paşa, Aksaray Cad. No:24, 34130 Fatih/İstanbul
B – For What Purposes Are Your Personal Data Processed?
Our Company processes the personal data it collects through the methods specified in this
Privacy Notice in a purpose-related and proportionate manner, in order to carry out the necessary
work to fulfill the legal obligations arising from the relevant legislation, for the following purposes.
Your personal data will be processed within the conditions specified in Articles 5 and 6 of Law
No. 6698 and other relevant legislation, by taking technical and administrative measures regarding
data security, provided that they are not used outside the purposes and scope determined by this
Privacy Notice. In this context, your personal data / special category personal data are processed in
the processes of fulfilling all our activities, especially tourism, accommodation and restaurant
services, within the scope of laws and other legislation, primarily the Turkish Commercial Code,
Turkish Code of Obligations, and Turkish Tax Legislation.
The purposes of processing your personal data can generally be listed as follows: First and
foremost, they are processed to enable us as the Company to fulfill our obligations arising from the
legislation (preparing and keeping guest/visitor files, keeping personnel files, insurance, salary, tax,
invoices, etc.). In these processes, certain special category personal data such as health data may
also be processed in order to fulfill our legal obligations. We may also process your personal data in
order to ensure the performance of the contracts established between you and our Company due to
you receiving services from our Company and/or for other reasons. In addition, other data processing
purposes of ours include complying with the information storage, reporting, and informing obligations
stipulated by administrative units; providing the services requested by you; using them for marketing
and communication purposes such as improving service quality and promotion through our
employees within the scope of the information you have consented to be processed; and sending you
SMS or commercial electronic messages if you have given your consent.
Furthermore, in cases where we obtain separate explicit consent from our employees and the
persons we serve, and within the scope of this Privacy Notice, we may process certain personal data
of our customers and employees for the corporate stability, interests, advertising, and promotional
purposes of the Company through methods such as anonymization and mosaicking.
An important part of our Company activities is carried out for the purpose of providing
accommodation and restaurant services. In carrying out our activities, we employ many personnel.
3
We process certain personal data of our personnel starting from the recruitment process until the end
of the contractual relationship with our Company and even after it ends, for the period determined in
the Ephesus Hotel KVKK Retention and Destruction Policy. In this context, we declare that we
process the personal data of our employees based on the authority granted by the legislation, in a
purpose-related and proportionate manner; and we do not process the relevant personal data of our
personnel who do not give explicit consent in matters where the legislation requires us to obtain
explicit consent.
As Ephesus Hotel, we may also process personal data of different groups of people other than
our employees and customers. Our Company, which has the title of data controller within the scope of
Law No. 6698 "Law on the Protection of Personal Data" and the "European General Data Protection
Regulation (GDPR)", may process the personal data and/or special category personal data obtained
through various channels within the scope of the personal data processing conditions and purposes
specified in Articles 5 and 6 of Law No. 6698, for the following purposes: carrying out the necessary
work by our relevant business units for the realization of commercial activities and executing the
related business processes; making the necessary efforts by our business units to benefit the
relevant persons from the products and services offered by our Company and executing the related
business processes; planning and executing activities necessary to customize the products and
services offered by our Company according to the tastes, usage habits, and needs of the relevant
persons and recommending and promoting them to the relevant persons; ensuring the legal,
technical, and commercial-business security of our Company and the relevant persons in a business
relationship with our Company; and planning and executing the commercial and business strategies
of our Company. To learn what types of personal data are collected, for what purpose your personal
data are processed, to whom and for what purpose they are transferred, the method and legal basis
of personal data collection, the duration of personal data processing, the cases in which your
personal data may be processed without your explicit consent, the rights of the data subject, and the
procedure for applying to the data controller, you can review our Data Protection Policy on our
website.
All of your data that you can provide to our Company in accordance with the cases specified in
the legislation are processed only in accordance with the relevant legislation and/or the scope of the
consent you have given for the collection of your data.
The said personal data will be kept by taking all necessary administrative and technical
measures for the period required by the processing purpose, provided that the legal storage period is
not exceeded, and will be destroyed/eliminated when this period expires.
C – To Whom and For What Purposes Do We Transfer Your Personal Data?
The Company acts in accordance with the regulations stipulated in Article 8 of Law No. 6698 on
the Protection of Personal Data and the general principles of the European Data Protection
Regulation – GDPR throughout the entire process regarding the transfer of personal data in its
possession.
Your personal data that we receive and use from you lawfully, based on the authority granted by
the legislation while carrying out our activities, may be transferred in a purpose-related and
proportionate manner, taking all security measures, primarily to the relevant Ministry and the relevant
4
units of public institutions, as well as to other authorized official persons and institutions. Furthermore,
certain personal data may be shared by taking the necessary security measures according to the
requests from courts, public prosecutors' offices, and authorized judicial authorities. However, no
personal data is shared without your explicit consent except for authorized persons, institutions, and
bodies, and all necessary technical and administrative measures are taken in their preservation.
Data transfer is carried out by our Company only to domestic institutions, organizations, and
persons, and in records made through foreign tourism and agency companies with which we have a
contractual relationship, the relevant foreign resident person/company is responsible as the data
controller. Even in this case, as the Company, we protect our customers' personal data throughout all
accommodation periods, including registration procedures.
During the transfer of data to authorized institutions, organizations, and third parties, all
necessary administrative, technical, and legal measures are taken within the Company to prevent
rights violations. However, our Company is not responsible for violations that occur in the risk area
under the responsibility of the institutions, organizations, and third parties receiving the data due to
their data protection policies after the transfer of personal data.
D – Methods of Collecting Your Personal Data and Legal Reasons
Your personal data may be collected by our Company through automatic and/or non-automatic
methods, in writing or electronically. The information collected by us online and offline may be
matched with information collected from you by different methods or at different times, and may be
used in accordance with the Law and this Privacy Notice. In this context, your personal data will be
collected to be processed within the framework of personal data processing conditions and purposes
specified in Articles 5 and 6 of the Law and in line with the legal reasons and purposes set out in this
Privacy Notice.
An important part of the personal data we commonly process in our commercial activities
consists of personal data authorized by the legislation within the scope of the contractual relationship
established with our customers for hotel management (accommodation, restaurant, and organization)
activities; during this process, certain identity data, contact data, health data (diet – special situation),
and at the payment stage, financial data (credit card, account number information, etc.) of our
customers are collected.
Personal data of our customers to whom we provide accommodation services are recorded
through the automation established within the relevant Ministries and kept in digital environments.
Although an explicit consent declaration of our customers is not required to receive this data in
accordance with the relevant legislation, we also fulfill our legal obligation with this Privacy Notice.
Apart from hotel management activities, personal data are also processed in the personnel
matters carried out by our Company's Human Resources unit and General Management, as well as
in the contracts for activities other than the main activity of the Company, by benefiting from cases of
necessity in order to fulfill explicit consent and legal obligations, and transferred to authorized public
institutions and organizations, especially to banks for payments, by taking the necessary
administrative and technical measures.
5
In summary, your personal data are processed in a proportionate manner, limited to the legal
periods required by this purpose, by taking all necessary technical and administrative measures, in
order to carry out all activities, primarily our hotel operations, within the framework of "Law No. 6698
on the Protection of Personal Data" and other legislation.
E – As a "Relevant Person" Whose Personal Data Is Processed, What Are Your
Rights Under the Law?
You have the following rights under Law No. 6698 on the Protection of Personal Data:
~ You can learn whether your data is processed,
~ If your data has been processed, you can request information about it,
~ You can learn the purpose of processing your data and whether it is used in accordance with its
purpose,
~ You can obtain information about the third parties to whom your data is transferred
domestically/abroad,
~ If your data has been processed incompletely/incorrectly, you can request the correction of your
data,
~ You can request the deletion or destruction of your data (*),
~ You can request that the operations performed pursuant to subparagraphs (d) and (e) above be
notified to the third parties to whom your personal data has been transferred,
~ In the event that an adverse result arises against you due to the analysis of your data exclusively
through automated systems, you can object to this result,
~ You can request that your damages be compensated if you suffer damages due to the unlawful
processing of your data.
(*) We have legal obligations regarding the storage of documents/data related to the transactions we
carry out with you. If you request the deletion or destruction of your personal data / special category
personal data, it may be possible for us to fulfill this request at the end of the period determined within
the scope of legal obligations.
If you would like to obtain more information about your personal data, you can reach us through
the contact channels provided above.
F – Retention and Destruction Conditions of Your Personal Data
Your personal data processed within the scope of this Privacy Notice are also kept for the
periods specified in the "Ephesus Hotel KVKK Retention and Destruction Policy" we have prepared,
and at the end of the period, they are anonymized or destroyed.
Note: This is an English translation of the Turkish original. In case of interpretation questions or legal disputes, the
Turkish original version shall prevail.