6698 KVK Rules

This notification is made in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and due to legal obligation. Within the scope of the KVKK, as the Data Controller, KONKAR TOURISM INVESTMENT INDUSTRY AND TRADE JOINT STOCK COMPANY (MERI HOTEL OLUDENIZ) is performing the obligation of informing to its business partners, customers, and individuals, whether real or legal, with whom it communicates.

A. Purpose of Personal Data Protection and Processing Policy:

KONKAR TOURISM INVESTMENT INDUSTRY AND TRADE JOINT STOCK COMPANY (MERI HOTEL OLUDENIZ) as the data controller, attaches maximum importance to the security of your personal data. With this awareness, we place great emphasis on processing, recording, transferring, sharing, and storing all kinds of personal data belonging to individuals associated with our Company, including those benefiting from our products and services, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”). Protection of personal data is among the fundamental policies of our Company, which has prioritized the confidentiality of personal data throughout its existence, adopted it as a working principle, and instructed its employees accordingly. Our Company undertakes to comply with all responsibilities imposed by the KVKK. With full awareness of this responsibility and as the Data Controller, we process, record, transfer, share, and store your personal data within the limits explained below and within the boundaries prescribed by the official legislation.

B. Collection, Processing, and Processing Purposes of Personal Data:

Our Company’s policy on the Protection, Processing, and Confidentiality of Personal Data has been prepared in accordance with Law No. 6698 on the Protection of Personal Data and the regulations published within the framework of this law. In this context, your personal data may be collected in written or electronic form through automatic or non-automatic methods, including but not limited to offices, branches, websites, social media channels, mobile applications, and similar tools, depending on the services, products, or commercial activities provided by our Company. Your personal data may be processed by being created and updated as long as you benefit from the products and services of our Company.

Furthermore, with the intention of benefiting from the products and services of our Company:

a. When you use our website, b. When you visit our companies, facilities, or units, c. When you visit our website or our social media channels, d. When you participate in trainings, seminars, or events organized by our companies or requested by you at our facilities under our company,
your personal data may be processed.

Method and Legal Basis:

Your personal data is collected in all kinds of verbal, written, or electronic environments by our Companies in order to fulfill our Companies’ contractual and legal obligations within the framework of the purposes specified in the above articles and to ensure that our products and services are provided within the determined legal framework, and in this context, our Companies’ contractual and legal obligations are fulfilled completely and accurately. Personal data collected for this legal reason are processed, recorded, transferred, shared, and stored for the purposes specified in this clause (B) within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law No. 6698 on the Protection of Personal Data (“KVKK”).

C. Method and Legal Basis of Personal Data Collection:

Your personal data is collected in all kinds of verbal, written, or electronic environments by our Companies in order to fulfill our Companies’ contractual and legal obligations within the framework of the purposes specified in the above articles and to ensure that our products and services are provided within the determined legal framework, and in this context, our Companies’ contractual and legal obligations are fulfilled completely and accurately. Personal data collected for this legal reason are processed, recorded, transferred, shared, and stored for the purposes specified in this clause (B) within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law No. 6698 on the Protection of Personal Data (“KVKK”).

D. Processing of Sensitive Personal Data:

Article 6 of Law No. 6698 on the Protection of Personal Data defines certain personal data as “sensitive” when processed unlawfully, posing a risk of victimization or discrimination to individuals. These data include race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association – foundation or union membership, health, sexual life, criminal conviction, and data related to security measures, biometric and genetic data. Our Companies act in compliance with the regulations stipulated in Article 6 of the KVKK regarding the processing of sensitive personal data and treat these data with sensitivity in their protection.

Our Companies process sensitive personal data in accordance with the provisions of the KVKK and subject to taking adequate measures determined by the Personal Data Protection Board:

a. If the data subject gives explicit consent;

Our Company will only process sensitive personal data of individuals by obtaining explicit consent from the relevant person and solely for the purpose of collection, in order to provide personalized services to guests who share their conditions with our Company and request personalized services (For example, if a guest shares their sensitive data to request a special service; such as requesting a thin pillow due to neck hernia, requesting a ground floor room due to a heart condition, requesting a dessert without nuts due to peanut allergy, etc.). Our Company will process individuals’ sensitive personal data only with the explicit consent of the individual and only for the purpose of serving their collection, in order to provide personalized services tailored to their identified needs by sharing their sensitive data and to remember these needs of the guests for future and provide the same services again.

b. If the data subject does not give explicit consent;

• Sensitive personal data other than the health and sexual life of the data subject are processed in cases envisaged by laws,
• Sensitive personal data regarding the health and sexual life of the data subject are processed by individuals or authorized institutions and organizations under the obligation of confidentiality for the purpose of protecting public health, performing preventive medicine, conducting medical diagnosis, treatment and care services, planning and management of health services and their financing, as required by laws.

E. Persons to Whom and for What Purpose Processed Personal Data May be Transferred:

Your collected personal data may be transferred to legally authorized public institutions and private persons by KONKAR TOURISM INVESTMENT INDUSTRY AND TRADE JOINT STOCK COMPANY (MERI HOTEL OLUDENIZ) within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law No. 6698 on the Protection of Personal Data (“KVKK”).

F. Transfer of Personal Data Abroad:

Our Company has the authority to transfer personal data abroad within the scope of the conditions determined by the Personal Data Protection Board in accordance with the Law on the Protection of Personal Data, provided that personal data are transferred abroad in accordance with other conditions of the law and after obtaining explicit consent from the individual.

G. Rights of the Data Subject as Stipulated in Article 11 of the Law on the Protection of Personal Data:

Under the Law No. 6698 on the Protection of Personal Data, we acknowledge that the data subject has the right to be informed and to give consent before the processing, recording, transfer, sharing, and storage of their personal data, and after the processing, recording, transfer, sharing, and storage of their data, they have the right to determine the fate of their data. In this context, if you, as data subjects, submit your requests regarding your rights in accordance with this “Notification on the Processing of Personal Data” to our Company through the methods specified below, our Company will conclude your request within thirty days at the latest, depending on the nature of the request.
In accordance with the Communique on Principles and Procedures for Application to the Data Controller published by the Personal Data Protection Board, regarding your requests related to your rights as data subjects;
i. If a response to your application will be given in writing, no fee will be charged for the first ten pages. A processing fee of 1 Turkish Lira may be charged for each page over ten pages. ii. If the response to the application is provided on a recording medium such as a CD, flash drive, etc., the fee that may be requested by our Company as the data controller shall not exceed the cost of the recording medium.

In this context, data subjects have the right to:

a. Learn whether personal data is being processed, b. Request information if personal data has been processed, c. Learn the purpose of processing personal data and whether they are used appropriately for their purpose, d. Know the third parties to whom personal data is transferred, whether domestically or abroad, e. Request correction of personal data if it is incomplete or incorrectly processed, and request notification of the transaction made within this scope to third parties to whom personal data has been transferred, f. Request the deletion, destruction, or anonymization of personal data within the scope of the conditions stipulated in Article 7 of the Law on the Protection of Personal Data and request notification of the transaction made within this scope to third parties to whom personal data has been transferred, g. Object to the occurrence of a result against himself by analyzing the processed data solely through automated systems, h. Request compensation for damages in case personal data is processed unlawfully.
However, there is no right for individuals regarding anonymized data within the Companies. Our Companies may share personal data with relevant institutions and organizations within the scope of a contractual and legal relationship, or for the purpose of exercising a judicial duty or state authority’s legal powers.

H. Periods for the Processing of Your Personal Data:

In accordance with the Law No. 6698 on the Protection of Personal Data, your personal data processed for the purposes specified in this “Notification on the Processing of Personal Data” will be deleted, destroyed, or anonymized by us when the purpose requiring the processing according to Article 7-(1) of the KVKK ceases to exist, and/or when the periods of limitation for processing your data, which we are obliged to process by legislation, have expired.

I. Circumstances in Which Our Companies May Process Your Personal Data Without Your Explicit Consent as Required by Laws:

In accordance with Article 5 of the Law No. 6698 on the Protection of Personal Data, our Company may process your personal data without seeking your explicit consent in the following cases and in compliance with the law:

Cases explicitly provided for in the laws;

• In cases where you, as the data subject, are unable to explain your consent due to actual impossibility or where your consent has no legal validity due to legal circumstances for the protection of your own or someone else’s life or physical integrity,
• If it is directly related to the establishment or performance of a contract concluded with our