Personal Data Processing and Protection Policy

A.    The Purpose of Protecting and Processing Personal Data:
As BHM Otelcilik A.Ş. (collectively known as the “Company”), we attach great importance to the security of personal data, and to the processing, recording and sharing, and the transfer and storage of all kinds of personal data belong- ing to all individuals related to our Company, including those who benefit from our products and services, in accordance with Law No. 6698 on the Protection of Personal Data (PDP Law).

The protection of personal data is among the fundamental policies of our Company. Our Company prioritizes the protection of personal data, and have adopted this priority as a working principle, with all employees acting in line with this principle. Our Company is committed to full compliance with all the responsibilities of the PDP Law. With full awareness of this responsibility and as Data Supervisor, we process, store, transmit, share and retain your personal data within the limits of the oficial regulations, as we have explained below.

If you have any questions about our Company's "Personal Data Processing and Protection Policy", you may contact us using the following information:

Application Address: Akra Hotel, Şirinyalı Mh. Lara Cd. No:24 Muratpaşa - Antalya / Türkiye
Application E-mail: [email protected]

Our Company reserves the right to update the “Personal Data Processing and Protection Policy” at any time within the framework of amendments to the applicable legislation.

B.    Collection, Process and Purpose of Processing Personal Data:
Our Company's policy regarding the Protection and Privacy of Personal Data has been prepared in accordance with the PDP Law. In this context, while your personal data may vary depending on the services, products or business activities provided by our Company, this data is collected verbally, electronically or in writing via automated or non-automated methods, including ofices, branches, dealers, call centres, websites, social media channels, mobile applications and similar tools. Your personal data will be processed and updated during the time that you benefit from our products and services.
In addition, if you intend to benefit from our products and services, your personal data will be processed:

    a.    When you use our call centre or website,
    b.    When you visit our companies, facilities or units;
    c.    When you visit our website or social media channels;
    d.    When you attend workshops, seminars or organisations carried out by our Companies;

Your personal data is collected from you upon your approval or in compliance with the regulations according to the Turkish Republic Laws, and is processed for the following purposes:
    a.    To improve the ability of our business units to enable you to benefit from the products and services oßered by our Companies,
    b.    To recommend and present to you the products and services oßered by our Companies by customizing them according to your preferences and usage,
    c.    To improve the quality of the services oßered by our Companies and our quality policy,
    d.    To inform and let you take best advantages of general and special campaigns, promotions, presentations, discounts, and similar advantages oßered by our Companies,
    e.    To provide you with the information and services that you request for your personal data, your preferences, your transactions and navigation data, along with your username and password when you log in to the channels oßered by our Companies,
    f.    To send notifications of any kind of loyalty card that is or will be issued either by our Companies and related companies or the website memberships (renewal, termination, etc.) of our Companies and related companies; to provide any kind of communication that may be established with you and to inform you regarding changes, innovations and similar issues in products, personal data policies and membership conditions,
    g.    To safeguard the legal and commercial rights of employees of our Companies and our professional partners. (The administrative operations carried out by our Companies are to ensure the physical security and oversight of the business locations, evaluation processes for our professional partners / customers / suppliers (authorized or employees), the legal compliance process, financial aßairs etc.),
    h.    To respond to and to manage security operations, accidents or other similar incidents, including medical and insurance purposes,
    i.    To carry out market research and internal research and development, and to develop and improve our product range, services, shops, IT systems, security, know-how and the way we communicate with you. We use CCTV images to help maintain the safety of anyone working in or visiting our shops, premises and other buildings, and for the prevention, detection and prosecution of criminal oßences. We may also rely on the images to establish, exercise or defend our legal rights,
    j.    To communicate information, activities and services that you request from our Companies,
    k.    To help determine and implement the commercial and business strategies of our Companies,
    l.    To ensure that our Company's human resources policy is executed accordingly,
    m.    To comply with legal obligations specified in the legislation or, where necessary, in accordance with legislation and such data may be processed by our Company and its associated Companies / Organization and other real person and / or legal entities specified in Article (E) below, subject to the personal data processing requirements and purposes set forth in Articles 5 and 6 of the PDP Law.

C.    Method of Collecting Personal Data and Its Legal Reason:
Your personal data is acquired in any verbal, written or electronic environment in order to be able to present products and services of our Company in the legal framework specified in the aforementioned articles, and to fulfil the responsibilities arising from our contracts and laws in this context in a complete and correct manner. Your personal data collected within this legal framework is processed, recorded, transferred, shared and retained for the purposes stated in Article (B) of this Policy within the scope of the personal data processing conditions and purposes stated in Articles 5 and 6 of the PDP Law.

D.    Processing Special Categories of Personal Data:
Per Article 6 of the PDP Law, personal data that could cause victimization or discrimination if processed illegally has been designated as "private". This data includes biometric and genetic data with respect to race, ethnicity, political afiliation and philosophical and/or religious beliefs, as well as association, foundation or trade union afiliation or membership, health, sexual life, criminal background and security measures. Our Company acts in accordance with the regulations set out in Article 6 of the Law on the Protection of Personal Data for the processing of special categories of personal data, and acts sensitively regarding the protection of such data. Regarding special categories of personal data, our Company operates in accordance with the PDP Law in line with the following conditions, provided that adequate measures to be determined by the PDP Board are taken:

    a.    If the personal data owner has provided explicit consent:
Our guests may request special services by sharing their conditions with our Company and share special category data for this purpose (e.g., requesting a thin pillow due to cervical disc hernia, requesting a ground-floor room due to heart disease, special food requests due to allergies, etc.). We can provide customized services for our guests' needs by sharing their special category data; and we can oßer similar services in the future by retaining this data, with the assurance that our Company will process such data only with the explicit consent of the individual providing the data, and only for collection purposes.
    b.    If the personal data owner does not provide explicit consent:
        –    Special categories of personal data, apart from the personal data owner’s health and/or sexual life, as foreseen in the laws,
        –    Private data regarding the personal data owner’s health and/or sexual life are processed by individuals operating under confidentiality agreements, or by authorised institutions and organisations and solely for the purpose of protecting public health and/or for preventive medical attention and medical diagnosis, for carrying out treatment and care services, and for the planning and management of health services and their financing.
E.    Why and To Whom Processed Personal Data May Be Transferred:
To serve the purposes of Article B, your collected personal data may be transferred to the following Barut Hotels Companies:

In addition, this data may be transferred to our shareholders, business partners, suppliers, authorised legal institu- tions and organisations and special persons, under the scope of the personal data processing conditions and purposes mentioned in Articles 8 and 9 of the PDP Law.

F.    Transferring Personal Data Abroad:
Our Company has the authority to transfer personal data abroad according to the conditions set by the Protection of Personal Data Board on the Protection of Personal Data Law, in accordance with the other conditions of the law, and with the consent of the individual for this purpose.

G.    The Rights of the Personal Data Owner Stated in Article 11 of the PDP Law:
With in the scope of the PDP Law, we hereby acknowledge that the the person who is the owner of his/her own personal data is the authority regarding the fate of this data prior to its recording, transmission, sharing and storage; and that the data owner has the right to approve and obtain information prior to the processing, recording, transmission, sharing and storage of personal data. In this context, if you, as the personal data owner, submit a request to our Company to exercise your rights, by means of the “Personal Data Processing and Protection Policy”, our Company will comply with the request within 30 or fewer days and free of charge, in accordance with the legitimacy of the claim.

In accordance with the Communiqué on the Procedures and Principles of Application for Data Oficers, issued by the Personal Data Protection Board and regarding your requests upon your rights as personal data owners:

    i.    If your application requires a return in writing, you will not be charged up to a maximum of ten pages. For every page exceeding ten pages, a transaction fee of 1 Turkish lira may be charged.
    ii.    If your application requires a return via a recording medium such as a CD or flash drive, the cost requested by our Company as the data supervisor, may not exceed the cost of the charge of the recording medium.

Within this scope, personal data owners have the following rights:
    a.    To be informed whether their personal data is processed ;
    b.    To request information regarding the processing of personal data;
    c.    To be informed regarding the purpose of processing their personal data, and whether such data is used in accordance with the stated purpose;
    d.    To be informed regarding domestic or foreign third parties to whom personal data is transferred.
    e.    To request correction of personal data if incomplete or improperly processed and torequest that a third-party recipient of such personal data is notified of any process conducted within this context.
    f.    To request the deletion, destruction, or conversion of personal data within the framework of the provisions of Article 7 of the PDP Law and to request that a third-party recipient of such personal data is notified of any process conducted within this context.
    g.    To object to unfavourable results achieved by analysing the processed data exclusively through automated systems.
    h.    To request compensation for damages due to corruption resulting from the unlawful processing of personal data

Personal data owners retain no rights in relation to anonymised data within the company. Our Company may share personal data with related institutions and organizations to utilise the statutory powers of a judicial or state authority in accordance with business and contractual relations.
H.    Processing Periods of Your Personal Data:
In accordance with the PDP Law and the purposes stated in this Personal Data Processing and Protection Policy, your processed personal data will be deleted or destroyed or will continue to be used as anonymised by the Company when the purpose to be processed according to PDP Law Article 7 / clause f. 1 is no longer in eßect and/or, according to the regulations, when the period within which we are required to process your personal data has expired.

I. Circumstances Where Our Company May Process Your Personal Data Without Your Explicit Consent:
According to Article 5 of the PDP Law, under the following circumstances (listed below), our Company may process your personal data as stated and collected above, in accordance with the law, without your explicit consent:
As they are clearly foreseen in laws:

J. To Submit a Request Under the Law on the Protection of Personal Data:

In accordance with paragraph 1 of Article 13 of the PDP Law, you may submit your request to our Company to exercise your abovementioned rights as regulated by the PDP Law and the related legislation and the methods (s) determined/to be determined by the Personal Data Protection Board, or you can apply via one of the following methods by completing and signing the Application Form at https://www.baruthotels.com/KVKK.

    i.    You may deliver a signed copy of the form by hand in person to the following address: Akra Hotel, Şirinyalı Mh. Lara Cd. No:24 Muratpaşa - Antalya / Türkiye
Including your statements regarding the right you have requested, along with your oficial identification documents (e.g., ID card, driver’s licence, passport, etc.).
    ii.    You may send your form and your oficial ID documents via notary or
    iii.    To the following email address, along with your oficial identification documents: [email protected]
with a secured electronic signature or mobile signature,
    iv.    You may send the form and your oficial ID documents to our Company by using your email address which is already registered in our Company’s system.

Our Company will finalise it in maximum 30 days according to the legitimacy of the request.

The rights regarding personal data are solely available for the individual's own personal data. Requests from an individual regarding the data of other persons will not be considered. Forms that do not include your oficial ID documents will not be considered. We also would like to inform you that we are required to share the data with oficial authorities as requested, even when data deletion requests have been fulfilled.