Personal Data Processing and Protection Policy

Dear Guests,

CANEM Tourism and Trade Inc. As (“the Company”), we attach importance to the protection of your personal data. In this context, your personal data is processed in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), as the data controller, and within the framework of the procedures and principles explained below.

This Privacy Notice concerns your personal data. within which data categories , for what purposes , on what legal grounds , to whom it can be transferred , storage periods And Your rights under the Personal Data Protection Law (KVKK) This has been prepared to inform you about the subject.

1. Identity of the Data Controller

Title: CANEM Tourism and Trade Inc. 

Address: Side Neighborhood, 651st Street, No: 6, 07330 Manavgat/ANTALYA
Email: kvkk@barutarum.com

1. Your Personal Data that we process

Our company may process the following categories of personal data within the scope of accommodation and service activities:

Identity Information: Name, surname, date of birth, Turkish Republic identity number, passport number.

Contact Information: Address, postal code, email address, telephone number, registered electronic mail (KEP) address, and social media contact information if you share it.

Financial Information: E-invoice information, payment and expense records, and information relating to accounting and financial processes.

Health Information (Special Categories of Personal Data): Limited health information shared with your explicit consent, regarding food allergies, special dietary requirements, or specific service requests related to your health condition. This data is not essential for the provision of accommodation services and will not be processed without your explicit consent.

Visual Recordings: Camera footage taken to ensure security throughout the facility. Photographs and videos for promotional purposes, with explicit consent.

Physical Space Security Information: Facility entry and exit records, camera system video recordings.

Location Information: Travel and transfer information, and limited information regarding the vehicles used, for the purpose of organizing transfers and transportation.

Transaction Security Information: IP addresses, log records, internet access and traffic information, and login/logout logs obtained during website and mobile application usage (within the scope of Law No. 5651).

Guest Reviews, Feedback, and Complaints : Includes reviews, opinions, and complaints regarding facilities and services, satisfaction records, reservation information, and room number.

Preference Information: Information regarding accommodation preferences, special requests, past service requests, and interests.

Marketing Information: With explicit consent; accommodation history, cookie records, loyalty program membership information, communication permissions, and special occasion information.

Other Information: Vehicle license plate, agency or company information, guest product acceptance information, written or electronic communications, signature obtained during check -in, signature related to room type changes or upgrades, signature related to lost item delivery, signature related to delivery of personalized shipments and orders, professional information, and information shared only by you within the scope of personal assistant services.

3. Purpose of Processing Personal Data

Your personal data is processed within the framework of the legal grounds specified in Articles 5 and 6 of the Law No. 6698 on the Protection of Personal Data, for the purposes stated below:

Managing Reservation Processes and Providing Accommodation Services

creating, scheduling, and fulfilling your reservations, providing accommodation services, enabling online check -in, performing identity verification procedures, and fulfilling services related to your stay if requested.

If you share this information, such as pillow preference, room preference, food allergies, or special dietary requests, we will collect it. only based on your explicit consent And limited to the requested service is being processed. Sharing this information It is not mandatory for the provision of accommodation services .

Providing Customized Services

Upon your request, your name, surname , and room number information will be processed to facilitate the creation of reservations for accommodation preferences, special requests, information regarding past service requests, and à la carte and similar areas .

mini club activities; the child guest's name, surname, room number and parent's contact information, solely for the purpose of ensuring the safe operation of the organization Health information relating to children is being processed.
 only with explicit consent And It is not processed unless absolutely necessary .

Information that you have made public on publicly accessible platforms, only within the scope of the relevant service and in a proportionate manner. can be taken into consideration.

Conducting Communication Activities

Your personal data is processed for the purposes of providing you with reservation information, informing you about your accommodation, providing personal assistant support upon your request, and informing you about payment processes.

Evaluation of Requests, Opinions and Complaints

Your personal data is processed for the purposes of measuring, increasing, and improving guest satisfaction, planning and executing guest relations management processes, and receiving, evaluating, and resolving requests, suggestions, and complaints.

Fulfillment of Legal Obligations

Turizm ve Ticaret A.Ş. processes your personal data to fulfill its obligations arising from national and international legislation, to respond to requests from official institutions and organizations, to conduct legal processes, and to respond to individual applications in accordance with the legislation.

Execution of Accounting and Finance Processes

Your personal data is processed for the purposes of conducting accounting and financial operations, processing payments, managing billing processes, and providing you with financial documents upon request.

Ensuring Physical Security of Space

Your personal data is processed for the purpose of ensuring the security of facilities and premises, controlling visitor entry and exit, and conducting security operations through security camera systems.

Ensuring Transaction Security

Your personal data is processed to ensure transaction security, prevent unauthorized access, maintain logs and traffic records, prevent fraud and deception, and ensure information security during the use of the website, mobile application, and wireless networks.

Managing the Barut Club Membership Program Processes

If you are a Barut Club member, your personal data is processed to enable you to benefit from the services offered within the membership program, and to carry out the point earning and reward processes.

Execution of Advertising and Marketing Activities

Your personal data, Your personal data will only be processed with your explicit consent for the purpose of providing information about our hotel and services , conducting promotional and marketing activities, and sending celebratory and congratulatory messages. If you do not give your explicit consent, no data processing activities for marketing purposes will be carried out.

Your personal data processed for these purposes will be processed in accordance with the relevant legislation. in physical archives and/or electronic information systems , as required by taking administrative and technical measures It is being preserved.

4. To Whom and for What Purpose Your Personal Data Will Be Transferred

Your personal data may be transferred only for the purposes stated below and to the extent necessary, within the framework of the conditions specified in Articles 8 and 9 of the Law No. 6698 on the Protection of Personal Data:

Transfer in the Context of Fulfilling Legal Obligations

In order to fulfill the obligations arising from the legislation to which our hotel is subject, your personal data may be shared with authorized judicial authorities, the General Directorate of Security and other law enforcement agencies, and authorized public institutions and organizations in accordance with the provisions of the Identity Reporting Law, the Tax Procedure Law and other relevant legislation.

Sharing with our lawyers

Your personal data may be shared with our lawyers for the purposes of fulfilling legal obligations, conducting legal processes, monitoring lawsuits and disputes, and obtaining legal advice, provided that the sharing is limited to the specific subject matter.

Sharing with Group Companies

Barut Management Services Inc., Barut Tourism and Education Trade Inc., and Band Tourism and Trade Inc. in order to enable you to earn points, receive rewards, and benefit from membership services within the membership program .

Sharing with Business Partners and Suppliers

Your personal data may be shared with banks (for payment and financial transactions), agencies (for booking and sales processes), transfer and transportation service providers, ticketing, CIP and pre-flight hospitality service providers, concierge service providers, facility operating systems and software service providers, and rental units operating within the hotel, only to the extent and for the purpose required by the relevant service, within the scope of providing accommodation services.

Sharing with Legal Representatives

Your personal data will be processed by your legally authorized representative in accordance with due process and law. It may be shared upon request, and only within the scope of the request and authorization.

Information Systems and Digital Service Providers

Your personal data may be shared with IT service providers, website and application infrastructure providers, server hosting and technical support companies that process data on behalf of our company, only for the purpose of operating, securing and ensuring the continuity of the systems.

When cloud computing services are used, data transfer is carried out while taking the necessary administrative and technical security measures.

Transfer within the Scope of Audit and Control Processes

Your personal data may be shared with auditing firms, information security firms, and authorized regulatory and supervisory bodies for the purpose of conducting internal and external audits, and performing quality, information security, and regulatory compliance audits.

Transfer within the scope of Promotion and Announcement Activities

With your explicit consent, photographs, video recordings, and limited personal data such as your name and surname may be used on our hotel's website, social media accounts, and international trade fair organizations for the purpose of promoting our hotel and announcing our projects. If explicit consent is not given, no such sharing will take place.

5. Methods and Legal Grounds for the Collection of Your Personal Data

Your personal data is collected and processed in accordance with the KVKK (Personal Data Protection Law ) through accommodation and reservation forms, conversations and messages with personal assistants, mobile applications, requests and communications during the stay within the hotel, software used, contracts entered into, electronic mail correspondence, websites and social media channels, and hotel security camera systems; in physical or electronic environments, verbally, in writing or electronically, by automated or non-automated methods, in line with the purposes stated in item (3) of this Disclosure Statement .

Legal Reasons

Your personal data collected through the methods mentioned above is processed based on the following legal grounds: the necessity of data processing for the establishment and performance of a contract pursuant to Article 5/2-c of the KVKK (Law on Protection of Personal Data) ; being explicitly provided for in the laws (Law on Identity Reporting, Tax Procedure Law, Law No. 5651 and other relevant legislation) pursuant to Article 5/2-c of the KVKK ; and the necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, pursuant to Article 5/2-f of the KVKK.

Data Processing via Security Cameras

Security camera systems are used in hotel facilities and grounds to ensure security, control entry and exit, and prevent potential security risks.

The camera footage obtained within this scope is processed based on the legal grounds of Article 5/2-c (legal obligation) and Article 5/2-f (legitimate interest) of the Personal Data Protection Law (KVKK). No audio recording is made via security cameras.

Processing Social Media Content

Photo and video content related to your stay that you publicly share on social media platforms and associate with our company by tagging our official accounts may be processed solely for promotional and communication purposes, based on the legal grounds that the data subject themselves made the content public , in accordance with Article 5/2-d of the Personal Data Protection Law . No use outside of this scope is permitted.

Processing of Special Categories of Personal Data

Your sensitive personal data (such as health information) is not required for the provision of accommodation services and is not requested as a prerequisite for the service.

However, if you wish to receive a completely customized service at your own request (e.g., food allergy, special diet, or room or pillow preference based on health condition), your health data will be processed in a limited and proportionate manner only for the purpose of fulfilling the requested service, and only with your explicit consent.

Even if you do not give your explicit consent, your access to accommodation services will not be restricted or negatively affected in any way.

Health data will be immediately deleted, destroyed, or anonymized if explicit consent is withdrawn or the purpose of processing ceases to exist.

6. Scope and Amendments of the Personal Data Protection and Processing Policy

This Privacy Notice, prepared by CANEM Tourism and Trade Inc., has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data. CANEM Tourism and Trade Inc. reserves the right to amend this Personal Data Protection Privacy Notice in accordance with the Law and board decisions, and to ensure better protection of personal data.

7. Information Regarding Commercial Electronic Messages

Law No. 6563 Law on the Regulation of Electronic Commerce And Regulation on Commercial Communication and Commercial Electronic Messages in accordance with; With your explicit consent , your personal data may be processed for the purposes of informing you about our services, promoting our goods and services, conducting marketing activities, and keeping you informed about our campaigns.

In this context, your permissions for commercial electronic communications are required by the relevant legislation. Message Management System (MMS) Recording is mandatory. The data to be transferred to IYS , Contact address (email address and/or phone number), authorization date, communication channel, recipient type, and authorization source. It is limited to.

If you do not consent to receive commercial electronic communications, you will not receive any promotional or marketing communications in this context. This will not affect your access to accommodation or other essential services in any way .

For detailed information about IYS https://iys.org.tr/ You can reach us at this address.

8. Your Rights Regarding the Protection of Your Personal Data

CANEM Tourism and Trade Inc. You may at any time apply to us regarding your rights under Article 11 of the Law concerning your personal data processed by us . In accordance with this article;

"To find out whether personal data is being processed",

"The right to request information regarding the processing of personal data."

"To learn the purpose for which personal data is processed and whether it is used appropriately for that purpose."

"Knowing the third parties to whom personal data is transferred, whether domestically or internationally"

"The right to request the correction of personal data if it has been processed incompletely or incorrectly, and to request that the actions taken in this regard be notified to third parties to whom the personal data has been transferred."

"The right to request the deletion or destruction of personal data when the reasons requiring the processing of personal data cease to exist, and to request that the actions taken in this regard be notified to third parties to whom the personal data has been transferred."

"The right to object to adverse consequences arising from the processing of personal data through automated systems."

You have the right to claim compensation for damages you have suffered as a result of the unlawful processing of your personal data." You have .

9. Application Method

You can submit your requests regarding your rights under Article 11 of the KVKK (Personal Data Protection Law). “ https://baruthotels.com/tr/policies ” You can submit your application to our company by filling out the "Application Form in Accordance with the Personal Data Protection Law" located at [address] and using one of the methods listed below:

In writing ; The address is Side Mahallesi 651.Sokak No:6 07330 Manavgat/ANTALYA. can be delivered in person or through a notary . can send, secure electronic signature or mobile signature using kvkk@barutarum.com​ You can send it to this address, the information you previously provided to our company and which is registered in our system your email address You can submit your application through [website address].

Your applications will be processed according to the nature of the request. It will be finalized free of charge as soon as possible and within thirty (30) days at the latest . However, if the application requires additional costs, In accordance with the tariff determined by the Personal Data Protection Board A fee may be charged.

Applications, Applications to the Data Controller must be made in accordance with the procedures and conditions set forth in the Communiqué on the Procedures and Principles Regarding Applications to the Data Controller.