INFORMATION AND CONSENT POLICY FOR THE PROTECTION OF PERSONAL DATA
As Kamelya Collection Exclusive Hotels (Kamelya Fulya Hotel, Kamelya K Club ve Kamelya Selin Hotel), we are aware of the importance of our valuable guests’ personal data. As such, we take utmost care to safeguard your personal data from access via unauthorized parties. We process your personal data within the framework of the limits required by the Protection of Personal Data Law No. 6698 and secondary regulations issued in respect of thereof, Identity Notification Law No. 1774, Tax Procurement Law. No. 213, Turkish Commercial Code No. 6102 and other related legislations with regard to your personal data, for the protection of in particular the right to privacy, and fundamental rights and freedom.
Identity of the data controller
Pursuant to the Protection of Personal Data Law No. 6698, FSP Turizm ve Yatırım A.Ş. has the capacity of “data controller”.
Within the scope of the “Obligation of the Data Controller to Provide Information”, contained in the 10th Article of the PDPL and “The Rights of Data Subject” contained in the 11th Article of the PDPL; we, as FSP Turizm ve Yatırım A.Ş., would like to inform our guests, visitors, business partners, and all natural and legal persons with whom we communicate in our capacity of data controller regarding the “Information And Consent Policy For The Protection Of Personal Data”, which was prepared for the fulfilment of our obligation to inform, with respect to the purpose your personal data will be processed, to whom and for what purpose your processed personal data may be transferred, the method of gathering your personal data and its legal cause and your vested rights.
* Our organization always reserves the right to revise the “Information And Consent Policy For The Protection Of Personal Data”, within the framework of amendments that may be made in the applicable legislation
Your personal data that we process:
Your identity Information (such as name-surname-T.R. identification number),
Your contact information (such as e-mail address, phone number),
Your location information (such as address),
Information on your children (such as age-date of birth),
Your financial information (such as information on your payments),
Your requests, complaints or comments during or after you stayed in our hotel.
** We are permitted to obtain from you the name, surname, nationality and birth date information of minors under 18 years old who are accompanying you, in accordance with the principle of limited number.
How we obtain your personal data:
Within the services that we offer, any personal data that you personally and directly or indirectly provide to our organization is collected via any verbal, audio, written or electronic medium.
During hotel activities:
Your personal data may be collected during your room booking, your communication with tour operators and travel agencies, your check-in and payment stages, notification of your requests and complaints, completed customer satisfaction and survey forms, the provision of participation in any training, seminar or other such event organized by or at the hotel, and during visits to our website.
Method of gathering personal data and its legal cause
Your personal data may be processed under the following conditions, as described in the 5th Article of Protection of Personal Data Law No. 6698;
- With the explicit consent of the data subject,
- Where it is clearly stipulated by the laws,
- Where it is mandatory for the protection of life or the physical integrity of the person or of any other person who is physically incapable of giving their consent or whose consent is not deemed legally valid,
- Where it is necessary to process personal data belonging to parties to the contract, provided that it is directly related to the conclusion or fulfilment of that contract,
- Where it is mandatory in order for the controller to be able to perform their legal obligations,
- Where the data concerned is made available to the public by the data subject themselves,
- Where data processing is mandatory for the establishment, exercise or protection of any right,
- Where it is mandatory for the legitimate interests of the controller, provided that this
processing shall not violate the fundamental rights and freedoms of the data subject
Your health data within the category of personal data of special nature can be processed dependent on meeting the specified requirements or via explicit consent contained in the 6th Article of Protection of Personal Data Law No. 6698.
Processing of personal data of special nature
Personal data of special nature is data that could cause harm in the case of any disclosure. Personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership in associations, foundations or trade-unions, health, sexual life, convictions and security measures, and biometric and genetic data are considered personal data of special nature. As a rule, personal data of special nature may be processed only by obtaining consent from the concerned individual.
As described in the 6th Article of Protection of Personal Data Law No. 6698, your personal data:
Personal data, excluding that relating to health and sexual life, may be processed without seeking the explicit consent of the data subject, in the cases provided for by the relevant laws. Personal data of special nature relating to blood type, allergies, diseases and health and sexual life
may be processed without seeking the explicit consent of the data subject by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services, as well as their financing.
It is essential to take adequate measures determined by the Board while processing personal data of special nature.
Processing purposes of personal data
- Performance of room bookings,
- Fulfilment of legal and regulatory requirements,
- Provision of quality development activities,
- Provision of risk management,
- Provision of customer relationship management,
- Determination and implementation of commercial business and strategies,
- Performance of marketing and sales operations,
- Realization of routine audits,
- Execution and inspection of finance-based operations,
- Planning, auditing and executing information safety processes,
- Preventing misconduct and unauthorized operation by employees,
- Evaluation of and responding to suggestions, requests and complaints that will communicated by customers through all kinds of channels, and improvement works in accordance with the notices.
Retention period of personal data
In cases where the purpose required to be processed is no longer in effect, or the time period for processing data is completed within the scope of the relevant legislation, your personal data shall be erased, destroyed, or used as anonymous.
The rights of the data subject
Each concerned individual may claim the below-listed rights by applying to the data controller:
- to learn whether their personal data are processed or not,
- to request information if their personal data are processed
- to learn the purpose of the data processing and whether this data is used for its intended purposes,
- to know the third parties to whom their personal data is transferred at home or abroad (in order to fulfil this request, the legal cause of personal data processing should be eliminated, legal retention periods or related lapse of time should expire. Erasure of personal data shall not be realized before these periods expire),
- to request the rectification of incomplete or inaccurate data, if applicable,
- to request the erasure or destruction of personal data under the conditions stipulated in Article 7,
- to request notification of operations carried out in compliance with sub- paragraphs (V) and (VI) to third parties to whom the personal data has been transferred,
- to object to the processing exclusively by automatic means of personal data, which can lead to an unfavourable consequence for the data subject,
- to request compensation for damages arising from the unlawful processing of personal data.
