Data Protection Policy

DATA PROTECTION INFORMATION NOTICE

This information notice has been prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1. Data Controller Your personal data is processed by İskofia Boutique Hotel as the data controller, in accordance with the purposes explained below, limited to these purposes, and in compliance with the law and the principles of good faith.

2. Personal Data Processed The following personal data is collected through our website and facility: • Identity information: Name, surname • Contact information: Email address, phone number • Accommodation information: Check-in/check-out dates, number of guests, reservation notes • Contact form information: Name, email, subject, message content • Transaction security information: Cookie data, session information

3. Purposes of Processing Personal Data Your personal data is processed for the following purposes: • Creating, managing, and tracking accommodation reservations • Responding to your communication requests • Providing and improving accommodation services • Fulfilling legal obligations • Ensuring website security and preventing misuse • Generating website usage statistics

4. Legal Grounds for Processing Personal Data Your personal data is processed based on the following legal grounds within the scope of Article 5/2 of the KVKK: • Being directly related to the establishment or performance of a contract (reservation transactions) • Being mandatory for the data controller to fulfill its legal obligations • Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (website security, statistics) • Having been made public by the data subject themselves (information transmitted through the contact form)

5. Transfer of Personal Data Your personal data may be transferred in accordance with the conditions specified in Articles 8 and 9 of the KVKK, for the realization of the purposes stated above: • To authorized public institutions and organizations where required by legal regulations, • To business partners from whom we receive infrastructure services (server and database services) for the provision of our services, • To analytics service providers for website performance and usage analysis.

6. Method of Collecting Personal Data Your personal data is collected through: • The contact form on our website, • The reservation form on our website, • Cookies and similar technologies, through automatic and non-automatic means.

7. Cookie Usage Cookies are used on our website for the following purposes: • Session management and authentication • Ensuring website security (rate limiting) Cookies can be managed or disabled through your browser settings.

8. Retention Period of Personal Data Your personal data is retained for the duration required by the processing purposes and for the statute of limitations periods prescribed in the relevant legislation. When the processing purpose ceases to exist and legal retention periods expire, your personal data will be deleted, destroyed, or anonymized.

9. Rights of the Data Subject Pursuant to Article 11 of the KVKK, you have the following rights: a) To learn whether your personal data has been processed, b) To request information if your personal data has been processed, c) To learn the purpose of processing your personal data and whether they are used in accordance with their purpose, d) To know the third parties to whom your personal data has been transferred domestically or abroad, e) To request the correction of your personal data if it has been incompletely or incorrectly processed, f) To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK, g) To request that the operations carried out pursuant to paragraphs (d) and (e) be notified to third parties to whom personal data has been transferred, h) To object to the occurrence of a result against you through the exclusive analysis of processed data via automated systems, i) To claim compensation for damages incurred due to the unlawful processing of your personal data.

10. Application Method You may submit your requests regarding the above-mentioned rights in writing through the contact form on our website or to the email address provided on our contact page. Your applications will be concluded free of charge as soon as possible and within 30 days at the latest.

This information notice will be updated and published on our website when deemed necessary.