Privacy Notice (GDPR / KVKK)

This is a draft; have it reviewed by legal counsel before publishing.

Data controller

• Unvan: [DOLDURULACAK: şirket ticaret unvanı]
• Adres: [DOLDURULACAK: açık adres]
• Telefon: [DOLDURULACAK: telefon]
• E-posta: [DOLDURULACAK: e-posta]
• Vergi dairesi / no: [DOLDURULACAK: vergi dairesi ve numarası]
• Mersis no: [DOLDURULACAK: mersis numarası]
• TÜRSAB belge no: [DOLDURULACAK: TÜRSAB belge numarası]

Data we process

When you book we process your name, email, phone, hotel and room number, language and country. Card details are never stored by us; they are handled by our payment provider.

Purpose and legal basis

• Performance of the booking contract
• Sending vouchers, reminders and cancellation notices
• Statutory record keeping
• Measuring service quality and marketing (consent — see cookie banner)

Retention

Booking and payment records are kept for 10 years as required by tax law. Marketing records are deleted after 6 months, security logs after 2 years.

Your rights

You may request access, rectification or erasure of your data through our data request form. Requests are processed after identity verification; personal fields in financial records are anonymised rather than deleted.