KVKK Privacy Notice and Privacy Policy

PERSONAL DATA PROTECTION LAW DISCLOSURE NOTICE

A. Our Commitment to Protecting the Privacy of Private Life

You are important to us. Providing you with an enjoyable stay and ensuring your satisfaction at Adempira Thermal&Spa Hotel is our priority. As part of this commitment, and as explained below, we attach the utmost importance to the processing and protection of personal data in accordance with the Personal Data Protection Law (KVKK).

In this notice, Ulu Maden Termal Turizm Deri Kuyumculuk Anonim Şirketi, operating Adempira Thermal&Spa Hotel, is referred to as the “Company”.

Our Contact Details

Address: Karahayıt Mahallesi, 113 Mustafa Sezer Sokak No:5/1, 20190 Pamukkale/Denizli
Telephone: 0 (258) 271 42 20
E-mail: adempira@adempirahotel.com
Website: https://www.adempirahotel.com/

B. Collection, Processing and Purposes of Processing of Personal Data

Which Personal Data Are Collected?

From time to time, we may need to request information such as the following about you or persons accompanying you:

• Contact details (e.g. name, surname, telephone number, e-mail address);
• Personal information (e.g. date of birth, nationality);
• Information relating to your children (e.g. name, date of birth, age);
• Your credit card number (for banking transactions and reservation purposes);
• Information contained in an identity document (e.g. national ID card, passport or driving licence);
• Your membership number for the Company’s customer loyalty programme or another partner programme (e.g. an airline loyalty programme) and information relating to your activities under such programme;
• Your arrival and departure dates;
• Your preferences and interests (e.g. smoking/non-smoking room, preferred floor, bedding type, newspaper/magazine type, sports, cultural interests, food and beverage preferences, etc.);
• Your questions/comments during or after your stay at the Company;
• Technical information and locations applicable while you use our website.

Information collected about persons under the age of 16 is limited to name, ID number, nationality and date of birth. Such information may be provided to us only by an adult. Please ensure that your child does not send us personal data without your consent (especially via the Internet). If such data are sent, you may contact the Personal Data Protection Desk indicated on our website to request deletion of the information.

In order to meet your requests or provide a suitable service (e.g. a special dietary programme), we may need to collect sensitive information such as race or ethnic origin, trade union membership or health data. In such cases, we obtain these data only with your prior consent. Apart from this, no such data are recorded.

1. Our Company’s Personal Data Protection and Privacy policy has been prepared in accordance with the KVK Law. In this context, your personal data may vary depending on the services, products or commercial activities provided by our Company and may be collected by automated or non-automated methods, verbally, in writing or electronically, through offices, branches, dealers, call centres, websites, social media channels, mobile applications and similar means. For as long as you benefit from our Company’s services, your personal data may be processed by being created and updated.

2. In addition, with the intention of benefiting from our Company’s services, your personal data may be processed when:

• you use our call centre or website,
• you visit our Company or facility,
• you visit our website or social media channels,
• you attend training sessions, seminars or events organised by our Company.

Your personal data obtained with your consent or on the grounds of lawfulness set out in the laws of the Republic of Türkiye may be processed by our Company and by the other natural and/or legal persons referred to in section (E) below, within the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVK Law, for the following purposes:

• to enable our business units to carry out the work necessary for you to benefit from the services offered by our Company,
• to customise and offer the products and services provided by our Company according to your tastes, usage habits and needs,
• to inform you of and enable you to benefit from general and special campaigns, promotions, advertisements, discounts and similar advantages offered by our Company,
• to improve the quality of the services offered by our Company and to develop our quality policy,
• to ensure the legal and commercial security of our Company and of persons in a business relationship with our Company (administrative operations relating to communication carried out by our Company, ensuring the physical security and supervision of Company locations, business partner/customer/supplier (authorised persons or employees) evaluation processes, legal compliance processes, financial affairs, etc.),
• to ensure the security of persons present at our facilities by means of CCTV footage and to assist in the prevention, detection and prosecution of criminal offences; and also, taking photographs into account, to establish, exercise or defend our legal rights,
• when you log in with your username and password to obtain services through channels offered by our Company, to process personal data, preferences, transactions and browsing duration obtained on such channels in order to provide the information and services you have requested,
• to inform you of any loyalty cards issued and/or to be issued by our Company, any communication that may be established with you, newly offered services and products, and changes, innovations and similar matters in personal data policies and membership conditions,
• to manage security operations, accidents or other similar events for medical/insurance purposes,
• to carry out market research and R&D (research and development) activities and to develop and improve our product range, services, stores, information technology systems and security systems,
• to inform you about information, events and services you request from our Company,
• to determine and implement our Company’s commercial and business strategies,
• to ensure the implementation of our Company’s human resources policies,
• where expressly stated in the legislation or where necessary, to fulfil a legal obligation determined by legislation,
• due to force majeure events including contagious epidemic diseases such as COVID-19.

C. Method and Legal Grounds for Collecting Personal Data

Your personal data are obtained in any verbal, written or electronic medium for the purposes set out above so that our Company can provide its services within the designated legal framework and fully and accurately fulfil its contractual and statutory responsibilities. Your personal data collected on these legal grounds are processed, recorded, transferred, shared and stored for the purposes set out in section (B) of this notice, within the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVK Law.

D. Privacy Policy

The website you are visiting belongs to and is operated by the Company. By using our website, you consent to the use of personal data obtained and collected through our website.

The Company undertakes to protect your personal privacy. This policy applies only to this website and does not apply to websites owned by third parties. By using our website, if you do not agree with the terms of our current Privacy Policy published in this section of the site, please do not share your personal data on this site.

We assure you that if you do not share your personal data with your explicit consent, the Company will not collect any personal data from your visits to our site. When you share your personal data, you authorise us to use such information in accordance with the terms of the Privacy Policy.

Personal data you may share are used for the following purposes:

• to send press releases or notifications by e-mail,
• to send printed publications or other correspondence,
• to deliver products or rewards you have purchased,
• to process your reservation requests and manage your account,
• to calculate statistics relating to your transactions,
• to create commercial statistics and analyses relating to website use.

If you prefer not to share your personal data on this site, you will not be able to benefit from certain rights such as accessing certain areas of the site, requesting online newsletters, making online reservations, applying for a job, providing feedback about our businesses or sending us e-mail.

Information relating to your computer, such as your IP address (the number assigned to your computer when you use the Internet), the type of web browser you use and the operating system you use, may also be collected and linked to your personal information. This is necessary to ensure that our website offers the best experience and serves as an effective information resource for our visitors.

We take reasonable measures to ensure the security of your personal data. All identifiable personal data are protected by reasonable security procedures and practices to prevent unauthorised access, alteration or disclosure.

E. Parties to Whom Personal Data May Be Transferred

Your personal data may be shared with our shareholders, business partners, suppliers, legally authorised public institutions and private persons within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVK Law, for the fulfilment of the purposes stated above.

F. Special Categories of Personal Data

Special categories of personal data (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data) may not be processed without the explicit consent of the data subject. However, personal data relating to health and sexual life may be processed by persons or authorised institutions and organisations under an obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

Principles Adopted by Our Company Regarding the Protection of Personal Data

In accordance with applicable legislation, we have adopted the following principles regarding the processing of your data within our Company:

• Where processing is required by law, we use your personal data only where: the person’s consent has been obtained; it is necessary for the performance of a contract to which the person is a party; it is necessary to fulfil a legal obligation; it is necessary to protect the person’s life; or the use of personal data is based on a legitimate purpose of ours and does not prejudice the person’s freedoms and interests.
• You are informed of where we use the personal data we collect.
• Only personal data that are genuinely necessary for us are collected. If the same result can be achieved with fewer personal data, it is guaranteed that only such data will be used.
• Data subjects are informed about how their data are used, and transparency is observed.
• Data subjects are enabled to exercise their rights. They may access, rectify and erase their data and object to the processing of their data.
• Data are retained only for limited periods.
• The security of personal data — namely their integrity, accuracy and confidentiality — is guaranteed.
• If a third party needs to use personal data, it is guaranteed that such party has the means to protect personal data.
• If personal data need to be transferred outside the European Union, compliance with the legal framework during such transfer is guaranteed.
• In the event of damage to personal data (loss, theft, damage, becoming unusable, etc.), if the breach is likely to create significant risks to the rights and freedoms of individuals, such breach is reported to the competent data protection authorities and to the data subjects concerned.

If you have any questions about these principles of our Company, please contact the Personal Data Protection Desk using the contact details on our page.

G. Force Majeure

Personal data and special categories of personal data are processed within the scope of measures taken or required to be taken in force majeure events such as COVID-19 and similar global or regional epidemics, contagious diseases, earthquakes, floods, war and states of emergency.

H. To Whom and for What Purposes Processed Personal Data May Be Transferred

Your collected personal data may be transferred to our shareholders, business partners, suppliers, legally authorised public institutions and private persons within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVK Law, in order to serve the purposes stated in section (B).

I. Transfer of Personal Data Abroad

Our Company is authorised to transfer personal data abroad after obtaining the person’s explicit consent for this purpose, in accordance with the conditions determined by the Personal Data Protection Board under the KVK Law and the other conditions in the KVK Law.

J. Rights of the Personal Data Subject Listed in Article 11 of the KVK Law

Within the scope of the KVK Law, we acknowledge that the data subject has the right to be informed and to give consent before their personal data are processed, recorded, transferred, shared and stored; and after such processing, recording, transfer, sharing and storage, the right to determine the fate of their data. Accordingly, if you, as personal data subjects, submit your requests concerning your rights to our Company by the methods set out below in this “Disclosure Notice on the Processing of Personal Data”, our Company will conclude the request free of charge within thirty days at the latest, depending on the nature of the request.

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller published by the Personal Data Protection Board:

• If a written response is to be given to your application, no fee is charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page above ten pages.
• If the response is provided on a recording medium such as a CD or flash drive, the fee that may be requested by our Company as data controller cannot exceed the cost of the recording medium.

In this context, personal data subjects have the right to:

• a. learn whether personal data are being processed,
• b. request information if personal data have been processed,
• c. learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• d. know the third parties to whom personal data are transferred domestically or abroad,
• e. request correction of personal data if they are incompletely or inaccurately processed, and request that the transaction carried out in this context be notified to third parties to whom personal data have been transferred,
• f. request the erasure, destruction or anonymisation of personal data within the framework of the conditions set out in Article 7 of the KVK Law, and request that the transaction carried out in this context be notified to third parties to whom personal data have been transferred,
• g. object to the occurrence of a result against the person by analysing the processed data exclusively through automated systems,
• h. request compensation for damage arising from the unlawful processing of personal data.

However, persons have no rights in respect of anonymised data within the Company. Our Company may share personal data with relevant institutions and organisations for the purpose of a judicial duty or the exercise of the legal powers of a state authority, as required by business and contractual relationships.

K. Periods for Which Your Personal Data Will Be Processed

In accordance with the KVK Law, your personal data processed for the purposes set out in this “Disclosure Notice on the Processing of Personal Data” will be erased, destroyed or anonymised by us and may continue to be used in anonymised form when the purpose requiring processing ceases pursuant to Article 7/1 of the KVK Law and/or when the limitation periods for which we are obliged to process your data under the legislation expire.

L. Situations in Which Our Company May Process Your Personal Data Without Your Explicit Consent as Required by Law

Pursuant to Article 5 of the KVKK, our Company may process your personal data obtained lawfully as stated above without seeking your explicit consent in the following cases:

• where it is clearly provided for by law;
• where it is mandatory to process your personal data to protect your or another person’s life or physical integrity, in cases where you are unable to give consent as data subject due to actual impossibility or where legal validity is not attributed to your consent;
• where processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract concluded with our Company;
• where it is mandatory for our Company to fulfil a legal obligation;
• where your personal data have been made public by you;
• where data processing is mandatory for the establishment, exercise or protection of a right;
• where data processing is mandatory for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms.

M. Making a Request under the Personal Data Protection Law

Pursuant to Article 13(1) of the KVK Law, you may submit your request concerning the exercise of the rights stated above to our Company by the method(s) set out in the KVK Law and related legislation and determined/to be determined by the Personal Data Protection Board; or you may submit your application by completing and signing the Application Form at https://www.adempirahotel.com and using one of the following methods:

• i. You may deliver a signed copy of the form containing explanations regarding the right you request, in person, together with official documents identifying you (e.g. national ID card, driving licence, passport, etc.), to Karahayıt Mahallesi 113 Mustafa Sezer Sokak No:5/1 Pamukkale/DENİZLİ.
• ii. You may send the completed form and official identifying documents via a notary.
• iii. You may send the completed form and identifying documents electronically to adempira@adempirahotel.com with a secure electronic signature or mobile signature.
• iv. You may send the completed form and identifying documents using the e-mail address you previously notified to our Company and that is registered in our Company’s system.

As data controller, our Company will ensure that the request is concluded within 30 days at the latest, depending on the nature of the request.

Rights relating to personal data may be exercised only in respect of data belonging to the persons themselves. Requests relating to the data of persons other than the person who completed the form and whose official identifying documents are attached will not be considered. Forms without official identifying documents attached will not be considered. Even if data erasure requests are fulfilled, we remain obliged to share data with official authorities if requested by such authorities.

You can access the most up-to-date version of this disclosure notice at https://www.adempirahotel.com/.