Gesetz zum Schutz personenbezogener Daten

Dear Guests,

As BARUT YÖNETİM HİZMETLERİ A.Ş., we place the utmost importance on the protection of your personal data and handle this matter with great sensitivity.

With this awareness, BARUT YÖNETİM HİZMETLERİ A.Ş., as the "Data Controller" defined under the Law on the Protection of Personal Data No. 6698 (“KVKK”), processes your personal data carefully and diligently in accordance with KVKK, for the purposes and by the methods specified below, within the limits set by the legislation, in compliance with retention and destruction obligations and time limits.

1. Personal Data We Process

• Identity Information: Name, surname, date of birth, nationality, place of birth, gender, marital status, passport number, driver’s license information, Turkish ID card details (ID number, serial number, card number, father’s name, mother’s name, place/date of birth, marital status, province, district, neighborhood/village, volume number, family order number, individual order number, place and reason of issue, registration number, issue date, former surname), copy of identity document, professional or chamber membership ID cards and their copies, if provided by the guest as a substitute for official ID.

• Contact Information: Address, postal code, email address, phone number, registered email address, and social media contact details.

• Visual and Audio Records: Voice recordings.

• Location Data: Travel and transfer information, vehicle details used to reach the facility.

• Transaction Security Information: Navigation data obtained during login with username and password on our website and mobile app, IP address, browser details, location data, internet access logs, and login/logout logs.

• Preference Information: Special preferences in accommodation, special requests, interests, and past service request data.

• Marketing Data: Cookie records, loyalty program membership information, publicly available data (e.g., information gathered through public platforms to learn more about you), special day information.

• Other: All personal data shared by you during interactions through “Barut Hotels AI,” “live chat,” “share your feedback,” or “travel assistant” sections.

2. Purpose of Processing Your Personal Data

• Creating Your Reservations: Managing the planning and execution of your reservations and verifying your identity.

• Establishing Communication: Communicating your reservation details, sharing payment-related information with you, and interacting via the “Barut Hotels AI,” “live chat,” and “share your feedback” sections on our website, as well as through the “travel assistant” section of our mobile application.

• Evaluating Your Requests and Feedback: Measuring, increasing, and analyzing guest satisfaction; receiving and evaluating your requests and complaints.

• Fulfilling Legal Obligations: Ensuring compliance with national and international regulations applicable to BARUT YÖNETİM HİZMETLERİ A.Ş., fulfilling legal obligations arising from such regulations, managing and following up legal processes, responding to data subject applications in compliance with legal requirements, and fulfilling official authority requests.

• Ensuring Transaction Security: Collecting browsing data, IP address, browser information, location data, internet access logs, and login/logout logs obtained when you log into our website or app with your username and password; preventing fraud and misconduct; and managing access permissions of our business partners and suppliers.

• Providing Barut Club Membership Benefits: If you are a member, ensuring that you benefit from Barut Club membership services and conducting the necessary business processes accordingly.

• Processing for Marketing Purposes: With your communication consent, your personal data may be processed for the purposes of informing you about our hotels, promoting and marketing our goods and services, introducing our operations, or enhancing brand awareness through content such as greetings and celebratory messages. Based on your consent, we may also inform you about campaigns of our business partners under BARUT YÖNETİM HİZMETLERİ A.Ş.

Your personal data, obtained and processed in accordance with relevant legislation for these purposes, may be transferred to and stored both digitally and physically in the archives and/or IT systems owned by BARUT YÖNETİM HİZMETLERİ A.Ş.

3. Transfer of Your Personal Data – To Whom and For What Purposes

• Fulfilling Legal Obligations: In order to comply with the legal obligations of our hotel, your personal data may be shared with public institutions and organizations such as the Personal Data Protection Authority, judicial authorities, the General Directorate of Security, and other law enforcement bodies, as permitted by the Law on the Protection of Personal Data.

• Sharing with Our Legal Advisors: Your personal data may be shared with the legal advisors we consult, limited to the relevant issue, for reasons such as fulfilling legal obligations or obtaining legal opinions.

• Sharing with Our Group Companies: If you are a member of the Barut Club, your points and reward-related information may be shared with our group companies—Band Turizm ve Ticaret A.Ş., Barut Turizm ve Eğitim Ticaret A.Ş., and Canem Turizm ve Ticaret A.Ş.—to ensure that you can benefit from the Barut Club membership program and accumulate points.

• Sharing with Our Business Partners: Your personal data may be shared with banks for tourism and hotel incentive purposes; with travel agencies we work with; with companies providing transfer planning, ticketing, CIP services, or pre-flight hospitality services, limited to the subject matter.

• Sharing with Your Authorized Legal Representative: Your personal data may be shared, solely within the scope of their authority and request, with your legal representative authorized by you.

• Use of Applications and Websites: Your personal data may be shared with companies that process data on our behalf, websites, IT infrastructure service providers used by our company, and cloud service providers where cloud computing is utilized.

• For the Execution of Audit Processes: Your personal data may be shared with audit and information security firms and with regulatory and supervisory authorities for the purposes of conducting necessary quality, confidentiality, and standard audits, as well as internal and external audits.

4. Method and Legal Grounds for Collecting Your Personal Data

Your personal data, for the purposes stated in clause (2) of this notice, may be collected and processed by the relevant departments of BARUT YÖNETİM HİZMETLERİ A.Ş., depending on the nature of the service provided, through call centers, conversations/messages made via the “Barut Hotels AI,” “live chat,” and “share your feedback” sections on our website, conversations/messages made via the “travel assistant” section on our mobile application, software, and similar means, verbally, in writing or electronically, through physical environments or by automatic or non-automatic means, in accordance with the Law.

Through the above-mentioned methods;

Your personal data is processed based on the legal grounds of “explicitly stipulated in laws,” “necessity of data processing for the establishment and performance of a contract,” “fulfillment of a legal obligation arising from legislation,” and “necessity of data processing for the legitimate interests of the data controller.” These preferences are retained in order to provide you with better service during your next reservation.

5. Scope and Amendments of the Personal Data Protection and Processing Policy

This Clarification Text has been prepared by BARUT YÖNETİM HİZMETLERİ A.Ş. in accordance with the Law on the Protection of Personal Data No. 6698.
BARUT YÖNETİM HİZMETLERİ A.Ş. reserves the right to amend this Clarification Text on the Protection of Personal Data in compliance with the Law and decisions of the Authority, and under the condition of providing better protection of personal data.

6. Information About Commercial Electronic Messages

In accordance with the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, if you provide your consent, your personal data may be processed for the purpose of informing you about our services, promoting our goods and services, and keeping you informed about our campaigns.

Pursuant to the relevant legislation, your permissions for commercial electronic messages must be recorded in the Message Management System (İYS). In this context, your contact information (email address and/or phone number), date of consent, communication channel, recipient type, and source of consent will be shared with the İYS. For more detailed information about the İYS, you can visit https://iys.org.tr/.

7. Your Rights Regarding the Protection of Your Personal Data

You may apply to us at any time regarding your personal data processed by BARUT HOTELS, in line with the rights listed in Article 11 of the Law. Pursuant to this article, you have the right to:

• Learn whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of the data processing and whether your data is used for its intended purpose,
• Know the third parties to whom your personal data is transferred domestically or abroad,
• Request correction of your personal data if it is incomplete or inaccurate, and request that the relevant correction be notified to third parties to whom the data has been transferred,
• Request deletion or destruction of your personal data if the reasons requiring its processing no longer apply, and request that this be communicated to third parties to whom the data has been transferred,
• Object to any unfavorable outcome that arises as a result of the automatic processing of your personal data,
• Request compensation for any damages incurred due to the unlawful processing of your personal data.

Application Method
You can submit your requests within the scope of the Law by filling out the "Application Form under the Law on the Protection of Personal Data" available at https://baruthotels.com/tr/policies, and:

• Delivering it in person to the address: Mehmetçik Mah. 1242 Sok. İdea İş Merkezi Sitesi No: 1/201 Apartment: 6 Floor: 2, Postal Code: 07100 Muratpaşa/ANTALYA,
• Sending it via notary,
• Or sending it electronically to the email address [email protected], with a secure electronic signature or mobile signature, via your registered email address or the email address registered in our system.

Depending on the nature of your request, it will be concluded free of charge as soon as possible and no later than thirty (30) days. However, if the process requires an additional cost, you may be charged a fee in accordance with the tariff to be determined by the Personal Data Protection Board.

(Please note that your request must comply with the conditions specified in the “Communiqué on the Principles and Procedures for the Application to the Data Controller.”)