Personal Data Processing and Protection Policy

Dear Valued Guests,

As Barut Tourism and Education Trade Inc. (“Company”), we attach great importance to the protection of your personal data. In this context, your personal data are processed in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), in our capacity as the data controller, and within the scope of the principles and procedures explained below.

This Privacy Notice has been prepared to inform you about which categories of personal data are processed, for what purposes, on which legal grounds, to whom such data may be transferred, the retention periods, and your rights under KVKK.

1. Identity of the Data Controller

Title: Barut Tourism and Education Trade Inc.
Address: Side Mah. Süleyman Demirel Bulvarı No:1 Manavgat/Antalya
E-mail: [email protected]

2. Personal Data We Process

Within the scope of our accommodation and service activities, the following categories of personal data may be processed by our Company:

Identity Information: Name, surname, date of birth, Turkish ID number, passport number.
Contact Information: Address, postal code, e-mail address, phone number, registered electronic mail (KEP) address, and social media contact details if shared by you.
Financial Information: E-invoice details, payment and expenditure records, accounting and finance-related data.
Health Data (Special Category Personal Data): Limited health information shared with your explicit consent, such as food allergies, special diet requirements, or special service requests based on health conditions. These data are not mandatory for accommodation services and are not processed without explicit consent.
Visual Records: CCTV recordings taken for security purposes within the facility (no audio recording is conducted). Photo and video recordings for promotional purposes only with explicit consent.
Physical Premises Security Data: Facility entry and exit records, CCTV image recordings.
Location Data: Travel and transfer details and limited vehicle-related information for the purpose of organizing transfer and transportation services.
Transaction Security Data: IP address, log records, internet access and traffic information, entry-exit logs obtained during website and mobile application use (pursuant to Law No. 5651).
Guest Feedback and Complaint Data: Evaluations, opinions, complaints related to facilities and services, satisfaction records, reservation details, and room numbers.
Preference Data: Accommodation preferences, special requests, previous service demands, and interest-related information.
Marketing Data: Accommodation history, cookie records, loyalty program membership details, communication consents, and special day information, only if explicit consent is given.
Other Information: Vehicle plate number, agency or company information, guest product acceptance records, written or electronic communications, signatures obtained during check-in, room change or upgrade processes, lost-and-found delivery, delivery of personalized shipments or orders, professional information, and personal assistant service information shared solely by you.

3. Purposes of Processing Personal Data

Your personal data are processed within the scope of Articles 5 and 6 of KVKK, based on the following purposes:

Execution of Reservation Processes and Provision of Accommodation Services

Your data are processed for creating, planning, and fulfilling reservations, providing accommodation services, enabling online check-in, performing identity verification, and delivering services related to your stay upon request.
Information such as pillow preference, room preference, food allergies, or special diet requests is processed solely based on your explicit consent and limited to the requested service. Sharing such information is not mandatory for accommodation services.

Provision of Personalized Services

Upon your request, data related to accommodation preferences, special requests, and previous service demands may be processed to arrange reservations for à la carte restaurants, pavilions, and similar areas, limited to name, surname, and room number.
For mini club activities, children’s names, surnames, room numbers, and guardian contact details are processed solely to ensure safe organization. Children’s health data are processed only with explicit consent and only if strictly necessary.
Information publicly disclosed by you on public platforms may be considered only to the extent relevant to the service and in a proportionate manner.

Execution of Communication Activities

Your personal data is processed to deliver reservation confirmations, provide information related to your stay, offer personal assistant services upon request, and inform you about payment processes.

Evaluation of Requests, Opinions, and Complaints

Your data are processed to measure, enhance, and improve guest satisfaction, manage guest relations processes, and receive, evaluate, and resolve requests, suggestions, and complaints.

Fulfillment of Legal Obligations

Your personal data are processed to fulfill obligations arising from national and international legislation, respond to requests from official authorities, conduct legal processes, and handle data subject applications in compliance with legislation.

Execution of Accounting and Financial Processes

Your personal data is processed for conducting accounting and financial operations, processing payments, managing invoicing, and delivering financial documents upon request.

Ensuring Physical Premises Security

Your data are processed to ensure the security of facilities and premises, control visitor entry and exit, and facilitate security activities via CCTV systems (with no audio recording).

Ensuring Transaction Security

Your personal data is processed to ensure transaction security during website, mobile application, and wireless network use, prevent unauthorized access, maintain log and traffic records, prevent fraud, and ensure information security.

Barut Club Membership Program

If you are a Barut Club member, your personal data is processed to enable you to benefit from membership services, manage point accumulation, and reward processes.

Advertising and Marketing Activities

Your personal data is processed only with your explicit consent to provide information about our hotel and services, conduct promotional and marketing activities, and send celebratory messages. If no consent is given, no marketing-related data processing will occur.

All personal data processed for these purposes are stored in physical archives and/or electronic systems in compliance with applicable legislation, with necessary administrative and technical measures in place.

4. Transfer of Personal Data and Purposes of Transfer

Your personal data may be transferred in accordance with Articles 8 and 9 of KVKK, solely for the purposes and to the extent necessary as outlined below:

Legal Obligations: To authorized judicial authorities, law enforcement agencies, and public institutions pursuant to the Identity Notification Law, Tax Procedure Law, and other applicable legislation.
Legal Counsel: To our attorneys for legal compliance, dispute resolution, litigation processes, and legal consultancy services, limited to the relevant scope.
Group Companies: If you are a Barut Club member, limited data necessary for membership services may be shared with Barut Yönetim Hizmetleri A.Ş., Barut Tourism and Education Trade Inc., and Canem Tourism and Trade Inc.
Business Partners and Suppliers: Banks, agencies, transfer and transportation service providers, ticketing and CIP service providers, concierge service providers, software and system service providers, and leased units within the hotel, limited to service requirements.
Legal Representatives: Upon lawful request of your authorized legal representative, limited to the scope of authority.
IT and Digital Service Providers: For system operation, security, and continuity purposes, with necessary safeguards in place.
Audit and Control Processes: With audit firms, information security firms, and authorized regulatory bodies.
Promotional Activities: With your explicit consent, we may use limited personal data, such as photos, videos, and your name and surname, on our websites, social media, and at international fairs.

5. Methods and Legal Grounds for Collecting Personal Data

Your personal data are collected through reservation forms, accommodation processes, personal assistant communications, mobile applications, hotel services, software systems, contracts, emails, websites, social media channels, and CCTV systems, via physical or electronic means, in accordance with KVKK.

Legal Grounds:

KVKK Art. 5/2(c): Necessity for contract establishment and performance
KVKK Art. 5/2(ç): Explicit legal obligation
KVKK Art. 5/2(f): Legitimate interests of the data controller

CCTV Data Processing

CCTV systems are used to ensure security and prevent risks. Data are processed based on legal obligation and legitimate interest. No audio recording is conducted.

Social Media Content

Publicly shared content tagged with our official accounts may be processed based on your disclosure, solely for promotional and communication purposes.

Processing of Special Category Personal Data

Health data are processed only upon your explicit consent, solely for providing requested personalized services, and are deleted or anonymized once the purpose ceases or consent is withdrawn.

6. Scope and Amendment of This Privacy Notice

This Privacy Notice has been prepared in compliance with KVKK. The Company reserves the right to amend this Notice in accordance with legislation and regulatory decisions, provided that enhanced data protection is ensured.

7. Commercial Electronic Communications

Pursuant to Law No. 6563 and related regulations, commercial electronic communications may be sent only with your explicit consent. Relevant consent data will be recorded in the Message Management System (İYS). Refusal of consent will not affect your accommodation or core services.

8. Your Rights Regarding Personal Data

Under Article 11 of KVKK, you have the right to:

Learn whether your personal data is processed
Request information if processed
Learn the purpose of processing and whether it is used accordingly
Know third parties to whom data are transferred
Request correction, deletion, or destruction
Object to unfavorable outcomes resulting from automated processing
Request compensation for damages due to unlawful processing

9. Application Method

You may submit your requests by completing the application form available at
https://baruthotels.com/en/policies
and sending it via the methods specified therein.

Applications will be finalized within thirty (30) days free of charge, unless additional costs arise as determined by the Personal Data Protection Board.