INFORMATION NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

This notice is provided to inform you, pursuant to Law No. 6698 on the Protection of Personal Data (“Law” or “KVKK”), which aims to protect fundamental rights and freedoms—especially the right to privacy—during the processing of personal data.

Dear Guests and Visitors, as JİVA BEACH RESORT Doğantur Turizm İnşaat Taahhüt Nakliyat Akaryakıt LPG Otogaz İthalat İhracat Sanayi ve Ticaret A.Ş. (the “Hotel” or the “Company”), in our capacity as Data Controller, we hereby inform you—within the scope of Article 10 (“Obligation to Inform of the Data Controller”) and Article 11 (“Rights of the Data Subject”) of the KVKK—about (i) the purposes for which your personal data will be processed, (ii) to whom and for what purposes your personal data may be transferred, (iii) the method of collection and the legal grounds for processing, and (iv) your rights as a data subject, as set out below in this Information Notice.

WHAT PERSONAL DATA DO WE COLLECT?

Within the scope of our business and operations, the personal data we process regarding our customers generally include:

Identity information; name, surname, Turkish ID number / tax ID number, and identity data on ID card, passport or similar documents such as age and photograph.
Contract / form data; signature, identity, contact and legal transaction data appearing on contracts, forms and similar documents.
Contact information; address, domicile address, e-mail address, phone and fax numbers, mobile phone number.
Personal information; date of birth, nationality, etc.
Information regarding your children; date of birth, age, etc.
Financial data; bank account details, invoice information, reservation details, credit card information, payment records, debit and credit statements.
Transaction data related to our services; preferences, likes, comments (e.g., smoking information, preferred floor, pillow request), your questions, comments and survey forms before, during and after your stay (requests, complaints, disputes).
Information from third parties; data transmitted to our facility via reservations made through tour operators, travel agencies, reservation systems and others.
Internet activities; connections to Jiva Beach Resort websites (IP addresses, cookies, etc.), online reservations, the Hotel’s pages on social networks, Facebook login, and other network-based log-in systems.
Physical venue security data; entry / exit logs to the premises (vehicle plate information, audio and video recorded by security cameras).
Consumption during stay; restaurant food and beverage information.
Sensitive health data; processed to serve you better, protect your health and enable spa use (e.g., past illnesses, allergies, joint problems, pregnancy, blood pressure, etc.). For persons under 18, we collect only name, nationality and date of birth, and these are provided to us only by an adult. (All of the foregoing are referred to collectively as “Personal Data.”)
Health data.
IP address and website session data; website entry, exit and navigation information.

As a general rule, the Company collects personal data directly from you. In cases where your personal data is transmitted and / or stored by a third party, we act by ensuring that your consent has been obtained before such information is acquired. Where permitted or required by applicable laws or regulatory requirements, we may collect information about you without your knowledge or consent.

WHY DO WE COLLECT PERSONAL DATA? DO WE SHARE YOUR PERSONAL DATA?

The personal data collected by our Company are used and shared primarily for the purpose of establishing, managing, or terminating our service relationship with you, including the provision of services. Your personal data are particularly processed for the following purposes:

Fulfilling obligations arising from service contracts and legal / administrative requirements,
Ensuring the health and safety of our hotel and our customers,
Fulfilling our legal and contractual obligations toward our customers; performance of contracts,
Tracking finance and accounting activities,
Managing customer relations and ensuring customer satisfaction, and fulfilling related obligations,
Tracking customer complaints,
Planning and executing activities necessary for recommending and promoting our products and services by customizing them according to the tastes, usage habits, and needs of data subjects,
Carrying out the necessary work and business processes to conduct our commercial activities,
Carrying out the necessary work and business processes to enable customers to benefit from the products and services offered by the Company,
Planning and executing activities for customized recommendations and promotions of our products and services,
Planning and managing transfer processes,
Carrying out the business and operational processes necessary to ensure that you can benefit from the products and services offered by the Company,
Ensuring the security of buildings, premises, and / or facilities,
Protecting the health of the data subject, other guests, and staff within the hotel, including — where necessary — room changes (e.g., moving to an isolation room),
Creating and tracking visitor records,
Ensuring the security of our assets and / or resources,
Ensuring technical and commercial business security,
Ensuring the security of corporate operations,
Providing information to authorized institutions and organizations as required by legislation,
Planning, establishing, and managing information security processes, infrastructures, and operations,
Providing information to public officials on matters of public safety and public health, and conducting and auditing all these processes.

Our Company records and stores your personal data in accordance with the general principles set forth in Article 4 of the Law, for legitimate purposes and in connection with such purposes; updates them to fulfill statutory obligations; and processes them as required during the establishment and continuation of the service relationship, or when mandated by law, or when establishing rights in favor of customers.

In addition, your personal data are processed only for the processing purposes stated in this Information Notice and may be transferred — to official and administrative authorities, audit firms within the scope of audits, and to service providers, intermediaries, and suppliers — for e-invoice, e-archive, storage, IT and information systems services; as well as, when necessary, to financial, legal, customs, and other professional consultants; and to transportation, accommodation, domestic and international event companies, agencies, and agents.

During data transfers to third parties, all necessary technical and legal measures are taken to prevent possible violations of rights, and confidentiality commitments and guarantees are obtained from the recipients.

Within the scope of legal obligations and when required, personal data may be shared — including but not limited to — with courts and other public authorities.

PROCESSING OF YOUR SPECIAL CATEGORIES OF PERSONAL DATA

Under Article 6 of Law No. 6698, certain personal data that may cause victimization or discrimination if processed unlawfully are designated as special categories (sensitive personal data). These include race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire, association / foundation or union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Our Hotel acts in compliance with Article 6 regarding the processing of special categories of personal data and exercises utmost diligence in protecting these data.
The special categories of personal data we collect from our valued Guests and Visitors are collected and stored for the following purposes:

Protecting public health,
Ensuring your health and that of our employees and other third parties present during your visits and stays,
Ensuring your physical security and online transaction security and that of our businesses,
Conducting our activities in accordance with applicable legislation and ensuring product safety and conformity to health requirements, while maintaining the Company’s legitimate interests.

At Jiva Beach Resort, we process your special categories of personal data in compliance with the Law — provided that adequate measures determined by the Personal Data Protection Board are taken — in the following cases:

Where Your Explicit Consent Is Present.

You may share special category data with our Hotel to request customized services (e.g., requesting a thin pillow due to cervical hernia; requesting a ground floor room due to a heart condition; requesting desserts without nuts due to a peanut allergy; requesting gluten-free meals due to gluten allergy; or providing health information to determine eligibility for sports activities offered on site). Within our Hotel, such health information obtained with your explicit consent is restricted even internally to ensure that only the responsible staff for the service can access it. We will process your special category data only with your explicit consent and solely to fulfill the stated purpose of collection, in order to offer services tailored to your described needs and to remember these needs in the future. Your special category health data and other preference-related special category data are shared within the organization only with the personnel providing the service to minimize life-threatening risks. They are never shared with other employees or third parties. All necessary administrative and technical measures are taken to protect these special category data with seriousness and care.

Where Your Explicit Consent Is Not Present.

Special category personal data other than health data may be processed only in cases stipulated by law. Your special category health data may be processed only by persons under an obligation of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing. Apart from these, in situations where your explicit consent cannot be obtained (e.g., accidents, severe illness preventing consent, emergencies requiring immediate medical intervention), your health data may be shared only with healthcare institutions.

Purposes of Processing Your Personal Data

Your personal data are processed—pursuant to Articles 5 and 6 of the Law and to fulfill the obligations imposed by law on our institution—for the following purposes related to ensuring the security of our Hotel and enabling you to benefit from the services offered to our visitors and guests, and for managing access records to our Hotel:

Fulfilling our obligations to our customers,

Managing room reservations and accommodation requests:

Creating statutory documents in line with accounting standards; managing and retaining billing services,

Managing your hotel stay:

Monitoring service usage (telephone, minibar/bar, pay TV, etc.),

Managing room access,

Internal management of lists regarding customers exhibiting inappropriate behavior during their stay (aggressive or antisocial behavior, breach of hotel contract, non-compliance with safety regulations, theft, damage, or payment incidents),

Carrying out marketing activities and promoting our brands,

Adapting and improving our products and services to better meet your needs,

Customizing commercial offers and promotional messages we send you,

Informing you—where your explicit consent exists—about special offers and new services created by Jiva Beach Resort,

Managing our relationships with customers before, during and after accommodation,

Segmenting based on reservation history and customer travel preferences for targeted communications,

Developing statistics and commercial scores and preparing reports,

Knowing the preferences of new or existing customers and providing personalized services,

Sending you—where your explicit consent exists—newsletters, promotions and tourism/hotel/service offers, or contacting you by phone,

Managing unsubscribe requests from newsletters, promotions, tourism offers and satisfaction surveys,

Respecting the right to object and managing objection processes,

Utilizing special call services to contact persons staying at our Hotel in case of serious events affecting the Hotel (e.g., natural disasters),

Conducting surveys and analyzing survey results and customer comments,

Managing claims/complaints,

Securing and improving your use of our websites, especially to (i) improve navigation and (ii) prevent security breaches and fraud,

Fulfilling our obligations under the Identity Notification Law No. 1774, and

Fulfilling obligations under other relevant legislation (e.g., ISG activities, Tax Procedure Law obligations, etc.).

Domestic or Cross-Border Transfer of Your Personal Data

For the provision of services within the Hotel, your personal data may be accessed by Jiva Beach Resort and, where applicable, its affiliates. Your personal data may be transferred—to the extent necessary and in a controlled and limited manner under the supervision of our technical units—to domestic and overseas institutions providing storage, archiving and IT support services (such as servers, cloud computing), financial institutions we cooperate with and/or receive services from, consulting firms in legal and similar fields, third parties supporting the Hotel’s activities, our business partners, and authorized institutions and organizations, for the purposes defined herein. During domestic data transfers, our Hotel fulfills all obligations under KVKK and applicable legislation. Where required under legal obligations, your Personal Data may be transferred to state institutions, judicial authorities and foreign missions established under international treaties (embassies, consulates, etc.).

Retention Period for Your Personal Data

If a retention period is stipulated for your Personal Data in the relevant legislation, we process and retain your data until the end of that period; if no such period is specified, we retain them for as long as necessary for the purposes for which they are processed. Upon expiry of these periods, your Personal Data will be deleted, destroyed or anonymized promptly, ex officio or upon your request, in accordance with legal rules. During these periods, if there is any change in your Personal Data, you are obliged to inform Jiva Beach Resort so that your records can be kept accurate and up to date.

CCTV Monitoring of Hotel Premises

For facility security, guest safety and occupational health and safety, the entrances and exits of our premises, corridors, common areas and building exteriors are monitored by cameras, and a camera symbol is displayed in these areas. Your constitutional and KVKK rights remain reserved regarding these images. The purpose of CCTV monitoring and recording is to identify actions that may occur in the workplace, particularly theft and similar acts. Access to these recordings is limited to the Hotel’s authorized units. Recordings are retained for 15 days for security purposes and destroyed at the end of this period.

Method of Processing Your Personal Data and Legal Grounds

For our customers: Personal data are processed—pursuant to Article 5 of the Law—on the legal grounds of (i) necessity for the establishment or performance of a contract, (ii) necessity for compliance with the data controller’s legal obligation, (iii) being made public by the data subject, (iv) necessity for the establishment, exercise or protection of a right, and (v) necessity for the legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed; and under the provisions of the Identity Notification Law No. 1774. Data are processed in physical and electronic media, through written or verbal data transfer tools, obtained directly from the person or from third parties as part of a data recording system, by automated means.

For our visitors: Personal data are processed—pursuant to Article 5 of the Law—on the legal grounds of (i) necessity for compliance with the data controller’s legal obligation and (ii) necessity for the legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed, via security cameras located at the entrances, building exterior façades, meeting and event areas, dining areas, reception waiting areas, parking lots, elevators and floor corridors within our service area, by automated means.

For our online visitors: Personal data are processed—pursuant to Article 5 of the Law—on the legal grounds of (i) necessity for the legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed and (ii) necessity for compliance with the data controller’s legal obligation; and under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications, by automated means.

Within the scope of performing accommodation and other service processes offered within our Hotel facilities and for the purposes specified in this Notice, your Personal Data may be collected and processed by the relevant departments of the Hotel and other authorized departments by automated or non-automated means, and through the following channels and methods:

In person (physical applications), through Hotel websites, by e-mail, mail, referrals, or via our Hotel’s solution partners and suppliers (e.g., travel agencies, tour companies, booking sites) and/or websites and social media accounts;

Through information obtained during communications conducted in various forms (face-to-face, phone, teleconference, video conference, fax, etc.).Your personal data are processed under the following legal grounds set out in Article 5 of Law No. 6698:

Presence of your explicit consent,

Express stipulation in laws,

Necessity to protect the life or physical integrity of yourself or another person where you are unable to disclose consent or where consent is not legally valid,

Necessity for the establishment or performance of a contract,

Necessity for compliance with our legal obligations,

Being made public by the data subject,

Necessity for the establishment, exercise or protection of a right,

Necessity for our legitimate interests, provided that your fundamental rights and freedoms are not harmed, and subject to obtaining your explicit consent where required.

Your special category health data are processed based on your explicit consent or under the conditions listed in Article 6 of the Law. Your personal data are processed pursuant to the Identity Notification Law No. 1774, the Tax Procedure Law, the Turkish Commercial Code No. 6102, the Personal Data Protection Law No. 6698, and other applicable legislation. Jiva Beach Resort processes your Personal Data in line with the Constitution of the Republic of Türkiye, international treaties to which our country is a party, EU data protection regulations (GDPR), and especially KVKK, adhering to data processing principles and obligations set forth in the relevant legislation.

Your Rights Under Article 11 of the KVKK

As a data subject, you have the following rights under Article 11 of the Law:

To learn whether your personal data are processed and to request information if processed,
To learn the purpose of processing and whether they are used in accordance with that purpose,

To know the third parties to whom your data are transferred domestically or abroad,

To request correction if your data are incomplete or inaccurately processed,

To request deletion or destruction under the conditions stipulated,

To request notification of the actions taken regarding correction, deletion or destruction to third parties to whom data have been transferred,

To object to the occurrence of a result against you due to analysis of the processed data exclusively by automated systems,

To demand compensation if you suffer damage due to unlawful processing.

To exercise your rights under Article 11 of the KVKK, please complete the KVKK Data Subject Application Form on our website and submit it to “Jiva Beach Resort Karagedik mah. 1104. Sok. No:14 Kocaçalış Fethiye/MUĞLA” or to our Registered Electronic Mail (KEP) address [email protected]. Your requests will be concluded free of charge within thirty (30) days at the latest, depending on the nature of your request. However, if the process requires an additional cost for the Company, a fee may be charged as determined by the Personal Data Protection Board under the Communiqué on the Procedures and Principles of Application to the Data Controller.