GDPR

INFORMATION NOTICE REGARDING ACCOMMODATION ACTIVITIES UNDER THE PERSONAL DATA PROTECTION LAW NO. 6698

In accordance with the Personal Data Protection Law No. 6698 (“Law”) and the General Data Protection Regulation (“GDPR”), LA PİGNA HOTEL, acting as the data controller, processes the personal data of natural persons in line with the principles set forth in the Law and the GDPR. As LA PİGNA HOTEL, we take all necessary technical and administrative measures in accordance with the Law and the GDPR regarding the processing of personal data, and we conduct the necessary audits on a periodic basis. You can find detailed information regarding your processed personal data in this privacy notice.

What Personal Data Do We Process?

As a customer of LA PİGNA HOTEL, we are required to process certain personal data about you within the framework of our business relationship and legal obligations. However, we process certain other personal data at your request in order to improve the services you receive and enhance their quality.

The personal data we process is listed below:

• Your identification information (First Name, Last Name, Turkish ID Number, ID Serial Number, Mother’s Name, Father’s Name, Place and Date of Birth, Marital Status, Religion, Blood Type, Signature, Photo, Province, District, Neighborhood, Village of Registration, Volume Number, Family Serial Number, Gender, Passport, Foreign ID)
• Your contact information (Phone Number, Email Address, Address)
• Information regarding your children under the age of 18 (First Name, Last Name, Date of Birth, Age)
• Your credit card number (for banking transactions and reservations)
• If you request an invoice: Turkish ID number, tax ID number, and sole proprietorship information
  Your check-in and check-out dates and times
• Your vehicle license plate information
• Your preferences and interests (e.g., smoking/non-smoking room, preferred floor, bedding type, pillow type, newspaper/magazine type, sports, cultural interests)
• Video footage captured by security cameras in our facility’s common areas
• Survey responses, suggestions, and requests you have voluntarily provided to us as part of our customer satisfaction efforts
• If you have requested a vehicle, usage, location, and license plate information for the vehicle assigned to you
• Health information (health, disability, or mobility status; allergen warnings; temperature measurement data as part of pandemic precautions)
• Statistical information and cookies related to the pages you visit on our website
• Visual and audio data captured during events and activities held at the hotel
• Your visual and audio data recorded for the purpose of ensuring the security of the physical premises.

Under the KVKK, we do not intentionally collect sensitive personal data such as blood type, information about medical devices or prosthetics you use, or your religious affiliation. However, when processing your identity or driver’s license, the religion field, blood type information, and details about medical devices or prosthetics you use may be visible.

In addition, if you choose to provide us with information regarding your health, disability, or limitations, as well as allergen warnings, this information is processed to enable us to provide you with better service and ensure a higher-quality stay at our facility (for example, wheelchair use, information on allergen-containing products).

The use of your contact information for campaigns, promotions, advertising, and marketing purposes (such as sending you emails or text messages for these purposes) is subject to your consent.

What Are Our Purposes for Processing Your Personal Data?

As LA PİGNA HOTEL, the collection and processing of your personal data will be carried out in accordance with the purposes specified in this privacy notice. Your personal data will be processed primarily for the purpose of establishing a contract or better fulfilling our obligation to provide services arising from the contract, as well as to comply with our legal obligation to provide information;

• To establish the accommodation service agreement between us,
• To manage room reservations and accommodation requests,
• To manage your hotel stay and access to rooms,
  To provide you with better service during your hotel stay,
• To ensure security at our facilities and premises,
  To provide information to authorized public institutions and organizations within the scope of our legal obligations,
• To create or carry out general or personalized campaigns, benefits, promotions, advertisements, notifications, and marketing activities,
• To protect our company’s legitimate interests, provided that this does not infringe upon the fundamental rights and freedoms of the data subject,
• To resolve current or future legal disputes,
  To detect unauthorized access in violation of regulations and notify the relevant individuals or institutions,
• To conduct satisfaction surveys regarding your hotel stay so that we can improve our services and standards,
• To ensure compliance with the legal obligations specified in the Personal Data Protection Law (KVKK), as required or mandated by law, in coordination with regulatory and supervisory authorities,
• To prepare and retain legal documents in accordance with accounting standards.

To Whom Do We Disclose Your Personal Data?

Your personal data is disclosed:

• To law enforcement agencies to fulfill our obligation to report and ensure the continuation of proceedings,
• To banks and relevant public institutions to process payments and refunds,
• To the general public via our publicly accessible website and social media accounts to conduct marketing and advertising activities,
• To the Information and Communications Technologies Authority, upon request, to fulfill our obligations,
• To relevant healthcare institutions for the purpose of managing the pandemic,
• To our legal service provider and authorized public institutions and organizations for the purpose of conducting legal proceedings,
  To your legal representatives whom you have authorized,
• To our suppliers, support service providers, archiving service providers, partners, and business partners from whom we receive services or with whom we collaborate.

In addition, when you make a transaction (reservation or payment) through booking platforms or websites, or through the travel agency you have chosen to stay at our hotel, data is transferred to the travel agency you have chosen (domestic or international) as required by the transaction.

Method and Legal Basis for Collecting Personal Data

LA PİGNA HOTEL collects your personal data through the following means: information you provide verbally or in writing to our reception staff, which is then recorded in our systems by those staff members; information you share regarding reservations made online, which is recorded in our systems; and the recording in our systems of all types of reservations, payments, transactions, survey responses, registrations, and behavioral data; information received from travel agencies when you make transactions through them; information you provide during telephone communications being recorded in our systems; the collection of photographs and video recordings for marketing and advertising purposes; and the collection of video recordings for physical premises security—all through automated methods. Additionally, we collect your personal data through non-automated methods if you provide written consent for personalized/commercial communications at our facility and/or manually complete a survey form.

As LA PİGNA HOTEL, we process your personal data in connection with service processes at our establishment based on the legal grounds of “data processing being necessary for the conclusion and performance of a contract,” “compliance with a legal obligation,” and “data processing being necessary for the legitimate interests of the data controller”; and, regarding our retention obligations arising from legislation, “compliance with a legal obligation”; and regarding recordings made by security cameras both inside and outside the premises, based on the legal grounds of “processing is necessary for the legitimate interests of the data controller” and “processing and transfer are necessary for the establishment, exercise, or defense of legal claims.”

Data processing activities conducted for personalized/commercial communication, surveys, and marketing purposes (sending messages, SMS, or emails; photographing and recording events; sharing them on the website and social media accounts), as well as the processing of blood type information from your old-style ID or driver’s license, information regarding medical devices or prosthetics you use, and your religious affiliation; the processing of health data during the pandemic; and, where applicable, the processing of allergen warnings and information regarding health, disability, or limitations—the personal data we obtain through these processes is collected with your explicit consent.

What Are Your Rights Regarding Our Data Processing Activities?

In accordance with Article 11 of the Personal Data Protection Law (KVKK), everyone has the right to request:

• To learn whether their personal data has been processed,
• To request information regarding the processing of their personal data if it has been processed,
  To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,
• To know the third parties to whom personal data has been transferred, whether within or outside the country,
• To request the correction of personal data if it has been processed incompletely or incorrectly, and to request that the third parties to whom the personal data has been transferred be notified of such correction,
• To request the erasure or destruction of personal data if the grounds justifying its processing no longer exist, even if it was processed in accordance with the provisions of the Personal Data Protection Law (KVKK) and other relevant laws, and to request that the third parties to whom the personal data was transferred be notified of this action,
• To object to a decision made solely through the automated analysis of processed data that results in a negative outcome for the individual,
• To request compensation for damages suffered as a result of the unlawful processing of personal data.