This notice is provided in accordance with the Personal Data Protection Law No. 6698 (“KVKK”) in order to fulfill the obligation of disclosure by TOTAL TURİZM İŞLETMELERİ A.Ş. (“Company”), acting as the Data Controller, to its business partners, customers, and real or legal persons with whom it communicates. Address: Yanıklar Mah. Mezargediği Sok. No:61 Fethiye / Muğla / TURKEY.
A. Purpose of the Personal Data Protection and Processing Policy:
TOTAL TURİZM İŞLETMELERİ A.Ş. (“Company”) attaches utmost importance to the security of your personal data as the data controller. With this awareness, we attach great importance to the processing, recording, transferring, sharing, and storing of all kinds of personal data belonging to all persons associated with our Company, including those who benefit from our products and services, in accordance with the Personal Data Protection Law No. 6698 (“PDPL”).
The protection of personal data is among the fundamental policies of our Company. Throughout the existence of our Company, we have prioritized the confidentiality of personal data, adopted this as a working principle, and instructed our employees to work in accordance with this principle. Our Company accepts and undertakes to comply with all responsibilities imposed by the PDPL. With full awareness of this responsibility and in our capacity as Data Controller, we process, record, transfer, share, and store your personal data within the limits prescribed by official legislation as explained below.
B. Collection, Processing and Purposes of Processing Personal Data:
Our Company’s policy regarding the protection, processing, and confidentiality of personal data has been prepared in accordance with the Personal Data Protection Law No. 6698 and the legislation issued within its scope.
Within this framework, your personal data may vary depending on the services, products, or commercial activities provided by our Company and may be collected verbally, in writing, or electronically through automatic or non-automatic methods via offices, branches, call centers, websites, social media channels, mobile applications, and similar tools. As long as you benefit from our products and services, your personal data may be processed by being created and updated.
Additionally, when you intend to benefit from our products and services;
a. When you use our call center or website,
b. When you visit our companies, facilities, or units,
c. When you visit our website or social media channels,
d. When you participate in trainings, seminars, or events organized by our Company or held at our facilities upon your request,
your personal data may be processed.
Your personal data obtained with your consent or based on legal grounds specified under the laws of the Republic of Turkey may be processed for the following purposes:
a. Carrying out the necessary work by our business units so that you can benefit from the products and services offered by our Company,
b. Recommending and offering products and services provided by our Company by customizing them according to your preferences, usage habits, and needs,
c. Improving the quality of the services offered by our Company and developing our quality policies,
d. Informing you about and enabling you to benefit from general and special campaigns, promotions, advertisements, discounts, and similar advantages offered by our Company,
e. Processing the data obtained together with your personal data, preferences, transactions, and browsing duration when you log in to the platforms offered by our Company using your username and password, in order to provide the information and services you have requested,
f. Informing you about changes, updates, and innovations related to new products, services, personal data policies, and membership conditions,
g. Ensuring the legal and commercial security of real and legal persons who have a business relationship with our Company,
- Managing security operations, accidents, or other similar events for medical or insurance purposes,
- Developing and improving our product range, services, information technology systems, and security systems,
- Ensuring the safety of individuals in our facilities by using video camera recordings and assisting in the prevention, detection, investigation, and prosecution of crimes, as well as establishing, exercising, or defending our legal rights by also considering photographs,
- Providing information regarding the information, activities, and services you request from our Company,
- Determining and implementing the commercial and business strategies of our Company,
- Ensuring the implementation of our Company’s human resources policies,
- Fulfilling a legal obligation if clearly stated in the legislation or when required by law.
These processes may be carried out by our Company and its affiliated companies/organizations and other real and/or legal persons specified in Article (E) within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL.
C. Method and Legal Basis of Personal Data Collection:
Your personal data is obtained verbally, in writing, or electronically in order to provide our products and services within the legal framework and to fulfill our contractual and legal obligations fully and correctly. Personal data collected on this legal basis are processed, recorded, transferred, shared, and stored for the purposes stated in section (B) within the scope of Articles 5 and 6 of the PDPL.
D. Processing of Special Categories of Personal Data:
According to Article 6 of the PDPL, certain personal data that may cause discrimination or victimization when processed unlawfully are defined as “special categories of personal data”. These include data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Our Company acts in compliance with Article 6 of the PDPL regarding the processing of special categories of personal data and shows sensitivity in protecting such data.
Our Company processes special categories of personal data in accordance with the PDPL and provided that adequate measures determined by the Personal Data Protection Board are taken in the following situations:
a. If the data subject gives explicit consent;
Our guests may share certain personal information with our Company in order to request customized services according to their conditions (for example: requesting a thin pillow due to a cervical hernia, requesting a ground-floor room due to a heart condition, requesting desserts without nuts due to peanut allergy, etc.). In such cases, our Company will process special categories of personal data only with the explicit consent of the relevant person and solely for the purpose for which the data was collected.
b. If the data subject does not give explicit consent;
– Special categories of personal data other than those related to health and sexual life may be processed in cases stipulated by law,
– Personal data related to health and sexual life may only be processed for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing by persons or authorized institutions and organizations under confidentiality obligations.
E. To Whom and For What Purpose Processed Personal Data May Be Transferred:
Your collected personal data may be transferred to legally authorized public institutions and private persons of TOTAL TURİZM İŞLETMELERİ A.Ş. within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the PDPL.
F. Transfer of Personal Data Abroad:
Our Company has the authority to transfer personal data abroad in accordance with the conditions determined by the Personal Data Protection Board within the scope of the PDPL and after obtaining the explicit consent of the data subject where required.
G. Rights of the Personal Data Owner Listed in Article 11 of the PDPL:
Within the scope of the PDPL, we acknowledge that individuals have the right to be informed and give consent before the processing, recording, transfer, sharing, and storage of their personal data, and the right to determine the fate of their data after such processing.
Within this framework, if personal data owners submit their requests regarding their rights to our Company using the methods specified in this “Clarification Text on the Processing of Personal Data”, our Company will finalize the request free of charge within thirty days depending on the nature of the request.
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller published by the Personal Data Protection Board:
i. If the response to the application is given in writing, no fee will be charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page exceeding ten pages.
ii. If the response is provided in a recording medium such as CD or flash memory, the fee requested by our Company may not exceed the cost of the recording medium.
Within this scope, personal data owners have the right to:
a. Learn whether personal data is processed,
b. Request information if their personal data has been processed,
c. Learn the purpose of processing personal data and whether they are used in accordance with this purpose,
d. Know the third parties to whom personal data is transferred domestically or abroad,
e. Request correction of personal data if it is incomplete or incorrectly processed and request notification of the correction to third parties to whom the personal data has been transferred,
f. Request deletion, destruction, or anonymization of personal data within the framework of Article 7 of the PDPL and request notification of such actions to third parties to whom the personal data has been transferred,
g. Object to the occurrence of a result against the person through analysis of processed data exclusively through automated systems,
h. Request compensation for damages if personal data is processed unlawfully.
H. Periods for Processing Personal Data:
In accordance with the PDPL, personal data processed for the purposes specified in this “Clarification Text on the Processing of Personal Data” will be deleted, destroyed, or anonymized when the purpose requiring processing disappears and/or when the statutory limitation periods expire in accordance with Article 7 of the PDPL.
I. Situations Where Our Company May Process Personal Data Without Explicit Consent:
In accordance with Article 5 of the PDPL, our Company may process personal data without seeking explicit consent in the following cases:
• If explicitly stipulated by law,
• If it is mandatory to process personal data to protect the life or physical integrity of a person who cannot express consent due to actual impossibility,
• If it is necessary to process personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract,
• If it is necessary for our Company to fulfill its legal obligations,
• If the personal data has been made public by the person concerned,
• If data processing is mandatory for the establishment, exercise, or protection of a right,
• If data processing is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
J. Application Under the Personal Data Protection Law:
Pursuant to Article 13 of the PDPL, you may submit your requests regarding the exercise of your rights to TOTAL TURİZM İŞLETMELERİ A.Ş. (“Company”) at the address Yanıklar Mah. Mezargediği Sok. No:61 Fethiye / Muğla / TURKEY by mail or via email at [email protected].
You must attach official documents identifying your identity (such as identity card, driver’s license, passport, etc.) to your application.
Our Company will finalize the request within thirty (30) days depending on its nature.
Rights regarding personal data can only be exercised for the data belonging to the individual themselves. Requests regarding data belonging to persons other than the applicant will not be considered. Applications without identity verification documents will not be taken into consideration.
Even if deletion requests are fulfilled, we inform you that we are obliged to share the data with official authorities if requested by them.