KVKK INFORMATION TEXT

(In accordance with the Law on Protection of Personal Data No. 6698)

Data Controller

In accordance with the Law on Protection of Personal Data No. 6698 (“KVKK”), as the data controller;

Simtan Tourism Trade Industry Inc.
www.papillon.com.tr

your personal data is processed within the scope disclosed below.

Processed Personal Data

During the use of the website, reservation, and accommodation processes, the following personal data may be processed:

  • Identity and Family Information: Name, surname, Turkish ID number (TCKN), passport number, place and date of birth, marital status, gender, names/surnames, number, ages, and birth dates of children, signature, voucher (travel card) information, registration card (accommodation card) information, room type and number, flight number, hotel stayed, accommodation dates, and accommodation fee.

  • Communication Information: Phone number, email address, address information.

  • Customer Transaction Information: Vehicle license plate, survey form information, records related to product and service provision, requests, instructions, photos, information about special days and anniversaries such as marriage/birth, invoice information, order information, request information.

  • Health Information: Blood type, allergy conditions, past diseases, information regarding any impediment to sports activities.

  • Reservation and Accommodation Information: Check-in and check-out dates, room information, preferences, and requests.

  • Financial Information: Invoice information, payment amount, masked card details.

  • Transaction Security Information: IP address, log records, internet access records.

  • Visual and Auditory Records / Physical Location Security Information: Entry and exit records of customers and visitors, common area camera recordings (CCTV).

  • Request/Complaint Information: Call center records and written applications.

  • Marketing Data (in the case of explicit consent): Campaign preferences and profile information.

Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • Managing reservation processes

  • Providing accommodation services

  • Fulfilling obligations under the Identification Notification Law No. 1774

  • Managing accounting and financial processes

  • Ensuring guest satisfaction and quality management processes

  • Fulfilling legal obligations

  • Fulfilling evidentiary obligations in case of possible disputes

  • Ensuring the security of the facility (camera recordings)

  • Conducting marketing activities in case of explicit consent

  • Managing loyalty programs (e.g., Papy Kids Loyalty)

  • Managing room reservations and accommodation requests

  • Providing personalized services; adapting and improving products and services

  • Carrying out statistical reporting; improving commercial processes

Legal Reasons for Processing

Your personal data is collected by verbal, written, or electronic means through information, documents, and similar channels provided by you or third parties in contractual relationships within the business partnership, or by electronic means, noting that automatic or non-automatic methods are used.

Your personal data may be processed based on your explicit consent as per Article 5 of the KVKK; in cases where explicit consent is not required, it may also be processed in the presence of the following legal reasons:

  • Expressly provided for in laws

  • Being unable to disclose consent due to physical impossibility or being in a situation where legal validity of consent is not granted must be mandatory to protect oneself or another person’s life or bodily integrity

  • It is essential for establishing or fulfilling a contract

  • It is necessary for fulfilling the legal obligations of the data controller

  • The individual has publicly disclosed their own data

  • Processing of data must be necessary for the establishment, exercise or protection of a right

  • In accordance with the principle of not harming the fundamental rights and freedoms of the individual, it must be necessary for the legitimate interests of the data controller

According to Article 6 of the KVKK; data related to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, affiliation with associations/foundations/unions, health, sexual life, criminal conviction, and security measures are considered sensitive personal data.

Personal data related to health and sexual life may only be processed by individuals or authorized institutions under the obligation of confidentiality for the protection of public health, preventive medicine, medical diagnosis, treatment, and care services, planning, and management of health services, without seeking the explicit consent of the individual.

Your personal data is processed in line with the principles outlined in Articles 4, 5, and 6 of the KVKK (compliance with laws and fairness, accuracy and currentness, specified, clear and legitimate purposes, proportionality, and preservation for the necessary duration) for the purposes mentioned above. Your personal data shall not be processed for purposes other than those mentioned. Necessary technical and administrative measures are taken by the data controller to prevent unlawful processing or access to personal data.

Method of Collection of Personal Data

Your personal data is collected through business units of the hotel, the official website, social media accounts, mobile applications, service providers that are complementary or extensions of hotel activities, contracted organizations, business partners, domestic and foreign tourism agencies, suppliers and lower-/upper-level carriers, and similar channels using automatic or manual methods; and can be collected in written, verbal, or electronic environments.

Transfer of Data

Your personal data can be transferred domestically or internationally in accordance with Article 8 and 9 of the KVKK.

Due to the presence of the conditions stated in Article 5 of the KVKK or in accordance with your explicit consent, your personal data collected may be transferred to individuals/entities/organizations/businesses involved in business partnerships, shareholders, suppliers, or third parties involved in taking or providing services in accordance with the purposes mentioned above and in compliance with Articles 8 and 9 of the KVKK.

In this context, your personal data may be transferred to the following recipient groups:

  • Authorized public institutions and organizations (Police, Revenue Administration, etc.)

  • Banks and payment organizations

  • Tour operators and travel agencies

  • Reservation and software infrastructure providers

  • Group companies (if any)

  • Legal and financial advisors

  • Organizations providing storage, archiving, and IT support (server, hosting, cloud computing, etc.)

  • CRM and loyalty program system providers

  • Contracted call center service providers

  • Business and solution partners

  • Supplier individuals and companies

  • Real or legal persons engaged in interaction

Transfer of data abroad is carried out under the conditions defined in Article 9 of the KVKK or in the case of having explicit consent.

Duration of Processing Your Personal Data

Your personal data shall be processed, until the end of the period specified in relevant legislation if such a period is indicated, or for the duration necessary for the purpose for which they are processed if no such period is specified. Upon expiry of the periods, your personal data will be deleted, destroyed or anonymized in compliance with the legislation either ex officio or upon your request.

During this period, in the case of any changes in your personal data, you are obligated to notify the data controller to keep the records updated and accurate.

Your Rights under the KVKK

According to Article 11 of the KVKK;

  • You have the right to learn whether your personal data is being processed,

  • To request information regarding your personal data if it has been processed,

  • To learn the purpose of processing and whether it is used appropriately for its purpose,

  • To know the third parties to whom it has been transferred in or outside the country,

  • To request correction if it is processed incorrectly or incompletely,

  • To request deletion or destruction within the framework of Article 7 of the KVKK,

  • To request notification of deletion/correction/destruction transactions to third parties to whom the data has been transferred,

  • To object to the outcome against you occurring as a result of the analysis of your personal data solely by automated systems,

  • To request compensation for damages incurred due to unlawful processing

you have these rights.

To exercise these rights; you can fill out the application form at www.papillon.com.tr, containing your request and documents that identify your identity; you can deliver a signed copy to …… address in person, send it through the notary, via KEP address or other methods prescribed in the KVKK. You can also send an email from your registered email address; with your secure electronic signature or mobile signature to info@papillon.com.tr or via the email address previously communicated to our company and registered in our systems info@papillon.com.tr.

Your applications will be concluded within a maximum of 30 (thirty) days.