EN ULUSLARARASI OTEL TURİZM İŞLETMECİLİĞİ A.Ş.
PRIVACY NOTICE ON THE PROCESSING AND PROTECTION OF GUEST PERSONAL DATA
This Privacy Notice has been prepared by En Uluslararası Otel Turizm İşletmeciliği A.Ş., in its capacity as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the "KVKK" or the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to fulfil the obligation to inform our guests regarding the processing of their personal data and special categories of personal data.
1. DATA CONTROLLER
The Data Controller is the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Under the Law, your data may be processed within the scope described below by En Uluslararası Otel Turizm İşletmeciliği A.Ş. ("EN" or the "Company"), acting as the data controller.
The Data Controller's Details Are as Follows:
Data Controller: EN ULUSLARARASI OTEL TURİZM İŞLETMECİLİĞİ A.Ş.
MERSIS No: 0325110701600001
Address: Bereketzade Mah. Bankalar Cad. Iletım Sark Han No: 16 İç Kapı No: 6 Beyoğlu / İstanbul
Telephone: 0 (0212) 803 29 60
Email: [email protected]
2. PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED, LEGAL GROUNDS AND PURPOSES OF PROCESSING
Your personal data are processed on the legal grounds set out in Article 5(2) of the Law, while your special categories of personal data are processed on the legal grounds set out in Article 6(3) of the Law. The categories of data processed, the legal grounds relied upon and the purposes of processing are shown in the table below.
| PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED | PURPOSES | LEGAL GROUNDS |
|---|---|---|
| Identity Data: The data subject's full name, Turkish Republic identity number, date of birth, nationality, foreign identity number, passport number, passport expiry date, passport issue date, passport place of issue, vehicle details and signature; and, where the data subject stays with a child under 18, the same information relating to the child Contact Data: Telephone number, email address, address Transaction Security Data: Device information, IP address information, access logs and login method Finance Data: Personal account number, IBAN, card number and other card information, including CVV, transaction amount, invoice information and tax identification number for sole proprietorships | Fulfilling the obligations arising from the legislation applicable to our Company, particularly Identity Notification Law No. 1774, Tax Procedure Law No. 213, Turkish Commercial Code No. 6102, Turkish Criminal Code No. 5237 and Law No. 5651 on Regulating Broadcasting on the Internet and Combating Crimes Committed through Such Broadcasts, Conducting our activities in compliance with the applicable legislation, Fulfilling the Company's obligations to disclose and retain data arising from the applicable legislation. | Article 5(2)(a): Processing is expressly provided for by law. |
| Identity Data: The data subject's full name, Turkish Republic identity number, date of birth, nationality, foreign identity number, passport number, passport expiry date, passport issue date, passport place of issue, vehicle details and signature; and, where the data subject stays with a child under 18, the same information relating to the child Legal Transaction Data: Information contained in correspondence with judicial authorities and in case files Transaction Security Data: Device information, IP address information, access logs and login method Finance Data: Personal account number, IBAN, card number and other card information, including CVV, transaction amount, invoice information and tax identification number for sole proprietorships | Managing legal disputes, responding to requests from authorised institutions and organisations, or making notifications to such bodies where required. | Article 5(2)(ç): Processing is necessary for the data controller to fulfil its legal obligations. Article 5(2)(e): Processing is necessary for the establishment, exercise or protection of a right. |
| Identity Data: The data subject's full name, Turkish Republic identity number, date of birth, nationality, foreign identity number, passport number, passport expiry date, passport issue date, passport place of issue, vehicle details and signature; and, where the data subject stays with a child under 18, the same information relating to the child Contact Data: Telephone number, email address, address Customer Transaction Data: Reservation details, membership number, room number and reservation number Finance Data: Personal account number, IBAN, card number and other card information, including CVV, transaction amount, invoice information and tax identification number for sole proprietorships | Providing the guest with information about accommodation and other services offered by the hotel, Creating hotel reservations and collecting payments in connection with reservations, Providing accommodation, dry-cleaning and similar services at the hotel, and supplying bed-and-breakfast, food and beverage products and services, Ensuring the performance of the relevant products or services, Conducting finance and accounting processes. | Article 5(2)(c): Processing personal data belonging to the parties to a contract is necessary, provided that the processing is directly related to the establishment or performance of the contract. |
| Identity Data: The data subject's full name, Turkish Republic identity number, date of birth, nationality, foreign identity number, passport number, passport expiry date, passport issue date, passport place of issue, vehicle details and signature; and, where the data subject stays with a child under 18, the same information relating to the child Contact Data: Telephone number, email address, address Customer Transaction Data: Reservation details, membership number, room number and reservation number | Communicating about the hotel's facilities, products and services for which information is requested, Ensuring satisfaction with the products and services, Receiving, evaluating and resolving suggestions, requests and complaints, Contacting the guest regarding suggestions, requests and complaints. | Article 5(2)(f): Processing is necessary for the legitimate interests pursued by the data controller, provided that the fundamental rights and freedoms of the data subject are not prejudiced. |
| Identity Data: Full name Contact Data: Telephone number, email address | Promoting the services offered, Conducting marketing activities and announcing invitations and events, Ensuring customer satisfaction, conducting surveys and making announcements, Advertising and sending commercial electronic messages to the contact addresses you have provided, including messages containing information, offers, campaigns, promotions, celebrations or good wishes. | Article 5(1): The data subject has given explicit consent. |
| Health Data: Allergen information | Determining suitable ingredients when preparing meal service for guests staying at the hotel, providing safe food to guests, preventing potential allergic reactions and protecting guest health. | Article 6(3)(a): The data subject has given explicit consent. |
3. METHODS OF COLLECTING YOUR PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA
The personal data and special categories of personal data specified above are collected on the legal grounds stated above through registration (check-in/registration) forms, telephone calls, emails, records created physically when you visit the hotel, reservation forms, information obtained during payment and bank or credit card channels; directly from you as the data subject, as well as from tour operators, travel agencies, booking websites and the hotel's website, in electronic, written or printed form, by automatic or partially automatic means or by non-automatic means provided that the processing forms part of a data recording system.
4. RECIPIENTS OF YOUR PERSONAL DATA AND PURPOSES OF TRANSFER
Your personal data obtained are shared with third parties in accordance with the purposes and legal grounds stated in this Privacy Notice. Information regarding the personal data transferred, the purpose and legal ground of the transfer and the recipient groups is set out below.
When your personal data are shared with third parties, they are transferred in accordance with Articles 8 and 9 of the Law and the rules governing transfers of personal data.
| PERSONAL DATA TRANSFERRED | PURPOSE OF TRANSFER | LEGAL GROUND FOR TRANSFER | RECIPIENT GROUPS |
|---|---|---|---|
| Identity Data, Contact Data, Customer Transaction Data | Making notifications to authorised public institutions and organisations, particularly law enforcement authorities, pursuant to Identity Notification Law No. 1774. Responding to requests made to our Company by law enforcement or authorised institutions and organisations. | Pursuant to Article 8(2)(a), by reference to Article 5(2)(a) of the KVKK: processing is expressly provided for by law. | The Provincial Police Department, police stations and the Gendarmerie Command as law enforcement authorities, Authorised public institutions and organisations, Judicial authorities. |
| Identity Data, Contact Data, Customer Transaction Data, Transaction Security Data, Legal Transaction Data and Finance Data. | Proving legal disputes and fulfilling legal obligations, Responding where authorised institutions or organisations request information from our Company or where we are required to notify such bodies. | Pursuant to Article 8(2)(a), by reference to Article 5(2)(ç) of the KVKK: processing is necessary for the data controller to fulfil its legal obligations. | Authorised public institutions and organisations, Judicial authorities, Judicial bodies. |
| Identity Data, Contact Data, Customer Transaction Data and Finance Data | Enabling guests to make reservations at our hotel through travel agencies, booking websites and tour operators, Ensuring the performance of products or services, Conducting finance and accounting processes, | Pursuant to Article 8(2)(a), by reference to Article 5(2)(c) of the KVKK: processing personal data belonging to the parties to a contract is necessary, provided that the processing is directly related to the establishment or performance of the contract. | Suppliers providing product and service support, Shareholders, Business partners. |
| Identity Data, Contact Data, Customer Transaction Data, Transaction Security Data, Finance Data and Legal Transaction Data. | Increasing guest satisfaction and improving the guest experience, Managing public relations processes, Receiving, evaluating and resolving suggestions, requests and complaints, Improving the quality of goods and services, Improving service quality and continuity, Obtaining technical infrastructure support. | Pursuant to Article 8(2)(a), by reference to Article 5(2)(f) of the KVKK: processing is necessary for the legitimate interests pursued by the data controller, provided that the fundamental rights and freedoms of the data subject are not prejudiced. | Suppliers providing product and service support, Shareholders, Business partners |
| Identity Data, Contact Data, Customer Transaction Data, Transaction Security Data, Finance Data and Legal Transaction Data. | Conducting the Company's commercial activities, Conducting marketing activities, Conducting reservation, accommodation and customer-relations processes and managing customer requests and complaints, Ensuring operational coordination among group companies, Conducting internal audits and reporting and fulfilling legal obligations. | A standard contract is in place with the transfer recipient pursuant to Article 9(4)(c) of the KVKK. | Our group companies established abroad. |
5. RIGHTS OF THE DATA SUBJECT
You may at any time submit your requests under Article 11 of the KVKK concerning your personal data processed by us, in writing in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, or by using the email address that you previously notified to us and that is registered in our systems, to the addresses below.
Email: [email protected]
Address: Bereketzade Mah. Bankalar Cad. Iletım Sark Han No: 16 İç Kapı No: 6 Beyoğlu / İstanbul
Date of Update: 15 June 2026