Your personal data and your rights.
This notice has been prepared to inform you in accordance with Turkish Personal Data Protection Law No. 6698 (“Law”), which was enacted to protect individuals’ fundamental rights and freedoms, particularly the privacy of private life, in relation to the processing of personal data.
AKKOR HOTELS (“Company”) may collect and process the personal data described in this notice verbally, in writing, visually or electronically, in accordance with the Law and the principles of lawfulness and fairness. Except where processing is necessary for the performance of a contract, expressly provided for by law or required for the Company to fulfil a legal obligation, explicit consent may be requested for processing within the purposes described below and, where permitted by legislation and limited to those purposes, for transfer to the third parties identified below.
For the purposes of the Law;
Explicit consent: Consent relating to a specific subject, based on being informed and expressed with free will;
Personal data: Any information relating to an identified or identifiable natural person;
Processing of personal data: Any operation performed on personal data, wholly or partly by automated means or by non-automated means provided that the process forms part of a data filing system, including collection, recording, storage, retention, alteration, reorganisation, disclosure, transfer, acquisition, making available, classification or restriction of use.
1. Personal Data Processed
Identity Information
Full name, place of birth, date of birth, marital status, photograph, Turkish ID number, passport number, identity card serial number, driving licence number, father’s name, mother’s name, nationality and place of registration in the civil registry.
Contact Information
Mobile and landline telephone numbers, email address and contact address.
Physical Premises Security Information
CCTV image recordings, audio recordings, turnstile records, security records and vehicle licence plate information collected during entry to, exit from and presence at the workplace, where the individual is present at the workplace or uses the workplace car park.
Financial Information
Credit card information.
Health Information
Medical information obtained by the hotel’s contracted physician for the management of first aid, medical diagnosis and treatment services in the event of health problems.
Other Information
IP address, browser information, survey, form and location information where internet service is used in common access areas.
2. Method of Collection and Legal Bases
The personal data listed above may be collected verbally, in writing or electronically through information and documents provided by you, copies of driving licences, identity cards and passports, CCTV systems, external employment, service or consultancy companies, agencies and similar channels. Such data may be processed by persons within the Company who are subject to confidentiality obligations or by authorised institutions and organisations on the following legal bases.
- Where processing is expressly provided for by law.
- Where processing is necessary to protect the life or physical integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person.
- Where processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract, including the lawful conduct of the Company’s activities and the full and proper performance of its contractual and statutory obligations.
- Where processing is necessary for the data controller to fulfil a legal obligation.
- Where the personal data has been made public by the data subject.
- Where processing is necessary for the establishment, exercise or protection of a right.
- Where processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
Personal data other than data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data may be processed without explicit consent where permitted by law. Personal data relating to health and sexual life may be processed without explicit consent only by persons under an obligation of confidentiality or by authorised institutions and organisations for purposes including the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.
In addition to the legal grounds listed above, personal data may be processed pursuant to Turkish Personal Data Protection Law No. 6698, Turkish Code of Obligations No. 6098, Turkish Civil Code No. 4721 and other relevant legislation.
3. Purposes of Processing Personal Data
Your collected personal data may be processed in accordance with the processing conditions set out in Articles 5 and 6 of Law No. 6698 for the following purposes:
- Providing guest accommodation services.
- Fulfilling obligations arising from law and contract.
- Resolving potential legal disputes that may arise between the parties in the future.
- Communicating with guests in the event of service interruptions or problems during their stay.
- Enabling guests to pay service fees and other amounts through the electronic systems used.
- Protecting guests and public health.
- Providing health services and meeting legal and regulatory requirements.
- Ensuring occupational safety and physical security.
- Administrative management, monitoring and control of workplace entry and exit; securing access to office buildings, departments, system rooms and guest rooms; administration of internet data networks and ensuring cybersecurity.
4. Transfer of Personal Data
Personal data processed for the purposes described above may be transferred, in accordance with the fundamental principles set out in Law No. 6698 and the conditions for transfer of personal data specified in Articles 8 and 9 of the Law and other applicable legislation, to the following persons, institutions and organisations:
- Public or private institutions and organisations authorised to request information and documents, and professional organisations having the status of public institutions.
- Legal consultancy firms from which the Company obtains services to prevent or resolve potential legal disputes.
- A limited number of the Company’s direct or indirect domestic and overseas suppliers and affiliates.
- Healthcare institutions and insurance companies from which the Company receives health-related services.
- Institutions or organisations acting as “Data Processors” from which the Company receives services in order to fulfil its obligations under applicable legislation.
- Tax advisers and other consultancy firms from which the Company receives services.
- Regulatory and supervisory bodies and official authorities for compliance with legal obligations and Company policies.
Your personal data may be transferred abroad, in light of the principles set out in Article 4(2) of Law No. 6698, based on explicit consent or, where the conditions set out in Articles 5(2) and 6(3) are present, without obtaining explicit consent, in accordance with the rules under Article 9 of the Law. Such transfers may be made to persons and organisations established in foreign countries determined by the Personal Data Protection Board (“Board”) to provide adequate protection or, in countries where adequate protection has not been determined, where the data controllers in Türkiye and the relevant foreign country undertake adequate protection in writing and the Board’s permission for the transfer can be obtained.
Your personal data is disclosed to official authorities only where requested by those authorities and where disclosure is mandatory under applicable compulsory legislation. The Company does not use or sell your personal information for purposes outside the scope and activities described in this notice. Necessary technical and administrative measures are taken to prevent unlawful processing of and unlawful access to personal data and to ensure that personal data is stored securely.
5. What Are Your Rights Under the Law?
Under Article 11 of Turkish Personal Data Protection Law No. 6698, you may apply to the Company at any time in relation to your personal data and:
- Learn whether your personal data is processed, the purpose of processing and whether it is used in accordance with that purpose, and request information where it has been processed.
- Learn the third parties in Türkiye or abroad to whom your personal data has been transferred in accordance with applicable legislation.
- Request correction where your personal data has been processed incompletely or inaccurately.
- Request deletion or destruction of your personal data under the conditions provided by the Law.
- Request notification of correction, deletion or destruction to third parties to whom your personal data has been transferred.
- Object to a result arising against you through analysis of your personal data exclusively by automated systems.
- Request compensation for damages where you suffer loss as a result of unlawful processing of your personal data.
To exercise your rights under the Law, you may apply to the Company by completing the “Data Subject Application Form” published by AKKOR HOTELS and submitting it through the application methods announced by the Company. If the Personal Data Protection Board determines new application methods, those methods will also be announced.
Applications made within this scope will be concluded as soon as possible and no later than 30 days. Applications are currently free of charge. If the Personal Data Protection Board establishes a fee schedule, fees may be charged in accordance with that schedule.
For communications regarding your personal data, please contact reservation@wyndhamistanbulasiaairport.com.
6. Personal Data Retention Period
Your personal data will be retained throughout the applicable statutory period. Even where personal data has been processed in accordance with the Law and other applicable legislation, if the reasons requiring processing cease to exist, the Company will delete, destroy or anonymise the personal data ex officio at intervals of no more than six months or, upon your request, within no more than thirty days.
Deletion of personal data means rendering the data inaccessible and unusable for persons who process personal data within the Company’s organisation or in accordance with the Company’s authority and instructions, except for the person or unit responsible for the technical storage, protection and backup of the data.
Destruction of personal data means rendering the data permanently inaccessible, irretrievable and unusable by anyone. Anonymisation means rendering personal data incapable of being associated with an identified or identifiable natural person even through the use of techniques appropriate to the recording environment and relevant field of activity, such as reversal or matching the data with other data.
All operations relating to deletion, destruction and anonymisation of personal data are recorded, and such records are retained for 3 (three) years from the date of the operation so that they may be submitted to the relevant Ministry when required.