1. PURPOSE AND SCOPE
Pursuant to the Law on Protection of Personal Data Numbered 6698, Mersoy Turizm Otelcilik İşletmeleri Limited Şirketi (referred to as "the Company" or "Data Controller") regulates the principles that it embraced regarding the protection of personal data, and it determines principles of processing of personal data of Customers (Guest), Employees, Prospect employees, Visitors, Prospect customers, suppliers, third parties, and visitors of online web site (“Person groups”) and aims to enlighten those individuals and groups.
2. PRINCIPLES RELATED TO THE PROCESSING OF PERSONAL DATA
The company processes your personal data as Data Controller within the framework of the following principles.
2.1 Processing in accordance with Laws and the rule of Integrity
In the processing of your personal data, the principles set forth in the framework of Law numbered 6698 are complied with the general trust and integrity rule.
2.2 Keeping Personal Data Accurate and Up-to-Date as Required
Periodic checks and updates are made for the accuracy and timeliness of the processed data we have by taking your personal interests and rights into account. For this purpose, units (responsible persons) to check the accuracy of personal data and make necessary corrections have been established within the Company and necessary measures have been taken in this regard.
2.3 Purpose of Processing the Data
Your personal data is processed for explicit, specific and legitimate purposes in accordance with laws.
2.4 Processing of data in line with the limits appropriate for the purposes
The Company processes the personal data in a restrained, purposeful and limited way in order to achieve the intended targets and ensures that the personal data that are not related to the realization of the purpose or not needed are not processed.
2.5 Data Retention Period
The Company retains all personal data only for the period required by the relevant legislation or for the purpose for which they are processed. In this context, firstly, it is determined whether a period is stipulated for the storage of personal data in the relevant legislation, and in case a period has been stipulated, then this period is observed. In case no such period has been stipulated, personal data is stored for the time that may be required within the service branches provided by the Company. In the event that the reasons that require the expiration or processing of data disappears or the relevant period expires, and in case there is no legal grounds that allows them to be processed for a longer period, data is deleted, destroyed or anonymized according to the Procedure for the Storage and Destruction of Personal Data through the Company Data Controller.
3. CONDITIONS OF PROCESSING OF PERSONAL DATA
Company ensures that all kinds of personal data are processed in accordance with the following conditions and purposes:
3.1 Conditions and Objectives Set by Laws
Your personal data may be processed by the Company where it is stipulated and made compulsory to process personal data explicitly in the laws.
3.2 Being Related to the Mutual Written Agreement
The company can process your personal data if it is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of the bilateral contract.
3.3 Not Being Able to Obtain Explicit Consent of the Relevant Person Due to Impossibility
Your personal data may be processed if it is mandatory to process the personal data of the relevant person who is unable to disclose his consent due to actual impossibility or whose consent cannot be validated, or to protect the life or body integrity of another person.
3.4 3. Data that is made public
In case your personal data is made public by you for 3rd parties, it may be processed by the company.
3.6 Data Processing is Compulsory to Establish or Protect a Right
The Company can process your personal data under the law in case data processing is compulsory to obtain, exercise or protect a right.
3.7 Protection of Personal Rights and Processing of Data Based on Legitimate Interest
The Company can process your personal data in case it is necessary to process data within the limits set by law to protect its personal rights and legitimate interests.
3.8 Processing Data Based on Explicit Consent
The company can process personal data with an oral or written statement from the other party.
4. CLASSIFICATION OF PERSONAL DATA
|
Data Type | Customer | Customer | Employee | Employee Candidate |
Visitor | Digital Visitor |
Supplier Business partner |
Tenant | 3. Person |
ID INFORMATION | Name, Surname |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
R.T. ID Number |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
ID information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Passport information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Driving License Information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Date of Birth |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Signature |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Photo |
+ |
+ |
+ |
+ |
+ |
|
+ |
+ |
+ |
|
Gender |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Marital Status |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
CONTACT | Address |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
Telephone Business-House-Mobile |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
||
INTERNET | IP Address |
|
|
|
|
|
+ |
|
|
|
Web Site |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
|
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
||
Youtube |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
|
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Other |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
SECURITY | Camera footage |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
Telephone Voice Recording |
+ |
+ |
+ |
+ |
+ |
|
+ |
+ |
+ |
|
Finger print |
|
|
+ |
|
|
|
|
|
|
|
OTHER | Criminal record |
|
|
+ |
+ |
|
|
|
+ |
|
Family Information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Health Information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Financial Information |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Resume Information |
+ |
+ |
+ |
+ |
+ |
+ | + | + | + | |
Car registration plate |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
|
Other Personal Information | + | + |
+ |
+ |
+ |
+ |
+ |
+ |
+ |
5 PURPOSE OF PROCESSING OF PERSONAL DATA
In accordance with the personal data processing conditions specified in Articles 5 and 6 of the Law numbered 6698, the Company will be able to process personal data for the relevant persons and groups for the following purposes.
Personal data of customers and prospective customers can be processed in order to benefit from the products and services offered by the Company today and in the future, within the personal data processing conditions specified in Articles 5 and 6 of Law numbered 6698. Data processing shall be carried out after the written or verbal consent of the client and prospect customer for processing of their personal data.
Personal data of employees and employee candidates can be processed for the purposes of planning and execution of human resources processes, execution of personnel activities, fulfillment of obligations arising from legislation, planning and execution of interests, personnel procurement processes within the scope of personal data processing conditions specified in Articles 5 and 6 of Law Numbered 6698.
Personal data of visitors can be processed for the purposes of ensuring the security of building and facility campuses and/or facilities, creating and monitoring visitor records, ensuring the security of fixtures and/or resources, ensuring technical and commercial business safety, ensuring safety of corporate operations, providing information to the authorized institutions and organizations, within the personal data processing conditions specified in Articles 5 and 6 of Law Numbered 6698.
Third Party personal data can be processed for the purposes of carrying out the necessary business and operational processes in order to have relevant persons benefit from products and services offered by the company, to carry out required works for realizing of commercial activities carried out by the company and conducting business processes linked to foregoing, carry out required works and relevant processes in order to have third parties benefit from products and services offered by the company, offering products and services provided by the company in customized manner and performing of agreements within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698.
Personal data of suppliers/business partners can be processed for the purposes of carrying out the necessary business and operational processes in order to have relevant persons benefit from products and services offered by the company, to carry out required works for realizing of commercial activities carried out by the company and conducting business processes linked to foregoing, carry out required works and relevant processes in order to have third parties benefit from products and services offered by the company, offering products and services provided by the company within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698.
Personal data of online Visitors can be processed for the purposes of carrying out marketing analysis studies, carrying out of advertising/promotion/campaign processes, carrying out of communication activities, carrying out of products development works, fulfilling of legal liabilities within the scope of the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698.
6 SHARING OF THE PERSONAL DATA PARTIALLY OR COMPLETELY
The Company can transfer personal data that it has, to its domestic and foreign business partners, customers, suppliers, legally authorized public institutions and legally authorized private persons, with the principles and objectives set out in Articles 3 and 5 of these Principles and 8th and 9th articles Law numbered 6698 in limited manner.
7 The Method and Legal Grounds of Collecting Personal Data
Data is processed automatically by collecting in physical and electronic environments, via written or verbal data transmission means as a part of data recording system from persons involved or from third parties by relying upon statements take place in article 5 of law numbered 6698 stating that “processing of personal data of any party of an agreement is required on condition to be directly related to establishment and performance of an agreement”, “being compulsory to be processed for legitimate interests of data controller on condition not to harm fundamental rights and freedom of relevant person”
In addition, Data is processed automatically by collecting in physical environment by filling physical form and in electronic environments by filling application forms, via written or verbal data transmission means as a part of data recording system from persons involved or from third parties by relying upon statements within scope of an agreement likely to be made, take place in article 5 of law numbered 6698 stating that “processing of personal data of any party of an agreement is required on condition to be directly related to establishment and performance of an agreement”, “being compulsory to be processed for legitimate interests of data controller on condition not to harm fundamental rights and freedom of relevant person”..
8 SECURITY OF PERSONAL DATA
The Company takes reasonable precautions to ensure the security of personal data and to prevent it from being processed illegally, to prevent unauthorized access risks, accidental data loss, deliberate deletion or damage of data. All necessary technical and physical precautions are taken to prevent unauthorized persons from accessing personal data. In this context, especially the authorization system is designed in such a way that no one can access more personal data than necessary.
The company conducts and have these conducted the necessary audits in its institution or organization to ensure the enforcement of the provisions of Law No. 6698.
9 APPLICATION PROCEDURES AND PRINCIPLES
As a relevant person, if you have a request regarding your rights under Article 11 of Law No. 6698, you may apply by filling out the Application Form Regarding the Protection of Personal Data, which you can obtain from our web site at https://www.elexushotel.com.tr address or by sending e-mail with mobile/signature/electronic signature via your registered e-mail address in our system to [email protected] or by applying in person or via notary public with your handwritten signature to our address Elexus Hotel Resort SPA Çatalaköy Mevkii Girne TRNC. As a Company, we will conclude your application free of charge, as soon as possible and within thirty days at the latest, depending on the nature of your request. However, in case the transaction requires a separate cost, the fee determined by the Personal Data Protection Board by the Company will be charged.
In this context, as the relevant person, you have the following rights;
a) To learn whether your personal data has been processed,
b) To demand information in case your personal data has been processed,
c) To learn the purpose of processing your personal data and whether they are used accordingly,
d) To know the third parties to which your personal data is transferred in land or abroad,
e) To request correction of your personal data in case your data is incomplete or incorrectly processed,
f) To request the deletion or destruction of your personal data within the conditions stipulated in article 7 of the Law,
g) To request notification of transactions made in accordance with sub-paragraphs (d) and (e) to third parties to whom personal data are transferred,
h) To make objection in the event of an occurrence of an unfavorable result in case your personal data is processed exclusively by means of automated systems,
I) To claim for your loss in case you have damages because your personal data has been processed in illegal manner.