LAW ON PROTECTION OF PERSONAL DATA

The data controller is Atalia Turizm Seyahat Acentesi TİC. A.Ş Details regarding the KVKK Policy prepared and put into practice in this business (hereinafter referred to as Roxymed) and the explanations in this clarification text prepared in accordance with the Personal Data Protection Law No. 6698 (KVK Law) can be found in the Data controller KVKK Policy and its annexes. You can access it from the documents. According to this;

1. Your Processed Personal Data

a) Identity and Family Information [Name-surname, Turkish Penal Number, Passport Number, place of birth – date, marital status, gender, child name, number, age and birth dates, signature, hotel stayed, accommodation dates and amount]
b) Contact Information [address, telephone number, e-mail address]
c) Customer Transaction Information [Vehicle license plate, survey form, records for product and service delivery, requests, instructions, photographs, marriage, birth, special days, anniversaries, invoice information, order information, request information]
d) Physical Space Security Information [Entry and exit registration information of customers and visitors, camera records,]
e) Transaction Security Information [IP address, hotspot records, password and password information, website login and exit information, log and digital traffic records]
f) Financial Information [personal data in e-invoice, e-archive, e-book records, bank account number, IBAN, Credit card number, credit and risk information, asset information]
g) Visual and Audio Records and Information [Visual and Audio records and information]
h) Health Information [Information regarding disability status, allergen status, chronic diseases, previous diseases, asthma, diabetes, heart and blood pressure diseases, personal health information,]
i) Other Information (voucher (travel card) [The document used by the guests during their stay

2. Collection Method of Your Personal Data and Legal Reasons

According to this clarification text, your personal data may be transmitted by you or by third parties with whom we have an agreement and to whom services are provided, as a requirement of operating with solution partners in cooperation and contractual relations, by automatic or non-automatic methods, provided that they are part of the data recording system. Information is obtained verbally, in writing or electronically through documents and similar means.

These data can be processed directly due to your express consent within the framework of Article 5 of the Personal Data Protection Law No. 6698, and in cases where your express consent is not required, provided that the conditions specified below are met. According to this;

a) It is clearly prescribed by law.
b) It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity.
c) It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
d) It is mandatory for the data controller to fulfill its legal obligation.
e) It has been made public by the person concerned.
f) Data processing is mandatory for the establishment, exercise or protection of a right.
g) It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Within the scope of Article 6 of KVKK No. 6698, your special personal data, other than health and sexual life, may be processed based on your explicit consent or in cases stipulated by law in accordance with the provisions of the same article. In the absence of your explicit consent, your personal data regarding health and sexual life can only be processed by persons or authorized institutions and organizations under the obligation of confidentiality for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing. can be processed.

3. Purpose of Processing Your Personal Data

In accordance with Articles 4, 5 and 6 of the KVK Law No. 6698, your personal data must be in compliance with the law and the rules of honesty, be accurate and up-to-date when necessary, be processed for specific, clear and legitimate purposes, be related to the purpose for which they are processed, be limited and proportionate, They are processed for the purposes set out below, taking into account the principles of retention for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed.

1. Conducting Emergency Management Processes

2. Execution of Information Security Processes

3. Conducting Activities in Compliance with Legislation

4. Conducting Finance and Accounting Affairs

5. Execution of Commitment Processes for Company / Product / Services

6. Ensuring Physical Space Security

7. Follow-up and Execution of Legal Affairs

8. Conducting Communication Activities

9. Execution of Goods / Service Sales Processes

10. Execution of Goods / Service Production and Operation Processes

11. Execution of Customer Relationship Management Processes

12. Carrying out Activities for Customer and Guest Satisfaction and Service Quality

13. Organization and Event Management

14. Execution of Advertising / Campaign / Promotion Processes

15. Carrying out Storage and Archive Activities

16. Execution of Contract Processes

17. Tracking of Requests / Complaints

18. Ensuring the Security of Data Controller Operations

19. Execution of Investment Processes

20. Providing Information to Authorized Persons, Institutions and Organizations

21. Conducting Management Activities

22. Creation and Tracking of Visitor Records

Your personal data is not processed for purposes other than those shown above. All kinds of technical and administrative measures are taken by the business to prevent unlawful processing or unlawful access of personal data.

4. Transfer of Your Personal Data

Your personal data can be transferred domestically or abroad, in accordance with Articles 8 and 9 of the Personal Data Protection Law No. 6698, if the following conditions are met.

Personal data received due to the existence of the conditions in Article 5 of the KVK Law No. 6698 or in line with your explicit consent can be transferred to the persons, institutions and companies, shareholders, companies with whom we cooperate, in line with the above-mentioned purposes and in order to carry out the above-mentioned activities, in accordance with the provisions of Articles 8 and 9 of the Law. It can be transferred to persons and institutions with whom we interact, such as suppliers, or to third parties from whom services are received or provided.

Provided that adequate precautions are taken, your personal data regarding health can only be disclosed to the person concerned or authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing. It can be transferred without consent.

It is necessary to process personal data of the parties to the contract, provided that it is clearly foreseen by law, It is necessary to protect the life or physical integrity of the person who is unable to express his consent due to actual impossibility or whose consent is not legally valid, or that it is directly related to the establishment or execution of a contract. , in cases where it is mandatory for the data controller to fulfill its legal obligation, the data has been made public, data processing is mandatory for the establishment, exercise or protection of a right, data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms, and also in cases where the public For the purpose of protecting health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, your personal data may be transferred abroad, provided that it is carried out by persons or authorized institutions and organizations under the obligation of confidentiality, if there is adequate protection, if there is not sufficient protection. In such cases, the data may be transferred abroad without your explicit consent, provided that the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing and have the permission of the KVK Board.

The KVK Board decides whether there is sufficient protection in the foreign country and whether the transfer abroad will be allowed; International agreements to which Turkey is a party, the reciprocity regarding data transfer between the country requesting personal data and Turkey, the nature of personal data and the purpose and duration of processing of personal data, the relevant legislation and practice of the country to which personal data will be transferred, personal information regarding each concrete personal data transfer, It decides by evaluating the measures undertaken by the data controller in the country to which the data will be transferred and, if necessary, by obtaining the opinion of the relevant institutions and organizations. Without prejudice to the provisions of international agreements, your personal data may be transferred abroad only with the permission of the Board, after obtaining the opinion of the relevant public institution or organization, in cases where Turkey’s or your interests would be seriously harmed.

 In this context, your personal data;

• Authorized public institutions and organizations

• Company partners and officials,

• To business and solution partners,

• Supplier persons and companies,

• To real or legal persons with whom we interact, for the purposes stated below, namely;

1. Conducting Emergency Management Processes

2. Execution of Information Security Processes

3. Conducting Activities in Compliance with Legislation

4. Conducting Finance and Accounting Affairs

5. Execution of Commitment Processes for Company / Product / Services

6. Ensuring Physical Space Security

7. Follow-up and Execution of Legal Affairs

8. Conducting Communication Activities

9. Execution of Goods / Service Sales Processes

10. Execution of Goods / Service Production and Operation Processes

11. Execution of Customer Relationship Management Processes

12. Carrying out Activities for Customer and Guest Satisfaction and Service Quality

13. Organization and Event Management

14. Execution of Advertising / Campaign / Promotion Processes

15. Carrying out Storage and Archive Activities

16. Execution of Contract Processes

17. Tracking of Requests / Complaints

18. Ensuring the Security of Data Controller Operations

19. Execution of Investment Processes

20. Providing Information to Authorized Persons, Institutions and Organizations

21. Conducting Management Activities

22. It can be transferred for the purpose of Creation, Tracking and execution of Visitor Records.

5. Your Rights as a Personal Data Owner

Within the scope of the law, the data owner, that is, the relevant person

a) Learning whether personal data is processed or not,

b) Requesting information if personal data has been processed,

c) Learning the purpose of processing personal data and whether they are used for their intended purpose,

d) Knowing the third parties to whom personal data is transferred domestically or abroad,

e) Requesting correction of personal data if they are incomplete or incorrectly processed,

f) Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

g) To request notification of personal data that has been processed incorrectly and requested to be corrected, and personal data that has been requested to be destroyed, to third parties to whom it has been transferred,

h) Object to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems,

i) Has the right to demand compensation for the damage in case of damage due to unlawful processing of personal data.

In order to exercise your complaint rights as a personal data owner, you must first contact the personal data controller using the following communication channels. A complaint cannot be made to the KVK Board without exhausting this method.

Your request is answered by our company, as the data controller, as soon as possible and within 30 days at the latest, depending on the nature of the request.

If your application is rejected, the response is found to be insufficient, or your application is not responded to in due time, you can exercise your right to complain to the KVK Board or directly apply to the judiciary.