Gönen Turizm İnşaat ve Otelcilik A.Ş. (“GÖNEN”), in its capacity as data controller, attaches paramount importance to the lawful collection, processing, and protection of your personal data for all categories of individuals, pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK / Law”) and relevant secondary legislation, as well as the General Data Protection Regulation (GDPR). This Information Notice (“Notice”) has been prepared to inform you regarding the sources from which we obtain your personal data, our legal grounds for collection and processing, the purposes for processing your data, to whom and for what purposes we transfer it, and your legal rights under the Law.

GÖNEN processes your personal data in accordance with the law, takes necessary administrative and technical measures to prevent unlawful processing of and access to your personal data, and ensures the most appropriate level of security to safeguard your data.

DATA SUBJECTS WHOSE DATA WE PROCESS

GÖNEN, as data controller, processes personal data limited to the following groups of individuals:

1. Our Employees,
2. Our Job Applicants (including reference persons declared by applicants),
3. Our Interns and On-the-Job Training Trainees,
4. Our Guests Subject to Accommodation Activities (Including Minors Under 18 Staying with Their Consent),
5. Parties to Any Commercial Activity or Authorized Persons/Employees of Companies We Collaborate / Will Collaborate With (Supply, Advertising, Support, Marketing, Accommodation, Transportation, Reference Sources, etc.),
6. Shareholders or Persons Negotiating Shareholding,
7. Our Legal Advisors, Lawyers, and Consultants, or Authorized Persons/Employees of Consultancy Companies,
8. Visitors,
9. Legal Representatives, Parents, Guardians, or Custodians of All Data Subjects,
10. Parties to Legal Processes and Their Legal Representatives,
11. Third Parties With Whom We Have Communicated Despite Having No Commercial or Legal Connection With Our Company.

PERSONAL DATA WE PROCESS

GÖNEN, in its capacity as data controller, processes general personal data, personal health data, and special categories of personal data in compliance with the principles of "lawfulness", "necessity", "purposefulness", and "proportionality":

• 1. Identity Data and Identifying Information: Name-surname, nationality, T.R. ID number, passport number/details or temporary T.R. ID number for non-Turkish citizens, place and date of birth, marital status, gender. Identifying data such as signature and handwriting. (For minors under 18, name-surname, age, and degree of relationship are obtained from their legal representative).
• 2. Contact Data: Residential address, correspondence address, mobile phone number, e-mail address.
• 3. Visual and Audio Data: Security camera recordings (CCTV), voice call recordings held when contacting our call center or switchboard.
• 4. Personnel Data: Employment start date, salary, monthly working days, and all employment-related data required by law or contract.
• 5. Educational Data: Educational background details of employees, candidates, interns, or trainees.
• 6. Work and Professional Data: Professional experience, diploma, certificates, and all data regarding occupation or profession.
• 7. Accommodation Data: Room number, number of nights stayed, room type, expenditure amounts and items, check-in/check-out dates and times, internal reporting of inappropriate behavior during stay (Internal List Application).
• 8. Accommodation Preference and Need Data: Smoking/non-smoking room preferences, requested items such as newspapers, magazines, or special room furnishings.
• 9. Comment and Complaint Data: Comments and complaints submitted to our Company with consent via our website or third-party platforms (TripAdvisor, Otelpuan, etc.) to evaluate our services.
• 10. Advantage and Loyalty Point Data: Memberships or ratings evaluated under guest loyalty programs.
• 11. Location Data: Address or geographical location data provided voluntarily through any means.
• 12. Transaction Security Data: IP address, MAC ID, browser details, website log-in/log-out and password information, cookies.
• 13. Legal Data: Data regarding being a plaintiff/defendant, execution proceedings files, and legal processes.
• 14. Financial Data: Bank account/IBAN number, accommodation and expenditure details, credit card information (including CVV/CVV2 and expiration date), mail order details, payment records.
• 15. Health Data: Health reports and medical documents in the personnel files of employees, applicants, interns, or trainees.
• 16. Vehicle and License Plate Data: Vehicle and license plate details when utilizing company parking or valet services.
• 17. Customer Transaction Data: Call center records, invoices, promissory notes, checks, receipts, order details, and request information.
• 18. Clothing Data: Body measurements, uniform size, shoe size, and equipment details.
• 19. Biometric Data: Palm prints, fingerprints, retina scans, or facial recognition data processed strictly for employee/intern attendance tracking.
• 20. Risk Management Data: Data processed to manage commercial, technical, and administrative risks.
• 21. Physical Space Security: Entrance-exit records of employees/visitors and security camera recordings.
• 22. Special Categories of Personal Data: Religion and blood type information if present on identity documents checked for verification during check-in, as well as blood type data in required medical reports.

III. PROCESSING OF PERSONAL DATA

A. Collection Method and Channels of Personal Data

Your personal data is collected via direct in-person applications, reservations made through our website or agencies, commercial contracts, Wi-Fi network authentication processes (T.R. ID, phone number required by Law No. 5651), cookies, job applications, personnel file creation, and contact forms.

B. Purposes and Legal Grounds for Processing

Your personal data is processed for identity verification, fulfilling legal obligations (Law on Identity Reporting No. 1774, Labor Law, Tax Legislation, Social Security Legislation), execution of accommodation contracts, invoicing and financial tracking, hotel security, service quality enhancement, and guest service personalization.

C. Transfer of Personal Data

Your personal data may be shared with authorized public institutions (Law Enforcement, Social Security Institution, Tax Offices, Ministry of Culture and Tourism), banks, payment processors, insurance companies, legal/financial advisors, auditors, suppliers, agencies, transportation/courier companies, and Gönen Group hotels within the scope of legal regulations and mentioned purposes.

IV. OUR MEASURES AND COMMITMENTS REGARDING DATA PROTECTION

GÖNEN protects your personal data with utmost sensitivity, adhering to physical and electronic security protocols and taking all necessary administrative and technical measures (encryption, authorization matrices, physical security, confidentiality agreements) registered in VERBİS and the Personal Data Inventory. Your data is not shared with third parties beyond specified purposes.

V. PROCESSING OF PERSONAL DATA COLLECTED VIA COOKIES

During your visit to our website, transaction security data such as IP address, browser information, MAC ID, and entrance-exit logs may be processed via cookies to enhance transaction security and user experience.

VI. YOUR RIGHTS REGARDING THE PROTECTION OF PERSONAL DATA

Under Article 11 of the KVKK Law, as data subjects, you have the following rights:

• Learn whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether data is used in accordance with its purpose,
• Know third parties to whom personal data is transferred domestically or abroad,
• Request correction if personal data is incomplete or incorrectly processed,
• Request erasure or destruction of personal data under Article 7 of the Law,
• Request notification of correction, erasure, or destruction to third parties to whom data has been transferred,
• Object to any outcome against yourself arising from sole automated system analysis,
• Claim compensation for damages incurred due to unlawful data processing.

Ways to Contact Our Company

To exercise your rights, you can submit your applications through the following channels:

1. In-Person Application: By delivering the Application Form with identity verification to the Human Resources department at Yenibosna Merkez Mah. Değirmenbahçe Cad. No:15 Bahçelievler / ISTANBUL,
2. Via Notary Public: By sending a written notification to our company address via Notary,
3. KEP (Registered E-Mail): By sending an e-mail with secure electronic signature to [email protected].