Privacy Notice

As the CITYLOFT group, the security and privacy of your personal data is our priority. This Privacy Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the "KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, in order to inform you of the scope within which your personal data is processed in connection with the reservation, accommodation, communication and promotional activities carried out through the cityloft.com.tr website (the "Site") and at the facilities promoted on the Site.

The facilities promoted on the Site are operated by the three separate companies whose titles and identifying details are set out below. This Privacy Notice therefore covers those three companies jointly; depending on the facility you visit or where you make a reservation or stay, your data controller is the company shown opposite that facility in the table below.

1. Information on the Data Controller

In the articles below, the term "Data Controller" refers to the relevant company identified above, according to the facility at which the data subject carries out a transaction. The facility–company mapping is also summarised in the table below.

2. Purposes of Processing Personal Data

Your personal data is processed by the Data Controller for the following purposes, within the personal data processing conditions set out in Articles 5 and 6 of the KVKK:

• Receiving reservation requests, providing accommodation and hotel services and managing guest relations
• Concluding and performing contracts, including distance sales/service contracts
• Issuing invoices, carrying out collection transactions and managing accounting/finance processes
• Managing guest requests, suggestions and complaints, and measuring and improving guest satisfaction
• Fulfilling legal obligations arising from Identity Notification Law No. 1774, tax legislation, tourism legislation and other relevant legislation
• Ensuring the security of the Site and the facilities, managing legal disputes and fulfilling legal obligations towards competent authorities
• Where your explicit consent exists, sending commercial electronic messages and carrying out marketing and promotional activities

3. To Whom and for What Purpose Personal Data May Be Transferred

Your personal data may be transferred to the following groups of recipients, limited to the purposes stated above and in compliance with the conditions set out in Articles 8 and 9 of the KVKK:

• To banks and payment institutions for the purpose of carrying out payment transactions
• To competent public institutions and organisations (including law enforcement and judicial/administrative authorities) as required by Law No. 1774 and the relevant legislation
• To suppliers providing the reservation/property management system (PMS), hosting and Site infrastructure services
• To third parties from whom financial advisory/accounting and audit services are received
• To competent judicial/administrative authorities on the basis of mandatory provisions, for the purpose of pursuing legal disputes
• To group companies, limited to the data controller company of the relevant facility and to activities carried out in cooperation

Where the analytics/marketing tools used on the Site rely on servers located abroad, such transfers will be separately assessed under Article 9 of the KVKK.

4. Method of Collecting Personal Data and Legal Grounds

Your personal data is collected in electronic or physical form through channels such as the reservation and contact forms on the Site, call centre/telephone conversations, e-mail correspondence and reception registration procedures at the facilities.

Your personal data is processed on the legal grounds set out in Article 5/2 of the KVKK — namely that processing is "directly related to the conclusion or performance of a contract", is "necessary for the data controller to fulfil a legal obligation" and is necessary "for the legitimate interests of the data controller" — and, for transactions such as sending commercial electronic messages, on the basis of Article 5/1 of the KVKK where your explicit consent exists.

5. Retention Period of Personal Data

Your personal data is retained for as long as the purposes of processing require, without prejudice to the limitation periods set out in the relevant legislation. By way of example, invoices and accounting records are kept for 5 years pursuant to the Tax Procedure Law, and commercial books and documents for 10 years pursuant to the Turkish Commercial Code. Following the expiry of the retention period, your personal data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

6. Ensuring the Security of Personal Data

The Data Controller takes the necessary technical and administrative measures to provide an appropriate level of security in order to prevent the unlawful processing of your personal data and unlawful access to such data, and to ensure the preservation of your personal data.

7. Your Rights Under Article 11 of the KVKK

Pursuant to Article 11 of the KVKK, you may exercise the following rights by applying to the Data Controller:

• To learn whether your personal data is being processed
• To request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose
• To know the third parties, in Türkiye or abroad, to whom your personal data has been transferred
• To request the correction of your personal data if it has been processed incompletely or inaccurately
• To request the erasure or destruction of your personal data within the conditions set out in Article 7 of the KVKK
• To request that the operations carried out in response to your correction, erasure and destruction requests be notified to the third parties to whom your personal data has been transferred
• To object to an outcome against you that arises from the analysis of the processed data exclusively by automated systems
• To claim compensation for damage you suffer as a result of the unlawful processing of your personal data

8. Application Procedure

You may submit your requests concerning the rights listed above, in accordance with the procedures set out in Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the company operating the facility to which your request relates (see Article 1), to that company's registered electronic mail (KEP) address with a secure electronic signature/mobile signature, or to info@cityloft.com.tr from the e-mail address you have previously notified to us and which is registered in our system. Your application will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request.