BOMONTI SUITES ISTANBUL
UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA
GUEST PRIVACY NOTICE
UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA
GUEST PRIVACY NOTICE
Bomonti Suites Istanbul
This Privacy Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) to inform guests about the processing of their personal data.
1. Data Controller
The data controller is Bomonti Apart Hotel ve Turizm A.Ş., which operates Bomonti Suites Istanbul (the Hotel).
Address: Merkez Mahallesi, Bomonti Arkası Sokak No: 4, Şişli / Istanbul
Telephone: 0 (212) 600 36 00
Email: info@bomontisuites.com
Website: www.bomontisuites.com
Tax Office / Tax Identification No.: Şişli / 1791192387
Trade Registry No.: 197992-5
Registered Electronic Mail (KEP) Address: bomontihotel@hs03.kep.tr
2. Personal Data Processed
• Identity details: full name, date of birth, nationality, Turkish national identity number or foreign national identity/passport number. No photocopy of a Turkish national identity card is retained.
• Contact details: telephone, email and, where necessary, address.
• Reservation and accommodation information: check-in and check-out dates, room, reservation channel, agency, request records and complaint records.
• Financial information: invoice, payment and collection information. Card details are not retained by the Hotel.
• Security and legal transaction information: CCTV footage, transaction/log records and dispute files.
• Vehicle and parking information: vehicle registration plate obtained through the licence plate recognition system, and parking entry and exit date/time records.
• Special categories of personal data: allergy, accessibility or health information disclosed solely to provide a service requested by the guest.
About identity documents
An identity document may only be viewed to verify identity details. No photocopy of a Turkish national identity card is taken or retained.
3. Purposes and Legal Grounds for Processing
Personal data is processed only for the activities and legal grounds set out below:
Data / activity:
• Identity and accommodation records
• Contact, reservation and accommodation information
• Financial information, Request and complaint records
• CCTV and security records,
• Legal transaction records
• Health, allergy and accessibility information,
• Vehicle registration plate and parking entry/exit records.
Purpose of processing:
• Guest identity reporting, check-in and compliance with legal obligations
• Creating and confirming the reservation and providing the accommodation service
• Payment, collection, cancellation, refunds, invoicing and accounting
• Resolving guest requests and maintaining service quality
• Ensuring the security of the premises, persons and property; investigating incidents
• Managing disputes and protecting rights
• Providing a special service or arrangement explicitly requested by the guest
• Operating parking arrangements; ensuring the security of the premises, persons and property; investigating incidents.
Legal basis under the KVKK:
• Expressly provided for by law; compliance with a legal obligation
• Necessary for the conclusion or performance of a contract
• Performance of a contract; expressly provided for by law; compliance with a legal obligation
• Performance of a contract; establishment, exercise or protection of a right; legitimate interests
• Legitimate interests, provided that fundamental rights are not adversely affected; establishment, exercise or protection of a right
• Establishment, exercise or protection of a right
• An applicable processing condition under Article 6 of the KVKK; explicit consent where no other condition applies
• Legitimate interests, provided that fundamental rights are not adversely affected; establishment, exercise or protection of a right
Marketing activities are based on optional consents obtained separately from the accommodation service and this Privacy Notice.
4. Methods of Collection
Personal data is collected through the website and booking engine, telephone, email, reception and check-in procedures, Booking, Expedia, travel agencies, payment institutions, the Opera Cloud hotel management system, security cameras, the licence plate recognition system and information provided during service, by automatic, partly automatic or non-automatic means forming part of a data filing system.
5. Transfers of Personal Data
Personal data may be transferred to the following recipient groups, subject to the necessary technical and administrative safeguards and only to the extent relevant to and limited by the purpose:
• Authorised public institutions and judicial and administrative authorities, for guest identity reporting, audits and legal requests.
• Banks and payment service providers, for payment and collection transactions.
• Opera Cloud, Booking, Expedia, travel agencies and related service providers, for reservation and accommodation procedures.
• Suppliers providing information technology, accounting, legal, security and support services. Relevant service providers for additional services requested by the guest. Transfers abroad: Personal data may be transferred abroad because the infrastructure, servers or support units of Opera Cloud, Booking, Expedia and the Google/Microsoft services used may be located outside Türkiye. Such transfers are carried out where one of the transfer conditions set out in Article 9 of the KVKK is met and, where necessary, appropriate safeguards such as standard contracts are provided. Detailed information about the international transfer mechanism may be requested through the application channels below.
6. Retention Period
Personal data is retained for 10 years in respect of the relevant records and documents. Data that, by its nature, must be retained for a shorter period, such as CCTV recordings, is kept for the limited period specified in the Hotel's retention and destruction policy. If a legal dispute or request from a competent authority arises, the relevant records may be retained until the dispute or request is concluded. Data whose retention period has expired is erased, destroyed or anonymised in accordance with the KVKK and applicable legislation.
7. Your Rights and Applications
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request its erasure or destruction where the applicable conditions are met and notification of those actions to third parties; object to a result arising from analysis carried out solely by automated systems; and request compensation for damage arising from unlawful processing.
You may submit your applications in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
• in writing to Merkez Mahallesi, Bomonti Arkası Sokak No: 4, Şişli / Istanbul;
• by registered electronic mail (KEP) to bomontihotel@hs03.kep.tr; or
• by email to info@bomontisuites.com from the email address previously registered in the Hotel's system.
Applications containing the information required to verify your identity and your request will be concluded as soon as possible and no later than 30 days, depending on the nature of the request.
GUEST PRIVACY NOTICE
Bomonti Suites Istanbul
This Privacy Notice has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) to inform guests about the processing of their personal data.
1. Data Controller
The data controller is Bomonti Apart Hotel ve Turizm A.Ş., which operates Bomonti Suites Istanbul (the Hotel).
Address: Merkez Mahallesi, Bomonti Arkası Sokak No: 4, Şişli / Istanbul
Telephone: 0 (212) 600 36 00
Email: info@bomontisuites.com
Website: www.bomontisuites.com
Tax Office / Tax Identification No.: Şişli / 1791192387
Trade Registry No.: 197992-5
Registered Electronic Mail (KEP) Address: bomontihotel@hs03.kep.tr
2. Personal Data Processed
• Identity details: full name, date of birth, nationality, Turkish national identity number or foreign national identity/passport number. No photocopy of a Turkish national identity card is retained.
• Contact details: telephone, email and, where necessary, address.
• Reservation and accommodation information: check-in and check-out dates, room, reservation channel, agency, request records and complaint records.
• Financial information: invoice, payment and collection information. Card details are not retained by the Hotel.
• Security and legal transaction information: CCTV footage, transaction/log records and dispute files.
• Vehicle and parking information: vehicle registration plate obtained through the licence plate recognition system, and parking entry and exit date/time records.
• Special categories of personal data: allergy, accessibility or health information disclosed solely to provide a service requested by the guest.
About identity documents
An identity document may only be viewed to verify identity details. No photocopy of a Turkish national identity card is taken or retained.
3. Purposes and Legal Grounds for Processing
Personal data is processed only for the activities and legal grounds set out below:
Data / activity:
• Identity and accommodation records
• Contact, reservation and accommodation information
• Financial information, Request and complaint records
• CCTV and security records,
• Legal transaction records
• Health, allergy and accessibility information,
• Vehicle registration plate and parking entry/exit records.
Purpose of processing:
• Guest identity reporting, check-in and compliance with legal obligations
• Creating and confirming the reservation and providing the accommodation service
• Payment, collection, cancellation, refunds, invoicing and accounting
• Resolving guest requests and maintaining service quality
• Ensuring the security of the premises, persons and property; investigating incidents
• Managing disputes and protecting rights
• Providing a special service or arrangement explicitly requested by the guest
• Operating parking arrangements; ensuring the security of the premises, persons and property; investigating incidents.
Legal basis under the KVKK:
• Expressly provided for by law; compliance with a legal obligation
• Necessary for the conclusion or performance of a contract
• Performance of a contract; expressly provided for by law; compliance with a legal obligation
• Performance of a contract; establishment, exercise or protection of a right; legitimate interests
• Legitimate interests, provided that fundamental rights are not adversely affected; establishment, exercise or protection of a right
• Establishment, exercise or protection of a right
• An applicable processing condition under Article 6 of the KVKK; explicit consent where no other condition applies
• Legitimate interests, provided that fundamental rights are not adversely affected; establishment, exercise or protection of a right
Marketing activities are based on optional consents obtained separately from the accommodation service and this Privacy Notice.
4. Methods of Collection
Personal data is collected through the website and booking engine, telephone, email, reception and check-in procedures, Booking, Expedia, travel agencies, payment institutions, the Opera Cloud hotel management system, security cameras, the licence plate recognition system and information provided during service, by automatic, partly automatic or non-automatic means forming part of a data filing system.
5. Transfers of Personal Data
Personal data may be transferred to the following recipient groups, subject to the necessary technical and administrative safeguards and only to the extent relevant to and limited by the purpose:
• Authorised public institutions and judicial and administrative authorities, for guest identity reporting, audits and legal requests.
• Banks and payment service providers, for payment and collection transactions.
• Opera Cloud, Booking, Expedia, travel agencies and related service providers, for reservation and accommodation procedures.
• Suppliers providing information technology, accounting, legal, security and support services. Relevant service providers for additional services requested by the guest. Transfers abroad: Personal data may be transferred abroad because the infrastructure, servers or support units of Opera Cloud, Booking, Expedia and the Google/Microsoft services used may be located outside Türkiye. Such transfers are carried out where one of the transfer conditions set out in Article 9 of the KVKK is met and, where necessary, appropriate safeguards such as standard contracts are provided. Detailed information about the international transfer mechanism may be requested through the application channels below.
6. Retention Period
Personal data is retained for 10 years in respect of the relevant records and documents. Data that, by its nature, must be retained for a shorter period, such as CCTV recordings, is kept for the limited period specified in the Hotel's retention and destruction policy. If a legal dispute or request from a competent authority arises, the relevant records may be retained until the dispute or request is concluded. Data whose retention period has expired is erased, destroyed or anonymised in accordance with the KVKK and applicable legislation.
7. Your Rights and Applications
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request its erasure or destruction where the applicable conditions are met and notification of those actions to third parties; object to a result arising from analysis carried out solely by automated systems; and request compensation for damage arising from unlawful processing.
You may submit your applications in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
• in writing to Merkez Mahallesi, Bomonti Arkası Sokak No: 4, Şişli / Istanbul;
• by registered electronic mail (KEP) to bomontihotel@hs03.kep.tr; or
• by email to info@bomontisuites.com from the email address previously registered in the Hotel's system.
Applications containing the information required to verify your identity and your request will be concluded as soon as possible and no later than 30 days, depending on the nature of the request.