Privacy notice on the processing of personal data

1. Data controller

• Company: Oikos Turizm Gıda İnşaat Sanayi ve Ticaret Limited Şirketi
• MERSIS number: 0636074728100001
• Address: Alaybey Mahallesi Göller Mevkii Küme Evleri No:27 Bozcaada/Çanakkale
• Hotel address: Alaybey Mahallesi Göller Mevkii Küme Evleri No:27 Bozcaada/Çanakkale
• Email: info@oikosbozcaada.com
• Phone: +90 545 219 43 46

2. Personal data we process

• Identity: first and last name of the person booking and, if you enter them, of the guests staying. Optionally the nationality, date of birth and gender of the guests staying.
• Contact: phone number, email address and email language.
• Booking and stay: arrival and departure dates, room type, board, number of guests, children's ages, bed type preference, arrival plan (ferry or estimated arrival time), early check-in and arrival day breakfast choices, notes to the hotel and to the kitchen.
• Invoicing: if you enter them, billing address, company name, tax office and tax number.
• Payment: amount due and paid, bank transfer reference, date the payment reached us. Your card details never reach our servers and are never stored.
• Security: irreversible hashes of email verification and login codes, of the guest portal session and of your IP address, the version of the legal texts you accepted and the time of acceptance, transaction logs.
• Measurement data (only if you accept cookies): random browser identifiers of Google Analytics and advertising platforms, pages you visit and booking steps, the room type, number of nights and guests you choose, the ad or site you came from, device and browser details, your IP address and the approximate location derived from it, booking amount.
• Collected at check-in: identity document type and number (stored encrypted), date of birth, nationality, gender and, if any, vehicle plate. These are not requested in the online booking.

Please do not enter health information (such as allergies or illnesses) in the note fields of the online forms. A health or diet note is only taken at the hotel, with your explicit consent and a separate approval. You can withdraw your consent at any time and the note is then deleted.

3. How we collect data

We collect data fully or partly by automated means through the forms on the booking site and the guest portal and through email, phone and WhatsApp messages, and partly by automated means at reception through an ID reader or manual entry. The ID reader does not store images, it fills in the form and deletes the image immediately.

If you book on behalf of others, you provide the details of the guests staying. Please let them know about this notice.

4. Purposes and legal grounds

We do not send you marketing or promotional messages. If we want to do so in the future, we will ask for your separate consent first.

5. Who we share data with and why

• Competent public authorities: the Police and Gendarmerie for identity reporting, tax and supervisory authorities, courts on request. Purpose: meeting legal obligations.
• Service providers who process data only on our behalf and on our instructions: hosting of the booking site and our hotel management system (Vercel Inc., server region Frankfurt), database (Neon, server region Frankfurt), encrypted backups (Cloudflare R2, European Union region), hosting of the website (Cloudflare), email delivery (Resend, with Postmark as backup), bot verification (Cloudflare Turnstile). Purpose: technical provision of the service.
• Measurement and advertising platforms (only if you accept cookies): Google (Google Analytics, Google Ads, Google Tag Manager) and Meta Platforms (Facebook, Instagram). Purpose: measuring site use and the results of our ads. These companies may also process the data under their own policies.
• Banks: carrying out bank transfer payments and refunds.
• Our accountant and, where needed, a lawyer: accounting and legal matters.

Some of our hosting and email providers are established abroad. Your data is kept on servers in the European Union, sent to these providers over encrypted connections, and backups are stored encrypted. Measurement data you consent to is transferred to Google's and Meta's servers abroad. These transfers fall under Article 9 of KVKK. The standard contract published by the Personal Data Protection Board for transfers abroad has not yet been signed with these companies. This notice will be updated when it is.

We do not sell your data. Only if you consent, and only for measurement, the measurement data above goes to advertising platforms. Your name, phone, email, identity, bank or card details are never sent to advertising or measurement platforms.

6. How long we keep data

We keep data for the periods set by law and for as long as needed for the purpose. Years are counted from the end of the year in which the relevant event took place. When the period ends, information that identifies you is irreversibly anonymised. Amounts, dates and room details remain without any link to you.

If we ever restore from a backup, records that were anonymised earlier are anonymised again.

7. Your rights

Under Article 11 of KVKK you can apply to us to:

• learn whether your personal data is processed
• request information if it has been processed
• learn the purpose of processing and whether it is used for that purpose
• know the third parties in Turkey or abroad to whom it is transferred
• request correction if it is incomplete or inaccurate
• request erasure or destruction where the conditions in Article 7 of KVKK are met
• request that corrections, erasure or destruction are notified to the third parties it was transferred to
• object to a result against you that arises solely from automated analysis
• claim compensation if you suffer damage because of unlawful processing

8. How to apply

Your application must be in Turkish and clearly state your identity and your request. You can send it in writing to Alaybey Mahallesi Göller Mevkii Küme Evleri No:27 Bozcaada/Çanakkale or by email to info@oikosbozcaada.com from an email address you gave us before and that is registered in our system.

We will conclude your application free of charge within 30 days at the latest. If the action involves an extra cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find our answer insufficient or we do not answer in time, you may file a complaint with the Personal Data Protection Board.

9. Cookies

Our sites always use the cookies strictly necessary for them to work. Measurement and advertising cookies are only used with your consent. Details are in the cookie policy.

10. Changes to this notice

We update this notice when needed. The current text is always on this page. The text version is shown at the end of the page.