KVKK Privacy Notice

Last updated: October 22, 2026

This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails.

At Assos Sunaba Kasrı, we care about the personal data of our guests and everyone who contacts us. Pursuant to Article 10 of the Personal Data Protection Law No. 6698 (KVKK), this notice explains which of your data we process, for what purpose and on which legal basis, with whom we share it, how long we keep it, and how you can exercise your rights.

This notice is for information only; it does not by itself constitute consent. For processing based on your explicit consent (such as analytics and marketing cookies), your approval is obtained separately and solely by your own choice.

Data controller

Data controller

Osman Gökpınar

Address

Büyükhusun Village, Ayvacık, Çanakkale / Türkiye

Email

[email protected]

Phone

+90 286 764 00 78

What data do we process, and why?

We process only the data necessary for the purposes below. The article numbers in parentheses indicate the legal basis under the KVKK.

Accommodation and guest registration

Data

First name, last name, Turkish ID or passport number, date of birth, nationality; the same information for persons staying with you; check-in and check-out dates, room information.

Purpose

To provide the accommodation service and to notify law enforcement of staying guests as required by the Identity Notification Law No. 1774.

Legal basis

Expressly provided for by law (Art. 5(2)(a)), establishment and performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)).

Room reservations

Data

First name, last name, phone, email, dates of stay, number of guests, special requests, information related to the payment transaction.

Purpose

To create and confirm the reservation and to manage changes and cancellations.

Legal basis

Establishment and performance of a contract (Art. 5(2)(c)).

Restaurant table reservations

Data

The first name, last name, phone, date, time, number of guests, meal preference and note you provide in the form on the website.

Purpose

To receive your table request and contact you to confirm it.

Legal basis

Establishment of a contract (Art. 5(2)(c)). You are not required to enter health information (e.g. allergies) in the note field; if you do, it is used only with your explicit consent and only to serve you appropriately (Art. 6).

Contact requests

Data

The name, contact details and message content you send us by phone, email or WhatsApp.

Purpose

To answer your questions, provide pricing and availability information, and review complaints and suggestions.

Legal basis

Establishment of a contract (Art. 5(2)(c)), our legitimate interest (Art. 5(2)(f)).

Invoicing and accounting

Data

First name, last name or company name, Turkish ID / tax number, billing address, payment and spending information.

Purpose

To issue invoices and fulfill record-keeping obligations arising from tax and commercial legislation.

Legal basis

Expressly provided for by law (Art. 5(2)(a)), legal obligation (Art. 5(2)(ç)).

Physical security of the property

Data

CCTV footage of the property's common areas. There are no cameras in the rooms.

Purpose

To ensure the safety of guests, staff and the property.

Legal basis

Our legitimate interest (Art. 5(2)(f)).

Website security and operation

Data

IP address, browser and device information, time of visit, request logs.

Purpose

To run the website, protect it against attacks and misuse, and fix errors.

Legal basis

Our legitimate interest (Art. 5(2)(f)).

Analytics and marketing cookies

Data

Cookie identifiers, pages viewed on the website, ad click information, device and location (country/city level) information.

Purpose

To measure how the website is used, see the effectiveness of our ads and show relevant ads.

Legal basis

Explicit consent (Art. 5(1)). These cookies run only if you give consent; you can withdraw it at any time in Cookie preferences, and the website can be used in the same way.

No payments are taken and no card details are requested on our website. Restaurant table requests are not stored in a database on the website; they go directly to our restaurant team. For details on cookies, see the Cookie Policy.

How do we collect data?

We collect your data, by partly or fully automated means, through the forms on the website, our online booking partner, phone, email and WhatsApp correspondence, the registration forms completed at reception, the security cameras on the property, and cookies.

With whom do we share data?

We do not sell your data. We share only as much as is necessary for the purposes above with the recipients below, in accordance with Articles 8 and 9 of the KVKK.

Within Türkiye

Abroad

The servers of the service providers below may be located abroad. These transfers are made with the appropriate safeguards provided for in Article 9 of the KVKK (such as the standard contracts announced by the Personal Data Protection Board) or, for cookies, based on your preferences.

How long do we keep it?

We keep your data for as long as the purpose of processing requires and the legislation prescribes. When that period ends, it is erased, destroyed or anonymized in accordance with the Regulation on the Erasure, Destruction or Anonymization of Personal Data.

How do we protect your data?

Website traffic is carried over an encrypted connection (HTTPS). Personal data is accessed only by staff who need it for their work; we sign contracts with our service providers that include confidentiality and data security obligations. If a data breach occurs, we notify the Board and the affected persons as required by the KVKK.

Your rights

Under Article 11 of the KVKK, by applying to us you may:

• learn whether your personal data is processed,
• request information about it if it has been processed,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it has been transferred,
• request its rectification if it is incomplete or inaccurate,
• request its erasure or destruction under the conditions set out in Article 7 of the KVKK,
• request that rectification, erasure and destruction be notified to third parties to whom the data has been transferred,
• object to a result against you arising from analysis exclusively by automated systems,
• claim compensation for damages if you have suffered damage due to unlawful processing.

You can withdraw the permission you have given for cookies at any time via the “Cookie preferences” link at the bottom of the page.

How can you apply?

You can submit your application in Turkish, clearly stating your first and last name, Turkish ID number (or, if you are a foreign national, your nationality and passport number), your address for notifications, your email and phone if any, and your request, through one of the following channels:

• In person or through a notary public, with a petition bearing your wet signature: Büyükhusun Village, Ayvacık, Çanakkale / Türkiye
• With a secure electronic signature or mobile signature, or from the email address you previously provided to us and that is registered in our system: [email protected]

We conclude your application free of charge within 30 days at the latest. If the process requires an additional cost, the fee set in the tariff determined by the Board may be charged. If your application is rejected, if you find our response insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and, in any case, within 60 days from the date of application.

We update this notice as our services or the legislation change; the current version is always on this page.