Data Protection (KVKK)

This Website and Business Communications Information Notice ("Notice") applies to personal data processed in connection with guestroom.com.tr, contact and quotation forms, product enquiries, catalogue requests, newsletter subscriptions, email, telephone and related professional or commercial communications.

Data controller / Veri Sorumlusu:
Otelsan Otel Ekipmanları ve Mimarlık Hizmetleri Anonim Şirketi ("OTELSAN")

Address:
Üçevler Mahallesi, Coşkun Caddesi, İnci Plaza, Kat: 1, Ofis: 10, Nilüfer / Bursa, Türkiye

Telephone: +90 224 250 27 00
Commercial email: export@otelsan.com.tr
Privacy / KVKK: info@otelsan.com.tr
Tax registration: Çekirge Tax Office · Tax No. 6491061135

Personal data may be collected wholly or partly by automated means through Website forms, cookies and similar technologies, server and security logs, email systems, communication tools and third-party technologies used by guestroom.com.tr.

Data may also be processed by non-automated means where information obtained through telephone calls, correspondence, quotations, project documents or other business communications becomes part of a data-recording system.

Information is generally obtained directly from the data subject. Where relevant and lawful, it may also be received from the organisation or authorised representative on whose behalf the person communicates, commercial partners involved in a project, or legitimate publicly available business sources.

The purpose of a processing activity and its legal processing condition are assessed separately. Depending on the relevant activity, OTELSAN may process personal data on one or more legal grounds available under the KVKK.

OTELSAN applies the legal ground appropriate to the particular processing activity rather than treating explicit consent as a general or default basis for all processing.

OTELSAN does not ordinarily request special-category personal data through general Website contact, quotation or newsletter forms.

Under Article 6 of the KVKK, special categories include information concerning race, ethnic origin, political opinion, philosophical belief, religion or other beliefs, appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Visitors should not submit such information through ordinary Website forms unless OTELSAN has specifically requested the information for a lawful and necessary purpose.

If special-category personal data is exceptionally processed, OTELSAN applies an appropriate condition under Article 6 of the KVKK and the administrative and technical measures required by applicable law.

Personal data may be transferred only to the extent necessary for an applicable purpose and lawful basis. Depending on the relevant activity, recipient groups may include:

Due to the international nature of Website technologies and OTELSAN's export activities, certain processing activities may involve recipients or infrastructure located outside Türkiye.

This may arise, for example, through international technology, analytics, map, communication or infrastructure providers, or where an overseas distributor, logistics provider, supplier or other project partner must receive information in connection with an international business request.

Personal-data transfers abroad falling within the scope of the KVKK are carried out in accordance with Article 9 of Law No. 6698 and the applicable secondary legislation.

Depending on the recipient and circumstances, an international transfer may rely on:

• an applicable adequacy decision;
• an appropriate safeguard recognised under Article 9, including an applicable standard contract or another legally recognised safeguard;
• a statutory exceptional transfer mechanism, but only where its specific requirements are satisfied; or
• another transfer mechanism permitted by mandatory applicable law.

Where explicit consent is legally relied upon for a specific activity or transfer, that consent is obtained separately and is not inferred merely from visiting guestroom.com.tr or reading this Notice.

Personal data is retained only for the period necessary for the relevant processing purpose and for any period required by applicable law.

When establishing an appropriate retention period, OTELSAN may consider the duration of an enquiry, quotation, project or customer relationship; applicable accounting, tax, commercial and customs obligations; warranty or claim periods; limitation periods; records required to demonstrate communication preferences; information-security requirements; and legal preservation obligations.

When the reasons requiring processing cease to exist, personal data is deleted, destroyed or anonymised in accordance with the KVKK, applicable secondary legislation and relevant OTELSAN procedures.

Backup copies are handled through the applicable secure backup lifecycle and are removed or overwritten in accordance with technical procedures unless continued preservation is legally required.

OTELSAN applies administrative and technical measures appropriate to the nature of the relevant processing activity and associated risk.

Depending on the applicable system, these measures may include access restrictions, role-based authorisation, authentication, logging, secure transmission, backups, software and security updates, malware and abuse protection, service-provider controls, confidentiality obligations, incident handling and periodic review.

Access to personal data is intended to be limited to employees, departments and service providers that require such access for an authorised purpose.

Subject to the conditions of applicable law, data subjects may apply to OTELSAN in order to:

1. learn whether their personal data is being processed;
2. request information where their personal data has been processed;
3. learn the purpose of processing and whether personal data is used in accordance with that purpose;
4. learn the third parties in Türkiye or abroad to whom personal data has been transferred;
5. request correction of incomplete or inaccurate personal data;
6. request deletion or destruction of personal data where the conditions under Article 7 are met;
7. request notification of correction, deletion or destruction operations to third parties to whom the personal data was transferred;
8. object to a result arising against the individual through analysis of processed data exclusively by automated systems; and
9. claim compensation where damage has arisen from unlawful processing of personal data.

Applications concerning rights under Article 11 should be made in Turkish and in accordance with the KVKK and the applicable Communiqué on the Procedures and Principles of Application to the Data Controller.

Written application

A signed written application may be delivered personally or sent by post/courier to:

Otelsan Otel Ekipmanları ve Mimarlık Hizmetleri Anonim Şirketi
Üçevler Mahallesi, Coşkun Caddesi, İnci Plaza, Kat: 1, Ofis: 10, Nilüfer / Bursa, Türkiye

The envelope may be marked "KVKK İlgili Kişi Başvurusu" to facilitate appropriate routing.

Application by registered email address

An application may also be sent to info@otelsan.com.tr from an email address that the applicant has previously notified to OTELSAN and that is already registered in OTELSAN's systems. The subject line may state "KVKK İlgili Kişi Başvurusu".

Other recognised methods

Applications may also be submitted through a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or another application software or method recognised under the applicable legislation, where the necessary infrastructure is available.

Information required in the application

To enable the application to be evaluated, the request should contain the information required by the applicable application rules, including:

• name and surname;
• signature where the application is made in writing;
• Turkish identity number for Turkish citizens;
• nationality and passport number or, where applicable, foreign identity number for foreign applicants;
• address for notification;
• email address, telephone and fax number, where available;
• a clear description of the request; and
• supporting information and documents, where relevant.

OTELSAN will respond to a valid application according to the nature of the request as soon as possible and in any event within no more than thirty days.

Applications are generally handled free of charge. If fulfilment of a request generates an additional cost, a fee may be charged only where permitted under the tariff determined by the Personal Data Protection Board.

If an application to OTELSAN is rejected, the response is considered insufficient, or no response is provided within the statutory period, the data subject may lodge a complaint with the Personal Data Protection Board in accordance with Article 14 of the KVKK.

The complaint must generally be submitted within thirty days from the date on which the data subject learns of OTELSAN's response and, in all circumstances, within sixty days from the date of the original application to the data controller.

Except where applicable law provides otherwise, the application procedure to the data controller must be completed before a complaint is submitted to the Board.

This KVKK Notice is intended to inform data subjects about processing activities. Reading, receiving or acknowledging this Notice does not constitute explicit consent.

Where OTELSAN requires explicit consent as the legal basis for a particular processing activity, the relevant consent request should be presented separately from this information notice, identify the specific processing concerned and provide an opportunity for the individual to make a freely given choice.

The fact that an individual does not provide or later withdraws consent should not prevent unrelated Website or business functions that can lawfully operate without that consent.

Newsletter permissions and non-essential cookie preferences should likewise be administered through separate, appropriate controls where consent is legally required.

OTELSAN may revise this Notice where guestroom.com.tr, its forms, service providers, processing activities, legal grounds, international-transfer arrangements or applicable legislation materially change.

The current version and revision date are shown at the top of this page.

Where a new or materially different personal-data processing activity requires an activity-specific information notice, appropriate information should also be provided at or before the relevant point of data collection.