Home
Data Controller: Istanbul Turizm ve Otelcilik Anonim Şirketi
Osmanlı Sokak No: 9 Taksim-Beyoğlu-Istanbul
İSTANBUL TURİZM VE OTELCİLİK ANONİM ŞİRKETİ, which is the operator of The Marmara Hotels and The Marmara Esma Sultan Mansion, whose commercial center is located at Osmanlı Sokak No:9 Beyoğlu- Istanbul, the taxpayer of Büyük Mükellefler Tax Office with the number 4810040881, the Data Controller İSTANBUL TURİZM VE OTELCİLİK ANONİM ŞİRKETİ with the MERSIS number 0481004088100015, attaches great importance to ensuring the security of your personal information you have submitted to it.
As Istanbul Turizm ve Otelcilik A.Ş. (“The Marmara Collection”), we have prepared this clarification text in order to inform our valued customers about the processing, storage and transfer of your personal data within the framework of our activities arising from the **Personal Data Protection Law No. 6698 (KVKK)**, the **EU General Data Protection Regulation (GDPR)** and related legislation and legal regulations.
Within the scope of our website sales operations, we collect and process the following categories of personal data for the purposes outlined below:
Identity Data: Full name, Turkish Republic identification number
Contact Data: Mobile phone number, email address, residential address
Financial Data: Credit card details
| Identity Data, Contact Data, Financial Data |
|
| Identity Data, Contact Data |
|
Your **identity data, contact data, and financial data** are processed for the purposes of carrying out financial and accounting operations, executing sales of goods and services, and performing contractual obligations. This processing is based on the legal ground specified under **Article 5/2(c) of the Law on the Protection of Personal Data (KVKK)**, as it is necessary for the establishment and performance of a contract. Furthermore, your **identity data and contact data** are processed for the purposes of managing company, product, or service loyalty programs; conducting marketing analytics; evaluating feedback for the improvement of business processes; carrying out marketing activities for products and services; and executing advertising, campaign, and promotional operations. These processing activities are based on your **explicit consent**, in accordance with **Article 5/1 of the KVKK**.
| Categories of Recipients | Purpose of transfer | Legal Basis for the Transfer of Personal Data |
|---|---|---|
| Business Partner (Banks) | Disclosure of personal data to authorized financial institutions (e.g., banks) for purposes such as credit card payment processing and the execution of refund transactions | Pursuant to **Article 5/2(c) of KVKK**, processing is lawful where it is necessary for the establishment and performance of a contract. |
| Business Partner (External Accountant) | Audit and review of financial statements by an independent CPA firm | Pursuant to **Article 5/2(ç) of KVKK**, personal data may be processed where it is necessary for compliance with a legal obligation. |
| Logistics Service Provider (Courier Company) | For the purpose of fulfilling the delivery of ordered products | Pursuant to **Article 5/2(c) of KVKK**, personal data may be processed where it is necessary for the establishment and performance of a contract |
| Third-party supplier |
Service providers from which we receive services for the
development of your mobile application and the processing of
online shopping payments Companies from which we receive services for the delivery of electronic information and campaign messages In order to ensure card security in online payments made by credit card, Wirecard Ödeme ve Elektronik Para Hizmetleri A.Ş. is utilized as a service provider | **Article 5/2(c) of KVKK**; Being Necessary for the Establishment and Performance of the Contract |
| Company shareholders | Conducting and auditing business operations | **Article 5/2(f) of KVKK**; Legitimate Interests of the Data Controller, provided that it does not violate the fundamental rights and freedoms of the data subject |
| Supplier (Assessment and Evaluation Specialist) | Surveys, market research and similar activities to be conducted for the purpose of measuring customer satisfaction and related evaluations | **Article 5/1 of KVKK**; Explicit Consent of the Data Subject |
| Authorized public institutions and organizations |
Courts, public prosecutor’s offices, and law enforcement
authorities, upon written and lawful request Revenue Administration, in the event of a statutory audit or tax inspection | **Article 5/2(ç) KVKK**; Being Mandatory for the Fulfillment of a Legal Obligation |
Your personal data mentioned above is collected **electronically** through your connection information and the forms you fill out on our website, **www.themarmarachocolate.com**. It is then processed and transferred for the purposes specified above.
By applying to us as a data subject pursuant to **Article 11 of the Law on the Protection of Personal Data (LPPD)**;
Your applications and requests regarding your personal data:
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, the application of the Data Subject must include: **name and surname, signature** (if the application is in writing), **Turkish Republic identification number** (or passport number if the applicant is a foreign national), **residential or workplace address for notification, e-mail address for notification, telephone number, fax number** (if any), and **information regarding the subject of the request**.
The Data Subject must clearly and comprehensibly state the issue requested in the application, which must include explanations regarding the right he/she intends to exercise. All information and documents related to the request must be attached to the application.
Your requests regarding your personal data are evaluated and responded to within a maximum of **30 days** from the date of receipt. If your application is rejected, the justified reasons for the rejection will be communicated to the address you specified in the application, either by e-mail or postal mail.