This notice is issued within the scope of the Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the "Law"), which has entered into force to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, in the processing of personal data, and is intended to inform you accordingly.

We, Doora Otelcilik Turizm Yatırım İşletmeciliği İnşaat Sanayi ve Ticaret A.Ş., along with our affiliated companies and subsidiaries, hereby request your explicit consent for the collection, processing, and – where legally permitted – transfer of your personal data, as specified in this document, in verbal, written, visual or electronic form in accordance with the applicable legal provisions and in good faith. This applies except in cases where processing is required for the performance of a contract, the fulfillment of a legal obligation, or is explicitly stipulated by Law No. 6698. Your data may be transferred to the third parties listed below, strictly limited to the purposes explained below.

Under the scope of the Law, the following definitions apply:

Explicit Consent: Consent that is based on information and freely given regarding a specific subject;

Personal Data: Any information relating to an identified or identifiable natural person;

Processing of Personal Data: Any operation performed on personal data, whether wholly or partially by automated means or, if part of a data recording system, by non-automated means, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of the use of such data.

Your Processed Personal Data

Identity Data	First and last name, place of birth, date of birth, marital status, photo, Turkish identification number (TCKN), passport number, ID card serial number, driver`s license number, father`s name, mother`s name, nationality, place of birth (mentioned again), place of registration in the population register.
Contact Data	Mobile / Landline Number, E-mail Address, Mailing Address
Physical Security Data	Video recordings via closed-circuit surveillance systems (CCTV), audio recordings, turnstile data, security records, vehicle license plate (in case of presence on company premises and use of the company parking area)
Financial Data	Credit Card Data, Bank Account Information
Health Data	Medical information collected by the company physician for the purpose of first aid, medical diagnosis, and treatment in case of health issues
Other	IP Address, Browser Data, Survey, Form, and Location Information

Method of Collection and Legal Basis for the Processing of Personal Data

The above-mentioned personal data may be collected verbally, in writing, or electronically through the information and documents you have provided, including your driver’s license, identity card, passport and copies thereof, the closed-circuit camera system, as well as through external employment, service or consultancy companies, agencies, and similar channels. These data may be processed by the person(s) bound by confidentiality obligations within this company or by authorized institutions and organizations on the following legal grounds:

The processing is explicitly provided for by law,
The processing is necessary to protect the life or physical integrity of the data subject or another person, when the data subject is physically incapable of giving consent,
The processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (e.g. for carrying out all activities within the company`s scope in accordance with legal regulations, and for the proper and complete fulfillment of the company’s contractual and legal obligations),
The processing is necessary for compliance with a legal obligation to which the data controller is subject,
The processing relates to data made public by the data subject,
The processing is necessary for the establishment, exercise or defense of legal claims,
The processing is necessary for the legitimate interests of the data controller, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject.

Personal data that do not concern ethnic origin, political opinions, philosophical beliefs, religion, denomination or other beliefs, clothing and appearance, membership in associations, foundations or trade unions, health data, sexual life, criminal convictions and security measures, as well as biometric and genetic data, may be processed without the explicit consent of the data subject in cases expressly provided for by law. However, personal data concerning health and sexual life may only be processed without the explicit consent of the data subject if the processing is carried out by persons subject to confidentiality obligations or by authorized institutions and organizations, and solely for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, as well as the planning and management of healthcare services and their financing.

Ihre personenbezogenen Daten können darüber hinaus – neben den oben genannten rechtlichen Grundlagen – auch auf Grundlage des Gesetzes Nr. 6698 zum Schutz personenbezogener Daten, des Türkischen Obligationenrechts Nr. 6098, des Türkischen Zivilgesetzbuches Nr. 4721 sowie weiterer einschlägiger gesetzlicher Bestimmungen verarbeitet werden.

Purpose of Processing Personal Data

Your personal data may be processed in accordance with the processing conditions set forth in Articles 5 and 6 of Law No. 6698, for the following purposes:

Provision of guest accommodation services
Fulfillment of obligations arising from laws and contracts
Resolution of potential legal disputes that may arise between the parties
Communication with the guest in case of service interruptions or problems during the stay
Execution of payments and other transactions by the guest via electronic systems
Protection of guests` and public health, provision of healthcare services, and fulfillment of legal and regulatory requirements
Ensuring workplace safety and physical security; administrative management, monitoring, and control of entries and exits; securing access to office buildings, departments, server rooms, and guest rooms; managing the internet data network and ensuring cybersecurity
Conducting marketing-related analysis, profiling, and targeting activities
Carrying out advertisement, marketing, campaign, and promotion activities and informing the guest accordingly
Presenting personalized offers based on the guest’s past preferences and interests
Creating potential customer records, enhancing loyalty to products and services, increasing customer satisfaction
Carrying out celebratory and greeting activities on special occasions

Transfer of Personal Data

Your personal data may be transferred in accordance with the basic principles stipulated in Law No. 6698 and within the framework of the conditions set forth in Articles 8 and 9 of the Law and other relevant legislation, to the following parties:

To public and private institutions and organizations, as well as to professional chambers with the status of public institutions that are authorized to receive information and documents,
To legal consultancy offices from which the company receives services for the prevention or resolution of possible legal issues,
To a limited number of direct or indirect domestic and foreign suppliers, group companies, and subsidiaries of the company (you may contact our company in writing for further details),
To healthcare institutions and insurance companies from which the company receives health-related services,
To institutions or organizations providing services as "data processors" within the framework of relevant legal regulations,
To tax consultants and other consultancy firms from which the company receives services,
To regulatory and supervisory authorities and official bodies in accordance with legal obligations and company policies.

Your personal data may be transferred abroad in accordance with the principles set forth in Article 4, paragraph 2 of Law No. 6698 on the Protection of Personal Data, either based on your explicit consent or — without your explicit consent — if the conditions set out in Article 5, paragraph 2 and Article 6, paragraph 3 of the Law are met, and in line with the provisions of Article 9. Transfer abroad is only permitted in the following cases: – To individuals and organizations located in foreign countries that are declared by the Personal Data Protection Board ("Board") to have an adequate level of protection, – To countries that do not provide an adequate level of protection, only if both the data controller in Turkey and the data controller in the respective foreign country undertake in writing to provide adequate protection, and the Board’s authorization for the data transfer is obtained.

Your personal data will only be disclosed to official authorities if requested by the competent authorities and if such disclosure is required by mandatory legal regulations. Our company does not use your personal data for any purposes other than those specified in this document, nor does it sell your personal data.

To protect your personal data, we take all necessary technical and organizational measures to ensure the lawful processing, prevention of unauthorized access, and secure storage of your personal data.

What Are Your Rights Under the Law?

Within the scope of Article 11 of Law No. 6698 on the Protection of Personal Data, you may contact our company at any time to exercise the following rights regarding your personal data:

To learn whether your personal data is being processed and, if so, to request information regarding the purpose of the processing and whether it is used in accordance with this purpose,
To request information about third parties, both domestic and international, to whom your data has been transferred in accordance with the applicable legal provisions,
To request the correction of your personal data if it has been processed incompletely or inaccurately,
To request the deletion or destruction of your personal data within the framework of the conditions set forth by law,
To request that the correction, deletion, or destruction of your personal data be communicated to the third parties to whom the data has been transferred,
To object to decisions made exclusively through automated processing that may have unfavorable consequences for you,
To request compensation if you suffer damage as a result of unlawful processing of your personal data.

To exercise your rights under the Law, you may complete the Data Subject Application Form available at:

https://www.thenormhotels.com/tr/the-norm-collection-doora and submit your application to us using one of the methods below. If the Personal Data Protection Board (KVKK) introduces new application methods, these will be announced accordingly.

After completing the Data Subject Application Form, you may send a wet-signed copy either in person or via notary to the following address: “Torba Mah. Kaynar Mevkii Kavşağı Bodrum, Muğla”
Alternatively, you may sign the completed form with a qualified electronic signature as defined by Law No. 5070 on Electronic Signatures and send it to our registered e-mail address: kvk@atghotels.com

Applications submitted within this scope will be processed as soon as possible and no later than within 30 days. Currently, such applications are free of charge. However, if the Personal Data Protection Board (KVKK) sets a fee schedule, a fee may be charged in accordance with that tariff.

Retention Period of Personal Data

Your personal data will be retained for a period of one (1) year. Even if the data has been processed in accordance with the Law and relevant legal provisions, it will be deleted, destroyed, or anonymized by our company at the latest in six-month intervals or, upon your request, within thirty (30) days, provided that the purpose for processing no longer exists.

Deletion of personal data means that the respective data is rendered inaccessible and unusable within the organization of the company or by third parties authorized and instructed by the company, except for those responsible for technical storage, backup, and archiving.

Destruction of personal data means that such data is made completely and permanently inaccessible, unrecoverable, and unusable so that no one can access it under any circumstances.

Anonymization of personal data means that such data can no longer be associated with an identified or identifiable natural person, even through the use of appropriate technical methods for the relevant data environment or activity areas such as reversing or combining with other data.

All processes related to the deletion, destruction, and anonymization of personal data are documented, and these records are kept for three (3) years and made available to the relevant Ministry upon request.

Thank you for your attention.

Doora Otelcilik Turizm Yatırım İşletmeciliği İnşaat Sanayi ve Tic. A.Ş. The Norm Collection Door’A Şubesi

Address : Torba Mah. 3131 Sk. DOORA Otel No:2 Bodrum/Muğla

MERSIS No.: 0127044353300001

Tax Office: Antalya Kurumlar Vergi Dairesi

Tax Number: 127 044 35 33

Check In / Check Out