PRIVACY AND SECURITY POLICY
*(Website and Mobile Application)*
1. DATA CONTROLLER
Personal data you share while making reservations, creating an account, or requesting information through our website and mobile application (together, "our Platforms") is processed by Midilli Konak Turizm Otelcilik Kafe Hizmetleri İnşaat İthalat İhracat Sanayi ve Ticaret Limited Şirketi ("Midilli Konak Hotel"), acting as data controller, within the scope described below and in accordance with Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
- Address: İsmetpaşa mah. 145 sokak no:1/1 Eski Foça/İzmir, Türkiye
- Tax Office / No: Foça V.D. / 6211218635
- Phone: +90 533 131 78 31
- E-mail: midillikonak@gmail.com
2. SCOPE
This policy covers:
- our website at www.midillikonak.com, and
- the Midilli Konak Hotel mobile application distributed via the App Store and Google Play.
Unless stated otherwise, the provisions below apply to both platforms.
3. PERSONAL DATA COLLECTED
3.1. Data Collected via Our Website
To complete your reservation, provide accommodation services, and contact you:
- First and last name
- Phone number
- E-mail address
- Postal address
3.2. Data Collected via Our Mobile Application
To create and manage your member account:
- First and last name
- Phone number
- E-mail address
- Password (stored only in irreversibly hashed form using a current industry-standard hashing algorithm; your password is never stored in plain text and cannot be viewed even by us)
3.3. Automatically Collected Data (Session and Security Logs)
When you create an account, sign in, or when your active session is renewed on our Platforms, the following data is recorded automatically to protect your account:
- IP address
- Device and browser information (user agent)
These records are kept to secure sessions, detect unauthorized access attempts, and automatically lock the account after repeated failed sign-in attempts. They are never used for any purpose other than security, and are not used for profiling or advertising.
3.4. Data Displayed in Your Account
The mobile application displays your stay history already held in our hotel records (stay dates, number of nights, number of guests, and room number) within your account. A birthday benefit feature is not currently offered; if this feature is enabled in the future, only the day and month of your date of birth will be processed in the application, your year of birth will never be transmitted to the mobile application, and this policy will be updated.
3.5. Device Permissions
Our mobile application does not access your contacts, photos, camera, location, or any other personal content on your device, and does not request any such permission. Directions to the hotel are provided from the hotel's postal address, not from your device location.
4. PURPOSES AND LEGAL BASES OF PROCESSING
Your personal data is processed for the purposes of:
- receiving and confirming your hotel reservation and performing the accommodation service contract,
- creating, managing, and verifying your member account in the mobile application,
- issuing invoices/financial documents and carrying out statutory accounting processes,
- contacting you regarding your reservation or membership when necessary,
on the legal basis of KVKK Article 5/2-c: processing being necessary for the establishment or performance of a contract to which the data subject is a party.
Your IP address and device/browser information is processed to secure your account and sessions, on the legal basis of KVKK Article 5/2-f: processing being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
Data collected in our systems is never used for marketing, advertising, campaigns, or newsletters without your consent. The mobile application does not currently send push notifications; if this feature is enabled in the future, notifications will relate solely to your reservation and the performance of the service, this policy will be updated, and notifications can be turned off at any time in your device settings.
5. CREDIT CARD AND PAYMENT SECURITY
Payments made through our website, whether in installments or as a single charge, are processed through our secure payment provider İŞBANK SANAL POS.
- Card data security: credit card, debit card, and password details entered on the payment page are never held, stored, or recorded on Midilli Konak Hotel servers or databases.
- Encryption (SSL): all payment transactions on our website are transmitted directly to iyzico's secure shared payment page with 256-bit SSL encryption. Your card details are verified in encrypted form directly between the bank and the payment institution.
No payment transactions are carried out within the mobile application itself, and the application does not request any card details. When you wish to make a reservation from the application, the booking page operated by our online booking engine provider (midilli-konak.hmshotel.net) opens in an in-app browser. The name, stay dates, and payment details you enter on that page are processed directly through that provider's secure infrastructure; the Midilli Konak Hotel application does not access or store this information.
6. TRANSFER OF DATA TO THIRD PARTIES
Your personal data is not shared with third parties except as required by law or for the performance of the service. Your data is transferred only:
- Payment infrastructure: to iyzico systems, to the extent necessary to collect payments made through our website;
- Online booking engine: for reservations initiated from the mobile application, the data you enter on the booking page is transferred to the systems of our online booking engine provider (HMS — midilli-konak.hmshotel.net) for the purposes of creating the reservation and collecting payment;
- Legal obligations: to the Identity Notification System (KBS) of the Turkish General Directorate of Security, under Law No. 1774 on Identity Notification, for statutory notifications completed physically at check-in;
- to the relevant official institutions and authorities in the context of financial audits and invoicing processes.
The App Store (Apple Inc.) and Google Play (Google LLC) apply their own privacy policies to the distribution of our mobile application; Midilli Konak Hotel does not transfer any of your personal data to these platforms.
7. DATA RETENTION AND SECURITY
Your personal data is retained for as long as required by the purposes of processing and by the statutory retention periods set out in applicable legislation, after which it is deleted, destroyed, or anonymized. Session and security logs (IP address, device information) are subject to the same principle and are not kept longer than the security purpose requires.
When you delete your mobile application account, all of your personal data is deleted from our systems, except for data subject to statutory retention obligations, such as stay and invoice records (retained for up to 10 years under applicable legislation). Before deletion, the application clearly shows you which data will be deleted and which will be retained due to legal obligations, and asks for your confirmation.
8. COOKIES AND MOBILE TRACKING TECHNOLOGIES
Our website may use only strictly necessary cookies to improve the user experience and keep the site technically stable. Our Platforms do not use any third-party tracking codes or SDKs that monitor user behavior, perform targeting, or serve advertising purposes (Google Analytics, Meta Pixel, advertising ID tracking, etc.). The mobile application does not collect your device's advertising identifier (IDFA/GAID) and does not share it with third parties.
9. RIGHTS OF THE DATA SUBJECT (KVKK ARTICLE 11)
As a data subject, you have the right to learn whether your data is being processed, to request information if it has been processed, and to request correction or deletion of your data. To exercise your rights, you may apply in writing to midillikonak@gmail.com. Mobile application users may also request deletion of their membership and personal data directly through the account settings in the application.