Data controller
The data controller for the Dilek Kaya Hotel website and the data processing described in this notice is Yiğitoğlu Tur. İnş. Otom. San. İç ve Dış Tic. Ltd. Şti.
Scope and contact details
This notice covers the website’s booking referrals, privacy preferences, communications with the hotel, and the accommodation and hotel-service data processing described below.
Our contact address is: Bahçelievler Mah. Mecit Yavuz Sk. No: 55, 50650 Ortahisar, Ürgüp / Nevşehir. For questions about your personal data, contact us at [email protected].
What information do we use, and why?
The dates and numbers of rooms and guests you select are used to open the booking page for your stay. When you select Book your stay, this information is sent to Reseliva as URL parameters. This page does not ask for your name, identity details, or payment information.
When you contact us by phone, email, or WhatsApp, we use the contact details and messages you share to answer your request and handle the booking services you ask for. For requests before booking, the legal basis is Article 5/2-c of Türkiye’s Personal Data Protection Law (KVKK), covering processing directly related to entering into or performing a contract. Article 5/2-e applies to correspondence that must be kept to establish, exercise, or protect a right.
Your map and Instagram choices are stored in your browser to remember your preferences and display the content you allow. These optional features are enabled with your explicit consent under Article 5(1) of the Turkish Personal Data Protection Law; you may withdraw permission at any time. The preference record is not used to create an advertising profile.
Contact data necessary to answer general questions unrelated to a booking is processed on the basis of our legitimate interest in responding to inquiries, provided that your fundamental rights and freedoms are not harmed (KVKK Article 5/2-f). Using a communication channel does not constitute permission to receive marketing messages.
How we collect information
The information you enter in the booking fields and the preference record in your browser are collected automatically by electronic means. Email and WhatsApp messages are received electronically through those channels. Information you share by phone is received verbally; when entered into an inquiry or booking record, it is processed as part of a filing system.
Accommodation records
For group stays, guest lists are received from travel agencies. For both group and individual stays, guests’ identity or passport details are entered into the hotel’s records system at check-in. This information is processed to arrange the stay and handle check-in, on the legal basis that processing is directly related to entering into or performing the accommodation contract (Article 5/2-c of the KVKK).
Returning guests may be recognized through their guest profile in the hotel records system provider’s system. The guest profile is retained for 10 years from the date it was first created; a new stay does not restart this period. Identity or passport details are requested again for each stay. The guest profile retention period does not change the separate retention periods that apply to identity reporting and financial records.
The guest profile retained for 10 years contains only first name, last name, room number, and booking channel. Identity or passport numbers and contact details are not part of this profile.
Guest lists received from travel agencies are used for room and accommodation planning. Reporting through the Identity Notification System (KBS) takes place after the guest has checked in and their identity has been verified.
Hotel services and retention periods
Identity and stay records kept for identity reporting are retained for 5 years. The required information is sent to the competent law enforcement authorities to meet the reporting obligation under Identity Reporting Law No. 1774. This processing is based on express provision in law and compliance with a legal obligation (Article 5/2-a and ç of the KVKK).
Invoices, accounting documents, and commercial contract records are retained for 10 years when subject to the retention obligation under Article 82 of the Turkish Commercial Code. Financial records are processed to meet obligations under the applicable tax and commercial legislation.
Photocopies, photographs, and scanned images of identity documents or passports are not retained. The details needed for check-in are taken from the document without making its image part of the records. Previously collected identity document images are destroyed without delay.
Guest Wi-Fi access logs are retained for 2 years to meet obligations under Law No. 5651 and the Regulation on Internet Collective Use Providers. This processing is carried out to comply with legal obligations.
Security camera footage is retained for 30–90 days to protect the premises and people. The legal basis is a legitimate interest in security, provided that guests’ fundamental rights and freedoms are not harmed (Article 5/2-f of the KVKK).
Data processed with explicit consent for the hotel’s marketing activities is used for that purpose until consent is withdrawn. Marketing use ends when consent is withdrawn. This does not change the retention periods for financial or identity-reporting records subject to a separate legal obligation.
When the reasons for processing personal data no longer apply, the data is erased, destroyed, or anonymized, taking applicable retention obligations into account.
Google Analytics 4
Visitor analytics automatically collects data electronically to understand how the website is used. Analytics data is processed on the basis of your explicit consent under Article 5(1) of the Turkish Personal Data Protection Law; Google receives the data for this purpose. You can withdraw analytics permission through “Cookie preferences”. Analytics permission does not replace the international transfer requirements under Article 9 of the Law.
Google Analytics 4 runs only with your analytics permission. Usage data, such as pages visited, the referring site’s domain, browser, device, and approximate location, is sent to Google, which may also process it outside Türkiye. Query strings and # fragments in page addresses are not sent. Ad personalization and Google Signals are off.
Google’s current retention settings are 2 months for event data and 14 months for user data; new activity resets the user data retention period. These limits do not apply to most standard reports based on aggregated data.
Website delivery and security
Cloudflare processes IP addresses, requested URLs, request times and browser information to deliver and protect the site. This processing is independent of map and Instagram permissions.
This information is collected automatically by electronic means when you access the site. Processing to keep the site secure and accessible is based on the necessity of the controller’s legitimate interests, provided that your fundamental rights and freedoms are not harmed (Article 5(2)(f) of the Turkish Personal Data Protection Law). Cloudflare is the technical service provider receiving this information for these purposes.
Email service
The hotel uses Pusula (Uzman Posta) for its email service. When you email us, the sender and recipient addresses, message content, any attachments and technical delivery information are processed by this service provider to receive and deliver the message. This process is independent of the map or Instagram preference on the website.
Pusula (Uzman Posta) privacy statement
Service providers and external links
Cloudflare uses a global service network, so technical connection data may be processed outside Türkiye. The OpenStreetMap map loaded with your permission may also connect to servers abroad. Permission for optional content does not replace the international transfer requirements in Article 9 of the Turkish Personal Data Protection Law.
With your permission, map images load from OpenStreetMap and Instagram images from Meta servers. These connections send your IP address and browser technical information to the relevant provider, where they may be processed outside Türkiye. Content you do not allow remains unloaded; directions and the Instagram account are available through external links.
Links to Reseliva, Google Maps, Instagram, or WhatsApp take you to those services. Please review each provider’s privacy notice for information about data processing on its platform. This website does not collect marketing consent. Choosing to book or contact us does not count as permission to send advertising.
Preferences and retention
Your preferences are saved in your browser for 180 days, after which you will be asked to choose again. You can change map and Instagram permissions through “Cookie preferences” in the footer. Withdrawing permission stops future loading.
Inquiries that do not lead to a booking are used to respond to your request; no separate customer archive is created. Email and message retention depends on the status of the request, legal obligations and the need to protect legal rights. The 180-day preference period does not apply to these records.
Your rights and how to make a request
Under Article 11 of the KVKK, you may ask whether your personal data is processed and, if so, request information about the processing, its purpose, whether the data is used for that purpose, and the third parties to whom it is transferred in Türkiye or abroad. You may request correction of incomplete or inaccurate data, deletion or destruction when the legal conditions are met, and notification of these actions to third parties who received the data. You may object to an adverse outcome resulting solely from automated analysis of your data and seek compensation for damage caused by unlawful processing.
You may submit a request using the methods set out in the Communiqué on the Principles and Procedures for Requests to the Data Controller. Send written requests to the mailing address above, or email us for information about the process. Requests are resolved as soon as possible, depending on their nature, and within 30 days at the latest. If the process involves additional costs, a fee may be charged according to the tariff set by the Personal Data Protection Board.
Information required for a data request
A request under the Turkish Personal Data Protection Law must include your first and last name, your signature if submitted in writing, and your Turkish identity number if you are a Turkish citizen. Foreign nationals must provide their nationality and passport number or identity number, if any. Include your residential or business address for service, your notification email address, telephone and fax number if available, and the subject of your request. Attach relevant information and documents.
Guest reviews
We share excerpts from public Google and Tripadvisor reviews to present guest experiences. We retain the platform name or username, rating and available date, and identify sources and translations. Contact us to request a correction or removal.
Last updated: October 24, 2026
