Personal Data Protection Notice
This notice explains the processing of personal data relating to individuals who visit the Palm Wings Ephesus Beach Resort & SPA website, use its communication channels, subscribe to its email newsletter or allow browser notifications.
1. Data Controller
The data controller under Turkish Personal Data Protection Law No. 6698 (“Law”) is BAZMER TURİZM VE OTELCİLİK İŞLETMELERİ A.Ş. (“Company”), which operates Palm Wings Ephesus Beach Resort & SPA.
Address:
İkiçeşmelik Mahallesi, Kitaş Anadolu Sitesi No:12,
Kuşadası / Aydın, Türkiye
Website:
ephesus.palmwings.com.tr
Email:
ephesus@palmwings.com.tr
Registered Electronic Mail (KEP):
bazmer.turizm@hs03.kep.tr
2. Website Use and Access Logs
Our website is hosted on the Company’s own servers located in Türkiye. Your IP address and technical access records are collected automatically in electronic form when you access the website.
These records are processed to maintain website security, detect unauthorised access and misuse, and investigate technical issues. Processing is based on the Company’s legitimate interest in ensuring information security under Article 5(2)(f) of the Law, provided that your fundamental rights and freedoms are not adversely affected. IP access logs are retained for 360 days.
3. Contact, Feedback, Callback and Quotation Requests
When you use the contact and request sections on our website, we process your name, the email address or telephone number you provide, the request type, and the information you enter in the subject and message fields.
This information is used to answer questions, review feedback, contact you, respond to callback requests and prepare quotations for the services you request.
Form submissions are delivered by email to ephesus@palmwings.com.tr and are not additionally stored as form records in the website administration panel. Information collected through these forms is not transferred to Tatilbudur.
Requests directly related to entering into or performing a contract are processed under Article 5(2)(c) of the Law. Other contact and feedback requests are processed under Article 5(2)(f), based on the Company’s legitimate interest in responding to requests and improving its services, provided that your fundamental rights and freedoms are not adversely affected.
Completing a form does not subscribe you to promotional or advertising messages. Please do not include personal data unrelated to your request or special categories of personal data, such as health information, in your messages.
4. Email Newsletter Subscription
If you subscribe to our email newsletter, your email address is stored in the subscription database managed through the administration panel to send you emails about our hotel’s promotions, special offers, events and announcements.
The processing of personal data for newsletter marketing purposes is based on your explicit consent under Article 5(1) of the Law. Any required consent to receive commercial electronic messages is obtained separately. This notice does not constitute subscription or marketing consent.
You can cancel your subscription using the unsubscribe link at the bottom of our emails. Promotional and marketing emails sent under that subscription will stop following cancellation.
5. Browser Notifications and On-Site Announcements
Our website may display pop-ups, announcement areas and information banners about promotions, events, special offers and recent developments.
If you allow browser notifications through the notification module developed by the Company, the subscription identifiers and permission information needed to deliver notifications to your device are processed. This information is used to manage notification delivery and your subscription preferences.
Personal data processing for marketing notifications that requires explicit consent is based on Article 5(1) of the Law. Technical notification permission granted through your browser does not replace any other required consent.
You can revoke notification permission through your browser’s site settings or notification permissions. Email newsletters and browser notifications are separate channels. Unsubscribing from the newsletter does not automatically revoke browser notification permission.
6. Cookies, Analytics and Advertising Tools
Our website uses Google Analytics, Google Ads and Meta Pixel. These tools are activated after you provide the relevant cookie consent.
Depending on the technical configuration, these tools may process online identifiers, cookie information, device and browser information, pages visited and information about interactions with the website.
Data is processed to analyse website use, improve the user experience, measure advertising and campaign effectiveness, and display relevant advertising content, based on your explicit consent under Article 5(1) of the Law.
You may reject optional cookies. Visiting our website or continuing to use it does not, by itself, constitute consent to these tools. Further explanations about cookie use are provided in our Cookie Policy.
7. Online Reservations and Tatilbudur
The online reservation section of our website operates through Tatilbudur’s embedded reservation system. Room sales and payments in this section are handled through Tatilbudur. Information about the personal data collected by Tatilbudur during these transactions is provided on the relevant reservation screens.
Following a reservation, Tatilbudur sends your first name, surname, age, nationality and telephone number to the Company by email and through the Elektraweb integration. This information is processed to fulfil your reservation and prepare your accommodation services.
Processing directly related to entering into or performing a contract is based on Article 5(2)(c) of the Law. Other personal data processing activities during your stay are explained separately in the relevant guest privacy notice.
8. Transfers of Personal Data
Data used within Google Analytics and Google Ads is transmitted to Google’s service infrastructure. Data used within Meta Pixel is transmitted to Meta’s service infrastructure. These transmissions serve the analytics, advertising and campaign measurement purposes described above.
Our website and email services are hosted on the Company’s own servers in Türkiye. However, the use of Google and Meta services may involve processing data on systems abroad or transferring data abroad.
Your browser’s notification infrastructure may also participate in the technical delivery of browser notifications.
Legally required transfers to authorised public authorities are carried out to fulfil the relevant obligation and are limited to the necessary scope.
9. Retention of Personal Data
Website IP access logs are retained for 360 days. This is not a general retention period applicable to all other personal data.
Information relating to contact, feedback, callback and quotation requests is retained for the time needed to review and resolve the request. It may subsequently be retained for periods necessary to meet applicable legal obligations or establish, exercise or defend a legal claim.
Your newsletter email address is used for sending newsletters while your subscription remains active. Promotional messages stop after you unsubscribe. Consent and refusal records may be retained to the extent and for the period necessary to meet legal obligations, respect your preference and demonstrate compliance where required.
Personal data is deleted, destroyed or anonymised when its processing purpose and legal grounds for retention no longer apply.
10. Your Rights
Under Article 11 of the Law, you may apply to the Company to:
- Learn whether your personal data is being processed.
- Request information if your personal data has been processed.
- Learn the purpose of processing and whether your data is used in accordance with that purpose.
- Learn the third parties to whom your data is transferred within Türkiye or abroad.
- Request correction of incomplete or inaccurate data.
- Request deletion or destruction of your data under the conditions set out in Article 7 of the Law.
- Request that third parties receiving your data be notified of its correction, deletion or destruction.
- Object to a result against you arising from the analysis of your data exclusively through automated systems.
- Request compensation if you suffer damage due to unlawful processing of your personal data.
11. How to Submit a Request
You may submit your requests to the Company using the following methods, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller:
- In writing: By submitting a signed application to İkiçeşmelik Mahallesi, Kitaş Anadolu Sitesi No:12, Kuşadası / Aydın, Türkiye.
- Registered Electronic Mail (KEP): By sending your application through registered electronic mail to bazmer.turizm@hs03.kep.tr.
- Email: By writing to ephesus@palmwings.com.tr from an email address previously provided to the Company and registered in our systems.
Your application must include your first name and surname; your signature for written applications; your Turkish identity number if you are a Turkish citizen, or your nationality and passport number or other identity number, if available, if you are a foreign national; your residential or business address for service of notices; your email address, telephone and fax number for correspondence, if available; and the subject of your request. Relevant information and supporting documents must be attached.
Requests are concluded as soon as possible, depending on their nature, and no later than thirty days. Your rights to use other application methods recognised by applicable legislation remain reserved.