CUSTOMER PRIVACY NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

1. Purpose

As Villacınız Seyahat Turizm Emlak İnşaat ve Ticaret Limited Şirketi (“Villaciniz”), given the sensitive nature of our business, data received from our customers and prospective customers have always been kept confidential and never shared with third parties. The protection of personal data is a fundamental policy of our company and was a working principle of ours even before any legal regulation existed. As Villaciniz, we undertake to comply with all obligations introduced by the Turkish Personal Data Protection Law No. 6698 (“KVKK”). Our principles concerning the protection of personal data also extend to our affiliates.

2. Scope and Amendments

This Privacy Notice has been prepared in accordance with the KVKK. Data obtained with your consent, or on the basis of the other lawful grounds listed in the Law, are used to improve the quality of the services we offer and to enhance our quality policy. Some data are de-identified and anonymised; such data are used for statistical purposes and fall outside the scope of the KVKK. This Notice covers the protection of the data of our customers, prospective customers and the customers of companies working with us as solution partners. Villaciniz reserves the right to amend this Notice, provided the amendment complies with the Law and better protects personal data.

3. Basic Principles of Personal Data Processing

a) Lawfulness and fairness: Villaciniz enquires into the source of the data it collects or receives from other companies and attaches importance to their being obtained lawfully and fairly; it gives the necessary warnings and notifications regarding data protection to third parties selling its services (including agencies and other intermediaries).

b) Accuracy and being up to date where necessary: Villaciniz attaches importance to all data in its organisation being accurate, containing no false information, and being updated when changes are notified to it.

c) Processing for specified, explicit and legitimate purposes: Villaciniz processes data only to the extent limited to the purposes for which it obtained the person's consent in the course of the service; it does not process, use or allow the use of data outside business purposes.

ç) Being relevant, limited and proportionate to the purposes of processing: Villaciniz uses data only to the extent limited to the purposes for which they are processed and required by the service.

d) Retention for the period laid down in the relevant legislation or required for the purpose: Villaciniz retains contract-related data for the limitation periods for disputes and as required by commercial and tax law; when those purposes cease to exist, it erases or anonymises the data.

Whether data have been collected with consent or on another lawful basis, the above principles apply in all cases.

Data Minimisation Principle

Data reaching Villaciniz are entered into the system only to the extent necessary; which data are collected is determined by the purpose, and unnecessary data are not collected. Surplus information is not recorded, and is deleted or anonymised; it may be used only for statistical purposes. Among special categories of data, health data are collected only with explicit consent, solely to serve customers better and to protect their health, and are kept in the system with due care.

Erasure of Personal Data

Upon expiry of the statutory retention periods, completion of judicial processes or the disappearance of other requirements, data are erased, destroyed or anonymised, either automatically or upon the request of the data subject.

Accuracy and Currency of Data

Data held by Villaciniz are, as a rule, processed as declared by the data subjects. Villaciniz is not obliged to verify the accuracy of declared data; declared data are accepted as correct. Villaciniz updates the personal data it processes on the basis of official documents reaching it or upon the request of the data subject, and takes the necessary measures to that end.

Confidentiality and Data Security

Personal data are confidential and Villaciniz respects that confidentiality. Personal data may be accessed within the company only by authorised persons. All necessary technical and administrative measures are taken to protect the personal data collected, to prevent them from falling into unauthorised hands and to prevent harm to our customers. In this context, software is kept compliant with standards, third parties are selected with care, and the data protection policy is observed within the company.

4. Purposes of Data Processing

Villaciniz processes personal data for the purposes set out in this Privacy Notice. Data are collected and processed for the establishment and performance of the contract and to provide customers with a better service.

5. Categories of Personal Data Processed

As Villaciniz, we process your personal data in the capacity of data controller under the KVKK and other applicable legislation. The categories of personal data processed are as follows:

Identity data: name and surname, names and surnames of accompanying guests, nationality, place and date of birth; Turkish ID, driving licence and passport numbers (including date and place of issue).
Contact data: address, telephone number, e-mail address.
Financial data: invoicing details, bank account details, payment card and other payment information, information on services purchased.
Customer comments, feedback and complaints: preferences regarding accommodation, marketing and communication; assessments, opinions and complaints about our services.
Other: reservation details, stay history; participation in competitions, prize draws or marketing programmes; details of vehicles used to reach the villa.

6. Collection and Processing of Data for the Contractual Relationship

Where a contractual relationship has been established with our customers, the personal data collected may be used without separate consent, but only for the purpose of the contract; they are used to the extent required for the better performance of the contract and the service, and are updated by contacting customers where necessary. Data left to us by prospective customers are processed in order to provide them with an easier and better service later; if no contractual relationship materialises, such data are deleted upon their request.

Business and Solution Partner Data

Villaciniz adopts lawfulness as its principle when sharing data with business and solution partners. Data are shared with business and solution partners only to the extent required by the service and subject to a confidentiality undertaking, and such parties are required to take data security measures.

Processing to Manage, Analyse and Improve Services

Conducting surveys to measure the services provided;
Communicating with guests for marketing purposes in line with communication permissions given under the applicable legislation;
Conducting internal correspondence concerning guests who behave contrary to general rules of conduct during villa rentals;
Recording guests' comments on social media, blogs and review portals in order to analyse feedback on the service provided;
Carrying out sales and marketing activities by processing service data in order to offer a personalised holiday experience;
Making an informational telephone call prior to villa check-in;
Segmenting reservation history, travel preferences and service data in order to manage marketing activities correctly;
Managing claims and complaints about our services on review portals, complaint pages and social media;
Keeping guests' personal data up to date.

E-Invoice and E-Archive Invoice

In this context, the customer is registered in the system and invoices are sent via the e-mail address they provide. It is the customer's responsibility to ensure that the e-mail address provided, or subsequently updated, is correct and is the preferred address for this communication. If reservations are made for other family members or persons using this e-mail address, the related e-invoice is sent to the address of the e-mail owner. An e-invoice is an invoice prepared and transmitted electronically (Tax Procedure Law General Communiqué No. 397); an e-archive invoice is an invoice issued electronically in accordance with General Communiqué No. 433, the second copy of which is retained electronically.

Data Processing for Advertising Purposes

In accordance with the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, advertising messages (e-mail, SMS, WhatsApp) may be sent, and telephone calls made, only to persons whose prior consent has been obtained. The explicit existence of the recipient's consent is essential. The consent to be obtained covers all commercial electronic messages sent to promote and market our company's goods and services, to promote its business or to increase its recognition through greetings and similar content. Consent may be obtained in writing or through any means of electronic communication; it must contain the recipient's affirmative declaration of intent, name and surname, and electronic contact address.

Processing Due to Legal Obligation or Express Provision of Law

Personal data may be processed without separate consent where processing is expressly provided for in the relevant legislation or is necessary for the performance of a legal obligation. The type and scope of the processing are limited to what is necessary for the legally permitted activity. The company may process personal data in line with its services and legitimate purposes; data may never be used for unlawful purposes.

Processing of Special Categories of Data

Under the KVKK, data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data. Villaciniz processes special categories of personal data only with the data subject's explicit consent or in the cases permitted by the Law, limited to the purposes for which they were collected, and takes the adequate measures determined by the Personal Data Protection Board.

Data Processed by Automated Systems

With regard to data processed by automated systems, Villaciniz acts in accordance with the Law. Information obtained from such data may not be used against the person without their explicit consent.

User Information, Internet and Cookies

Where personal data are collected, processed and used on Villaciniz websites, systems or applications, data subjects are informed by a privacy notice and, where necessary, about cookies. Detailed information on the cookies used on our website, their types, purposes, retention periods and how to manage your cookie preferences is provided in the Cookie Policy published at www.villaciniz.co.uk.

Security Camera Data

Images obtained by Villaciniz, as data controller under Law No. 6698, during your visits to our office and to villas equipped with security cameras are processed to ensure both our company's and your security, on the legal basis of legitimate interest under Article 5/2(f) of the KVKK. These data are not used for any other purpose and, as a rule, are not shared with third parties; they may be shared only to meet the requests of legally authorised public institutions under Article 5/2(ç). The data are destroyed once the purpose of collection has ceased.

Transfer of Personal Data Within Turkey and Abroad

Personal data may be transferred, to the extent necessary for the performance of the service: to our business partners, limited to the fulfilment of the purposes of the partnership; to our suppliers, limited to the provision of the services our company procures externally for its commercial activities; and to our solution partners, limited to activities requiring the participation of our affiliates. Villaciniz is authorised to transfer personal data within Turkey and abroad in accordance with the conditions set out in the KVKK and determined by the Personal Data Protection Board. Data may also be shared with the competent institutions for the performance of a judicial duty or the exercise of statutory powers by authorised public bodies.

Rights of the Data Subject

Under Article 11 of the KVKK, everyone has the right, by applying to the data controller, with respect to themselves:

a) To learn whether their personal data are processed;

b) If processed, to request information regarding the processing;

c) To learn the purpose of the processing and whether the data are used in accordance with that purpose;

ç) To know the third parties to whom the data have been transferred, within Turkey or abroad;

d) To request rectification of incomplete or inaccurate data;

e) To request erasure or destruction of the data under the conditions set out in Article 7 of the KVKK;

f) To request that the operations carried out under (d) and (e) be notified to the third parties to whom the data have been transferred;

g) To object to a result arising against the person through the analysis of the processed data exclusively by automated systems;

ğ) To request compensation for damage arising from unlawful processing of the data.

Data subjects have no rights in respect of anonymised data.

Application Procedure

You may submit requests concerning the rights listed above by completing the Personal Data Protection Application Form published on our website and sending it: (1) in writing to Kalkan Mahallesi Cumhuriyet Cad. No: 48/1, 07960 Kaş/Antalya, Türkiye; (2) to our registered electronic mail (KEP) address villacinizseyehatturizmemlak@hs01.kep.tr; (3) by e-mail bearing a secure electronic or mobile signature; or (4) from the e-mail address you have previously notified to us and which is registered in our system, to info@villaciniz.com.tr. Your application must contain the information needed to verify your identity (name and surname, Turkish ID/passport number, contact details); our company may request additional verification information where necessary. Applications are answered free of charge as soon as possible according to their content and within 30 (thirty) days of reaching our company at the latest. Only the part of an application concerning the applicant is answered; applications concerning your spouse, relatives or friends (without a power of attorney) are not accepted.

Confidentiality Principle and Processing Security

Data held at Villaciniz, whether of employees or other persons, are confidential. No one may use, copy, reproduce or transfer such data to others for any purpose without a contractual or legal basis. All necessary technical and administrative measures are taken to protect the personal data collected; security measures are continuously renewed and improved. Villaciniz has the necessary internal and external audits carried out on the protection of personal data.

Notification of Breaches

When any breach concerning personal data is notified to Villaciniz, it takes immediate action to remedy the breach, minimises and compensates the data subject's damage. Where personal data are obtained by unauthorised persons, the situation is immediately notified to the Personal Data Protection Board. You may use the channels in the Application Procedure section for breach notifications.

Amendments

Villaciniz reserves the right to amend the statements in this Notice. Where a significant amendment is made, a link providing access to the current version is added to the website home page. Every amendment takes effect upon publication of the amended version on the site.

Last updated: 07.08.2026 (Version 2)