Personal Data Protection Law

KASSANDRA HERITAGE

Personal Data Processing Notice

Under Turkish Personal Data Protection Law No. 6698 (KVKK)

Last Updated: 10 November 2026

1. Data Controller

At Kassandra Heritage, we value the privacy of our guests, website visitors and individuals interested in our services.

This notice explains how your personal data is collected, processed, stored and protected in accordance with Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Your personal data is processed by the following data controller:

• Property Name: Kassandra Heritage
• Legal Data Controller: My Orion Turizm İnşaat Ticaret Ltd. Şti.
• Address: Kayaköy Mahallesi, Belen Caddesi No: 80, 48300 Fethiye, Muğla, Türkiye
• Email: [email protected]
• Phone: +90 532 391 87 84
• Website: https://kassandraheritage.com

2. Personal Data We Process

Depending on how you interact with our website and services, we may process the following categories of personal data:

• Identification and contact information: Full name, email address and telephone number.
• Reservation information: Arrival and departure dates, selected villa, number of guests, booking preferences and special requests.
• Transaction and financial information: Reservation and payment transaction records, and billing information required for the provision of services.
• Communications: Messages, enquiries and correspondence submitted through our contact form, email or other communication channels.
• Technical information: IP address, access times, browser and device information, security logs and cookie-related information.

We process only the personal data necessary for the relevant purposes.

3. Purposes and Legal Bases of Processing

Your personal data is processed for the following purposes and on the legal grounds specified in Article 5 of the KVKK:

Responding to enquiries: To respond to questions, requests and messages submitted through our website or other communication channels, where necessary for establishing a contract under Article 5(2)(c) or for legitimate interests under Article 5(2)(f), depending on the circumstances.

Managing reservations and accommodation services: To process reservations, organise stays, communicate with guests and provide requested services, based on the establishment or performance of a contract under Article 5(2)(c).

Complying with legal obligations: To manage invoicing, accounting, statutory records and legally valid requests from competent authorities, based on compliance with legal obligations under Article 5(2)(ç).

Maintaining security and protecting legal rights: To ensure website security, prevent misuse, manage disputes and establish, exercise or protect legal rights, based on Articles 5(2)(e) and 5(2)(f).

Marketing communications: To send promotional offers, special packages and marketing communications where the required separate explicit consent and commercial electronic communication permission have been obtained.

4. Methods of Data Collection

We may collect your personal data through:

• Contact forms available on our website,
• Online booking and reservation systems,
• Email, telephone and other communication channels,
• Website servers, technical logs and cookie technologies.

Personal data may be collected through automated or partially automated electronic processes or, where part of a data filing system, non-automated methods.

5. Sharing Personal Data

Where necessary for providing our services and subject to applicable legal requirements, your personal data may be shared with:

• Reservation and hospitality management technology providers,
• Payment service providers and authorised financial institutions,
• Website hosting, IT infrastructure and technical support providers,
• Accounting, financial and legal advisers,
• Competent public authorities where legally required.

Such disclosures are limited to relevant business purposes and are carried out in accordance with Article 8 of the KVKK.

6. International Data Transfers

The actual data flows associated with our reservation, analytics, advertising, email and other technical services must be reviewed to determine whether personal data is transferred outside Türkiye.

Where international transfers take place, this section will specify the relevant data categories, transfer purposes, recipient categories and applicable transfer mechanism under Article 9 of the KVKK.

7. Data Retention and Security

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal retention requirements.

When the applicable retention period expires or the relevant processing grounds cease to apply, personal data is deleted, destroyed or anonymised in accordance with applicable legislation.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and unlawful processing.

8. Cookies

Our website may use strictly necessary cookies to maintain essential functionality and security.

Non-essential analytics, personalisation and advertising cookies are activated only where the required consent has been obtained.

Further information about cookie categories, providers, purposes and retention periods is provided in our separate Cookie Policy.

9. Your Rights

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed,
• Request information regarding its processing,
• Learn the purposes of processing and the recipients of your data,
• Request correction of incomplete or inaccurate personal data,
• Request deletion or destruction of personal data where legally applicable,
• Exercise other rights of objection and compensation provided under the KVKK.

10. Contact and Data Protection Requests

To exercise your rights, please submit your request using a method permitted under the applicable Turkish data controller application procedures.

Kassandra Heritage

Address: Kayaköy Mahallesi, Belen Caddesi No: 80, 48300 Fethiye, Muğla, Türkiye

Email: [email protected]

Phone: +90 532 391 87 84

Requests will be reviewed and answered as soon as reasonably possible and within a maximum of 30 days, in accordance with Article 13 of the KVKK.

11. Updates to This Notice

We may update this notice to reflect changes in our data processing activities, operational practices or applicable legal requirements.

The latest version will be available at https://kassandraheritage.com.

Kassandra Heritage — Kayaköy, Fethiye, Türkiye