Legal

Data Protection Notice

Why and how we process your personal data, who we share it with, how long we keep it, and your rights.

This notice is provided under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures for Fulfilling the Obligation to Inform. It explains how your personal data is processed when you use our website, make a reservation or write to us.

In short: we ask only for what we need to take your reservation, arrange your stay, answer you and meet our legal obligations. We do not sell your data or share it with anyone for marketing. Personal data whose retention period has expired is erased automatically every night.

Last updated: 11 October 2026

Data Controller

Business: Pera Boutique Hotel
Address: Aralık Köyü No: 19, 08490 Aralık / Borçka / Artvin, Türkiye
Email: [email protected]
Telephone: +90 532 721 13 60

What Data We Collect, and How

We receive data from you when you fill in the forms below, and automatically from your browser while you use the site:

Online reservation: first and last name, email, telephone and country; check-in and check-out dates, number of guests and the room you choose; your optional special request; if you ask for an airport transfer, the arrival date, time and flight number; records of the code sent to verify your email address; the moment you accepted the agreements and the version of the text you accepted.
Online payment: your card details never reach us (see below). From the payment institution we record only the last four digits of the card, the card type, the transaction number, the amount and the number of instalments.
Contact form: full name, email, optional telephone, subject and your message.
Restaurant table booking: full name, telephone, optional email, date and time, number of guests, restaurant preference, your optional note and pre-order.
Site security: your IP address, browser details, the page requested and the time (the server's security log); an irreversible pseudonym of your IP address to stop forms being abused by automated software; technical signals from your browser during the bot check.
Visit measurement: to understand how the site is used, visits are counted anonymously — country, device type, where you came from, the steps you took, and the dates and number of guests you searched for. Instead of your identity, an irreversible digest that changes every day is used. If you consent in the cookie settings, a random identifier is also stored in your browser to recognise repeat visits (details: Cookie Policy).
Your cookie choice: the decision you made, its date and the version of the text.

Data We Do Not Ask For

The website does not ask for an ID number, date of birth, home address or card details.

Your card details (card number, expiry date, security code) never reach our servers at any stage: payment is made on the secure page of iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), a licensed payment institution.

We do not ask for health information (such as allergies); please do not write it in the note fields — tell our staff when you arrive. If it is written anyway, it is used only to meet your request and is erased at the end of the record's retention period.

Identity details taken at reception during your stay are outside the scope of the website; they are collected under Turkish Identity Notification Law No. 1774 and reported to the relevant law-enforcement system.

Why We Process Your Data

To take your reservation, verify your email address, take your payment, and conclude and perform the accommodation contract
To send reservation confirmations and cancellation and refund notices, and to arrange your airport transfer if you asked for one
To answer your questions and your restaurant table booking
To meet our record-keeping obligations under invoicing, tax and distance-sales legislation
To exercise and protect our rights should a dispute arise
To protect the site against attacks, fake reservations and abuse of the forms
To measure anonymously how the site is used and improve our service

Legal Grounds

Your personal data is processed on the following grounds under Article 5 of the KVKK. The tick box on our forms records that you have read this notice; it is not consent.

Conclusion or performance of a contract (Art. 5(2)(c)): reservation, payment, transfer, table booking and the reply to your question.
Legal obligation (Art. 5(2)(ç)): invoicing and tax records, distance-contract records, identity notification.
Establishing, exercising or protecting a right (Art. 5(2)(e)): evidence in case of a dispute.
Legitimate interest (Art. 5(2)(f)): site security, security logs and anonymous visit measurement.
Explicit consent (Art. 5(1)): only the repeat-visit identifier stored if you consent in the cookie settings. You can withdraw consent at any time via the “Cookie Preferences” link at the bottom of the page.

Who We Share Your Data With

Your data is not sold, rented or shared for marketing. It is transferred only as far as needed to provide the service, to the following recipients:

iyzico (Türkiye) — for online payment and fraud checks: first and last name, email, telephone, country, IP address and payment amount.
Cloudflare (USA; data centres worldwide) — all site traffic passes through this network for security and speed, and the bot check on the forms (Turnstile) is Cloudflare's: IP address, browser details and the request you send.
Resend (US-based email service; sending server in Japan) — to send verification-code, reservation confirmation, cancellation and refund emails: your name, email address and the reservation details in the email.
Google Workspace (data centres in the USA and Europe) — the hotel's mailbox is on this service: the emails you write to us and our replies.
Authorised public bodies, courts and law enforcement — where the law requires it and on request.

Transfers Abroad

Transfers to Cloudflare, Resend and Google are transfers abroad (KVKK Art. 9). These services are needed for the site to run securely and for emails to reach you; the data transferred is limited to what is described above.

The map on the contact page is loaded from Google only when you press “Show the Map”; at that moment your browser connects to Google directly.

How Long We Keep It

Personal data whose retention period has expired is erased (anonymised) automatically and irreversibly every night. Information that does not identify anyone — reservation number, dates, room, number of guests and amount — is kept for statistics and as a financial record.

Accommodation reservation and online payment record: 5 years from the check-out date
Contact form message: 2 years
Restaurant table booking: 1 year from the booking date
Unfinished reservation (left without payment): Deleted within a few hours
Server security log (IP address): 30 days
Visit measurement: 1 year; after that only daily totals remain
Cookie choice record (proof of consent): 5 years

Keeping Your Data Secure

The database is kept on our server in Türkiye. The connection to the site is encrypted (HTTPS). Only authorised staff can access the management panel, with additional identity verification and two-factor authentication; every change made in the panel is logged with who made it. Access to personal data is limited to staff whose work requires it.

Security backups of the database are taken only to recover from data loss, and access to them is limited to the authorised system administrator. An older copy of an erased record may exist in these backups; if a backup is ever restored, expired data is erased again.

Your Rights

Under Article 11 of the KVKK you have the right to:

Learn whether your personal data is being processed
Request information if it has been processed
Learn the purpose of processing and whether it is used accordingly
Know the third parties to whom data is transferred, in Türkiye or abroad
Request correction if the data is incomplete or inaccurate
Request erasure or destruction where the conditions are met
Request that corrections and erasures be notified to third parties the data was transferred to
Object to a result reached against you through automated analysis of the data
Claim compensation if you suffer damage due to unlawful processing

How to Apply

To exercise your rights you can send a written application to our address above (Communiqué on the Procedures and Principles of Application to the Data Controller).

You can also write to [email protected] from the email address registered with us.

Your application will be concluded within thirty days at the latest, as a rule free of charge. Please include the information we need to verify your identity; without it we cannot process your request.

If your application is refused, if you find the answer insufficient, or if no answer is given in time, you may complain to the Turkish Personal Data Protection Board (KVKK Art. 14).