Privacy Notice (KVKK & GDPR)

Last updated: 16 October 2026

This notice is provided under Article 10 of the Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how we process the personal data of guests, people who send us booking requests and visitors to our website in connection with the short-term holiday rental service offered as hesperasuits.com.

Because we welcome many guests from the European Union and the European Economic Area, we also apply the principles of the EU General Data Protection Regulation (“GDPR”) to the extent that it applies to our processing, and we set out your GDPR rights in section 9.

1. Data controller

The data controller is İrfan (“we”, “us”):

• Data controller: İrfan
• Business: Hespera Suits · Studio 374
• Address: Ormancılar Sitesi, Kadıkalesi, Karakaya Mah., 48960 Bodrum / Muğla, Türkiye
• Email: yyasinyilmaz0@gmail.com
• Phone:
• Tourism rental registration no.: 48-13627

2. Personal data we process

• Identity data: name, surname, date of birth, nationality; Turkish ID number or passport / foreign ID number and the details on your identity document required for the statutory guest registration.
• Contact data: phone number, email address, postal address.
• Booking data: dates of stay, home booked, number of guests, arrival time, information about pets, special requests, booking and stay history.
• Financial data: amounts and dates of payment, bank details and payment receipts; bank details needed for any refund.
• Communication records: the content of messages you send us through website forms, WhatsApp, email or phone, and reviews you submit for publication on the website.
• Technical and usage data: IP address, browser and device information, date and time of visits, server logs and cookie data.

We do not ask for special categories of personal data (such as health data). If you choose to share such information with us to help plan your stay, we process it only as far as necessary and only under the conditions set out in Article 6 KVKK (and, where applicable, Article 9 GDPR).

3. Why we process your data

• to receive, assess and confirm booking requests and to conclude and perform the accommodation contract;
• to handle check-in and check-out and to stay in touch with you during your stay;
• to register guests’ identity details with the competent law-enforcement authorities as required by Turkish Law No. 1774 on Identity Notification and related legislation;
• to process payments, deposits, security deposits and refunds and to meet our accounting and tax obligations;
• to answer your questions, requests and complaints;
• to review guest reviews and publish approved reviews on the website;
• to keep the website secure, running and technically sound;
• to establish, exercise or defend legal claims and to respond to lawful requests from authorities;
• with your consent, to compile usage statistics using optional analytics cookies.

4. Legal bases

We rely on the following legal bases under Article 5 KVKK (with the corresponding GDPR basis in brackets):

• processing is expressly provided for by law, in particular guest identity registration and tax rules (Art. 5(2)(a) KVKK; Art. 6(1)(c) GDPR);
• processing is necessary for the conclusion or performance of a contract with you, such as your booking and stay (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR);
• processing is necessary to comply with a legal obligation (Art. 5(2)(ç) KVKK; Art. 6(1)(c) GDPR);
• processing is necessary to establish, exercise or protect a right (Art. 5(2)(e) KVKK; Art. 6(1)(f) GDPR);
• processing is necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed—for example website security, keeping records of correspondence and maintaining service quality (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR);
• your explicit consent, for processing not covered by the bases above, such as optional analytics cookies or publishing your review under your name (Art. 5(1) KVKK; Art. 6(1)(a) GDPR).

Special categories of personal data are processed only where one of the conditions in Article 6 KVKK is met. Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

5. Who we share your data with

We share personal data only for the purposes above and in line with Articles 8 and 9 KVKK:

• Public authorities: the units of the General Directorate of Security and the Gendarmerie for guest identity registration, the tax authorities, the Ministry of Culture and Tourism, courts and other authorities—only where we are legally required to or upon a lawful request.
• Service providers: companies providing website hosting, maintenance and email services, our accountant, and banks for payments and refunds. They access data only as far as needed to provide their service.
• Booking platforms: for bookings made through Airbnb, the information needed to manage the booking is exchanged with Airbnb, which acts under its own privacy policy for that data.

Some of our service providers may store data on servers outside Turkey. We transfer personal data abroad only where one of the conditions in Article 9 KVKK is met (an adequacy decision, appropriate safeguards, or one of the incidental transfer cases listed in the law) and, where the GDPR applies, only with an appropriate safeguard under Chapter V GDPR.

6. How we collect your data

We collect personal data partly by automated and partly by non-automated means: through the booking, contact and review forms on our website; through WhatsApp, email and phone; through booking platforms such as Airbnb; from the identity documents shown at check-in; and through cookies and server logs. Collection is based on the legal grounds described above.

7. How long we keep it

We keep personal data for as long as needed for the purpose for which it was collected, for the retention periods required by law (in particular tax and identity-registration rules) and for the statutory limitation periods for possible claims. After that, data is deleted, destroyed or anonymised in accordance with the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data. Booking requests that do not lead to a stay, and general correspondence, are deleted after a reasonable period.

8. Your rights under Article 11 KVKK

By applying to us, you have the right to:

• learn whether your personal data is being processed;
• request information about the processing if it is;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties in Turkey or abroad to whom your data is transferred;
• request the correction of incomplete or inaccurate data;
• request the deletion or destruction of your data under the conditions in Article 7 KVKK;
• request that third parties to whom your data was transferred be notified of any correction, deletion or destruction;
• object to a result against you arising from analysis of your data exclusively by automated systems;
• claim compensation for damage you suffer as a result of unlawful processing.

9. Your rights under the GDPR

Where the GDPR applies to our processing of your data, you also have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing based on our legitimate interests, and to withdraw your consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA member state where you live or work.

10. How to apply

Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can submit your request in writing in one of the following ways:

• in person or by registered post with return receipt or through a notary, with a signed letter, to Ormancılar Sitesi, Kadıkalesi, Karakaya Mah., 48960 Bodrum / Muğla, Türkiye;
• by registered electronic mail (KEP), secure electronic signature or mobile signature, or from an email address you have previously given us and that is registered in our records, to yyasinyilmaz0@gmail.com.

Your application must include your name and surname, your signature if it is in writing, your Turkish ID number or—for foreign nationals—your nationality and passport number or ID number if any, your residential or business address for notifications, your email address, phone number and the subject of your request, together with any supporting documents. Applications under the KVKK should be made in Turkish; for GDPR requests you may also write to us in English.

We will respond as soon as possible and within thirty days at the latest, free of charge. If responding involves an additional cost, we may charge the fee set by the Turkish Personal Data Protection Board. If your request is refused, you find our answer insufficient, or we do not respond in time, you may complain to the Personal Data Protection Board within thirty days of learning of our answer, and in any event within sixty days of your application.

For details on the cookies used on our website, see our Privacy & Cookie Policy.