سیاست حفظ حریم خصوصی

Last updated: 8 October 2026

This is an English translation of the Turkish text. If the two differ, the Turkish text prevails, without prejudice to any mandatory consumer rights you have.

This privacy notice explains how we process the personal data of people who visit foursevenhotel.com, make a booking, fill in the contact form or guest survey, or stay at our hotel, in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Data controller

Company: Kapital Elektronik İç ve Dış Ticaret A.Ş.
Trading as: Four Seven Hotel
Address: Aksaray Mah. İnkılap Cad. No: 1/1, 34096 Fatih / Istanbul, Türkiye
Tax office / no: Beyazıt / 4980870007
Phone: +90 212 588 50 07 · E-mail: [email protected]

2. Data we process

Identity: your name; during your stay, the details on your identity document (Turkish ID number or passport number, date of birth, nationality, etc.).
Contact: e-mail address, phone number, country.
Booking: booking number, arrival and departure dates, room type, number of guests, price, payment method and status, special requests and our correspondence with you.
Payment: If you pay by card, only a masked card number (first 6 and last 4 digits), the bank name and the transaction result. Your full card number, expiry date and security code (CVV) are never stored on our website; they are processed directly on your bank’s 3D Secure page.
Security: IP address, browser and device information, date and time of actions, website security logs.
Requests and complaints: contact form messages and guest survey answers.

You do not need to send us sensitive data such as health information (e.g. allergies or disabilities). If you include such information in your special requests, it is used only to meet your request and in accordance with Article 6 of the KVKK.

3. How we collect data

Directly from you through the booking, contact and survey forms on our website, by e-mail, by phone and at reception; and automatically through website security logs and strictly necessary cookies.

4. Purposes and legal grounds

Taking, confirming and managing your booking and providing your stay; taking payment and making refunds; booking-related e-mails (request received, confirmation, cancellation): performance of a contract (KVKK art. 5/2-c).
Identity notification of staying guests (Identity Notification Law No. 1774), invoicing, and retention duties under tax and commercial law: required by law and compliance with our legal obligations (art. 5/2-a and ç).
Answering your requests, questions and complaints; keeping the website and our systems secure; preventing fake bookings and abuse: our legitimate interests (art. 5/2-f).
Establishing, exercising or defending legal claims: art. 5/2-e.
Visitor statistics (if analytics cookies are used): your explicit consent (art. 5/1). We currently do not use analytics cookies.

We do not send you marketing or advertising messages without your permission.

5. Sharing your data

Within Türkiye, only as far as necessary:

with public authorities where required by law or on official request (the police and gendarmerie for identity notification, tax offices, courts);
with banks and payment institutions to take payments and make refunds;
with our service providers: website hosting and e-mail (servers located in Türkiye), our hotel management software provider, our accountant and legal advisers. They may access your data only as needed to provide their services and under a duty of confidentiality.

Outside Türkiye:

Our website is served through the infrastructure of Cloudflare, Inc. (USA) for protection against cyber attacks and fast access. When you visit the website, your IP address and technical connection data may be processed on servers abroad as part of this service. This transfer is made under Article 9 of the KVKK.
If we use analytics cookies in the future and you consent, visitor statistics will be processed by Google LLC (USA).

We do not sell your personal data or share it with third parties for advertising.

6. Retention

We keep your data for the periods required by law or, where none applies, for as long as the purpose requires:

Booking, payment and invoice records: for the retention period under tax and commercial law (10 years), after which they are anonymised.
Identity notification records: for the period required by the relevant legislation.
Contact form messages and guest survey answers: 2 years.
IP addresses and browser details: 180 days.

When the period ends, the data is deleted, destroyed or anonymised.

7. Security

Your connection to our website is encrypted with SSL/TLS. Card details are not stored on our website. Only authorised staff can access the admin panel, each with their own account, and actions are logged. We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse.

8. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether the data is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for incomplete or inaccurate data to be corrected and for data to be deleted or destroyed under the conditions of Article 7; to ask for these actions to be notified to the third parties to whom the data was transferred; to object to a result against you arising exclusively from automated processing; and to claim compensation for damage caused by unlawful processing.

9. How to apply

Send your request in writing to our address, or by e-mail to [email protected] from the e-mail address you previously gave us, with information that allows us to verify your identity. We will respond free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your request is refused, you find the answer insufficient or we do not reply in time, you may complain to the Personal Data Protection Board (KVKK Kurulu).

10. Guests from the EU/EEA and the UK

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, the legal grounds above correspond to Article 6(1)(b) (contract), (c) (legal obligation), (f) (legitimate interests) and (a) (consent) of the GDPR. In addition to the rights above, you have the right to restrict processing, to data portability, to withdraw your consent at any time without affecting earlier processing, and to lodge a complaint with the data protection authority in your country of residence.

11. Changes

We may update this notice when the law or our services change. The current version, with its last-updated date, is always published on this page.