Privacy Notice — Personal Data Processing Disclosure
Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform
Last updated: March 2026
1. Identity of the Data Controller
As Prinkipo House, in the capacity of data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), we process your personal data for the purposes and legal grounds described below. Business Name: Prinkipo House (Mehmet Utku Keser — Sole Proprietorship) Address: Büyükada, Adalar / Istanbul, Turkey Tax Office / No: Erenköy / 5450805009 Tourism License: 34-3110 Email: prinkipohouse@gmail.com Web: prinkipohouse.com
2. Personal Data Processed and Legal Grounds
a) Identity Information (name, surname, Turkish ID number or passport number) Purpose: Legal accommodation registration (Provincial Security Directorate/Gendarmerie), reservation management Legal ground: Explicitly provided by law (Art. 5/2-a — Identity Reporting Law No. 1774); Performance of contract (Art. 5/2-c) b) Contact Information (phone number, email address) Purpose: Guest communication (check-in details, house rules, support) Legal ground: Performance of contract (Art. 5/2-c) c) Accommodation Information (check-in/check-out dates, number of guests, preferences) Purpose: Reservation creation and service delivery Legal ground: Performance of contract (Art. 5/2-c) d) Payment Information (billing details, payment method) Purpose: Invoice issuance, fiscal obligations Legal ground: Legal obligation (Art. 5/2-ç — Tax Procedure Law); Performance of contract (Art. 5/2-c) Note: Your credit card information is not stored directly by us; it is processed by our payment service provider in compliance with PCI-DSS standards. e) Security Camera Footage (entry/exit footage) Purpose: Ensuring the physical security of the premises, detecting potential unlawful situations Legal ground: Legitimate interest of the data controller (Art. 5/2-f) Camera Information: There are 2 security cameras in total — one at the front entrance and one at the rear entrance of our premises. These cameras only capture entry and exit areas and do not record the interiors of apartments, accommodation areas, or private living spaces. No audio recording is made. Recordings are stored on a 21-day rolling cycle and automatically overwritten. f) Transaction Security Information (IP address, cookie data, device and browser information) Purpose: Secure and functional operation of the website Legal ground: Legitimate interest (Art. 5/2-f) g) Booking Platform Data (Airbnb profile information, messaging content) Purpose: Reservation management Legal ground: Performance of contract (Art. 5/2-c)
3. Transfer of Personal Data
a) Public Authorities: Provincial Security Directorate / General Command of Gendarmerie (accommodation registration — legal obligation, Law No. 1774), Revenue Administration (tax obligation) b) Payment Service Provider: For the secure processing of online payment transactions. Your credit card information is not stored by us. c) Hosting and Infrastructure: Vercel Inc. (USA) — Website hosting; Cloudflare Inc. (USA) — Web security and performance d) Booking Platforms: Airbnb Ireland UC (Ireland) — Under the platform's own privacy policy International Transfer: Due to website infrastructure (Vercel, Cloudflare), certain transaction security data (IP address, cookie data) may be transferred to servers in the USA. This transfer is carried out within the framework of appropriate safeguards under KVKK Art. 9. Your identity and contact information is not transferred abroad. Security camera recordings are not transferred abroad and are stored only on the local recording device.
4. Data Retention Periods
Accommodation registration records: 2 years (Identity Reporting Law No. 1774) Invoice and financial records: 10 years (Tax Procedure Law Art. 253, Turkish Commercial Code) Security camera recordings: 21 days (overwritten on a rolling basis) Reservation and contact information: 1 year from the end of the stay Website cookie data: Session duration or up to 12 months depending on cookie type At the end of the specified periods, your personal data will be deleted, destroyed, or anonymized.
5. Detailed Information on Security Camera Use
Number and location of cameras: 2 — front entrance (1), rear entrance (1) Viewing area: Entry and exit points only. Accommodation areas, apartment interiors, balconies, garden seating areas, and other private living spaces are not within the camera's field of view. Audio recording: Not applicable Recording duration: 24/7 continuous recording, automatic overwrite on a 21-day cycle Access to recordings: Only the business owner (Mehmet Utku Keser) and authorized public authorities in case of legal obligation Purpose of recordings: Ensuring physical security and detecting potential unlawful situations. Recordings are not used for any other purpose. Physical notice: KVKK-compliant information signs are posted at camera-equipped entry points.
6. Data Security Measures
• SSL/TLS encryption (all traffic on prinkipohouse.com is served over HTTPS) • Payment data processed by a PCI-DSS compliant third-party provider • Cloudflare WAF and DDoS protection • Restriction of access privileges • Physical access control and password-protected access to security camera recording device • Camera recordings stored only on local device (no cloud transfer)
7. Your Rights (KVKK Art. 11)
a) To learn whether your personal data is being processed b) To request information about processing if data has been processed c) To learn the purpose of processing and whether data is used in accordance with its purpose d) To know the third parties to whom data has been transferred domestically or abroad e) To request correction if data has been processed incompletely or inaccurately f) To request deletion or destruction under KVKK Art. 7 g) To request notification of correction or deletion to third parties to whom data has been transferred h) To object to any outcome arising from the analysis of processed data exclusively through automated systems i) To claim compensation for damages arising from unlawful processing of data
8. Application Method
Email: prinkipohouse@gmail.com (subject: "KVKK Application") Mail: Registered letter to Büyükada, Adalar / Istanbul, Turkey Your application will be concluded free of charge within 30 days at the latest. If the process requires an additional cost, the tariff determined by the Personal Data Protection Board shall apply.
9. Changes
This privacy notice may be updated in line with legal regulations or changes in our services. The current version is always available at prinkipohouse.com/en/privacy.