Our Properties
(0212) 514 93 93
GF Hotels

Select check-in date

August 2026

Mo
Tu
We
Th
Fr
Sa
Su
27
28
29
30
31
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
1
2
3
4
5
6
1 Night

Reservation

Select Room & Book Now

08/08/2026

09/08/2026

2
0
Best RateFree CancellationSecure Payment
Data Protection

Personal Data Protection Policy

Last updated: August 2025

1. Purpose & Scope

Great Fortune Hotels & Resorts is committed to protecting the personal data of its guests, website visitors, employees, and business partners in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

This policy explains how we collect, process, store, and protect personal data, as well as the rights of data subjects.

2. Data Controller

Great Fortune Hotels & Resorts, located at Bab-i Ali Cad. Basmuhasip Sok. No 11-13, Sultanahmet, Istanbul, Turkey, acts as the data controller for the personal data processed through our services and website.

3. Principles of Data Processing

We adhere to the following principles when processing personal data:

  • Lawfulness, fairness, and transparency
  • Purpose limitation — data is collected for specified, explicit, and legitimate purposes
  • Data minimization — only data necessary for the stated purpose is collected
  • Accuracy — personal data is kept accurate and up to date
  • Storage limitation — data is kept only as long as necessary
  • Integrity and confidentiality — appropriate security measures are applied

4. Categories of Personal Data

We may process the following categories of personal data:

  • Identity information (name, surname, date of birth, nationality)
  • Contact information (email, phone, address)
  • Financial information (payment details, billing address)
  • Accommodation information (check-in/out dates, room preferences, special requests)
  • Identity documents (passport, ID card — as required by Turkish law for hotel registration)
  • Digital data (IP address, cookies, browsing behavior)
  • Visual data (CCTV footage within hotel premises for security purposes)

5. Data Processing Purposes

  • Fulfilling hotel reservation and accommodation services
  • Legal compliance, including hotel registration and tax obligations
  • Ensuring guest safety and property security
  • Processing payments and financial transactions
  • Sending marketing communications (with explicit consent)
  • Analyzing website usage to improve services
  • Responding to inquiries and complaints

6. Data Transfers

Your personal data may be transferred to third parties only when necessary and with appropriate safeguards:

  • Government authorities as required by Turkish law
  • Payment processors and banking institutions
  • Booking and channel management platforms
  • IT infrastructure and cloud service providers

For international data transfers, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions, in compliance with GDPR and KVKK requirements.

7. Data Security Measures

We implement comprehensive technical and organizational measures, including:

  • SSL/TLS encryption for all data transmissions
  • Access controls and authentication mechanisms
  • Regular security audits and vulnerability assessments
  • Employee training on data protection and confidentiality
  • Physical security measures at all hotel properties

8. Your Rights

Under KVKK and GDPR, you have the following rights regarding your personal data:

  • Right to be informed about whether your data is being processed
  • Right to request information about data processing activities
  • Right to know the purpose of processing and whether data is used accordingly
  • Right to know third parties to whom data is transferred
  • Right to request correction of incomplete or inaccurate data
  • Right to request deletion or destruction of personal data
  • Right to object to processing results that are against your interests
  • Right to compensation for damages arising from unlawful processing

9. Data Retention

Personal data is retained for the duration necessary to fulfill the purposes for which it was collected, or as required by applicable laws. When data is no longer needed, it is securely deleted or anonymized.

10. Contact & Requests

To exercise your rights or for any questions regarding personal data protection, please contact us:

We will respond to your request within 30 days in accordance with applicable legislation.