Personal Data Protection Notice

Last Updated: 05 February 2026

Data Protection Notice under the Turkish Personal Data Protection Law (Law No. 6698)

Last Updated: 05.02.2026

As Naturel Cappadocia ("Company" or "Data Controller"), we have prepared this notice to inform you about the processing of your personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Data Controller

  • Company: Naturel Cappadocia
  • Address: [Address], Göreme / Nevşehir, Turkey
  • Email: info@naturelcappadocia.com
  • Phone: +90 XXX XXX XX XX
  • Website: naturelcappadocia.com

2. Personal Data Processed

The following categories of personal data are processed by us:

Data CategoryPersonal DataIdentity InformationFirst name, last nameContact InformationEmail address, phone numberDigital Environment DataIP address, browser type and version, operating system, cookie dataUsage DataPages visited, on-site navigation behavior, click dataMembership DataUsername, password (encrypted), account creation dateCommunication ContentMessages and requests submitted via WhatsApp or phone

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

  • Responding to your inquiries about activities
  • Communicating with you via WhatsApp or phone
  • Creating and managing your membership account
  • Improving our service quality and enhancing the site experience
  • Ensuring site security and preventing potential misuse
  • Conducting statistical analyses (anonymously)
  • Fulfilling obligations arising from legal regulations

4. Legal Basis for Processing

Your personal data is processed based on the following legal grounds under Article 5 of the KVKK:

  • Explicit consent: Marketing communications and analytics cookies
  • Performance of a contract: Creating membership accounts, providing activity information, and facilitating communication
  • Legal obligation: Storing data as required by law and providing information to authorized institutions
  • Legitimate interest: Ensuring site security, improving service quality, and performing statistical analysis

5. Transfer of Personal Data

Your personal data may be transferred to third parties under Articles 8 and 9 of the KVKK in the following circumstances:

  • Activity providers: Your necessary information (name, phone) may be shared with the relevant activity provider to facilitate the activity you wish to join
  • Service providers: Technical partners providing hosting, email infrastructure, and analytics services
  • Authorized public institutions: In cases of legal obligation (court order, prosecution request, etc.)

When data is transferred abroad (e.g., Google Analytics servers), compliance with the conditions set forth in Article 9 of the KVKK is ensured.

6. Data Retention Periods

Data TypeRetention PeriodMembership dataAs long as the account is active; deleted within 30 days of a deletion requestCommunication records2 years from the date of last communicationCookie dataSession duration to 26 months, depending on cookie typeLog records2 years as required by Law No. 5651Accounting and invoice data10 years as required by the Turkish Commercial Code No. 6102

Data that has exceeded its retention period is deleted, destroyed, or anonymized as part of periodic disposal processes.

7. Data Security Measures

The following technical and administrative measures are implemented to protect your personal data:

  • Data transmission security via SSL/TLS encryption
  • Passwords stored using hash algorithms
  • Firewalls and access controls against unauthorized access
  • Regular backup and data recovery procedures
  • Personal data protection training for employees
  • Restriction of data access authorizations

8. Your Rights as a Data Subject

Under Article 11 of the KVKK, you have the following rights:

  • To learn whether your personal data is being processed
  • To request information if your personal data has been processed
  • To learn the purpose of processing and whether it is used in accordance with its purpose
  • To know the third parties to whom your personal data has been transferred domestically or abroad
  • To request correction of personal data if it has been processed incompletely or inaccurately
  • To request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK
  • To request that correction, deletion, and destruction operations be notified to third parties to whom data has been transferred
  • To object to any adverse outcome arising from the analysis of processed data exclusively through automated systems
  • To claim compensation for damages arising from unlawful processing of personal data

9. How to Submit a Request

To exercise your rights listed above, you may apply through one of the following methods:

  • Email: Written application to info@naturelcappadocia.com with documents verifying your identity
  • Mail: Written petition with wet signature to [Address], Göreme / Nevşehir, Turkey

Applications must clearly state your first name, last name, Turkish ID number (passport number for foreign nationals), contact information, and subject of the request.

Your application will be concluded free of charge within 30 days at the latest. If the process requires additional cost, fees may be charged based on the tariff determined by the Personal Data Protection Board.

10. Right to File a Complaint with the Personal Data Protection Board

In the event that your application is rejected, the response given is deemed insufficient, or no response is provided within 30 days, you reserve the right to file a complaint with the Personal Data Protection Board.

  • Board website: kvkk.gov.tr

11. Changes

This Data Protection Notice may be updated in line with legal regulations or changes in our data processing activities. The current version will always be published on this page.