Data Subject

By visiting the Acapulco Resort & Convention & Spa Hotel website, you are classified as a Website Visitor and, as your personal data is being processed, you are considered a data subject under the Law.

Data Controller

Acapulco Resort & Convention & Spa is the data controller responsible for determining the purposes and means of processing your personal data, as well as for establishing and managing the data recording system.

Processed Personal Data, Purposes of Processing, and Legal Grounds

We may process the following personal data for the purposes and legal reasons outlined below:

• Name, surname, e-mail address, phone number, selected hotel, how you heard about us, and your message content: These are processed based on your explicit consent, for the purpose of communicating with you. (Law Article 5/1)
• Hotel reserved, reservation dates, number of guests and children, room preferences: These are processed for the performance of the accommodation agreement. (Law Article 5/2(c))
• Connection time, disconnection time, IP address, IP protocol used, and amount of data transferred: These are processed in accordance with the legal obligations of hosting providers as stated in the Law on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications (Article 4). (Law Article 5/2(ç))
• Information about the pages you visit: This is processed for our legitimate interests to improve the user experience and website functionality. (Law Article 5/2(f))

Sharing of Personal Data

Your personal data and any new data generated through your interaction with the website may be shared, to the extent necessary and proportionate to the purposes specified above, with:

• Call centers, complaint management systems, and software companies to fulfill communication and security needs
• Authorized public institutions and judicial authorities, as required by law
• Third parties within the country, or—where legal requirements are met—abroad

These data may be shared to fulfill communication requests, comply with legal obligations, enhance user experience and system performance, authenticate user identity, ensure security, create documentation in physical or electronic form, and fulfill our reporting and record-keeping responsibilities.

Methods of Collecting Personal Data

Your personal data is collected through automated means (via the internet) and manually through direct communication with you.

Your Rights Regarding Personal Data

As a data subject, you must first apply to the data controller to exercise your rights. According to Article 14 of the Law, complaints cannot be submitted directly to the Personal Data Protection Board without first contacting the data controller.

Under the Law, you have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether it is used appropriately
• Know third parties to whom your data is transferred domestically or abroad
• Request correction of inaccurate or incomplete data
• Request deletion or destruction of personal data if processing purposes no longer exist
• Request that any correction or deletion be notified to third parties to whom the data was disclosed
• Object to outcomes that arise from automated processing
• Request compensation if you suffer damages due to unlawful processing

How to Apply

You may submit your request:

• By sending an email to kvkk@acapulco.com.tr, using the same email address registered in our system.

Your application must include:

• Your full name and, if the application is in writing, your signature
• Your ID number (for TR and TRNC citizens) or, if a foreign national, your nationality and passport or ID number
• Your residential or workplace address for official notifications
• Your email address, phone, and fax number (if applicable)
• The subject of your request
• Any documents or information related to your request

Acapulco Resort & Convention & Spa reserves the right to verify your identity.

For further information regarding the application process, you can refer to the "Communiqué on the Principles and Procedures for the Request to Data Controller" published by the Personal Data Protection Authority.