Privacy Policy & KVKK Notice

1. Data Controller

This Privacy Policy concerns personal data collected through www.dndreserve.com, operated by CY-DND MAINTENANCE & SERVICE'S LTD. (the "Company"). Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), the data controller is:

Legal name: CY-DND MAINTENANCE & SERVICE'S LTD.
Address: Amber Sok. No:12/A Zemin Kat Ofis 14/A Bahçeler İskele, KKTC
Company registry no (TRNC): MŞ28899 — Legal entity no: 107267725586 — Tax office/no: Gazimağusa / 216020811
E-mail: info@dndreserve.com — Phone: +90 548 888 03 63

2. What Data We Collect

Identity data: full name.
Contact data: phone number, e-mail address.
Booking data: check-in/check-out dates, apartment type, number of guests, your booking notes, booking code.
Transaction-security data: IP address, browser/device information and audit records of critical actions on the site (creating a booking, giving consent, payment).
Payment data: your card details are never collected or stored on this site. Payment takes place on the secure 3D Secure page of Ziraat Bank; we receive only masked card information (first 6 / last 4 digits), bank transaction references and the transaction result.
Accommodation-law data: under Law No. 1774 on Identity Notification, identity details may be processed during your stay for notification to the competent authorities.

3. Purposes of Processing

Creating and managing your booking and providing the accommodation service,
Collecting payment through the bank and bookkeeping,
Communicating with you about your booking,
Fulfilling legal obligations (tax, identity notification, etc.),
Securing the site and transactions; evidence in case of disputes,
Sending campaign and offer notifications, only with your explicit consent (marketing).

4. Legal Bases

Art. 5/2-c — formation and performance of a contract: booking and payment.
Art. 5/2-ç — legal obligation: tax legislation, Law No. 1774.
Art. 5/2-f — legitimate interest: transaction security, audit records, fraud prevention.
Explicit consent — only for marketing messages and consent-based third-party content.

5. Data Transfers

Ziraat Bank — to execute payment (you provide card details directly to the bank).
Hosting and database providers — to host the site and data. As some servers are located abroad, this transfer falls under KVKK Art. 9 and is carried out on the basis of {M9_AKTARIM_DAYANAĞI}.
Competent public authorities — where legally required.

Your data is not sold or transferred to any other third party.

6. Retention Periods

Booking and payment records: 10 years under tax and commercial legislation.
Bank message logs (masked): 2 years.
Transaction-security/audit records: 24 months.
Marketing consent: until withdrawn; withdrawal records are kept as evidence.

7. KVKK Notice and Your Rights (Art. 11)

Under KVKK Art. 11 you may at any time:

Learn whether your personal data is processed and request information about it,
Learn the purpose of processing and whether data is used accordingly,
Know the third parties to whom data is transferred, in Türkiye or abroad,
Request correction of incomplete or inaccurate data,
Request erasure or destruction under the conditions of Art. 7,
Request that corrections/erasures be notified to recipients,
Object to a result produced exclusively by automated analysis,
Claim compensation for damages caused by unlawful processing.

You may submit requests to kvkk@dndreserve.com by e-mail or in writing to Amber Sok. No:12/A Zemin Kat Ofis 14/A Bahçeler İskele, KKTC. Requests are answered free of charge within 30 days at the latest.

8. Cookies

For cookies and similar technologies used on the site, see the Cookie Policy.

9. Changes

When this policy is updated, the "Last updated" version at the top of the page changes. Material changes are additionally announced on the site.