Privacy and Cookie Information

1. Controller and scope Ermuna Turizm Seyahat İnşaat Emlak Ticaret Limited Şirketi is the controller for the Look Boutique Hotel website at lookboutiqueotel.com. Address: Yanıklar Mahallesi, Atçılar Sokak No 6/1B, Fethiye/Muğla, Türkiye. Privacy enquiries and guidance on making a request: [email protected]. Hotel contact: [email protected] and +90 533 195 48 08. This notice covers website visits, availability searches, the contact form, site security and the website/campaign measurement you permit. The website does not complete bookings, payments or membership registration. Separate privacy information applies to hotel-stay activities. 2. Information and purposes Information is collected electronically, wholly or partly by automated means, through requests sent by your browser, details you enter into the electronic contact form, and staff actions in the administration panel. Hosting and security infrastructure may process your IP address, request time, requested resource and browser/device signals to deliver the site, maintain a secure session and prevent abuse. Necessary security processing is assessed under legitimate interests, to the extent it does not harm your rights (Article 5(2)(f) of Turkish Law No. 6698, KVKK). The contact form receives your name, an email address and/or telephone number for replying, and your message. Processing necessary to answer an accommodation/price enquiry relies on Article 5(2)(c) to the extent directly related to entering into a contract; answering other general enquiries relies on Article 5(2)(f) to the extent necessary and not harmful to your rights. Records needed for legal obligations or the protection of a right rely on Article 5(2)(ç) or 5(2)(e), where the relevant conditions apply. Your message is delivered to the hotel's authorised mailbox. The form does not create a separate customer-message archive. If submission fails, you need to enter your details again; form entries are not stored in the site session for redisplay. Acknowledging the form notice is not analytics, advertising or international-transfer consent. Contact details are not added to a marketing list as a result of your enquiry. Please do not send identity documents, payment-card details, health information or unnecessary information about other people. You can contact us by telephone or WhatsApp instead. Dates and party size entered in an availability search are used to calculate the result you requested. A result does not create a booking or sale. With your permission, we use Google Analytics 4 to understand website use, identify traffic sources, assess the usefulness of our contact channels and evaluate the hotel's own advertising campaigns. Measurement covers page views, traffic sources, configured campaigns, availability searches that show a result, phone/WhatsApp button clicks and successfully submitted contact forms. A click or form submission is not treated as a completed booking or sale. The processing basis for this optional measurement is your explicit consent under Article 5(1) of KVKK. Consent is obtained through your active choice in Cookie preferences. We do not include names, email addresses, phone numbers or messages entered in the contact form, or dates and party size entered in availability searches, in analytics events. Measurement may process browser/cookie identifiers, device/browser information and interaction data. Your IP address reaches Google during the connection. We do not represent this data as anonymous. 3. Recipients and providers Authorised hotel staff use information as required for their duties. We use Hostinger for hosting and email, and Cloudflare for site delivery, security and public web images. Disclosures to competent authorities are made under the relevant legal obligation or valid request. Cloudflare Turnstile on the contact and staff-login forms may evaluate IP addresses, browser signals, connection fingerprints and site/origin information to prevent automated abuse. Cloudflare describes its role as a processor when protecting our website and as a controller when improving its own bot detection. Service information: https://www.cloudflare.com/turnstile-privacy-policy/ The web-hosting server is in Frankfurt, Germany; the hosting provider lists France as the backup location for this plan. This does not mean that email and Cloudflare services are limited to those countries. Provider infrastructure may involve processing outside Türkiye. We do not promise that information is processed only in Türkiye. If you permit analytics, the Google companies providing Google Analytics and the service's subprocessors process measurement data. Authorised hotel staff use the reports to evaluate the website and the hotel's own campaigns. Google's service infrastructure involves processing outside Türkiye. Google's information on data collection, recipients and retention: https://support.google.com/analytics/answer/6004245?hl=en 4. Cookies and analytics Analytics is optional. We do not load the Google Analytics script or send measurement requests before you grant permission. Declining does not prevent you from using prices, availability or contact features. Continuing to browse or reading this notice does not give consent. You can withdraw your permission at any time in Cookie preferences. New measurement stops and this site's analytics cookies are removed from this browser. Withdrawal does not automatically delete data previously received by Google; requests concerning earlier data can be submitted through our contact channels. Direct Google Ads conversion tracking, remarketing, Google Signals and advertising personalisation are disabled in this version. Permitting GA4 campaign-performance measurement does not permit these separate advertising features or marketing emails, texts or calls. Acknowledging the contact-form notice is separate from your analytics choice. XSRF-TOKEN: A first-party security cookie used to prevent forged requests. Its browser duration is 60 minutes and may renew on active requests. look-boutique-hotel-session: A first-party session cookie for a secure session, form results and temporary processing state. It has no persistent browser expiry date; browser session-restoration settings may affect its lifetime. Server-side session access is limited to 60 minutes from the last activity. Expiry of access does not mean that the server record is physically deleted at the same instant. look-boutique-hotel-trusted-browser: Used only when staff select the trusted-browser feature at login. It is scoped to /yonetim for up to 30 days. Password sign-in and session-duration rules still apply; the trusted-browser feature remembers only the MFA step. Manual logout removes the cookie; account-security changes can invalidate the existing trust decision. You can manage cookies in your browser settings. Blocking necessary cookies may affect secure sessions and form functionality. look_analytics_preference: A necessary first-party preference cookie. It remembers whether you permit measurement for 180 days and is not used as an analytics visitor identifier. look_ga and look_ga_*: Cookies set by Google Analytics on this website's domain only with your analytics permission. They contain identifiers used to measure the browser and its interactions. They are configured for up to 180 days without renewing the period to another 180 days on every visit. 5. Retention and deletion The hotel's adopted policy for general email enquiries is to retain correspondence that does not result in a reservation for 12 calendar months from the last relevant correspondence and delete it at the monthly review following expiry. The hotel team performs this review and deletion manually; no automatic email-deletion service is used. Records required by an applicable legal retention obligation or to protect a right are retained only for as long as that requirement continues. Reservation, hotel-stay, accounting and dispute records are assessed separately against their purposes and applicable periods. Access to security records and backups is limited to authorised persons who need it for their duties. Google Analytics user and event data retention is configured to 2 months, with reset on new activity disabled. This setting does not mean that standard aggregated reports are also deleted after two months. The 180-day browser-cookie lifetime and Google's event-data retention period are different. Deletion and other rights requests can be submitted through the channels below. 6. External links Opening a WhatsApp, map or social-media link takes you to that provider's service. Processing there is subject to its privacy information and the scope of your communication with the hotel. Opening a link does not permit advertising or analytics measurement on our website. 7. Rights and requests Under Article 11 of KVKK, you may ask whether your information is processed, learn its purposes and recipients, and request applicable correction, deletion or destruction and notification to recipients. You may object to an adverse outcome based solely on automated analysis and seek redress for unlawful processing. Send written requests to the postal address above. Contact [email protected] for guidance on the procedure and other accepted channels. Only necessary information is requested to verify your identity. We respond as soon as appropriate for the request and within 30 days. Your statutory right to complain to the Turkish authority remains available.