1. Overview and Data Controller Identity
This privacy declaration applies to all visitors, users, and enquirers accessing Palpatchrankt.monster. The designated Data Controller responsible for the processing of your personal information is:
Palpatchrankt Hospitality Advisory Ltd.
Company Registration Number: 14892014
Registered Office: 28 Kempinski Terrace, Çırağan Caddesi No. 32, Beşiktaş, 34349 Istanbul, Türkiye
Designated Privacy Officer Contact: [email protected]
2. Categories of Information We Collect
We process personal data only when necessary to deliver editorial content, process advisory correspondence, or ensure website stability and integrity. The information categories we collect include:
- Direct Communications Data: Your full name, email address, telephone contact (if provided), and any substantive enquiry details you transmit via our contact portal.
- Technical and Device Identifiers: Your Internet Protocol (IP) address, browser family and version, operating system, localized language preferences, referring URLs, and session timestamps.
- Cookie and Consent Records: Logs indicating your stated preferences regarding essential, analytics, and functional web cookies stored within local browser storage.
3. Legal Bases for Processing Under GDPR & KVKK
Under the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the UK Data Protection Act 2018, and the Turkish Personal Data Protection Law No. 6698 (KVKK), our processing is grounded upon specific legal bases:
- Legitimate Interests (Art. 6(1)(f) GDPR): To monitor site infrastructure health, thwart denial-of-service incursions, and maintain content relevancy.
- Consent (Art. 6(1)(a) GDPR): For the deployment of non-essential statistical analytics cookies and subscription communication dispatches.
- Pre-Contractual / Contractual Measures (Art. 6(1)(b) GDPR): To respond to your direct lodging enquiries, itinerary consultation requests, and service advisories.
4. Third-Party Service Processors & Transfers
We do not commercialize, sell, rent, or trade your personal information. Personal data may be shared solely with authorized third-party service providers bound by strict data processing addenda (DPAs), including web hosting providers, cloud infrastructure services, and IT security auditors. Cross-border transfers outside the European Economic Area (EEA) or the Republic of Türkiye are executed exclusively under European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.
5. Data Retention Schedules
Personal data received via our contact and advisory mechanisms is retained for no longer than twenty-four (24) months from the resolution of the enquiry, unless statutory tax, audit, or commercial dispute retention rules mandate extended preservation. Technical log files are held for a maximum of ninety (90) days before automated cryptographic purging.
6. Your Statutory Rights (GDPR & CCPA)
Depending on your geographic residency, you are entitled to exercise comprehensive statutory rights regarding your personal records:
- Right of Access & Portability: Request confirmation and machine-readable copies of any records we store relating to you.
- Right to Rectification: Require the immediate correction of incomplete or outdated personal data.
- Right to Erasure ("Right to be Forgotten"): Demand the deletion of your personal records where no overriding legal basis for retention persists.
- Right to Restrict or Object: Restrict processing or object entirely to processing activities based on legitimate interests.
- Non-Discrimination (CCPA): We guarantee that California residents will not face denial of access or altered service quality for exercising rights under the California Consumer Privacy Act.
7. Contacting the Data Protection Officer
To exercise your privacy rights, lodge an inquiry, or register a formal objection, contact our Data Protection Officer directly at [email protected]. We respond to all authenticated requests within thirty (30) calendar days. You also retain the right to lodge a complaint with your regional supervisory authority (such as the UK Information Commissioner's Office or the Turkish KVKK Institution).