PRIVACY POLICY

Introduction

Thank you for your interest in our website at https://purcunda.com and our Pür Cunda mobile application.

We are committed to protecting your privacy and safeguarding your personal data in compliance with Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), the General Data Protection Regulation (“GDPR”) and other applicable data protection laws. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website and when you use our mobile application.

Responsible for data processing

PÜR OTELCİLİK VE TURİZM İŞLETMELERİ ANONİM ŞİRKETİ (“Pür Otel”)

Caddebostan Mah. Funda Çıkmazı Sk. No: 2-6 İç Kapı No: 6 Kadıköy / İstanbul, Türkiye

info@purcunda.com

1. What data does Pür Otel collect?

1.1 Data provided by you

Identity information: your name and surname.

Contact information: your email address and phone number.

Enquiry and booking information: when you submit an accommodation, studio or restaurant request, your preferred dates, number of guests and any notes you provide.

1.2 Data coming directly from your device

Device data: when you browse our website we collect certain information about your device. This information is required to understand how users navigate our site, helping us improve its content and functionality and safeguarding our website from threats and unauthorised access. This may include your device information, IP address and browser information.

Cookie data: cookies that are necessary for the functioning of the website are used. Mandatory identification cookies are used to fulfil an information society service requested by the user. You can configure your browser to block or warn you about mandatory identification cookies; however, in this case some parts of our website may not function properly.

1.3 Data collected through the mobile application

Account information. For staff using the operations side of the app: name, surname, email address, phone number and role. The public side of the app does not require an account.

Payment information. Card payments made in the app are processed directly by Yapı Kredi (Posnet), a licensed Turkish payment provider, using 3-D Secure verification. We do not see or store card numbers, expiry dates or security codes. We retain only the transaction amount, date and reference.

Notification identifier. If you allow notifications, a device-specific push token is stored. This identifier does not directly reveal your identity and is used solely to deliver notifications.

Technical data. App version, device model, operating system version and crash logs, used to monitor the stability of the app.

Data covered by device permissions. Described in detail in Section 6.

2. What does Pür Otel use your data for?

2.1 To operate and maintain our website and application

• To technically enable the service, for example the use of your IP address and browser information so that you can use our website.
• To prevent and detect potentially illegal or fraudulent behaviour, for example identifying suspicious browsing behaviour.
• To provide a safe and secure browsing experience, for example preventing illegal or unwanted content from being uploaded or attacks on our website.

We use your data for the above purposes because it is necessary to provide you with the service you have requested, and on the basis of the legitimate interests of Pür Otel and other users to ensure our business continuity and to protect the data and systems of others.

2.2 Communication

We use your name, surname, email address and phone number with your consent to contact you if you fill out our enquiry form, to respond to your requests and complaints, to let you know about special offers, to share updates about our company and industry, and to obtain your feedback on your experience with us.

We use this information on the basis that it is necessary to perform our contract with you or to provide a service you have requested. Without this data we cannot deliver the requested service. We also process this data on the basis of our legitimate interest to improve and optimise our business, or with your consent, which you can withdraw at any time.

2.3 Bookings, stays and payments

We use your enquiry and booking information to plan and deliver the service. We process payment information to complete card transactions made in the app and to meet our record-keeping obligations under financial regulations.

2.4 Legal operations

We also use the information you provide to us, or that we collect from and about you, to operate our business. This may mean that we use your data for:

• Legal proceedings involving you or others
• Law enforcement investigations and other criminal investigations
• Mergers and acquisitions
• Compliance requirements to which we are subject

We use this information primarily on the basis of legal obligations to which Pür Otel is subject. In other cases we use the data on the basis of our legitimate interest to ensure the continuity of our business operations.

3. Who do we share your personal data with?

We do not sell your personal data and do not transfer it to third parties for marketing purposes. Your data may be transferred to the following recipients:

• Our group companies, affiliates and business partners: strictly limited to the purposes specified in this Privacy Policy and where necessary for the performance of a contract.
• Yapı Kredi (Posnet): for processing card payments made in the app.
• Our hosting and infrastructure providers: for the secure storage of data.
• Apple Push Notification service: for delivering notifications to your device.
• Authorised public institutions and organisations: when required by law or for the fulfilment of legal obligations.

4. Data retention

We collect and use your personal information for the purposes described above. Each of these purposes has different requirements and therefore a different retention period. We delete your personal data as soon as it is no longer necessary to keep it for the purpose for which it was collected.

• Enquiry and booking records: for the period required by applicable financial and legal regulations.
• Account information: until the account is deleted.
• Technical and crash logs: for a maximum of 12 months.

If you request erasure of your personal information, we will endeavour to erase it within 30 days. Under certain circumstances this may take longer, and we will inform you accordingly. Please note that we are required by law to keep some of your personal information in order to comply with legal obligations to which we are subject.

5. Your rights

Under the KVKK and the GDPR you have the following rights:

• Right to access: to request access to the personal data we process about you and receive a copy of it.
• Right to rectification: to request the correction of inaccurate or incomplete personal data we hold about you.
• Right to erasure: to request the erasure of your personal data under certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
• Right to restrict processing: to request the restriction of processing under certain circumstances, such as when the accuracy of the data is contested.
• Right to data portability: to receive your personal data in a structured, commonly used and machine-readable format, and to transmit that data to another data controller.
• Right to object: to object to the processing of your personal data under certain conditions.
• Right to withdraw consent: where we rely on your consent, to withdraw that consent at any time.

To exercise your rights, or if you have questions or concerns about this Privacy Policy, please contact us using the details in Section 8.

6. Mobile application

This section covers additional terms that apply to the Pür Cunda mobile application.

6.1 Device permissions and why they are requested

The following permissions are requested only at the moment the related feature is used. None are mandatory; the app works without granting any of them.

No camera or microphone recording takes place in the background. Face ID verification is performed on the device; your biometric data is never transmitted to us and is not stored.

6.2 Payments

Card payments made in the app are exclusively for physical goods and services: accommodation charges, restaurant reservation deposits and tickets to live events held at our property in Cunda. No digital goods, content or subscriptions are sold in the app.

Payments are processed by Yapı Kredi (Posnet), a licensed Turkish payment provider, using 3-D Secure. Your card details are not stored in the app.

6.3 Home Screen and Lock Screen widgets

Widgets display summary information from your signed-in account (occupancy, sessions for the day, reservation counts) on your device. This data is cached only on your device and is not shared with third parties. Widget data is cleared when you sign out.

6.4 Account deletion

You can delete your account directly in the app: Account > Settings > Delete my account. When an account is deleted, your profile information and session data are permanently removed. Transaction records that must be retained under financial regulations continue to be held for the statutory period without being linked to your identity.

You may also send a deletion request to info@purcunda.com

6.5 Languages

The app is available in Turkish and English. On first launch it follows your device language; you can change it under Account > Settings > Language.

7. Contact us

If you have any questions or comments about how we use your personal information, you can contact us at info@purcunda.com

If you feel that we have not adequately answered your query, you always have the right to lodge a complaint with the Turkish Personal Data Protection Authority, or with the supervisory authority in the country in which you live.

8. Changes

Any changes to this Privacy Policy will be published on this page and take effect on the date of publication.

Effective date: 29.07.2026