Cookie Policy

TOK ŞEN TURİZM OTELCİLİK VE TİCARET A.Ş. | DUCALE LARA HOTEL

ducalelara.com

This policy has been prepared within the framework of the Law No. 6698 on the Protection of Personal Data (KVKK) and relevant legislation to inform visitors about the personal data processed during the use of the website with the domain name ducalelara.com (“Site”), operated by Tok Şen Turizm Otelcilik ve Ticaret Anonim Şirketi (hereinafter referred to as the “Company” or “Tok Şen A.Ş.”), the cookies used, and third-party services.

1. IDENTITY OF THE DATA CONTROLLER

2. PERSONAL DATA PROCESSED THROUGH THE SITE

2.1. Contact Form

The following personal data are processed through the form on the contact page of our site: * Name and surname * E-mail address * Message content

2.2. Automatically Collected Technical Data

When you visit the Site, the following technical data are automatically recorded by the server infrastructure: * IP address * Browser type and version * Operating system * URLs of visited pages and referrer address * Date and time of visit * Session duration

Legal basis: KVKK Art. 5/2-f (legitimate interest — site security and error management); log recording obligation within the scope of Law No. 5651. Retention period: 2 years.

2.3. Reservation — Tatil Budur Integration

Reservation processes on our site are managed through the Tatil Budur (tatilbudur.com) reservation engine. The reservation flow starts on the Ducale Lara site; in the payment step, the user is redirected to Tatil Budur’s secure payment infrastructure.

Card information and payment data entered during payment transactions are processed in Tatil Budur’s infrastructure. At this stage, Tok Şen A.Ş. does not have access to card information. We recommend you review Tatil Budur’s policy at tatilbudur.com/gizlilik for their data processing practices.

3. COOKIE POLICY

3.1. What is a Cookie?

Cookies are small text files saved on your device (computer, tablet, phone) through your browser when you visit a website. Thanks to cookies, sites can remember visitors’ preferences, analyze usage habits, and offer personalized content.

3.2. Cookie Categories and Cookies Used

The cookies used on our site are divided into the following four categories. The first category, Mandatory Cookies, is always active; your consent is obtained for other categories.

3.3. Google Tag Manager (GTM)

Google Tag Manager (GTM-WP9H2PL) is used on our site. GTM itself does not collect personal data or leave cookies; it is merely a container that allows central management of third-party service tags (Google Analytics, Google Ads, Meta Pixel, Yandex Metrica). Which tags will run via GTM is controlled according to the scope of your cookie consent.

3.4. Managing Your Cookie Preferences

A cookie information banner will appear on the screen during your first visit to our site. Through this banner, you can: * Accept all cookies, * Allow only mandatory cookies, * Make any selection between categories.

You can update your preferences at any time from the “Cookie Preferences” link at the bottom of the page. Withdrawing your consent does not mean that previous processing was unlawful.

Management via browser: You can also manage cookies from your browser settings. If you block cookies completely, some functions of the site (language preference, reservation redirection) may not work properly.

4. THIRD-PARTY SERVICES AND DATA TRANSFER

4.1. Graphx Ajans — Data Processor

Technical infrastructure and digital marketing activities of the site are carried out by Graphx Ajans (graphxajans.com). In this context, Graphx Ajans is a data processor acting on behalf of and in line with the instructions of Tok Şen A.Ş. A Data Processing Agreement has been signed between the parties in accordance with Article 12 of the KVKK. Graphx Ajans cannot use the personal data it processes for its own purposes.

Graphx Ajans’ access to Google Analytics, Google Ads, and Meta Pixel accounts is limited solely to the purpose of monitoring and optimizing Ducale Lara’s digital marketing performance.

4.2. Google Services

International transfer: Google services process data on Google servers in the USA and other countries. This transfer is carried out within the scope of the EU-US Data Privacy Framework and standard contractual clauses. Within the framework of Art. 9 KVKK, the Company provides the necessary safeguards in accordance with the Data Processing Agreement signed with Google.

4.3. Meta (Facebook / Instagram) Pixel

Meta Pixel is provided by Meta Platforms Ireland Limited and is used to measure the interactions of users visiting our site with Facebook and Instagram ads. Meta Pixel is activated only when marketing cookies are approved.

International transfer: Meta processes the collected data on its servers in the USA. The transfer is carried out within the scope of standard contractual clauses. For Meta’s data practices: facebook.com/privacy/policy

4.4. Yandex Metrica

Yandex Metrica is used for market analysis aimed at Russian-speaking visitors. The service is provided by Yandex LLC (Russia), and data may be processed on servers in Russia.

Yandex Metrica data is transferred to Russia. This transfer is evaluated within the scope of Art. 9 KVKK. Russia is among the countries where the reciprocity status in the field of personal data protection with Turkey has not yet been clarified. For this reason, Yandex Metrica cookies are activated only when your explicit consent is obtained. For Yandex’s privacy policy: yandex.com/legal/confidential

4.5. WhatsApp Communication Widget (Potential)

A WhatsApp communication button or widget may be integrated into our site in the future. WhatsApp operates within Meta Platforms Inc., and when the widget is activated, your IP address and device information are transmitted to Meta servers.

When the WhatsApp button is added to the site, this policy will be updated and additional information will be provided in the cookie preference panel. The widget will not work without functional cookie consent.

4.6. Tatil Budur Reservation Engine

Reservation processes carried out through our site are managed through the Tatil Budur (Dijital Turizm A.Ş.) reservation engine. The reservation flow starts on the Ducale Lara site; at the payment stage, the user is redirected to Tatil Budur’s secure payment page.

5. INTERNATIONAL DATA TRANSFER

Some data collected through our site are processed on servers abroad. The transferred data, transfer country, and safeguard mechanisms are summarized in the table below:

6. LINKED EXTERNAL SITES

Our site may contain links to third-party websites (tatilbudur.com, graphxajans.com, social media profiles, etc.). When you click on these sites, those sites’ own privacy policies apply. Tok Şen A.Ş. does not assume responsibility for the contents and personal data practices of third-party sites.

7. YOUR RIGHTS UNDER KVKK

In accordance with Article 11 of the KVKK No. 6698, you have the following rights regarding your personal data: * Learning whether your personal data is processed and how it is processed, * Requesting correction of incorrect or incomplete data, * Requesting deletion or destruction of data when the storage purpose has ceased, * Learning the third parties to whom data is transferred, * Objecting to decisions based solely on automated systems, * Requesting compensation for damages you suffered due to unlawful processing.

For cookie consent: You can use the “Cookie Preferences” link at the bottom of the page. For KVKK application: You can send an e-mail to [email protected] or apply to the Ducale Lara Hotel reception with a wet-signed petition. Your application will be answered within 30 days.

8. POLICY UPDATES

This policy may be updated in line with legislative changes, addition of new cookies or services, or changes in existing practices. Important changes will be announced on the site and the update date will be specified below. We recommend you review the policy regularly.