Privacy policy
How we handle personal data under the GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK). Draft, prepared for final legal sign-off.
This notice explains how NRDMG YAPI SİSTEMLERİ A.Ş. handles personal data on this website. It is our privacy notice under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Data controller
NRDMG YAPI SİSTEMLERİ A.Ş. (data controller, veri sorumlusu), Fenerbahçe Mah. İğrip Sk. No:13 İç Kapı No:1, Kadıköy / İstanbul, Türkiye. Istanbul Trade Registry no. 1101675, MERSIS 0632154561400001, tax number 6321545614 (Göztepe Vergi Dairesi), represented by Emre Koçak, sole member of the board of directors.
Privacy contact: info@the-hoteldesign.com, phone +90 533 347 65 88, or by post to the address above.
2. Representative in the EU (GDPR Art. 27)
We are established only in Türkiye. Because we offer our services to businesses in the EU and process the data of contact persons there, the GDPR applies to us under Article 3(2). We therefore need a representative in the EU. The exception in Article 27(2) for occasional processing does not fit, because we address EU markets on a regular basis. An EU representative will be appointed before go-live. Its name and address will be given here. You can contact it instead of us on any data protection matter.
3. Data protection officer
We have not appointed a data protection officer. Under Article 37 GDPR this is required only where the core activities involve regular and systematic monitoring of people on a large scale or large-scale processing of special categories of data. Neither applies to us. KVKK does not require a data protection officer. Please send all privacy questions to the contact in section 1.
4. Turkish data controllers registry (VERBİS)
Under KVKK Board Decision 2018/87, as amended by Decisions 2023/1154, 2025/1572 and 2025/2393, controllers with fewer than 50 employees a year and an annual balance sheet total under 100 million TL, whose main activity is not the processing of special categories of data, are exempt from registration in VERBİS. We meet these criteria (to be confirmed by the company) and are therefore not registered. The exemption does not change our other duties under KVKK.
5. Overview of our processing
How we obtain data (KVKK Art. 10): electronically, through the forms on this website, by email and by phone, and automatically through the server logs when you open a page.
| Activity | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Opening pages (server logs) | IP address, date and time, page or file requested, referring page, browser and operating system, response status | Delivering the website, stability, security, finding errors | GDPR Art. 6(1)(f); KVKK Art. 5(2)(f) | 30 days |
| Quote request, configurator, sample box (section 7) | Your form entries, form type, page, language, time, shortened browser identification, IP hash | Answering your request, preparing an offer, sending samples, follow-up on that request | GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f) | 24 months after last contact, or 10 years if a contract follows |
| Email and phone | Contact details and what you tell us | Answering you | GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f) | as for requests |
| Spam protection | Hidden field, IP hash | Protecting the forms from misuse | GDPR Art. 6(1)(f); KVKK Art. 5(2)(f) | with the request; spam is not stored |
| Contracts that follow | Contract and correspondence data | Performing the contract, accounting, tax | GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(c) and (ç) | 10 years (section 10) |
Our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) are a working and secure website, handling business enquiries efficiently and protecting our forms. Where a request comes from you as an employee of a business, we use Art. 6(1)(f) for the steps that serve your employer.
6. Hosting and server logs
The website runs on web hosting from Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, including Hostinger's content delivery network. Hostinger acts as our processor under a data processing agreement in line with Article 28 GDPR and stores and processes data only on our instructions. Server location: per hosting contract, to be confirmed.
When you open a page, the server automatically records the log data listed in section 5. We need it to deliver the pages and to detect and fix attacks and errors. Logs are deleted after 30 days at the latest. A log entry is kept longer only if it is needed to clear up a specific security incident, and only until that is done. We do not combine log data with other data and do not use it to identify visitors.
7. Our three forms
7.1 Request a quote (contact page)
Fields: full name, company and email (required), phone, hotel or project name, city and country, project type, scope, your role, planned opening and your message.
7.2 Select your hotel (configurator)
The same fields as the quote form. The message field is filled in for you with a summary of your choices (location, spaces, focus, moods, room concepts and suggested room types). You can change it before you send it.
7.3 Sample box
Fields: the samples you tick, full name, company, email and the delivery address for the box (required), phone, hotel or project name, rooms planned and your message.
7.4 What is stored with every request
Besides your entries, the server stores the form type, the page you sent it from, the language of the page, the date and time, your browser identification (shortened to 200 characters) and a one-way hash of your IP address. We do not store the IP address itself. A hidden field catches spam robots. If it is filled in, the request is discarded and nothing is stored.
Requests are saved as a file on our web server at Hostinger, in a folder outside the public part of the website that cannot be opened from the internet. Email notification for new requests is switched off at the moment. When it is switched on, a copy of each request will also go to our company mailbox.
7.5 The tick box and required fields
The tick box under each form confirms that you have read this notice. It is not a request for consent. We process your request because you ask us for something before a possible contract and because we have a legitimate interest in answering business enquiries, not on the basis of consent, and we do not ask for explicit consent (açık rıza) under KVKK. The required fields are needed to answer you. Giving them is voluntary, but without them we cannot handle the request.
8. Email and phone
If you email or call us, we use your contact details and what you tell us to answer you, on the legal bases in section 5.
9. Cookies, device storage and third-party content
This website sets no cookies. It uses no analytics, no tracking or advertising tools and no social media plugins, and it embeds no content from other servers. Fonts and images are delivered from our own server. We checked this on 30 October 2026: opening the pages caused no requests to any third-party server.
The only storage on your device is the configurator's local storage (section 7.2). It keeps your choices so you can come back later, stays on your device and reaches us only if you send the form. You can delete it by clearing your browser's site data. Storing information on your device is covered by § 25 of the German TDDDG and the matching rules in other EU countries, which implement Article 5(3) of the ePrivacy Directive. This storage is strictly necessary for the configurator you choose to use, so it falls under the exemption in § 25(2) no. 2 TDDDG and needs no consent. For this reason there is no cookie banner.
The "Open in maps" buttons are plain links. Google receives data only if you click one and the map opens in a new tab. Google's privacy policy then applies.
10. How long we keep data
- Server logs: 30 days, see section 6.
- Requests that do not lead to a contract: deleted 24 months after our last contact with you.
- Requests that lead to a contract: kept with the contract records. Commercial books, business letters and supporting documents are kept for 10 years under Article 82 of the Turkish Commercial Code No. 6102, and tax records under Article 253 of the Tax Procedure Law No. 213, counted from the end of the calendar year.
- Configurator choices in your browser: until you delete them.
After these periods we delete or anonymise the data. We review stored requests at least every six months.
11. Recipients
- Hostinger International Ltd., our hosting provider, as processor (section 6).
- The provider of our company mailbox, as processor, for emails you send us and, once switched on, for request notifications.
- For the sample box, the courier that delivers it (name, company, delivery address and phone).
- Our tax and legal advisers, who are bound to professional secrecy, and courts and public authorities where the law requires it.
We do not sell personal data and do not use it for advertising.
12. International transfers
From the EU to us in Türkiye. We are based in Türkiye, a country without an EU adequacy decision. When you send us a form or an email, you give the data directly to us. The GDPR applies to us directly under Article 3(2). Where data passes between our hosting provider in the EU and us in Türkiye, we use the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914) where the hosting contract provides them. Otherwise, and for your requests to us, the transfer is necessary for steps taken at your request before a contract (GDPR Art. 49(1)(b)). You can ask us for a copy of the safeguards used.
From Türkiye abroad. Storing data with our hosting provider outside Türkiye is a transfer abroad under Article 9 of KVKK, as amended by Law No. 7499 with effect from 1 June 2024. It is based on the standard contract published by the KVKK Board, which is notified to the Personal Data Protection Authority within five business days of signing: per hosting contract, to be confirmed. Individual transfers needed to answer your request or to perform a contract with you rely on the exception for occasional transfers in Article 9(6) KVKK.
13. No automated decisions
We make no decisions based solely on automated processing (GDPR Art. 22; KVKK Art. 11(1)(g)) and do no profiling.
14. Your rights under the GDPR
- Access to your data (Art. 15)
- Correction of incorrect data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Notification of recipients about correction, erasure or restriction (Art. 19)
- Data portability (Art. 20)
- Objection (Art. 21, see below)
- Not to be subject to a decision based solely on automated processing (Art. 22)
15. Your rights under KVKK Article 11
- to learn whether your personal data is processed, and to request information if it is
- to learn the purpose of processing and whether it is used for that purpose
- to know the third parties in Türkiye or abroad to whom it is transferred
- to ask for incomplete or incorrect data to be corrected
- to ask for your data to be deleted or destroyed under KVKK Art. 7
- to ask that these corrections and deletions be notified to the third parties who received the data
- to object to a result against you that comes only from automated analysis
- to claim compensation for damage caused by unlawful processing
16. How to use your rights
Write to info@the-hoteldesign.com or by post to the address in section 1. Under KVKK you can also apply as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller: in writing, by registered electronic mail (KEP), with a secure electronic or mobile signature, or from an email address you have already given us. We may ask you to confirm your identity.
We answer GDPR requests within one month. For complex requests this can be extended by two more months, and we will tell you if so. We answer KVKK applications within 30 days. Requests are free of charge. Under KVKK a fee set by the Board may be charged only where answering causes extra cost.
17. Right to complain
Türkiye: Kişisel Verileri Koruma Kurulu (Personal Data Protection Board), Kişisel Verileri Koruma Kurumu, Ankara, kvkk.gov.tr. Under KVKK Articles 13 and 14 you first apply to us. You can then complain to the Board within 30 days of our answer, or within 60 days of your application if we do not answer.
EU: Because we have no establishment in the EU, there is no lead supervisory authority for us under the one-stop-shop rule. You can complain to the supervisory authority in the EU country where you live or work or where the alleged infringement took place (GDPR Art. 77). In our main markets these are the Information and Data Protection Commissioner in Malta (idpc.org.mt), the data protection authority of your federal state in Germany, the Autoriteit Persoonsgegevens in the Netherlands (autoriteitpersoonsgegevens.nl) and Datatilsynet in Denmark (datatilsynet.dk).
18. Security
The website is served only over an encrypted connection (HTTPS). Requests are stored outside the public part of the web server, access is limited to the people who handle them, and IP addresses are stored only as a one-way hash (GDPR Art. 32; KVKK Art. 12). If a breach occurs, we notify the competent authorities and, where required, the people affected within the statutory time limits.
19. Children
This website is aimed at businesses and not at children. We do not knowingly collect data from people under 18. If we learn that we have, we delete it.
20. Changes
We will update this notice when the website or the law changes. The current version is always on this page, with its date below. Image sources are listed on the image credits page.
Version: 30 October 2026