REVIEW TEXT WITH INCOMPLETE INFORMATION: Production hosting and email data-processing records still require completion. Viewing this document alone does not create a confirmed booking.
Operator and contact details
Registered company name: REVA GROUP İNŞAAT TAAHHÜT SANAYİ VE TİCARET LTD. ŞTİ.
Registered office: Yalı Mahallesi 6402 Sokak Kocatepe No:42/A, Karşıyaka / İzmir, Türkiye
Property name: Reva Miami Hotel
Property address: Kozbeyli, Kozbeyli Kümeevler No:619, 35680 Foça / İzmir, Türkiye
Tax office: Çiğli Vergi Dairesi
Tax identification number (VKN): 734 148 0158
Central registry number (MERSİS): 0734148015800001
Trade registry number: 233197
Registered chamber: İzmir Ticaret Odası
Chamber registry number: 2190741
Registered electronic mail (KEP): revagroup@hs01.kep.tr
Telephone: 0532 224 54 35
Email: info@revamiami.com
Ministry-registered property type: Pension (Pansiyon). The property has 28 accommodation units: 16 De Luxe bungalows, 6 Corner De Luxe bungalows and 6 standard pension rooms. Physical room totals are not live availability.
Scope, collection, purposes and legal grounds
The operator identified above is the data controller. This notice covers the web booking form, price/contract previews and related communications. Form and contact data are collected electronically; the system obtains technical records.
- Name, email, telephone, room/dates and guest count: handling the request, arranging/managing a booking and transaction communications; KVKK Article 5(2)(c), formation/performance of a contract.
- Transaction, contract version and dispute records: evidence of transactions/claims; Article 5(2)(e), establishment, exercise or protection of a right.
- IP, access and session security records: preventing unauthorised access/abuse; Article 5(2)(f), legitimate interests, without harming your fundamental rights.
The form does not request Turkish ID numbers, ID photocopies, health data, card numbers or CVVs. Do not add these to the form or ordinary email. Other processes, such as check-in or invoicing, require separate notices when data is collected. Camera and staff activities are outside this notice.
Recipients and transfer purposes
Authorised reservation staff access data according to their duties. Hosting/maintenance providers may access necessary data to operate the system; email providers to send transaction messages; competent public authorities/legal advisers for relevant obligations or claims. Transfers require appropriate legal conditions. This form does not transfer data to inactive card-payment or marketing services.
Hosting provider and country: Awaiting operator verification
Email provider and country: Awaiting operator verification
International transfer assessment: Assessment completed for the present application: embedded foreign maps are disabled; fonts/images/scripts are local; analytics, marketing and bank card processing are inactive. SMTP requires a provider, reviewed server, all processing/support countries and documented lawful transfer basis; a password alone cannot enable sending. Optional Maps/WhatsApp links carry no booking details in their URLs and are not required to book. Production guest-data collection is blocked until the hosting origin, provider and all processing countries are reviewed. Production hosting, backups and remote support must be assessed before use. No signed transfer contract, adequacy decision or Board permission is claimed to exist.
Retention periods and disposal plan: Policy 2026-10-08.1: unconverted booking enquiries 30 days; commercial booking/contract records 10 years from the calendar year following the relevant final transaction/stay; redundant outbox copies and rolling backups 30/30 days; disposal logs at least 3 years. A documented continuing legal obligation or dispute suspends disposal of the affected records. The daily job is prepared; production scheduling and restore controls must be installed on the actual server.
Production provider/country details will be completed when the actual server is selected. No assurance of zero international transfers is given before every server/provider is assessed.
Retention and disposal plan
| Data class | Retention period |
|---|---|
| Unconverted enquiries | 30 days |
| Commercial bookings / contract snapshots | 10 years from the following calendar year |
| Redundant email-outbox content | 30 days |
| Rolling backups | 30 days |
| Disposal audit records | At least 3 years |
Enquiry/outbox/backup periods are the operator's minimisation choices, not statutory periods for every document. Commercial transaction documents are archived under TTK Article 82; applicable VUK Article 253 records require five years from the following year, and distance-contract evidence at least three years. Where duties overlap for the same document, the longer applicable period is observed; unrelated guest data is not automatically kept for ten years. The form does not collect ID copies, health data or card numbers. Preview-only guest information is not stored as a booking. Restricted legal-archive records are not used for marketing. Continuing disputes/official preservation obligations are held separately and reviewed within 90 days; the job does not silently lift holds. Deletion requests are assessed and answered within 30 days, explaining any lawful refusal. The prepared daily job deletes eligible rows and linked personal snapshots, and logs category/count/method/time without copying guest names or contact details. Logical database deletion does not guarantee forensic destruction of physical media. Backups expire after 30 days. Restores remain isolated until current holds and disposal records are reconciled and cleanup is rerun before access resumes. Administrator sessions last 30 minutes and cookie preferences 180 days. The actual server operator must install and monitor the job, and control database, journal, disk, backup and support access.
International-transfer assessment
Assessment completed for the present application: embedded foreign maps are disabled; fonts/images/scripts are local; analytics, marketing and bank card processing are inactive. SMTP requires a provider, reviewed server, all processing/support countries and documented lawful transfer basis; a password alone cannot enable sending. Optional Maps/WhatsApp links carry no booking details in their URLs and are not required to book. Production guest-data collection is blocked until the hosting origin, provider and all processing countries are reviewed. Production hosting, backups and remote support must be assessed before use. No signed transfer contract, adequacy decision or Board permission is claimed to exist.
Your rights under Article 11 of the Personal Data Protection Law (KVKK)
You may ask whether your data is processed; request information if it is; learn the purpose and whether use matches that purpose; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate data, or deletion/destruction where the legal conditions apply; request that recipients be notified of correction or deletion/destruction; object to an adverse outcome based solely on automated analysis; and seek compensation for damage caused by unlawful processing.
Requests and response time
Written requests: Yalı Mahallesi 6402 Sokak Kocatepe No:42/A, Karşıyaka / İzmir, Türkiye. KEP: revagroup@hs01.kep.tr. You may use a secure electronic or mobile signature, or email info@revamiami.com from an email address previously supplied to the operator and registered in its system.
Include your name/surname, signature for a written request, Turkish identification number (for foreign nationals: nationality, passport number or identification number if available), service address, email/telephone/fax if available, and your request. Relevant documents may be attached. Do not send an ID photocopy or card image for a routine request; proportionate identity verification may be carried out where needed.
Requests are answered as soon as possible, within 30 days. Processing is normally free; additional costs may only follow the Board's prescribed tariff. Fees caused by the operator's error are refunded. For rejection, an inadequate reply or no timely reply, a complaint may be made to the Personal Data Protection Board within 30 days of learning the reply and, in all cases, within 60 days of the request.
Acknowledging that you read this notice is neither explicit consent nor marketing permission.