Skip to content
SunflowSunflow
Demo

KVKK Privacy Notice

On this page

This notice explains, under Turkish Personal Data Protection Law No. 6698 ("KVKK"), how your personal data is processed when you visit sunflowapp.com and when you contact us through the contact / demo form.

Data controller#

This website is operated under the Sunflow brand. For requests about your personal data: sunflowtech@outlook.com

This notice covers website visitors and people who contact us through the form. For guest data in the guest portal used by hotels, the roles may differ; see "About the guest portal" below.

Personal data we process#

Demo / contact form: hotel name, contact person's name, e-mail address, phone number (optional), number of rooms (optional), the package you are interested in, and your message. The state of the privacy notice and contact consent boxes you tick and the time the form was sent are recorded as well.

Technical data: when you submit the form, your IP address is kept briefly in server memory to prevent abuse (limiting many requests from the same IP in a short time) and is not stored permanently. For the security check on submission, your IP address and the verification data are sent to the Cloudflare Turnstile service. When you visit the website, the hosting provider's server logs record your IP address and request details.

Browser preferences: your language, theme and cookie choices are stored on your device. See the Cookie Policy for details.

Direct contact: the information you share when you write to us by e-mail, phone or WhatsApp.

Purposes#

  • To respond to your demo and information requests and to schedule a call.
  • To keep the website and the form secure and to prevent bots and abuse.
  • To remember your language, theme and cookie choices.

Contact form data is used only to respond to your request.

Intended grounds:

  • Processing is directly related to establishing a contract at your request (KVKK Art. 5/2-c).
  • Processing is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms: website security and abuse prevention (KVKK Art. 5/2-f).

How data is collected#

Personal data is collected from you when you fill in the form, and automatically by your browser and our server while you use the website. The website's hosting provider (Vercel Inc.) automatically collects server logs for every request to the site (request details such as IP address, date and time, the page requested and browser information).

Transfers#

Your personal data is transferred to the service providers below, only for the stated purpose. Their servers may be located outside Türkiye:

  • Vercel Inc.: hosting the website; IP addresses in server logs.
  • Google LLC (Gmail SMTP): delivering form submissions to Sunflow by e-mail.
  • Microsoft Corporation (Outlook): storing delivered form submissions in Sunflow's mailbox.
  • Cloudflare, Inc. (Turnstile): bot protection and the security check on the form.

Transfers abroad are carried out in line with the conditions set out in Article 9 of the KVKK.

Apart from these, your personal data is not shared with third parties; it may be shared with competent authorities where legally required.

Retention#

  • Information sent through the demo/contact form is not stored on the website or in any database; it is only delivered by e-mail to Sunflow's mailbox and used only to respond to your request. These e-mails are kept until your request is concluded and afterwards for at most 2 years for legal obligations and possible disputes , and are then deleted.
  • The IP information kept for abuse prevention stays in server memory only briefly and is not stored permanently.

About the guest portal#

For guest data processed in the guest portal Sunflow provides to hotels, the hotel may be the data controller and Sunflow the data processor. In this context:

  • Guest data is never shared with any third party.
  • To verify a guest, confirming that they are staying at the hotel is enough (room number and date of birth).
  • When a PMS integration is set up, no personal data is requested from the guest; only the stay is verified.
  • Notifications are sent only with the guest's permission.
  • General manager, manager and staff roles are separate; each user sees only the screens they are authorised for.
  • Data is kept separately for each hotel and connections are encrypted with HTTPS.
  • With modules in development (requests and complaints, spa and doctor appointments), photos attached to complaint reports and appointment details will also be processed in future; this notice will be updated before those modules go live.

Your rights#

Under Article 11 of KVKK you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties in Turkey or abroad to whom it is transferred, to request correction if it is incomplete or inaccurate, to request deletion or destruction under the conditions of Article 7, to request that these actions be notified to third parties to whom it was transferred, to object to a result against you arising solely from automated analysis, and to claim compensation if you suffer damage due to unlawful processing.

How to apply#

You can send requests about your rights to sunflowtech@outlook.com. Requests are handled under the Communiqué on the Procedures and Principles of Application to the Data Controller and concluded within thirty days at the latest.