Privacy Policy

1. Who is responsible

Your personal data is processed by Villa Pala acting as the data controller.

Address: Dalyan Mahallesi 227. Sokak No: 23/2, 48600 Ortaca/Muğla, Türkiye

Email: info@villapala.com — Phone: +90 540 929 54 14

2. What we collect

What we collect depends on how you get in touch with us:

• Contact form: your name, email address, subject and message.
• Booking enquiry via WhatsApp: your phone number, your name and the stay details you share in the message (dates, number of guests).
• Booking record: once a booking is confirmed we record the guest name, stay dates and number of guests.
• Technical and usage data: IP address, browser and device information, the pages you visit, how long you stay and how you move around the page.
• Your preferences: the language you selected and whether you turned analytics cookies off.

3. Why we process it, and on what legal basis

• To answer your booking enquiry and enter into the accommodation contract — KVKK art. 5/2-c and GDPR Art. 6(1)(b) (performance of a contract).
• To reply to your questions and stay in touch — KVKK art. 5/2-f and GDPR Art. 6(1)(f) (legitimate interest).
• To keep accommodation records and meet our statutory retention duties — KVKK art. 5/2-ç and GDPR Art. 6(1)(c) (legal obligation).
• To measure how the site is used, spot errors and improve the content — KVKK art. 5/2-f and GDPR Art. 6(1)(f) (legitimate interest). Measurement is on by default; you can switch it off at any time with the button on the Cookie Policy page.

4. Who we share it with

We do not sell your personal data. We rely on the following service providers to run the site, and because some of them are based abroad your data is transferred outside Türkiye:

• Formspree (USA): the name, email and message you type into the contact form reach us through this service.
• Meta / WhatsApp (USA and Ireland): when you write via WhatsApp, your message and phone number travel through WhatsApp's infrastructure.
• Google Ireland Ltd. / Google LLC (USA): Google Analytics measurement and the embedded Google Map on the contact page.
• Microsoft Corporation (USA): Microsoft Clarity usage analytics and session recording.
• Vercel Inc. (USA): hosting of the site and a cookieless visitor counter.
• Supabase: the database that stores booking records and site content.
• Public authorities: only where legislation requires it and limited to what is requested.

5. International transfers

The providers listed above may keep servers outside Türkiye. These transfers take place in line with the KVKK provisions on transfers abroad and Chapter V of the GDPR, on the basis of the providers' standard contractual clauses and their own data protection commitments.

If you would rather avoid such a transfer, call us directly instead of using the contact form.

6. How long we keep it

• Contact form messages: up to 2 years after the correspondence ends.
• Booking records: for the period required by tax and commercial legislation after the stay ends (as a rule, 10 years).
• Analytics data: up to 14 months in Google Analytics and up to 13 months in Microsoft Clarity.
• Once these periods expire the data is deleted or stripped of anything that links it to you.

7. Your rights

Under KVKK art. 11 and GDPR Art. 15-22 you have the right to:

• Learn whether we process your personal data and, if so, request information about it,
• Learn the purpose of the processing and whether the data is used accordingly,
• Know the third parties, at home or abroad, to whom the data is transferred,
• Ask for incomplete or inaccurate data to be corrected,
• Ask for the data to be erased or destroyed,
• Object to the processing and request that your data be ported,
• Claim compensation if you suffer damage because the data was processed unlawfully.

To exercise these rights, write to info@villapala.com. We answer within 30 days at the latest. If you are not satisfied with the outcome you may complain to the Turkish Personal Data Protection Authority, or, if you live in the European Union, to the data protection authority of your own country.

8. Security

Traffic to the site is encrypted with HTTPS. Only authorised accounts can reach the admin panel where booking records are kept, and that panel is closed to search engines. Even so, no transmission over the internet can be guaranteed to be completely secure.

9. Children

The site is not aimed at people under 18 and we do not knowingly collect data from children. If you believe you have sent us data belonging to your child, write to us and we will delete it.

10. Changes

We may update this text from time to time. The current version is always published on this page, and the date at the top shows the most recent change.