Legal Information & Policies

This Privacy Notice explains which personal data we process when you visit mydorahotel.com, book a stay, or get in touch with us; why we process it; on what legal basis; who receives it; how long we keep it; and what rights you have. It is our disclosure under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors in the European Economic Area, the United Kingdom and Switzerland, Articles 13 and 14 of the GDPR. How we use cookies is set out in more detail in our Cookie Notice.

• ERDOĞAN TURİZM İŞLETMECİLİĞİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ, trading as My Dora Hotel
• Rıhtım Cad. Tayyareci Sami Sk. No: 17, 34716 Kadıköy, İstanbul, Türkiye
• MERSİS: 0351001034300011 · Registered e-mail (KEP): erdoganturizm@hs02.kep.tr
• E-mail: info@mydorahotel.com · Phone: +90 216 414 83 50

When you book a stay

• Data: first and last name, e-mail address, phone number, billing address (country, region, city, street, postal code), stay dates, number of adults and children's ages, room and bed choice, your notes to the hotel, promo code; for an airport pickup, the airport, number of vehicles, flight number and arrival date; the guest names for each room where a booking link names them; the IP address you pay from.
• Purposes: making and managing your reservation, taking payment, telling our reception about your arrival and requests, arranging the airport pickup you ordered, answering your questions about the booking, and keeping the accounting records the law requires.
• Legal basis: performance of the contract you make with us (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)); our legal obligations, such as commercial and tax record keeping (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)); and our legitimate interest in preventing payment fraud (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Card details are typed into the payment form of our payment institution, iyzico; we never see or store your full card number. We keep the record iyzico returns about the payment, which includes the card's first six and last four digits and its type.

When we prepare a booking link for you

If you ask us — by phone, in person, or through our WhatsApp assistant — to prepare a booking, we create a personal checkout link holding your name, e-mail address, phone number, the guest names and the stay you asked for, so you can pay without typing them again. The legal basis is taking steps at your request before entering into a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).

Our WhatsApp assistant can also tell you the status and dates of a reservation when you give its reservation number together with the e-mail address or phone number it was booked with; it never discloses names, contact details or addresses.

Our guest list (news and offers by e-mail)

• Data: e-mail address, first and last name where given, the language you used, how you joined the list and, where applicable, the coupon code you received.
• How you join: when you claim a coupon on our site, which states that you join the list; when you enter your contact details at checkout; and when you answer our sustainability survey.
• Purpose: sending you news and offers about the hotel.
• Legal basis: your consent when you claim a coupon (KVKK Art. 5(1); GDPR Art. 6(1)(a)); our legitimate interest in keeping our guests informed, for addresses given at checkout or in the survey (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

You can leave the list at any time with the unsubscribe link in any e-mail, or by writing to info@mydorahotel.com.

Feedback and the sustainability survey

• Data: for feedback left with the QR code in our lobby — your rating, the topics you choose, your comment and, if you give it, your room number; for the sustainability survey — your name, e-mail address and ratings.
• Purposes: improving our service and our sustainability practice, and thanking you for the survey by e-mail.
• Legal basis: our legitimate interest in measuring and improving the quality of our service (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Analytics and advertising

We measure how the site is used and how our advertising performs with cookies and similar technologies from Mixpanel, Google (Google Analytics, Google Tag Manager, Google Ads) and Meta. Which of these run, and when, depends on your cookie preferences and the region you visit from; the Cookie Notice describes each one, the cookies it sets, and the legal basis.

• When measurement is on and you book, we link your analytics profile to your name, e-mail address and phone number, so a booking can be connected to the visit that led to it; we also report the payment and booking from our server, with your browser and device details and IP address.
• When marketing is on, your e-mail address, phone number and, for Meta, your name, city, postal code and country are shared with Google and Meta only as irreversible SHA-256 hashes, together with your Meta browser identifiers and IP address, so that a booking can be matched to an ad.

Separately, and for every visitor, our server counts page visits without cookies or identifiers: the page, language, country, device type, the campaign tags in the link and the referring website's name. No IP address, browser identifier or user identity is kept. The legal basis is our legitimate interest in knowing how visitors reach us (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Security and operation of the site

• Data: IP address, browser and device details, the pages you request, and technical error reports.
• Purposes: delivering the site, protecting it from abuse (for example, limiting how often one connection can submit a form), presenting it in the right language and currency for your country, and finding and fixing faults.
• Legal basis: our legitimate interest in running a secure and working site (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

Your country is read from your connection and kept in a cookie for 30 days. Error reports are collected without cookies; only when measurement is on do they carry the same pseudonymous identifier as our analytics, so a fault can be traced to the session that met it.

When you contact us

When you write to us by e-mail or WhatsApp, or call us, we process your contact details and what you tell us in order to answer you (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)). WhatsApp messages are carried by WhatsApp, a Meta service.

Through the forms on our site, the checkout and payment pages, our WhatsApp assistant, e-mail and phone, and automatically through your browser and the cookies described in our Cookie Notice.

Providing the data marked as required at checkout is necessary to make a reservation; without it we cannot book your stay. Everything else is optional.

We share personal data only as far as each purpose requires:

• iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico, Türkiye) — payment processing, including your name, contact details, billing address and IP address; an independent controller for its legal obligations as a payment institution.
• Reseliva (Türkiye) — our hotel reservation system, which receives your reservation.
• The airport transfer company we work with — your name, phone number and flight details, only when you order a pickup.
• Service providers acting on our instructions: Vercel (hosting; functions run in Frankfurt, Germany), Supabase (database, Frankfurt), Resend (e-mail delivery and our guest list, United States), Slack (our team's booking and feedback notifications, United States), Sentry (error reports, Frankfurt), Mixpanel (analytics, EU data residency), Mux (video streaming, which receives your IP address when a film plays) and Mapbox (the map on our home page, which receives your IP address when the map loads).
• Advertising and analytics platforms: Google and Meta, as described above and in the Cookie Notice.
• Public authorities and courts, where the law requires it.

We never sell or rent your personal data.

Several of the recipients above are outside Türkiye. Transfers abroad from Türkiye rely on the standard contracts published by the Personal Data Protection Board, signed with each recipient and notified to the Authority (KVKK Art. 9(4)). For visitors in the EEA, the United Kingdom and Switzerland, transfers to the United States rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise on standard contractual clauses.

• Bookings and payments: 10 years from the end of the year of the booking, as the Turkish Commercial Code (Art. 82) and the Tax Procedure Law (Art. 253) require for commercial and tax records.
• Booking links: until 30 days after the link expires (a link is valid for 48 hours unless we set otherwise).
• Guest list: until you leave it.
• Feedback and survey answers: 2 years.
• Analytics and advertising identifiers stored with a booking: 26 months.
• Cookie-free visit counts: 14 months.
• Error reports: up to 90 days.
• Messages you send us: as long as needed to answer you and, where they concern a booking, as long as that booking's records.

Data held by Mixpanel, Google and Meta is kept under each service's own retention settings, described in our Cookie Notice. When a period ends, we delete or anonymise the data.

Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information about it; learn the purpose of the processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; have incomplete or inaccurate data corrected; have it erased or destroyed under the conditions of Article 7; have the correction, erasure or destruction notified to the third parties it was transferred to; object to a result to your detriment that arises solely from automated analysis; and claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interest or for direct marketing; where processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

How to apply: in writing to the address above, by registered e-mail (KEP) to erdoganturizm@hs02.kep.tr, or by e-mail to info@mydorahotel.com from the e-mail address you gave us. We answer free of charge within 30 days at the latest. If your request is refused or not answered, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); visitors in the EEA, the United Kingdom and Switzerland may also complain to the supervisory authority where they live.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We update this notice when our processing changes. The current version is always published on this page.

This Accommodation Sales Agreement has been drawn up between MY DORA HOTEL, ERDOĞAN TURİZM İŞL.SAN.TİC.LTD.ŞTİ., Rasimpaşa Mah. Rıhtım Caddesi Tayyareci Sami Sokak No 17, 34716 Kadıköy / Istanbul (hereinafter referred to as "Hotel"), and the consumer making the reservation, regarding accommodation services.

The subject of this agreement covers the mutual rights and obligations of the parties pursuant to the provisions of Law No. 6502 on the Protection of Consumers and the Distance Contracts Regulation, regarding the hotel accommodation service sold electronically by the Hotel through www.mydorahotel.com.

• The consumer acknowledges having received, read and understood all preliminary information regarding the subject, sales price, payment method and other details of the contracted service/product, and confirms this electronically.
• Identity and age verification is carried out upon check-in. If a discrepancy is found due to incorrect or incomplete information, the difference will be collected at hotel check-in.
• The consumer acknowledges that check-in to rooms is possible at the earliest at 14:00 and that rooms must be vacated by 12:00 at the latest on the day of departure.
• The Hotel is not responsible for any loss, damage or theft of valuables sustained by the consumer at the accommodation facility.
• Child discounts apply when children stay in the same room as their parents. If a discrepancy is detected between the declared age and the age on the identity document at check-in, the price difference will be collected from the consumer.
• Force majeure events such as adverse weather conditions, road obstruction, terrorism, risk of war, flood, fire and unforeseeable technical issues are valid grounds for exemption.

In resolving disputes arising from the implementation of this agreement, the provisions of this agreement, Law No. 6502 on the Protection of Consumers and the relevant Regulation shall apply. The parties may apply to Consumer Courts and/or Consumer Arbitration Committees within legal limits. The competent courts for the resolution of disputes are the courts and enforcement offices of Istanbul.

The consumer shall pay the contract price via credit card through the Hotel's website or by bank transfer/EFT to the bank accounts specified by the Hotel. All services included in the price are detailed on the accommodation information page; services beyond these, such as food and beverages, personal expenses and transportation, are subject to additional charges. The consumer is obliged to pay the full contract amount at the time of registration.

• For cancellations and changes, it is necessary to contact the support line at +90 216 414 83 50 or to send written notification to info@mydorahotel.com.
• If the consumer requests cancellation or change up to 1 day before the check-in date, the full amount will be refunded.
• An airport pickup bought with the reservation is non-refundable: its fee is not refunded, even when the reservation is cancelled within the free cancellation period.
• If the consumer fails to notify in writing that they cannot travel to the facility, the Hotel has the right to cancel all reservations 24 hours after the start of the accommodation period; no refunds will be made for such cancellations.
• If the Hotel fails to fulfil its obligations, the consumer may terminate the agreement. In case of termination, all collected payments shall be refunded with statutory interest within 14 days from the receipt of the termination notice.
• In the event of early departure, the consumer accepts and undertakes to pay the full contract amount. Refunds will be made to the credit card or bank account used during the reservation.
• If the hotel is not checked into without cancellation, the accommodation fee will not be refunded. In documented cases of force majeure such as death, illness or accident, the fees for the unused period will be refunded.

This Cookie Notice explains how we use cookies and similar technologies on this website, in accordance with the GDPR and, where applicable, the Turkish Personal Data Protection Law (KVKK). This notice is separate from, and independent of, the consent action itself; your explicit consent is captured separately through the cookie preferences panel.

Your personal data is processed, as data controller, by ERDOĞAN TURİZM İŞL.SAN.TİC.LTD.ŞTİ. ("My Dora Hotel", "we", "our"), for the purposes described below.

A cookie is a small text file sent by the website you visit to your browser and stored on your device. Cookies help a website function correctly, remember your preferences, and gather statistical information about how the site is used.

Necessary Cookies

Required for the site's core functionality (language and currency preference, remembering booking steps, security). These rely on legitimate interest and contract-performance grounds; they do not require your consent and cannot be switched off.

Measurement / Analytics Cookies

Help us understand how many visitors use our site, which pages they visit, and how (e.g. room search, booking steps, page views). This category uses two services:

• Mixpanel Inc., including Session Replay and Heatmaps: Mixpanel may record a sample of on-screen interactions (clicks and page layout) so we can see where guests engage or get stuck; text and form inputs are masked by default, and payment iframes are not recorded.
• Google Analytics 4 (Google) — _ga, _ga_ followed by our property id: distinguishes visitors and keeps the session's state. Lifetime: 2 years.

Measurement cookies follow the same regional rule as marketing cookies below: for EEA, UK and Swiss visitors (and where country is undetermined) they are off until you consent; in other countries, including Türkiye, they are on by default, and you can switch them off at any time. While measurement is off, no measurement data is collected, Mixpanel's script is not loaded on your device, and Google Analytics sets no cookies.

Marketing Cookies

Marketing cookies let us measure ad performance (e.g. whether an ad led to a booking) and show you relevant offers on other platforms. They are used by Meta and Google.

For EEA, UK and Swiss visitors (and where country is undetermined), marketing cookies are off until you choose "Accept all" or switch them on in the cookie preferences. In other countries, including Türkiye, they are on by default, and you can switch them off at any time in the cookie preferences. When off, the Meta tag does not load. The Google tag (Google Tag Manager) loads for every visitor via Google Consent Mode; while both measurement and marketing are off, it sends only cookieless signals without advertising identifiers, which Google uses to estimate conversions in aggregate. It sets no advertising cookies and shares no contact details.

If marketing cookies are on, your email address and phone number are converted at checkout into an irreversible SHA-256 hash in your browser before being shared with Google and Meta, so that they can match a booking to an ad click without receiving the plain values. We report completed bookings to Meta from our server only if marketing consent was on when paying: booking value, currency, room types, hashed contact details (for Meta additionally hashed first name, last name, city, postcode, country), browser identifiers, and IP address/user agent at checkout. Payment card data is never shared with advertising platforms.

• Meta Pixel — _fbp, _fbc: Browser identifier; identifier of the Meta ad click that brought you. Lifetime: 90 days.
• Google Ads — _gcl_au, _gcl_aw: Conversion measurement; identifier of the Google ad click. Lifetime: 90 days.

We process your personal data to operate the site, improve the user experience and booking flow, measure service quality, and perform statistical analysis.

Processing for measurement/analytics and marketing cookies for visitors in the European Economic Area, the United Kingdom and Switzerland is based on your consent (GDPR Art. 6(1)(a)). You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal. For visitors in Türkiye and all other countries, these cookies are on by default and you can switch them off at any time in the cookie preferences; this processing relies on our legitimate interest in measuring and improving our site and the performance of our advertising (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f) where it applies), balanced by your right to switch it off at any moment.

Data is collected automatically, through your browser, while you use the site.

Measurement/analytics data is transferred to Mixpanel Inc. (United States) and to Google (see below) under the regional rule described above. Technical error and performance diagnostics are processed by Sentry (Functional Software, Inc.) in the EU (Frankfurt, Germany). These reports are collected without cookies or identifiers; only where you have consented to measurement is the pseudonymous measurement identifier attached so a fault can be traced to a session. Your personal data is never sold or rented for marketing purposes.

For Google Analytics and for marketing cookies, we work with the following vendors:

• Meta: For EEA and Switzerland visitors: we and Meta Platforms Ireland Limited (Block J, Serpentine Avenue, Dublin 4, Ireland) are joint controllers for collecting the data and transmitting it to Meta. UK visitors: the joint controller is Meta Platforms, Inc. (1 Meta Way, Menlo Park, CA 94025, USA). Türkiye and other countries: Meta Platforms, Inc. processes data on our behalf. Meta uses data as an independent controller for its own purposes (such as personalising ads), processing in the United States and other countries.
• Google: Contracting party: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); for UK visitors, Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google acts as our processor for Google Analytics and for matching hashed contacts, and as an independent controller for conversion measurement. Data may be processed outside your country, including the United States; Google LLC uses the EU-U.S. Data Privacy Framework (and UK/Swiss extensions) and standard contractual clauses.

Transfers abroad from Türkiye rely on the standard contracts published by the Personal Data Protection Board, signed with each recipient and notified to the Authority (KVKK Art. 9(4)). For EEA/UK/Switzerland, transfers rely on adequacy decisions, the Data Privacy Framework, or standard contractual clauses as stated above.

Your cookie preference (consent record) is stored in your browser for up to 180 days, after which you will be asked again. Your consent will also be requested again if this policy changes materially.

Under GDPR Art. 15-21 (and KVKK Art. 11, where applicable), you have the right to: know whether your data is being processed; request information about the processing; learn the purpose of processing and whether it is used accordingly; know the third parties to whom your data is transferred, domestically or abroad; request correction of incomplete or inaccurate data; request erasure or destruction of your data under the conditions set out in applicable law; request that these actions be notified to third parties to whom your data was transferred; object to a result that is to your detriment arising solely from automated analysis; and claim compensation for damage arising from unlawful processing.

To exercise these rights, contact us at info@mydorahotel.com.

You may change or withdraw your measurement/analytics and marketing cookie preferences at any time using the "Cookie Preferences" button directly below this notice. Switching marketing off removes the Meta cookies from your browser and stops further sharing; it does not recall data shared before the change.

Cookie Preferences