This Privacy Policy ("Policy") explains how 3 STARS TURİZM TEKNOLOJİ VE TİCARET LTD. ŞTİ. (VKN: 0011907187, Antalya/Turkey) and its branch in the Republic of Azerbaijan (VÖEN: 2008590231, Baku/Azerbaijan) ("Company", "we", "us") collect, use, disclose, and process your Personal Data.
Our data processing practices comply with the European Union General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK No. 6698), and the Law on Personal Data Protection of the Republic of Azerbaijan.
We are committed to protecting your privacy and ensuring that your Personal Data is handled in accordance with all applicable data protection laws.
This Policy applies to you and all individuals who provide us with their personal data or whose personal data we collect, use, process, store, and/or disclose in connection with our operations.
This Policy supplements but does not supersede any prior consent you may have provided to us. It also does not affect any legal rights we have concerning the collection, use, processing, or disclosure of any individual's Personal Data.
We may occasionally update this Policy to reflect changes in our business needs or applicable laws. All updates will be published online at https://3-stars.com. Notifications of significant changes will also be posted on the Website. By continuing your relationship with us after amendments are published, you accept the updated Policy.
This Policy is part of the terms governing your relationship with us (“Website Terms”) and should be read alongside them. In case of conflict, the Website Terms prevail to the fullest extent allowed by law.
For the purposes of this Policy, “3 STARS DPO” or “DPO” refers to the Data Protection Officer based in Antalya/Turkey and Baku/Azerbaijan. He can be contacted at info@3-stars.com.

Our approach to protecting Personal Data is based on three key principles that are central to all our actions concerning Personal Data.

• User Sovereignty: You have control over your data and can make necessary changes.
• Transparency: We adopt a human-centered approach to processing personal data, being open, honest, and transparent.
• Security: We use industry-leading methods to protect the personal data entrusted to us.

We will only collect, use, and disclose personal data from or related to an individual that is reasonably deemed necessary for the relevant purposes of such collection, use, or disclosure. This may include, but is not limited to, the following:

• Facilitating the provision of our products and services that you utilize, along with periodically sending newsletters, marketing or promotional materials, and any other pertinent information,
• Communicating with you to assist with your inquiries,
• Managing administrative matters related to the products and/or services you have purchased and/or subscribed to,
• Conducting market research and customer satisfaction surveys,
• We will inform you of any additional purposes at the time of obtaining consent (collectively known as the “Purposes”).

If you visit our website without registering or providing us with information, we only collect data that your browser transmits to our server, known as "server log files." When you access our website, we gather the following data, which is technically necessary for displaying the individual web pages to you:

• The specific pages of our website (URL)
• Date and time of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (possibly in anonymized form)

Processing is carried out in accordance with Article 6(1)(f) GDPR, based on our legitimate interest in enhancing the stability and functionality of our website. However, we reserve the right to review the server log files if there are concrete indications of illegal use. Non-anonymized server log files will be automatically deleted after a maximum of seven days.
Our website is hosted by a service provider that offers infrastructure and platform services, computing capacity, storage space, database services, security services, and technical maintenance. We have a contract with them for data processing, which is conducted to ensure the operational readiness of our website, and we have a legitimate interest in this. In this regard, we'd like to refer to Article 6(1)(f) of the GDPR. Furthermore, third parties may also collect data from server log files.

Generally, we may collect personal data from you in one or more of the following ways or circumstances:

• Information provided directly: You may be asked to provide Personal Data when visiting or using certain parts of our websites and/or services. While you are not obligated to share your Personal Data, opting not to do so may prevent you from accessing certain areas of our website or using our services.
• Information collected automatically: Certain information, such as your IP address and device type, is automatically collected when you visit our websites or use our services. This information is valuable because it helps us understand how you interact with our websites and services, allowing us to continue providing you with the best possible experience.
• Information from third parties: Most of the Personal Data we collect comes directly from you. However, some data may be sourced from other channels, such as publicly available information or credible third parties, to conduct background checks related to your relationship with us. We use this information to enhance the Personal Data we have gathered from you.

Where your Personal Data is collected from third parties, we will only use such Personal Data if you have provided consent to the third party, which would also cover our processing of your Personal Data, or where we have a legitimate interest in using the Personal Data to evaluate the suitability of your relationship with us.
We aim to protect the information we share by imposing contractual privacy and security safeguards on the recipient. Whenever you are redirected away from us, we encourage you to read the provider’s relevant privacy policy to understand better how your data is processed.

Where we collect personal data, we will only process it:

• to perform a contract with you, or
• where we have a legitimate interest in protecting the personal data that is not overridden by your rights, or
• by a legal obligation, or
• where we have your consent.

Please note that if you choose not to provide us with your Personal Data or do not consent to our processing of your Personal Data, we may be unable to offer you some or all of our Services or respond to your other requests. For job applicants, we would not be able to assess your suitability for our employment opportunities.

We share information with external parties carrying out tasks on our behalf (including data processors and sub-contractors), as well as with other companies, organizations, government bodies, and individuals outside our company when we have a legitimate legal reason to do so (for example, in connection with any merger or acquisition or to comply with a court order) or when we are instructed to share the information on behalf of our clients.

Unless authorized under the GDPR, Turkish Personal Data Protection Law (KVKK No. 6698), or any other applicable law, we will not collect, use, or disclose your Personal Data without your knowledge and explicit consent. We will make sure to highlight the relevant Purposes to you at the time we collect your Personal Data.
We may obtain your consent through any of the following methods:

• Through express provisions in a contract, application form, and/or registration form to be signed or submitted to us;
• Through notifications on our website;

Insofar as any Purpose(s) are intrinsic to the relationship or provision of services, we reserve the right to decline to engage in the relevant relationship or to provide appropriate services to you if you do not consent to our collection, use, or disclosure of your Personal Data for such purposes.
By voluntarily providing Personal Data to us for any specified purpose, using or accessing our website or computer network, entering our premises or using any of the facilities there, and/or attending or participating in events or programmes organised by us, you (the “User”) specifically, knowingly, and freely consent to the collection, processing, storage, transfer, and use of your Personal Data by 3 STARS TURİZM TEKNOLOJİ VE TİCARET LTD. ŞTİ. (VKN: 0011907187, Antalya/Turkey) and its branch in the Republic of Azerbaijan (VÖEN: 2008590231, Baku/Azerbaijan) in accordance with the European Union General Data Protection Regulation (GDPR), Turkish Personal Data Protection Law (KVKK), and Azerbaijani Personal Data Protection Law.
You may withdraw your consent at any time by contacting us at info@3-stars.com. Withdrawal of consent will not affect the legality of processing based on your prior consent.

There may be occasions when we need to share your Personal Data with third parties. We will disclose your Personal Data only under the following circumstances,

• to our third-party service providers or agents,
• to our auditors and professional advisors,
• to regulators, law enforcement bodies, government agencies, courts, or any other third party to whom disclosure is permitted or required by applicable law or regulation,
• to other parties where we have your consent.

You have the right to withdraw your consent to the collection, use, and/or disclosure of your Personal Data in our possession by submitting your request to our Data Protection Officer at info@3-stars.com at any time.
We will process your request to withdraw consent within a reasonable timeframe from when the request is made. After this period, we will not collect, use, or disclose your Personal Data as outlined in your request.
If you're not able to give your consent, it may impact the services we can offer you. Depending on the degree of your withdrawal of consent for us to process your Personal Data, it might mean that we cannot maintain our current business relationship.

We currently do not use cookies on our website. However, we may use cookies in the future to enhance your experience and improve our services.
Should we implement cookies, we will inform you accordingly and provide options to manage or disable them.

We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include but are not limited to:

• Encryption technologies such as SSL/TLS to secure data transmission,
• Access controls and authentication procedures,
• Regular security audits and monitoring,
• Secure storage and backup solutions,
• Contracts with third-party processors that ensure compliance with data protection laws.

While we strive to protect your Personal Data, no system can be guaranteed to be completely secure. We recommend that you take necessary precautions to protect your own devices and credentials.
For more information or concerns about data security, please contact our Data Protection Officer at info@3-stars.com.

Our website may occasionally contain links to and from the websites of our partner networks and affiliates. If you follow a link to any of these websites, please note that they have their own privacy policies, and we do not accept any responsibility for them. Please check these policies before submitting any personal data to these websites.

The information you voluntarily provide to us will be considered complete and accurate.
We will take reasonable steps to verify the accuracy of the Personal Data received at the collection point. However, you will remain primarily responsible and liable for ensuring that all Personal Data you submit to us is complete and accurate.
We will also take reasonable steps to periodically verify the Personal Data in our possession, considering the scope of our operations. However, you are responsible for notifying us about any applicable changes to your Personal Data. You can amend your Personal Data by contacting the Personal Data Officer at info@3-stars.com at any time.
We shall not be held liable for any inability to provide services if you do not ensure that the personal data you submit to us is complete and accurate.

You have the following rights regarding your Personal Data processed by us:

• Right to Access: You can request access to the Personal Data we hold about you to verify its lawfulness and accuracy.
• Right to Rectification: You may request correction or completion of your Personal Data if it is inaccurate or incomplete.
• Right to Erasure: Subject to applicable law, you can request deletion of your Personal Data where it is no longer necessary for the purposes collected or if you withdraw your consent.
• Right to Restrict Processing: You can request restriction of processing of your Personal Data under certain conditions.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used format and transfer it to another data controller.
• Right to Object: You can object to processing of your Personal Data based on legitimate interests or for direct marketing purposes.
• Right not to be subject to Automated Decision-making: You have the right not to be subject to decisions based solely on automated processing that significantly affect you.
• Right to Withdraw Consent: You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, you can contact our Data Protection Officer at info@3-stars.com. We will respond to your request within the timeframes prescribed by GDPR, KVKK, and Azerbaijani law.
If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction.

Retention of Personal DataThe duration for which we retain your Personal Data depends on its nature and the purposes for which it was collected. We retain your Personal Data only as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, or to protect our legitimate interests.
Specifically:

• We will keep your data for the duration of our business relationship with you.
• After the business relationship ends, we may retain certain Personal Data for a legally prescribed period or as necessary to resolve disputes, enforce agreements, or comply with applicable laws.
• Once the retention period expires, your Personal Data will be securely deleted or anonymized.

We implement appropriate technical and organizational measures to ensure your Personal Data is protected during the retention period.
For further details on retention periods or to make a request related to data retention, you may contact our Data Protection Officer at info@3-stars.com.

In the course of providing our services, your Personal Data may be transferred to and processed by third parties located in countries outside of Turkey, the European Economic Area, or Azerbaijan.
We ensure that any such international transfers of Personal Data are carried out in compliance with applicable data protection laws, including the GDPR, Turkish KVKK, and Azerbaijani Personal Data Protection Law.
Before transferring your Personal Data internationally, we implement appropriate safeguards such as standard contractual clauses, binding corporate rules, or other legally recognized transfer mechanisms.
Your Personal Data will be treated with the same level of protection as required under the applicable data protection laws.
If you would like more information about the specific safeguards we use for international data transfers, please contact our Data Protection Officer at info@3-stars.com.

If you believe that your rights regarding your Personal Data have been violated, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.
For your convenience, here are the primary supervisory authorities related to data protection:

• Turkey: The Personal Data Protection Authority (KVKK) — https://www.kvkk.gov.tr/
• European Union: European Data Protection Board (EDPB) — https://edpb.europa.eu/
• Azerbaijan: The Ministry of Transport, Communications and High Technologies of the Republic of Azerbaijan — https://mincom.gov.az/

You may contact our Data Protection Officer at info@3-stars.com for assistance in exercising your rights or filing a complaint.
We are committed to cooperating fully with data protection authorities in any investigations.

If any provision of this Policy is deemed illegal, void, invalid, or unenforceable under the laws of any jurisdiction, the legality, validity, and enforceability of the remainder of this Policy in that jurisdiction will not be affected; nor will the legality, validity, and enforceability of the entire Policy in any other jurisdiction be impacted.
Nothing in this Policy shall be interpreted as providing indemnity to any Customer regarding any Customer Data or its use.
According to this Policy, we're not responsible for any losses that the Customer may suffer due to our collection, storage, or use of Customer Data. In any event, we expressly exclude any liability to the Customer for indirect or consequential losses, special losses, loss of profits, loss of contracts, loss of reputation or goodwill, or other tangential or intangible losses that a Customer may incur due to a breach of this Policy by us or any of its agents or service providers.

This Privacy Policy may be updated due to ongoing developments on our website and changes in legal or regulatory requirements.

If you have any questions, concerns, or requests regarding your Personal Data or this Privacy Policy, please contact our Data Protection Officer at info@3-stars.com.
You may also reach us via the contact methods listed on our website at https://3-stars.com/en/#contacts.
We strive to respond to all inquiries promptly and transparently.