otelka.Türkçe← Home

Data Processing Agreement

Last updated: 25 October 2026 · Version: 2026-10-25-v2

This English version is provided for convenience. If there is any inconsistency, the Turkish version prevails.

This agreement sets out the mutual obligations of Otelka Yazılım (“Otelka”) and the accommodation business using the service (the “Property”) regarding the processing of personal data of guests and of the Property staff’s work records. It forms an integral part of the Terms of Service.

1. Roles

For this data, the Property is the data controller and Otelka is the data processor. Otelka processes the data only on the Property’s instructions and for the purpose of providing the Service; it does not use it for its own purposes, sell it to third parties or combine it with other properties’ data.

Under Article 12 of the Turkish Law No. 6698, the Property and Otelka are jointly responsible for data security obligations. Otelka accepts that this responsibility cannot be transferred entirely to the Property by contract and undertakes the commitments below.

2. Scope of processing

  • Subject and purpose: running the Property’s reservation, channel, front-office, invoicing and identity-reporting operations through the Service.
  • Duration: as long as the Property’s account is open; on termination, section 10 applies.
  • Data categories: guest identity and contact details, stay and reservation details, vehicle licence plate for car park management, amount and payment method, channel payment summary (card brand and last four digits), ID type and number, nationality, gender, date and place of birth for identity reporting, guest profile and notes, guest messages, invoice and company account details, booking page consents, Property staff work records.
  • Data subjects: the Property’s guests and persons making reservations, representatives of companies and agencies, Property staff.
  • Instructions: the Property’s instructions are this agreement and the settings and actions the Property makes in the Service (such as channel connections, the booking page, identity reporting, the choice of retention period and staff permissions).

3. Otelka’s commitments

  • Processing only on instructions: we process the data only on the Property’s instructions and within this agreement. If a legal obligation requires us to do otherwise, we inform the Property in advance unless this is prohibited.
  • Confidentiality: everyone with access to the data is bound by confidentiality; access is limited to the fewest people necessary. Support access by Otelka operators requires two-step verification and is logged.
  • Technical and organisational measures (Art. 12): encrypted connections (HTTPS/TLS); row-level access rules isolating properties in the database; role- and department-based access with verified sessions; extra verification on new devices and for sensitive actions; irreversible password hashes and hashed IP addresses; rate limits and bot protection; card numbers kept out of our systems and masked in text; encrypted backups; ID numbers and dates of birth kept out of application logs; regular security testing.
  • Breach notification: we notify the Property without undue delay and within 24 hours at the latest after becoming aware of a breach. The notice covers the nature of the breach, the data categories affected, likely consequences and the measures taken, so that the Property can meet its 72-hour notification duty to the Board. We support the Property in investigating the breach and preparing the notification.
  • Sub-processors: we publish the current list in the Personal Data Notice and impose obligations consistent with this agreement on sub-processors. We inform the Property before adding a new sub-processor; if the Property objects on reasonable grounds, it may terminate its subscription without penalty.
  • Data subject requests: if a guest contacts us directly, we do not handle the request ourselves but forward it to the Property without delay, and provide the records (including export tools) the Property needs to respond.
  • Retention: we automatically delete guest identity details when the period chosen by the Property (default 24 months) ends after check-out, vehicle licence plates 30 days after check-out, and channel messages 24 months after the last message. Other data is kept while the account is open and can be deleted by the Property. Reservations received from a channel (OTA) cannot be deleted by the Property; while the channel connection is active, the fields the channel sends (e.g. guest name, payer, dates, amount, channel note) stay in sync with the channel and cannot be changed by the Property (except a record changed while the connection was off, until the channel sends a new update; on an early check-out the check-out date moves to the day the guest left (at the earliest the day after check-in), and the Property edits the channel’s record in the channel’s extranet). The Property forwards deletion requests for these fields to us and to the channel, and we fulfil them within a reasonable time. Unless the record is also deleted at the channel, the channel may send these fields again.
  • Information: we respond to the Property’s reasonable, pre-announced requests needed for its own compliance.

4. The Property’s obligations

  • It collects data lawfully, on a valid legal ground, and fulfils its duty to inform guests.
  • It checks that the privacy notice shown to guests on the booking page, generated by Otelka from the Property’s details, is accurate and current, and keeps its property details up to date.
  • It is authorised to connect its channel accounts and acts in accordance with its contracts with the channels.
  • It defines its staff’s accounts and permissions only as needed for their work and closes access for staff who leave.
  • It fulfils its legal obligations such as identity reporting and does not enter data it does not need into the Service.

5. Channel connection (Channex)

  • The channel connection is set up on the Property’s instruction through the Channex connectivity platform. Channex is a sub-processor of Otelka.
  • Reservations, modifications, cancellations, guest details and guest messages are received from channels; the rates, availability and restrictions entered by the Property and the message replies it writes are sent to channels. Guest details of reservations made on the booking page or entered manually are not sent to channels.
  • Card numbers stay in Channex’s secure environment; Otelka only receives summary data such as the card brand and last four digits.
  • Otelka never asks for channel account passwords and does not sign in to channel extranets on the Property’s behalf.

6. Identity reporting and the Otelka KBS application

  • Identity reporting is the Property’s legal obligation. For reporting, Otelka passes only the necessary fields (first and last name, ID type and number, country, date and place of birth, gender, room, check-in/check-out time) to the Otelka KBS application running on the Property’s own computer and paired and approved by the Property. The guest’s phone, email, address, notes and amounts are not passed on.
  • The application processes this data in memory only during reporting and submits it to the Police or Gendarmerie KBS with the Property’s own KBS account. This transfer is made by the Property, as required by its legal obligation.
  • The KBS username, password and two-step verification details are stored only on the Property’s computer, in the operating system’s encrypted key store, and are never sent to Otelka. Only the result of the report (status, result code and KBS transaction number) and the application’s status information come back to Otelka.
  • For support and troubleshooting, the application sends technical diagnostic records (step, error code, duration, application and browser version, screen-structure counts) to Otelka. These records contain no guest data, identity details, passwords or IP addresses; only the Otelka support team sees them, and they are deleted after 30 days.
  • The application’s communication with Otelka is signed with a key generated on the device; the Property can remove the connection at any time.

7. Booking page

Data entered by guests on the booking page is processed on the Property’s behalf. Otelka does not collect payments from guests. The guest’s confirmation of having read the privacy notice and any optional marketing permission are recorded with the time and text version. The booking confirmation is emailed to the guest and the reservation notice to the Property.

8. Reservation import by email (previous version)

For accounts using this method, Otelka does not connect to channels; data is obtained when the Property forwards reservation notifications it has received to Otelka. There are two ways:

  • Method A — Adding a notification address: the Property adds the email address assigned to it by Otelka to the notification recipients in the extranet of its channel manager or booking platform, with its own account and authority.
  • Method B — Forwarding from the mailbox: the Property forwards reservation notifications arriving in its own mailbox to Otelka with a forwarding rule. For data minimisation, a filtered rule covering only reservation senders is recommended.

In this setup the Property is responsible for being authorised to make the setting, complying with its platforms’ terms and removing the setting when its membership ends. Otelka is responsible for an accurate and clear guide, recommending the setup that receives the least data, generating the assigned address unpredictably and keeping it confidential, warning the Property when an email arrives from an unrecognised sender for the first time, and disabling the address when the account is closed permanently; emails sent to a closed address are not processed. When the subscription is paused the address stays assigned and incoming reservation emails continue to be processed for up to 12 months so the Property can resume where it left off; the Property can stop this at any time with an account closure request.

9. Transfers abroad

Some sub-processors have servers or headquarters outside Türkiye. These transfers follow the procedures in Article 9 of the KVKK and are limited to the minimum data needed to provide the service. The database holding guest data is in the European Union (Frankfurt). The list of providers is published in the Personal Data Notice.

10. Termination, return and deletion

When the subscription ends, the data is kept so that the Property can resume where it left off, and the Property can still view and export it. All data is permanently deleted 30 days after the Property owner’s account closure request; deleted data disappears from encrypted backups within 30 days at the latest. Financial records that must be kept by law and deletion records that contain no guest data (3 years) are excluded.

11. Term and changes

This agreement takes effect when the Property opens an Otelka account and remains in force while the account is open. Material changes are announced to the Property before they take effect. For questions and personal data requests: iletisim@otelka.com.