Personal Data Notice (KVKK)

Last updated: 25 October 2026 · Version: 2026-10-25-v2

This English version is provided for convenience. If there is any inconsistency, the Turkish version prevails.

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), this notice explains how Otelka Yazılım ("Otelka") processes personal data.

1. Data controller

2. Our two roles

a) As data controller: Otelka is the data controller for the representatives and users of properties that open an Otelka account, billing details, visitors to our marketing website and people who contact us through the contact form or by email. This notice mainly describes this data.

b) As data processor: the property concerned is the data controller for its guests’ data and its staff’s work records. Otelka processes this data only on the property’s instructions and on its behalf; it does not use it for its own purposes, sell it or combine it with other properties’ data. The privacy notice prepared on the property’s behalf for guests is shown on the booking page; Otelka’s commitments are in the Data Processing Agreement.

3. Personal data processed

Data for which we are the controller

• Account and user: name, email, phone, role and permissions; username for staff accounts without email; for Google sign-in, the name, email and account ID shared by Google.
• Property: property name, address and contact details, room structure, images, the bank account (IBAN) shown on the booking page, and the tax certificate if uploaded (for sole proprietorships it may contain a Turkish ID number).
• Billing and payment: billing name, tax office, tax or Turkish ID number, billing address; the name, email, phone, address and IP address at the time of payment sent to the payment institution. Card details never enter Otelka.
• Security: an irreversible hash of the password, login attempts, a hash of the IP address, recognised devices (country and browser information), session and authorised-action records, app notification (push) identifiers.
• Otelka KBS application: device name, operating system, application version, the device’s public key and fingerprint, a hash of the IP address, last seen time, status and error codes. The KBS username, password and two-step verification details never reach Otelka.
• Contact: support requests and the contact form (name, email, phone, property name, message).
• Marketing website: cookie preferences (a random preference ID, categories, text version, country code — no IP address or identity is stored); with consent, page view and click measurement with Google Analytics.

Data we process on behalf of properties (processor)

• Reservation: name, email and phone, stay dates, room, number of adults and children, children’s ages, for each guest adult / child status and (if no date of birth is recorded) age, nationality, arrival time, notes, amount, payment method and status, booking channel and channel codes; if the property records it, the vehicle licence plate for car park management.
• Channel payment summary: card brand, last four digits, virtual card balance and usable date (the card number stays in the channel infrastructure). In the previous version, only for accounts where the property explicitly enabled it, virtual card details are kept in an encrypted vault until at most 180 days after check-out.
• Identity and identity reporting: first name, last name, ID type and number (Turkish ID or passport), nationality, gender, date of birth, place of birth.
• Guest profile: contact details, language, preferences, VIP or unwanted-guest flag and the property’s note, communication permissions.
• Messages: guest messages received from and sent to channels (card numbers are masked; attachments are not stored).
• Invoices and company accounts: recipient name on invoices (masked) and amounts; tax number, address and contact details of company and agency accounts.
• Booking page consents: time of consent, text version, marketing permission.
• Property staff work records: housekeeping task times.

4. How data is collected

Data is collected electronically, by automated or partly automated means: sign-up and setup forms, use of the application, the channel connection set up on the property’s instruction (reservations and messages received from channels through the Channex platform), the form a guest fills in on the booking page, entries by property staff, status information sent by the Otelka KBS application, reservation emails forwarded and files uploaded by the property in the previous version, the contact form and cookies. Through the channel connection Otelka sends channels only the rates, availability and restrictions entered by the property and the message replies written by the property.

5. Purposes and legal grounds

• Opening the account and providing the Service (channel connection, calendar, front office, booking page, KBS tools) — conclusion and performance of a contract (KVKK Art. 5/2-c)
• Invoicing, collection and keeping financial records — legal obligation (Art. 5/2-ç) and performance of a contract
• Account security, preventing unauthorised access and misuse, keeping activity records — legitimate interest (Art. 5/2-f)
• Handling support requests and mandatory notices about the Service — performance of a contract and legitimate interest
• Visit statistics on the marketing website — explicit consent (cookie preference; you can withdraw it at any time)
• Guest data — on the property’s instructions, relying on the property’s own legal grounds (such as the accommodation contract, Law No. 1774 and tax legislation)

6. Recipients

The Service is provided with the following service providers (sub-processors); each processes data only within its own service:

In addition, on the property’s instruction and legal obligation: guest identity details are passed to the Otelka KBS application on the property’s own computer and by the property to the Police or Gendarmerie KBS; recipient details of invoices issued by the property are passed to the property’s own e-invoicing provider. Data may be disclosed to competent public authorities upon a lawful request and to the extent required by law.

7. Transfers abroad

Some of the providers above have servers or headquarters outside Türkiye. These transfers are made in accordance with the procedures in Article 9 of the KVKK (including standard contracts and, where required, notification to the Personal Data Protection Board) and are limited to the minimum data needed to provide the service. The database holding guest and property data is located in the European Union (Frankfurt).

8. Retention periods

When a period ends, the data is deleted, destroyed or anonymised. Deleted data disappears from encrypted backups within 30 days at the latest.

9. Data security

• All connections are encrypted (HTTPS/TLS, HSTS).
• Row-level access rules are applied in the database: each property can only access its own data; access is limited by a verified session and the user’s role and department.
• An email verification code is required when signing in from a new device; sensitive actions such as payments, team, channel and KBS settings, viewing cards and closing the account require re-confirmation with a password and bot check.
• Support access by Otelka operators requires two-step verification and is logged.
• Rate limits and bot protection are applied to sign-in and forms; IP addresses are not stored in raw form but as hashes.
• Card numbers never enter Otelka (iyzico for subscription payments, Channex for channel cards); sequences resembling card numbers are masked in incoming text. Virtual card details stored in the previous version are encrypted with AES-256.
• Properties’ e-invoicing keys and database backups are stored encrypted; ID numbers and dates of birth are not written to application logs.
• Requests from the Otelka KBS application are signed with a key generated on the device; KBS passwords stay only in the operating system key store on the property’s computer.
• Regular security testing is carried out; changes go through a security review before release.
• In the event of a data breach, the Personal Data Protection Board and the persons concerned are notified within the periods set by law (72 hours to the Board); breaches affecting guest data are reported to the property within 24 hours at the latest.

10. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties to whom it is transferred in Türkiye or abroad, to request its correction if incomplete or inaccurate, to request its deletion or destruction, to request that these actions be notified to the third parties to whom it was transferred, to object to a result against you arising exclusively from automated analysis, and to claim compensation for damage caused by unlawful processing.

You can submit requests to iletisim@otelka.com from your registered email address or in writing to the address in the company information. Requests are handled free of charge within 30 days at the latest. For requests about guest data, please contact the property where you stayed; the property is the data controller, and such requests received by Otelka are forwarded to the property without delay.