اتفاقية معالجة البيانات الشخصية (المالك – المنصة)

This agreement is Annex 1 to the Host Service Agreement between KALYNDA TEKNOLOJİ HAVACILIK VE TURİZM LİMİTED ŞİRKETİ (the "Platform") and the Host, and is deemed accepted together with that agreement.

1. Allocation of roles

• The Platform is the data controller for data processed in guest accounts, bookings, payments, messaging and the Platform infrastructure.
• The Host is a separate data controller when it uses guest data transferred to it for a booking to perform the stay, make identity notifications (Law No. 1774), meet tax and its own legal obligations, and fulfils its own obligation to inform for such processing.
• When processing data within the panel, messaging, calendar and operations tools provided by the Platform, the Host and its team act as processors on behalf of the Platform and are bound by the provisions below.

2. Data processed and purpose

Guest name, booking dates, number of guests, names of those staying, notes, transfer and extra-service details. The guest's email address is not shared with the Host; messaging with the guest takes place through the Platform. The guest's phone number can be viewed only for a confirmed booking, within the check-in window that starts 48 hours before the check-in time and ends on the check-out day, through the "show" action in the panel, and only by the Host and team members in the manager or reception role; the cleaning role cannot view it, and every view is logged with who, which booking and when. The phone number is not written to exports (CSV etc.). This data may be processed only to perform the booking concerned, run check-in and make statutory notifications; it may not be used for marketing or profiling or shared with third parties.

3. Host obligations

• To process data only on the Platform's instructions and within this agreement; not to transfer it outside the Platform (except for identity notification and legal requirements).
• To give panel access only to team members who need it to perform bookings, bind them to confidentiality and revoke access of departing members immediately.
• To take reasonable technical and organisational measures under KVKK Art. 12: strong passwords, device locks, secure storage and destruction of printed guest lists, and no sharing of screenshots of conversations.
• To notify the Platform at — (to be completed by management) — within 24 hours of becoming aware of a data breach and provide the information needed for the Platform to notify the Board within 72 hours.
• To forward to the Platform, within 3 business days, any part of a guest's KVKK Art. 11 request that concerns the Platform.
• To delete or destroy data not subject to statutory retention after the stay has ended.

4. Platform obligations

The Platform must take appropriate security measures in the panel and infrastructure (encrypted connections, role-based access, session security, concealment of guest contact details — email never, phone only within the check-in window via logged viewing —, audit logs), bind its sub-processors (hosting: Cloudflare, Inc.; e-mail and push notification services) with KVKK-compliant contracts and ensure the safeguards of KVKK Art. 9 for transfers abroad.

5. Audit

The Platform may audit compliance with this agreement at reasonable intervals and with prior notice by requesting information and documents. The Host provides information requested by the Board or competent authorities without delay.

6. Liability and term

The Host is liable for claims and administrative fines brought against the Platform due to breach of this agreement. This agreement remains in force for the term of the Host Service Agreement and thereafter for as long as the Host holds guest data.