HotelDing Privacy Policy and Data Protection Notice

1. Scope and roles

HotelDing processes data in two distinct roles. For hotel accounts, users, subscriptions and visitors of this website we are the data controller. For guest data that hotels enter into the software we are a data processor: the hotel you stay at is the controller, and that data is processed only on the hotel's instructions.

If you are a hotel guest, the hotel provides its own privacy notice and the way to exercise your rights. This page explains only HotelDing's own processing and the infrastructure it provides to hotels.

2. Data we process as controller

Marketing messages are sent only with your separate explicit consent, which you may withdraw at any time. The website uses no advertising or behavioural tracking cookies.

3. Guest data we process on behalf of hotels

Hotels enter guest identity details (full name, nationality, ID/passport number, date of birth), contact, stay, payment records (no card data) and incoming messages into the software. HotelDing stores this data, makes it available to the hotel, backs it up and deletes it on the hotel's instruction; it does not use, analyse or sell it for its own purposes.

The software does not accept copies or images of identity documents (Board decision of 9 December 2025). ID numbers and dates of birth are stored encrypted in the database. Statutory police notifications under the Identity Reporting Law and e-invoice documents are generated in the hotel's name under the hotel's legal obligations.

A data processing agreement compliant with KVKK art. 12/2 is signed with every hotel; the draft is available on request.

4. Sub-processors

We use the following providers to deliver the Service. Changes to this list are announced on this page and notified to hotels 30 days in advance.

5. International transfers

The database and e-mail infrastructure are located in the European Union (Germany). Transfers abroad are made under the standard contracts published by the Turkish Data Protection Board pursuant to KVKK art. 9, and signed contracts are notified to the Authority within 5 business days. If a provider does not sign the standard contract, data of hotels in Türkiye is moved to a managed cloud service located in Türkiye and this page is updated accordingly.

6. Retention

• Account and hotel data: for the term of the subscription; 30 days for export after termination, then deletion together with backups within 90 days.
• Activity and server logs: up to 2 years (security and audit).
• Booking requests: subject to the hotel's retention policy once forwarded; rate-limit fingerprints are deleted by HotelDing after 24 hours.
• Invoicing and accounting records: statutory period (Turkish Tax Procedure Law and Commercial Code: 10 years).
• Guest data: the period set by the hotel as controller; deleted or anonymised on the hotel's instruction at the end of that period.

7. Security

• Each hotel's data is isolated with row-level security; staff of one hotel cannot see another hotel's data, and this rule is verified by automated tests on every software change.
• ID numbers and dates of birth are encrypted at column level; the encryption key is not accessible to the application role.
• Role-based access (manager, reception, housekeeping); housekeeping cannot see guest or payment data.
• All connections are TLS-encrypted; backups are encrypted and kept in a separate store; actions are written to an append-only log.
• Hotels concerned are notified within 24 hours of a data breach being discovered.

8. Cookies

Only strictly necessary cookies are used: the session cookie (sign-in), language preference and the selected hotel. On the booking request form, Cloudflare Turnstile may set its own technical cookie for bot control. There are no advertising, analytics or third-party tracking cookies, so no cookie consent banner is shown.

9. Your rights (KVKK art. 11)

You have the right to learn whether your data is processed, to request information, to learn the purpose, to know the third parties it is transferred to, to request correction or deletion, to have these notified to recipients, to object to a result produced solely by automated analysis and to claim compensation for damage. Requests are answered free of charge within 30 days. The contact address is on the Company and contact page. Hotel guests should first contact the hotel; guest requests received by HotelDing are forwarded to the hotel.

10. Changes

When this notice changes, the new version is published at this address with an updated date; hotel managers are notified of material changes by e-mail.