Privacy Policy & KVKK Notice

Depending on the nature of our relationship with you, we process the following categories of personal data:

• Identity & contact data: name, email, phone, company/hotel name, job title.
• Customer transaction data: subscription plan, order and invoice details, support requests.
• Payment data: transaction amount, date and status. Sensitive payment details such as the full card number are not stored by us (see Section 7).
• Digital trace data: IP address, device/browser information, site usage and cookie data.

• Providing the service, creating and managing your account.
• Establishing and performing the contract, processing payments and invoicing.
• Customer support and handling of requests and complaints.
• Fulfilling legal obligations (tax, commercial and data-protection law).
• Service security, fraud prevention and improvement analytics.
• Marketing and informational communications, subject to your explicit consent.

Your personal data is processed under Articles 5 and 6 of KVKK on the following grounds: being directly related to the conclusion or performance of a contract, compliance with our legal obligations, the establishment/exercise of a right, our legitimate interests, and — where required — your explicit consent.

Your personal data may be shared, strictly limited to the purposes above and to the extent permitted by law, with the following parties:

• Our payment service provider iyzico (iyzico Ödeme Hizmetleri A.Ş.) — to process payments.
• Hosting, email, analytics and infrastructure vendors that support the service.
• Authorised public authorities and judicial bodies — upon a lawful request.

Your personal data is retained for as long as the purpose of processing requires and until the end of the statutory limitation/retention periods (e.g. 10 years for commercial and tax records). At the end of these periods the data is deleted, destroyed or anonymised.

Our site uses essential, analytics and marketing cookies. Essential cookies are required for the site to function. Analytics and marketing cookies run only with your consent; visitors from the EU/EEA, UK, Switzerland and Türkiye are shown a consent banner. You can change your cookie preferences at any time from your browser settings.

Card payments are collected through the infrastructure of iyzico, a licensed payment institution. Sensitive card data such as the card number, expiry date and CVV are never seen or stored by OtelCiro; such data is processed by iyzico in compliance with PCI-DSS standards. Our site is encrypted end to end with an SSL/TLS certificate.

Under Article 11 of KVKK you have the right to: learn whether your personal data is being processed; request information if it is; learn the purpose of processing; know the third parties to whom it is transferred domestically or abroad; request correction if it is incomplete/incorrect; request deletion/destruction where the conditions are met; and object to results arising against you solely from automated analysis of the data.

To exercise your rights, you can send your requests to [email protected]. We will respond to your request within 30 days at the latest.