Personal Data Information Notice
This notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1.1. Data controller
RATE EXTRA TOURISM L.L.C ("Otelyar", the "Company"), Dubai Department of Economy and Tourism licence no. 1253634, commercial register no. 2115485, address: Office J-02, Fronds Capital Properties L.L.C building, Al Quoz Industrial Area 4, Dubai, United Arab Emirates. Email: destek@otelyar.com. Data controller representative in Türkiye: Sindibad Turizm Ticaret Anonim Şirketi.
1.2. Personal data processed
| Category | Data |
|---|---|
| Identity | First and last names of the booker and guests (in Latin characters, as in the passport) |
| Contact | Email address, telephone number |
| Nationality | Guest nationality (hotel rates depend on nationality) |
| Customer transaction | Booking details, hotel, dates, room, rate, special requests, cancellation and refund records, account details, favourites |
| Financial | Payment amount and status, currency, card brand and last four digits. Card number and security code never reach Otelyar's servers and are processed directly by the payment institution Stripe |
| Transaction security | Hashed IP address, session and login records, verification code records, device and browser information |
| Customer support | Conversations with the AI support assistant Defne and human agents |
| Marketing | Only if explicit consent is given: newsletter preference and message records |
| Site usage (analytics) | Only if explicit consent to analytics cookies is given: pages viewed, device and browser information, approximate location, Google Analytics cookie ID |
Passport numbers, passport images, dates of birth and gender are not collected. Please do not share health data or other special categories of personal data in special requests.
1.3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating the booking, sending it to the hotel, confirmations and change notices | Establishment and performance of a contract (5/2-c) |
| Taking payment, refunds, cancellation and penalty calculation | Performance of a contract (5/2-c) |
| Invoicing, accounting and tax records | Legal obligation (5/2-ç) |
| Opening and managing the account | Establishment and performance of a contract (5/2-c) |
| Customer support, conversations with Defne, complaint handling | Performance of a contract (5/2-c) and legitimate interest (5/2-f) |
| Fraud prevention, information security, detection of misuse | Legitimate interest (5/2-f) |
| Protecting rights in disputes | Establishment, exercise or protection of a right (5/2-e) |
| Keeping language, country and currency preferences beyond the session | Explicit consent (5/1) |
| Measuring and improving how the site is used (Google Analytics) | Explicit consent (5/1) |
| Sending campaigns and newsletters | Explicit consent (5/1) and approval under Law No. 6563 |
1.4. Method of collection
Data is collected electronically, by automated and partly automated means, through the otelyar.com website, booking and membership forms, the payment step, the support chat, email correspondence and cookies.
1.5. Recipients
| Recipient | Purpose | Country |
|---|---|---|
| Sindibad Turizm Ticaret A.Ş. (Safaryar Holidays), our hotel supplier | Sending the booking to the hotel | Türkiye |
| The hotel where you stay | Providing the accommodation | Country of the hotel |
| Stripe | Payment processing and fraud prevention (taking and refunding payments) | USA, Ireland |
| Resend | Sending transactional emails | USA, Ireland |
| Anthropic | Running the AI support assistant | USA |
| Slack | Internal team notifications | USA |
| Vercel and Railway | Hosting (web: Frankfurt; API and database: Amsterdam) | Germany, Netherlands |
| Bugsink | Error tracking | EU (Netherlands) |
| Google (Google Ireland Ltd / Google LLC) | Site usage statistics (Google Analytics), only with explicit consent to analytics cookies | Ireland, USA |
| Competent public authorities, courts | Legal obligation | Relevant country |
As the Company is established in the United Arab Emirates and some service providers are located abroad, personal data is transferred abroad within the meaning of KVKK Art. 9. These regular transfers rely on appropriate safeguards under KVKK Art. 9/4, namely the standard contracts published by the Personal Data Protection Board; standard contracts are notified to the Board within the statutory period after signature. The occasional-transfer cases listed in KVKK Art. 9/6 are used only for non-recurring, exceptional transfers. The transfer under Google Analytics (Ireland, USA) also relies on a standard contract with Google; Google Analytics itself runs only if you give explicit consent to analytics cookies (KVKK Art. 5/1). You can withdraw your consent at any time via the "Cookie preferences" link at the bottom of the site.
1.6. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Türkiye or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction where the conditions of KVKK Art. 7 are met, and notification of these actions to third parties; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
1.7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request from the email address registered with Otelyar to destek@otelyar.com, or in writing to the address above. Requests are concluded free of charge within 30 days at the latest. If an additional cost arises, the fee set by the Personal Data Protection Board may be charged.