Privacy Policy
2.1. Scope
This policy explains how personal data is processed through the otelyar.com website and related services (the "Service"). For users in Türkiye, the KVKK Information Notice also applies. This policy has been prepared with regard to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Turkish Law No. 6698 (KVKK) and, to the extent applicable, the EU General Data Protection Regulation ("GDPR") and the Saudi Personal Data Protection Law.
2.2. Data controller
RATE EXTRA TOURISM L.L.C, licence no. 1253634, Office J-02, Fronds Capital Properties L.L.C building, Al Quoz Industrial Area 4, Dubai, UAE. Contact: destek@otelyar.com.
2.3. Data we collect
First and last name, email, telephone, nationality, booking and payment details, account details, support conversations, hashed IP address and technical logs, cookie preferences; if you consent to analytics cookies, site usage data (pages viewed, device and browser information, approximate location, Google Analytics cookie ID). The full list is in Section 1.2 of the KVKK Information Notice. Passport numbers, passport images, dates of birth and gender are not collected. Card details are processed directly by Stripe and are not stored on Otelyar's servers.
If you book on behalf of another guest, you confirm that you are authorised to share that person's data and have informed them of this policy.
2.4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Bookings, payment, cancellation, refunds, confirmations and notices | Performance of a contract |
| Invoicing and tax records | Legal obligation |
| Customer support, the Defne AI assistant | Performance of a contract, legitimate interest |
| Security, fraud prevention | Legitimate interest |
| Handling legal claims | Legitimate interest, protection of rights |
| Persistent storage of functional cookies | Consent |
| Measuring how the site is used (Google Analytics) | Consent |
| Campaign and newsletter emails | Consent |
Otelyar does not sell personal data or share it with third parties for advertising.
2.5. Service providers and recipients
| Recipient | Role | Location |
|---|---|---|
| Sindibad Turizm Ticaret A.Ş. (Safaryar Holidays) | Hotel supplier; passes the booking to the hotel | Türkiye |
| Hotels | Accommodation | Country of the hotel |
| Stripe | Payment processing and fraud prevention | USA, Ireland |
| Resend | Outgoing and incoming email | USA, Ireland |
| Anthropic | AI support assistant | USA |
| Slack | Internal notifications | USA |
| Vercel | Web server | Germany (Frankfurt) |
| Railway | API and database | Netherlands (Amsterdam) |
| Bugsink | Error tracking | EU (Netherlands) |
| Google (Google Ireland Ltd / Google LLC) | Site usage statistics (Google Analytics), only with consent to analytics cookies | Ireland, USA |
Service providers process data only on Otelyar's instructions and under contractual confidentiality obligations. Hotels and Sindibad Turizm may also act as independent controllers in respect of their own legal obligations relating to the accommodation.
2.6. International transfers
Data is transferred to countries outside the UAE. Transfers rely on adequacy decisions under applicable law, the European Commission's standard contractual clauses and standard contracts under KVKK Art. 9/4 notified to the Board. Derogations for occasional transfers (e.g. a transfer necessary for the performance of a contract) are used only for non-recurring, exceptional transfers. The transfer under Google Analytics (Ireland, USA) also relies on a standard contract; Google Analytics runs only if you consent to analytics cookies, and you can withdraw that consent at any time via the "Cookie preferences" link at the bottom of the site. You may request a copy of the safeguard applied at destek@otelyar.com.
2.7. Retention periods
| Data | Period |
|---|---|
| Booking, payment and invoice records | 5 years from the end of the financial year of the transaction |
| Account details | While the account is open; deleted within 30 days of a deletion request (except records subject to legal retention) |
| Incomplete booking entries | 90 days |
| Support and Defne conversations | 12 months |
| Security and access logs | 12 months |
| Cookie preference records | 3 years from the end of the preference's validity (12 months) |
| Google Analytics usage data | 2 months in Google Analytics; cookies at most 2 years, deleted when consent is withdrawn |
| Marketing consent and opt-out records | Until consent is withdrawn; opt-out record 3 years |
At the end of the period, data is deleted, destroyed or anonymised.
2.8. Security
Data is encrypted in transit with TLS. Access is limited to authorised staff. IP addresses are stored hashed with a secret key. Card details are processed on Stripe's PCI DSS-compliant infrastructure.
2.9. Automated decisions
No fully automated decision producing legal effects about you is made. Prices shown by nationality result from the hotel's rate. Defne cannot decide on refunds, penalties or payments.
2.10. Your rights
Depending on the applicable law, you have the right to access, rectify and erase your data, restrict processing, object, data portability, withdraw consent at any time and lodge a complaint with a data protection authority. Requests are sent to destek@otelyar.com and answered within 30 days at the latest. We may ask for additional information to verify your identity.
2.11. Children
Bookings and membership are available only to persons aged 18 or over. Names of child guests are processed only to perform the booking.
2.12. Changes
This policy may be updated. Material changes are announced on the site and by email to registered users. The version in force is on this page.