إشعار الخصوصية وفق KVKK

This notice has been prepared under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about the personal data processed through the go4villa website and mobile apps (the "Platform").

1. Data controller

الاسم التجاري

KALYNDA TEKNOLOJİ HAVACILIK VE TURİZM LİMİTED ŞİRKETİ

رقم MERSIS

0493152313600001

رقم السجل التجاري

13265 (Muğla Ticaret Sicili Müdürlüğü)

الرقم الضريبي

4931523136

مكتب الضرائب

Dalaman Vergi Dairesi

العنوان المسجّل

Söğütlüyurt Mah. İstiklal Cad. No: 57, 48770, Dalaman / Muğla, Türkiye

عنوان KEP

— (ستُستكمل من الإدارة) —

تسجيل ETBİS

— (ستُستكمل من الإدارة) —

البريد الإلكتروني

— (ستُستكمل من الإدارة) —

الهاتف

— (ستُستكمل من الإدارة) —

• Data controller: KALYNDA TEKNOLOJİ HAVACILIK VE TURİZM LİMİTED ŞİRKETİ
• Contact person: — (to be completed by management) —
• VERBİS registration: — (to be completed by management) —

The Platform is an intermediary service provider connecting villa owners and guests. The villa owner providing the accommodation processes the data transferred to them for your booking as a separate data controller, for performing the stay and for their own legal obligations such as identity notification.

2. Personal data processed

• Identity: first and last name; names and guest type (adult/child/infant) of those staying. Turkish ID numbers or passport details are not collected by the Platform; they are taken by the villa owner at check-in for identity notification.
• Contact: e-mail address, phone number, country, language preference.
• Customer transactions: booking code, villa, dates, number of guests, price breakdown, payment and refund status, reason for cancellation, favourites, saved searches, reviews and ratings, extra services and airport transfer details (airport, flight number and time, number of passengers and luggage).
• Financial: sender name, amount and date of bank transfers; IBAN for refunds. Your card details are not stored by the Platform.
• Communications: messages with the villa owner via the Platform, support requests and chats with the go4villa Assistant (with e-mail/phone details masked).
• Transaction security: irreversible hash of your password, session records, IP address, browser/device details, login attempts (hashed), transaction and acceptance records.
• Marketing: only with your consent, commercial message preferences and campaign interactions; push notification token.
• Visual: photos you attach to reviews.
• Visit data: page views, clicks, approximate location (city/country), device type (see the Cookie Policy).

The Platform does not request special categories of personal data (health, religion, biometrics, etc.); please do not share such information in messages, notes or reviews.

3. Purposes and legal grounds

• Concluding and performing the membership and booking contract (account, forwarding the booking request to the villa owner, confirmation, payment tracking, cancellation/refund, arranging transfers, notifications): KVKK Art. 5(2)(c).
• Legal obligations (tax and accounting records; retention of pre-contractual information and contract records under Law No. 6502 and the Distance Contracts Regulation; obligations under Law No. 7464; traffic records under Law No. 5651; requests from competent authorities): Art. 5(2)(ç).
• Establishing, exercising and protecting rights (disputes, complaints, damage deposit processes, keeping acceptance records as evidence): Art. 5(2)(e).
• Legitimate interest (masking contact details until a booking is confirmed to prevent fraud and off-platform payment, information security, brute-force protection, measuring service quality and visit statistics, publishing verified reviews): Art. 5(2)(f).
• Commercial electronic messages, personalised marketing, push notifications and analytics technologies similar to cookies: only with your explicit consent or approval (Art. 5(1); Law No. 6563). Details: Explicit Consent Text, Commercial Electronic Message Consent.

4. Transfers of personal data

• Villa owner and team: your name, dates, number of guests, names of those staying and your note, to perform the booking (Art. 8(2)(a), Art. 5(2)(c)). Your email address is not shared with the villa owner; messaging runs through the Platform. Your phone number can be viewed only for a confirmed booking, within the check-in window that starts 48 hours before the check-in time and ends on the check-out day, and only by the persons running check-in (the villa owner, its manager, reception); every view is logged. The villa owner's phone number and the exact address are shown to you only for a confirmed booking.
• Carriers performing the transfer service: if you selected an airport transfer, your name, phone, flight details, number of passengers/luggage and destination address (Art. 5(2)(c)).
• Banks and payment institutions: deposit collection and refunds (Art. 5(2)(c)).
• Competent public authorities: where required by law (Art. 5(2)(ç)).
• Legal and financial advisers, auditors: to protect rights and meet legal obligations (Art. 5(2)(ç), (e)).
• Infrastructure providers (processors): Cloudflare, Inc. (USA) for hosting, database, file storage, content delivery, security and automatic translation/assistant; our e-mail sending service running on Cloudflare and an e-mail provider; Google Firebase Cloud Messaging and Apple Push Notification Service for mobile push notifications; your browser's notification service for web push; our own analytics service (Kalynda Analytics) for visit statistics; OpenFreeMap and Esri for maps (your IP address reaches these providers when map tiles are requested).

5. Transfers abroad

Because the servers of our infrastructure providers (Cloudflare, Google, Apple and the analytics infrastructure) are located abroad, the data above is transferred abroad. These transfers are made with appropriate safeguards under KVKK Art. 9 and the Regulation on the Transfer of Personal Data Abroad — by signing the standard contracts published by the Board and notifying the Board in due time. Where a standard contract is not possible and the transfer is incidental, it is made only under the exceptions in Art. 9(6) (e.g. your explicit consent or necessity for performing the contract). For visit statistics, raw data is kept online for no more than 72 hours; it is then moved to an encrypted archive in Türkiye and the online copy is de-identified.

6. Method of collection

Your personal data is collected electronically, partly by automated and partly by non-automated means, through registration, booking, contact, review and application forms, in-Platform messaging, the assistant, e-mail and phone conversations, the mobile app, cookies and similar technologies, and server logs.

7. Retention periods

• Account data: for the duration of membership; after closure, only for disputes for the general limitation period (10 years).
• Bookings, acceptance records, pre-contractual information and contract texts, invoices and accounting records: for the periods prescribed by Law No. 6502, Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102 (up to 10 years).
• Traffic and security records: for the period prescribed by Law No. 5651 and secondary legislation; login-attempt records 1 day.
• Assistant chats: 90 days. Raw visit statistics: 72 hours (then encrypted archive in Türkiye and anonymous totals).
• Marketing consent and opt-out records: 3 years from withdrawal of consent (secondary legislation under Law No. 6563).
• Push tokens: until you turn notifications off or the token becomes invalid.

Data whose retention period has expired is deleted, destroyed or anonymised in periodic disposal processes under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8. Information you provide about others

When you enter the names of those staying in a booking, you must inform them of this notice. Children's data is processed only to the extent necessary to perform the booking.

9. Your rights under KVKK Art. 11

You have the right to learn whether your personal data is processed; to request information if so; to learn the purpose of processing and whether data is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to request rectification of incomplete or inaccurate data and erasure or destruction under KVKK Art. 7; to request that such actions be notified to the third parties to whom data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

10. How to apply

You can send your application in writing, with information verifying your identity, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to the address above, to our registered e-mail (KEP) address (— (to be completed by management) —) or from the e-mail address registered on the Platform to — (to be completed by management) —. You can also request account closure from My account → Profile. Applications are concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee set by the Board may apply. If your application is rejected or you find the reply insufficient, you may lodge a complaint with the Personal Data Protection Board (KVKK Art. 14).