KVKK information notice

Your personal data is processed by AI Otel Teknoloji ve Turizm Limited Şirketi (“the Company”) as data controller, within the scope described below.

For legal review: VERBİS: whether the Company must register in the Data Controllers Registry (VERBİS) before processing begins, or falls under one of the Board’s exemptions, is not settled. The exemptions depend on the number of employees, the annual balance-sheet total and whether the main activity is processing special categories of data; the current thresholds are to be read from the Board’s decisions, not assumed.

For legal review: Both founders recorded on 26 September 2026 that trbnb is operated by AI Otel Teknoloji ve Turizm Ltd. Şti. (HUB.md, Decisions). If the operating company ever changes, the controller named in every text changes with it.

The Company processes personal data for the purposes and on the legal bases below, and each purpose only with the data it needs.

Trip requests and offers

Data: the content of your request (destination, dates, number of travellers, children's ages, budget, stated needs) and your language. Purpose: understanding the request and showing suitable stays. Legal basis: art. 5(2)(c), steps necessary to set up a contract at your request.

Bookings and after-sales service

Data: identity (name and surname of the lead guest and, where the hotel requires, of other guests), contact (email address, optional phone number), transaction (hotel, dates, room, price, currency, cancellation terms, booking and payment references and status) and requests to the hotel. Purpose: making, changing and cancelling bookings; passing them to the supplier and the hotel; handling complaints and refunds under the rate's policy. Legal basis: art. 5(2)(c), performance of a contract; art. 5(2)(e), establishing, exercising or protecting a right.

Your account

Data: your email address and language and, if you keep them on the account's settings page, your name, a mobile phone number and the currency prices are shown in. Purpose: signing you in with a code, greeting you by name, filling in the booking form for you (the phone is used for nothing else) and showing prices in the currency you chose. Legal basis: art. 5(2)(c), performance of the contract for the account you opened. You can remove the name, the phone and the currency yourself at any time.

Legal and financial records

Data: the identity, contact and transaction data of the booking. Purpose: keeping the records required by commercial and tax law and answering competent authorities. Legal basis: art. 5(2)(ç), compliance with a legal obligation; art. 5(2)(a), expressly provided for by law.

Security and service quality

Data: IP address, session and access records (for each sign-in: when it started and was last used, the browser and system it came from, and a one-way hash of a random key kept in the browser), error logs. Purpose: preventing abuse and fraud, limiting repeated attempts, telling an account's owner by email when it is signed in to from a browser the Company does not recognise, keeping the systems working and finding faults. Legal basis: art. 5(2)(f), legitimate interest, provided your fundamental rights and freedoms are not harmed.

Applications under KVKK

Data: identity, contact and the content of your application. Purpose: receiving and answering applications under articles 11 and 13. Legal basis: art. 5(2)(ç), compliance with a legal obligation.

Marketing and optional cookies

Data: contact data and cookie identifiers. Purpose: sending commercial electronic messages and measuring the use of the site, only if you agree. Legal basis: your explicit consent (art. 5(1)) and, for messages, your approval under Law No. 6563. No such processing takes place today.

For legal review: Special categories (art. 6): details about health, disability or religion a guest may type into the assistant. Since 28 Sep 2026 they are kept with a trip only when the guest ticks the trip's consent line (explicit consent, art. 6(2)); otherwise they are left out of what is kept and used only for the search. The line's wording, the receipt of each tick and its 730 days are a draft for the lawyer's read.

For legal review: Draft, 28 Sep 2026: “Your account” (the optional phone and display currency) and the sign-in details under “Security and service quality” (the browser and system, the browser key and the new-sign-in email) are new. Their wording, legal bases and periods are for the lawyer's read before they are final.

For legal review: Draft, 28 Sep 2026: the answers to “How did trbnb do?” (a score and any words, read by the two founders; legitimate interest, art. 5(2)(f), proposed), and a trip's name, the parts a guest adds to it and the conversation kept with it (under “Trip requests and offers”) are new. For the lawyer's read.

Within the purposes above, and only as far as each of them needs, personal data may be transferred to:

• Our booking partner, the supplier the booking is made through and the merchant of record for the payment — to make the booking and take the payment (abroad: mainly the United States; data may also be processed in the European Union, and our booking partner's sub-processors may be in the United States or other countries).
• The hotel providing the accommodation — to provide the stay (Türkiye).
• Stripe, through our payment partner's payment form — to process the card payment; the Company does not receive card data (abroad).
• Google LLC (Gemini) and, if used, Anthropic PBC — to understand the text of trip requests, text the guest asks trbnb's AI to read before planning, questions in the chat, and reviews (abroad). Google LLC also receives text the guest asks to have translated, for translation only and only when the guest taps the button that sends it to Google (abroad). A reading made before planning is kept in the server's memory for up to 20 minutes and is not written to a database.
• ElevenLabs — for text-to-speech and the voice assistant (abroad).
• Cloudflare, Inc. — domain, network and storage services (abroad).
• Brevo, the email provider — to send the emails trbnb sends, which includes recording when an email is opened and which of its links is followed (abroad: a French company); hosting and error-monitoring providers once chosen; and public authorities where the law requires.

For legal review: Each recipient's legal entity name and the countries its data goes to must be confirmed from its contract.

Transfers to recipients abroad are made under article 9 of the KVKK: where there is an adequacy decision, or under an appropriate safeguard such as a standard contract announced by the Board, signed with the recipient and notified to the Authority within five working days of signature. Where neither applies, data is transferred only occasionally and under one of the exceptions in article 9(6), such as a transfer necessary for the performance of a contract with you.

For legal review: No standard contract has been signed with any recipient. This blocks launch with real guest data.

Personal data is collected electronically: through the forms and the assistant on the website, the voice assistant, cookies and similar technologies, and from the supplier and the hotel when they send information about your booking. A hotel may also send you a stay link, using the email address it holds for your booking.

Personal data is kept for the periods below, and then deleted, destroyed or anonymised.

Under article 11 of the KVKK you have the right to:

• learn whether your personal data is processed;
• request information about it if it has been processed;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it has been transferred;
• request its correction if it is incomplete or inaccurate;
• request its deletion or destruction under the conditions of article 7;
• request that the correction, deletion or destruction be notified to the third parties it was transferred to;
• object to a result against you arising from analysis exclusively by automated systems;
• claim compensation for damage suffered because of unlawful processing.

You may send applications about these rights to the Company in writing at the address above; by registered electronic mail (KEP); with a secure electronic or mobile signature; from an email address you gave the Company before and that is registered in its systems; or through the online request form. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, an application states your name and surname, your Turkish identity number (for citizens of Türkiye) or your nationality and passport number (for others), your address for notification, your email address or phone number if you have one, and what you are asking for.

The Company concludes applications as soon as possible and at the latest within 30 days, free of charge. If the action involves an additional cost, the fee in the tariff set by the Board may be charged.

If your application is refused, if you find the answer insufficient, or if it is not answered in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of your application.

For legal review: The online form does not ask for an identity or passport number (data minimisation). Confirm whether the Communiqué requires it for applications made through the Company's own software, or whether identity may be verified another way.