Privacy notice (KVKK)

1. Data controller

Under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and related rules the data controller is Handooser LLC (New Mexico, USA; details below), which provides the CesiSync product. The Service is not currently offered to users in the EU/EEA/UK; GDPR compliance for those regions will be set up when the Service opens there.

2. Data we process

Identity and contact: name, e-mail, phone. Business: trade name, tax number / national ID, tax office, address, TÜRSAB and licence details, uploaded documents. Property and calendar: property details, address, location, photos, prices, calendar. Transactions: subscription, hold and booking records, guest count, the agency's own reference, optional guest name. Communication: in-platform messages, messages you send to the WhatsApp assistant. Technical: IP address, browser information, session and security logs, API usage counters, audit log.

A guest's identity details are not required; a booking holds only the number of guests and a name/reference the agency may enter. We do not intend to process special-category data; do not send unnecessary information in document uploads (for example health or religion on an ID copy).

3. Purposes and legal bases

Account creation, verification and performing the contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)); agency and document approval and fraud prevention (legitimate interest, art. 5/2-f); invoicing, tax law and retention duties (art. 5/2-a, ç); information security and audit logging (art. 5/2-f); support and communication; mandatory service notices. Marketing messages are sent only with your explicit consent, which you may withdraw at any time.

4. Who receives the data

Within the network: an owner's contact details and exact address are shown to an agency only once its subscription is approved. Approved agencies without a subscription see only a blurred location and general facts. Agencies never see each other's booking details, guest information or identity; another agency's booking appears only as "busy" dates.

Service providers (processors): hosting and infrastructure, e-mail delivery, WhatsApp Business (Meta; verification codes and notices), machine translation (DeepL, only for property texts you choose to translate), map tiles (OpenStreetMap; your IP address reaches the tile server when a map is shown), and PayPal (payment provider for plan fees). Webhook addresses defined by an agency are that agency's responsibility. Data may be disclosed to authorities and courts where legally required.

5. International transfers

Handooser LLC is based in the USA; your data may be processed in the USA and in other countries where our service providers are located. Transfers are made under KVKK art. 9 and GDPR Chapter V with suitable safeguards such as an adequacy decision, standard contractual clauses (SCCs), or explicit consent; for KVKK the notification duties towards the Board are also met. The current list of providers is published on the security page.

6. How data is collected

Data is collected through sign-up and panel forms, document uploads, API and webhook requests, WhatsApp messages, iCal imports and cookies, by automatic or partly automatic means.

7. Retention

Account data is kept while the account is open. On a request to close the account, data is deleted or anonymised within 30 days; invoice and tax records are kept for the period required by the relevant law (generally 10 years) and security and audit records for as long as needed for disputes and security. Webhook delivery logs and API usage counters are kept for a limited time. Expired holds and cancelled bookings remain as business records for the life of the account.

8. Security

Passwords are hashed, only a digest of API keys is stored, connections are protected with TLS, critical actions are written to an audit log, and the staff panel is a separate application with restricted access. Details are on the security page. In the event of a breach we notify the data protection authority and affected people within the legally required time.

9. Your rights

Under KVKK art. 11 you may ask whether your data is processed, request information, learn whether it is used for its purpose, know the third parties it is transferred to, ask for correction, deletion or destruction of incomplete or incorrect data and have these actions notified to third parties, object to a result against you arising from automated analysis, and claim compensation for unlawful processing. Under the GDPR you also have the rights to data portability and restriction. Send requests in writing to the contact address below or from the e-mail address registered on your account; we answer within 30 days. You may complain to the data protection authority if you are not satisfied.

You can download most of your data yourself from the panel as JSON, ZIP, CSV or iCal.

10. Automated decisions

Account and property approval is decided by human review. Price suggestions and the WhatsApp assistant's reading of dates are suggestions only; a calendar change is made only with your explicit confirmation.

11. Changes

When we update this notice we publish the new version here and announce material changes by e-mail.