Personal data protection — privacy notice (KVKK)
This text describes the data that stayistanbul.com.tr actually collects today and where that data goes. If a tool or a channel on the site changes, the text is updated too.
Data controller
Under Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”), this notice explains how your personal data is processed by STAY ISTANBUL (“StayIstanbul”) as data controller. Contact: hello@stayistanbul.com.tr · +90 543 323 29 96 (WhatsApp line). We operate in Istanbul. For a written application you can ask for our address for service at hello@stayistanbul.com.tr. This notice is written for visitors to stayistanbul.com.tr, people who use the contact form or write by email or WhatsApp, and property owners who request a call, a sale call or a site visit.
Personal data processed
Identity and contact data: name and surname, email address, phone number (optional), the country and time zone you are in. Property and request data: the property’s district, number of rooms, gross square metres, vacant or tenanted status, title and occupancy status, the package you are interested in or the work you want done, and the content of your message. Transaction security data: when you send the form, your IP address and the time of submission are held only in the server’s temporary memory to limit abuse; they are not written to any permanent record or log. Separately, the site’s hosting provider produces standard access records (IP address, request time, browser information) on its own infrastructure. The site uses no analytics, advertising or tracking cookies; see the cookie policy. Special categories of data (health, religion, biometrics and the like) are not requested; if you include them in your message on your own initiative, they are processed only to the extent needed to handle your request.
How data is collected
Your data is collected electronically and partly by automated means through the contact form on the site, emails you send to hello@stayistanbul.com.tr, messages to the WhatsApp line and information you share during the call. There is no WhatsApp integration on the site; the button is simply a link that opens the WhatsApp app on your device, and you send the message yourself. You choose which channel to use.
Purposes of processing
To assess your call, sale or site-visit request and contact you; to answer your question; if you ask, to identify the package that fits your property and to prepare a written quote and service contract for selling or renovation; if a contract is concluded, to deliver the service (rent collection, owner statement, power of attorney procedures, managing the sale or renovation); to meet our legal obligations (tax, e-invoicing, record keeping); to keep the form and contact channels secure. Your data is not used for marketing profiling or automated decision-making, and we do not send you commercial electronic messages without your consent.
Legal grounds
Information, legal ground and explicit consent are separate matters. Processing your request rests on the following grounds: KVKK art. 5/2-c, processing directly related to the conclusion or performance of a contract (call, sale and site-visit requests, proposal, service contract); KVKK art. 5/2-ç, compliance with a legal obligation of the controller (tax and commercial legislation); KVKK art. 5/2-f, our legitimate interest, provided it does not harm your fundamental rights and freedoms (security of contact channels and keeping records of requests). The one processing operation that falls outside these grounds is the transfer of your form message abroad; for that the form carries a separate, unticked, single-purpose explicit consent box (KVKK art. 5/1 and art. 9). You may withdraw your consent at any time by writing to hello@stayistanbul.com.tr; withdrawal does not affect the lawfulness of processing carried out until then. If you would rather not give consent, you do not have to use the form: WhatsApp and direct email remain open.
Transfers, including transfers abroad
Your data is transferred only to the extent necessary to handle your request. Within Turkey (KVKK art. 8): if a service contract is concluded, to CKAY Law Firm, with whom we work; where legally required, to competent public authorities. Abroad (KVKK art. 9), the transfers that actually take place are these: when you send the contact form, the message reaches us through the infrastructure our email delivery provider Resend operates abroad (the provider is based in the United States); the site is hosted on Vercel infrastructure whose servers are located abroad, and the provider produces standard access records while doing so; if you choose to write on WhatsApp, the content of your message passes through Meta Platforms’ servers abroad. There is no adequacy decision covering these transfers: as at 10 September 2026 the Turkish Data Protection Authority has issued none for any country. Nor do we hold a standard contract notified to the Board or an undertaking approved by it. The separate explicit consent you give when you submit the contact form relies on the derogation in art. 9(6) of the Law, and that derogation is written for occasional transfers. We therefore do not treat it as a permanent solution: until a standard contract is in place you are not obliged to use the form — email and WhatsApp are open, and this page will be updated when the process is complete. Your data is never sold or shared with third parties for advertising or marketing.
Retention
Call, sale and site-visit requests and questions are deleted, destroyed or anonymised once the purpose of processing has ceased and the limitation periods set by the relevant legislation have expired, if no service contract is concluded. If a contract is concluded, data is kept for the term of the contract and, after it ends, for the limitation and retention periods set by law (Turkish Code of Obligations art. 146, general limitation of ten years; Tax Procedure Law art. 253, five years; Turkish Commercial Code art. 82, ten years). The IP address and time held when the form is sent survive at most a ten-minute window, because the rate limit runs only in the server’s temporary memory, and they are not stored permanently. The hosting provider’s own access records are kept on the provider’s infrastructure for the period the provider sets; that period is not set by us.
Data security
Under KVKK art. 12 we take reasonable technical and organisational measures against unauthorised access, loss and unlawful processing: all traffic runs over an encrypted connection (HTTPS), access is limited to authorised staff, form submissions are rate-limited to curb abuse, and personal data is not written to application logs. In the event of a data breach we notify the Personal Data Protection Board without delay and within seventy-two hours of becoming aware of it, under KVKK art. 12/5 and the Board’s principle decision no. 2019/10 of 24 January 2019; the individuals concerned are notified within the shortest reasonable time.
Your rights as a data subject
Under KVKK art. 11: to learn whether your personal data is processed; to request information if it is; to learn the purpose and whether it is used accordingly; to know the third parties to whom it is transferred in Turkey or abroad; to request correction if it is incomplete or inaccurate; to request deletion or destruction under the conditions in art. 7; to request that corrections, deletions and destructions be notified to third-party recipients; to object to a result against you produced exclusively by automated analysis; and to claim compensation for damage caused by unlawful processing.
How to make a request
You may submit requests concerning your rights in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your request must state your name and surname, your signature for written applications, your Turkish ID number or, for foreign nationals, your nationality, passport number or identity number if any, your address for service, the email address, telephone or fax number for notification, and the subject of the request. You can send it from the email address registered in our system to hello@stayistanbul.com.tr; by registered electronic mail (KEP), secure electronic signature or mobile signature; or in writing (Communiqué art. 5(1), which also lists a purpose-built software or application channel — we have none today). Under art. 4(2) of the Communiqué, an application under the Turkish data protection law must be made in Turkish; write to us in English if you prefer and we will tell you what the Turkish application needs to contain. For a written application, ask for our address for service at the same email address and we will send it to you without delay. Your request is dealt with as soon as possible and free of charge, within thirty days at the latest, under KVKK art. 13(2); if the answer runs to more than ten pages, or the process requires an additional cost, the charges in art. 7 of the Communiqué apply (nothing is charged for the first ten pages, and where the answer is given on a recording medium the charge cannot exceed the cost of that medium). If your request is refused, the answer is found insufficient or no answer is given in time, you may lodge a complaint with the Board under KVKK art. 14 within thirty days of learning the answer and in any case within sixty days of the request.
Changes
This notice is updated to reflect changes in legislation or in our services; the current version and its date are published on this page. If a new tool, channel or provider starts to be used on the site, the text is updated before that tool goes live.