1. Controller and scope
In this pre-formation informational version, The Artifics is the service brand; the actual service provider/controller’s legal identity and required notice details are disclosed when the company/operator arrangement is completed. A brand alone does not establish the controller’s individual or legal-entity identity, and this version does not represent that the identity details are complete. Requests and contact: info@theartifics.com. Guester is a hotel software service provided by The Artifics. This notice describes processing for our own purposes relating to The Artifics and Guester websites, demonstrations, enquiries, customer relationships and user accounts.
For guest, staff, reservation and selected-module review/competitor-analysis data processed on a Hotel’s documented instructions, the Hotel is the controller and the Provider is a processor under the Data Processing Agreement. The Hotel establishes the lawful basis and data-subject notice appropriate to its purpose. The Artifics gains no authority from those instructions or public availability to build an independently controlled identifiable-review corpus or independent profiles about individuals; those activities are not authorised within the default service scope. Independent use requires a defined purpose, an established and documented applicable Turkish processing condition and the corresponding data-subject notice arrangement before it proceeds. The Hotel is not automatically the controller for every product activity. This notice does not replace the Hotel’s notices to guests and staff.
2. Data and collection methods
We may process names, business contact details, roles, hotel/company information, demonstration requests and correspondence supplied by you or your organisation; account identifiers, invitations and permissions; support requests and attachments you provide; accepted document versions, scope and timestamps; and IP addresses, browser/device information, sessions and transaction records needed to protect the service. When a subscription is arranged, necessary invoicing, tax and payment-status information is also processed. Do not attach access secrets or unnecessary guest lists to support requests.
Data is obtained electronically through forms, email, meetings, the panel and integrated systems; indirectly through an authorised customer representative; and, for reviewer names and review text, from public OTA/review pages and authorised integrations. Public availability does not permit unrestricted reuse for every purpose. Reviews can contain additional information disclosed by their authors.
3. Purposes and legal bases
Responding to demonstrations and sales enquiries, establishing accounts, providing authorised access and support may rely on contractual necessity under Article 5(2)(c) of Turkish Law No. 6698 where its conditions apply. If a company’s representative is not personally a party to the contract, necessary business-contact processing to manage customer relationships relies on legitimate interests under Article 5(2)(f), subject to a documented assessment balancing that person’s rights and freedoms. Contractual necessity does not automatically cover all representative data.
Service and account security, abuse prevention and limited operational records rely on balanced legitimate interests under Article 5(2)(f) where applicable. Acceptance and dispute evidence necessary to establish, exercise or defend rights relies on Article 5(2)(e); mandatory financial/administrative records rely on the relevant legal requirement and Article 5(2)(a) or (ç). Public reviews processed on the Hotel’s instructions use the lawful basis and notice established by the Hotel for its defined purpose. Public availability is not itself a lawful basis for independent reuse; independently controlled review processing by the Provider does not proceed before the separate purpose, lawful-basis and notice conditions described above are established.
Marketing and non-essential tracking requiring consent use separate, freely given and withdrawable choices. Accepting a service agreement is neither marketing permission nor consent on a guest's behalf. Service notifications are distinguished from advertising. Special-category data, payment-card security information and unnecessary identity documents are not requested for general use; their appearance in reviews or messages requires separate legal and technical controls.
4. Recipients and actual routes
Guester’s infrastructure in Türkiye is organised as application and data-processing clusters operating on private cloud services. The infrastructure service providers are Sunucun Bilgi İletişim Teknolojileri ve Ticaret Ltd. Şti. and Netlen İnternet Hizmetleri Ltd. Şti. The operator/provider inventory identifies the physical location of Sunucun’s infrastructure as Mars Datacenter Istanbul-1, operated by Mars Veri Merkezi A.Ş., and Netlen’s infrastructure as DATACASA Istanbul-1, operated by Datema Bilişim Ticaret A.Ş. Primary hotel databases and PMS reports are held on the infrastructure supplied through Sunucun; website records are held on the relevant Netlen/WordPress infrastructure. Access and data-protection roles of the infrastructure provider and data-centre operator depend on the actual service scope; the physical facility is not treated as the sole or principal processor.
The panel frontend displays data received from the API and does not operate an independent persistent PMS/hotel database. Display, transmission, sessions, browser memory/cache and technical records may nevertheless involve personal-data processing. This distinction does not mean website application records or browser data are absent.
Dashboard and backoffice traffic passes through Cloudflare. Because the connection terminates at that service, Cloudflare may process session and screen-related personal data as well as IP addresses. Physical infrastructure in Türkiye does not mean all processing occurs there or that external transfers are absent.
Cloudflare Workers AI receives review text, reviewer names and relevant staff information for analysis, translation, replies and staff matching. The Google Gemini-based panel chat processes messages and added hotel context. The active OpenRouter route may send messages, reviews and necessary PMS/hotel context to the actual inference provider for selected models, including Google/Gemini and Anthropic/Claude; actual recipients/endpoints, processing countries, retention and onward recipients are established separately from the model brand. Fallback to Cloudflare depends on account and routing settings. OpenAI may be considered in future and is not identified as a confirmed active recipient in this version. The active Channex channel connection processes property, rates/availability and reservation fields. Apify and selected Actors support public-review collection; standard input is a hotel URL/identifier, rather than a PMS file. User-enabled email, maps, remote images and external AI connections introduce further recipients. See Subprocessors and Data Flows for details.
Our authorised personnel access information as necessary. Limited information may also be disclosed to advisers, financial services and competent authorities subject to applicable obligations and procedural safeguards. These categories do not mean public disclosure or that every provider receives every category.
5. International processing
Cloudflare, Google, OpenRouter and enabled international integrations may involve processing or access outside Türkiye. A provider's headquarters country does not necessarily identify every processing, storage or remote-access location. Regular transfers require both an applicable processing basis and an available adequacy decision or appropriate safeguard. Where official Turkish standard contracts are required, the correct parties, annexes, signatures and notification must be completed separately. Reading this notice or ticking a box does not replace those formalities. A route lacking its required conditions must not be used for personal data.
6. Retention and security
Retention takes account of the specific enquiry/service purpose, customer relationship, applicable legal duties and what is necessary for concrete legal claims. PMS files, reviews, account/acceptance evidence, security logs and backups are not all subject to one period. When processing conditions end, deletion, destruction or genuine anonymisation is required; legally retained records are segregated with restricted access. Hotel-data return and deletion are addressed in the DPA.
Measures appropriate to the activity, including access limits, secure connections and incident response, must be applied. A datacentre's certification is not an independent Guester certification. We do not give a blanket assurance of immediate deletion, zero retention by every provider, or no training use across every AI route. The specific provider, account type, configuration and purpose must be considered.
7. Rights and requests
Under Article 11 of Law No. 6698, you may learn whether data is processed, its purposes and recipients; request correction, conditional deletion/destruction and notification to recipients; object to adverse results arising solely from automated analysis; and seek compensation for unlawful processing. You may begin through our contact channel and use legally permitted methods such as a written request, registered electronic mail, qualified electronic signature or an email previously registered with us, with appropriate identity verification. Requests are handled promptly and within thirty days; charges are limited to what the law permits.
Requests concerning guest/staff data processed on hotel instructions are referred to the hotel and supported by us. Applicable US state laws may provide additional rights to access, delete, correct, obtain portable data, opt out of certain sales/sharing or profiling, and avoid discrimination. Scope and exemptions are assessed; this notice does not claim every state's thresholds automatically apply. Cookie and communication choices can be changed separately. Material changes are communicated through suitable channels, with separate action where a new purpose or consent requires it.
Where applicable US state law provides an appeal against a rejected data-rights request, an appeal may be sent to info@theartifics.com with the subject “data-rights appeal”. It is assessed within the time and procedure required by the applicable law; a reasoned decision and any available regulator complaint route following a continued denial are supplied. Eligibility, rights and deadlines vary by state and the actual activity.
8. Guester website: demonstrations and Founding applications
Guester demonstration appointments use a Cal.com calendar served through app.cal.com. Loading the calendar transmits technical connection information; making a booking provides your name, email, time/date, appointment details and any permitted campaign source to Cal.com. Its published policy identifies Cal.com, Inc. and processing in the US; the actual account’s region and onward-recipient terms also apply. Provide only necessary booking information, without confidential PMS or guest files. This scheduling flow is separate from panel PMS processing.
Founding Hotel applications collect your name, hotel name, business email, business phone and room count. An application is held in a non-public WordPress administrative record. A short salted IP digest, browser information and application language/channel may also be recorded to evaluate/respond to the enquiry and prevent abuse. Hashing the IP does not anonymise the entire application. Notifications and application acknowledgments are emailed; they do not themselves grant marketing permission. Submitting an application does not activate the pilot: authorised customer acceptance and activation are separate.
The external CRM/webhook route for Founding applications is disabled in this version. Before any future activation, the actual recipient, purpose, scope, processing/transfer conditions and disclosure must be established; new uses beyond application assessment are not automatically authorised.
9. Guester website: statistics and campaign measurement
The Guester website is configured for Google Analytics and Google Ads tags through Google Site Kit. Active Google measurement may send page/interaction, technical connection/browser information, IPs, measurement/advertising identifiers and advertising conversion/campaign information to Google; advertising personalisation may apply depending on settings. This website activity is separate from Google Gemini model processing. Consent-based statistics and marketing are distinct purposes; allowing statistics alone is not advertising permission.
The first-party session-storage entry guester_attr may hold UTM campaign/platform information, referring hostname, landing-page path and time to measure application sources. It must be subject to the statistics choice; a permitted record is associated only with a Cal.com booking or Founding application you submit. Refusal/withdrawal must stop new campaign measurement. Information already recorded server-side with an application is not automatically erased; personal-data requests are assessed separately. Technical choices and lifetimes are explained in the Cookie Notice.
In this version, Google measurement and advertising tags are linked in a shared configuration. “Analytics only” permits first-party campaign recording and does not enable that shared Google package. The package containing Google Analytics and Google Ads may operate when “Accept all” authorises both statistics and marketing purposes. “Decline” does not enable those optional routes. An applicable GPC/refusal signal separately preserves the marketing restriction where required.