Last updated: June 10, 2026. How Guester collects, uses and protects personal data — under the Turkish Personal Data Protection Law (KVKK) and, where it applies, the EU GDPR.

1. Who we are

Guester (İstanbul, Türkiye) operates guester.co, app.guester.co and dashboard.guester.co. For data about our website visitors and customers' account users, Guester is the data controller. For personal data about hotel guests that our customers bring into the platform, the hotel is the controller and Guester is a data processor. Contact: admin@guester.co.

2. What we collect

  • Account and contact data — name, work email, hotel/company name, role, password (stored hashed).
  • Billing data — plan, invoices and payment status. Card details are handled by our payment provider; we do not store full card numbers.
  • Usage and log data — IP address, device and browser information, pages and features used, timestamps; used for security and to improve the service.
  • Support communications — messages you send us by email or in-app.
  • Hotel-provided data — data your hotel connects to the platform (PMS records, reservations, reviews, guest names and stay details). We process this only on the hotel's instructions.

3. Why we process it — and on what legal basis

Under KVKK Articles 5–6 and, where applicable, GDPR Article 6, we process personal data to:

  • provide and operate the service (performance of a contract);
  • bill, invoice and keep legally required records (legal obligation);
  • secure the platform, prevent abuse and debug (legitimate interest);
  • improve features using aggregated, de-identified usage statistics (legitimate interest);
  • send service announcements; optional product news only with your consent, which you can withdraw at any time.

4. Hotel guest data

When a hotel connects its PMS, booking channels or review platforms, guest-related personal data flows into the platform so the hotel can see arrivals, reviews and operational insights. Guester processes this data solely to provide the service to that hotel, does not use it for its own marketing, and deletes or returns it when the hotel's subscription ends, subject to the retention rules below.

5. Cookies

The marketing site (guester.co) sets no third-party tracking cookies — fonts and assets are self-hosted. The application uses strictly necessary cookies for sign-in sessions and security. If we ever introduce analytics cookies, we will ask for consent first where the law requires it.

6. Who we share data with

  • Service providers (sub-processors) — hosting, email delivery and payment processing, bound by data-processing agreements.
  • Integrations you enable — data flows to/from your PMS, OTAs and review platforms only when your hotel connects them.
  • Authorities — where disclosure is required by law.

We do not sell personal data.

7. International transfers

Where personal data is transferred outside Türkiye or the EEA, we rely on the safeguards required by KVKK Article 9 and GDPR Chapter V — such as explicit consent, adequacy decisions or standard contractual clauses, as applicable.

8. Retention

We keep account data for the life of your account and as long as required afterwards by tax and commercial law. Hotel guest data processed on a hotel's behalf is deleted or returned within 30 days of subscription end, unless the hotel asks for earlier deletion. Log data is kept for a limited period for security purposes.

9. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, access controls, environment separation and logging. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authority as the law requires.

10. Your rights

Under KVKK Article 11 — and the GDPR where it applies — you can ask us: whether we process your data; for access, correction or deletion; to object to processing or to automated outcomes; and for data portability. Write to admin@guester.co and we will respond within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or your local supervisory authority. Guests of a hotel using Guester should direct requests to their hotel first; we support the hotel in fulfilling them.

11. Children

The service is for businesses and is not directed to children. We do not knowingly collect children's data from website visitors or account users.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on this page (and by email for significant ones) before they take effect.

13. Contact

For anything privacy-related — questions, requests, concerns — contact admin@guester.co.