1. Controller and scope
The Artifics, Inc., a Delaware corporation (Delaware File No. 10805181) with its principal office at 2810 N. Church Street, STE 91313, Wilmington, Delaware 19802, United States (“The Artifics”, “we” or “us”), is the data controller for the processing described in this notice. Guester is a hotel software product of The Artifics. Requests and contact: info@theartifics.com; company details are available under Legal information. This notice describes processing for our own purposes relating to The Artifics and Guester websites, demonstrations, evaluation and program applications, customer relationships and user accounts. It is provided as the disclosure required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data and as a notice under applicable US state privacy laws. Sections 8 and 9 describe processing that is specific to theartifics.com; processing specific to guester.co is described in the notice published at guester.co/legal/privacy-notice/.
For guest, staff, reservation and selected-module review/competitor-analysis data processed on a Hotel’s documented instructions, the Hotel is the controller and the Provider is a processor under the Data Processing Agreement. The Hotel establishes the lawful basis and data-subject notice appropriate to its purpose. The Artifics gains no authority from those instructions or public availability to build an independently controlled identifiable-review corpus or independent profiles about individuals; those activities are not authorised within the default service scope. Independent use requires a defined purpose, an established and documented applicable Turkish processing condition and the corresponding data-subject notice arrangement before it proceeds. The Hotel is not automatically the controller for every product activity. This notice does not replace the Hotel’s notices to guests and staff.
2. Data and collection methods
We may process names, business contact details, roles, hotel/company information, demonstration requests and correspondence supplied by you or your organisation; account identifiers, invitations and permissions; support requests and attachments you provide; accepted document versions, scope and timestamps; and IP addresses, browser/device information, sessions and transaction records needed to protect the service. When a subscription is arranged, necessary invoicing, tax and payment-status information is also processed. Do not attach access secrets or unnecessary guest lists to support requests.
Data is obtained electronically through forms, email, meetings, the panel and integrated systems; indirectly through an authorised customer representative; and, for reviewer names and review text, from public OTA/review pages and authorised integrations. Public availability does not permit unrestricted reuse for every purpose. Reviews can contain additional information disclosed by their authors.
3. Purposes and legal bases
Responding to demonstrations and sales enquiries, establishing accounts, providing authorised access and support may rely on contractual necessity under Article 5(2)(c) of Turkish Law No. 6698 where its conditions apply. If a company’s representative is not personally a party to the contract, necessary business-contact processing to manage customer relationships relies on legitimate interests under Article 5(2)(f), subject to a documented assessment balancing that person’s rights and freedoms. Contractual necessity does not automatically cover all representative data.
Service and account security, abuse prevention and limited operational records rely on balanced legitimate interests under Article 5(2)(f) where applicable. Acceptance and dispute evidence necessary to establish, exercise or defend rights relies on Article 5(2)(e); mandatory financial/administrative records rely on the relevant legal requirement and Article 5(2)(a) or (ç). Public reviews processed on the Hotel’s instructions use the lawful basis and notice established by the Hotel for its defined purpose. Public availability is not itself a lawful basis for independent reuse; independently controlled review processing by the Provider does not proceed before the separate purpose, lawful-basis and notice conditions described above are established.
Marketing and non-essential tracking requiring consent use separate, freely given and withdrawable choices. Accepting a service agreement is neither marketing permission nor consent on a guest's behalf. Service notifications are distinguished from advertising. Special-category data, payment-card security information and unnecessary identity documents are not requested for general use; their appearance in reviews or messages requires separate legal and technical controls.
4. Recipients and actual routes
Guester’s infrastructure in Türkiye is organised as application and data-processing clusters operating on private cloud services. The infrastructure service providers are Sunucun Bilgi İletişim Teknolojileri ve Ticaret Ltd. Şti. and Netlen İnternet Hizmetleri Ltd. Şti. The operator/provider inventory identifies the physical location of Sunucun’s infrastructure as Mars Datacenter Istanbul-1, operated by Mars Veri Merkezi A.Ş., and Netlen’s infrastructure as DATACASA Istanbul-1, operated by Datema Bilişim Ticaret A.Ş. Primary hotel databases and PMS reports are held on the infrastructure supplied through Sunucun; website records are held on the relevant Netlen/WordPress infrastructure. Access and data-protection roles of the infrastructure provider and data-centre operator depend on the actual service scope; the physical facility is not treated as the sole or principal processor.
The panel frontend displays data received from the API and does not operate an independent persistent PMS/hotel database. Display, transmission, sessions, browser memory/cache and technical records may nevertheless involve personal-data processing. This distinction does not mean website application records or browser data are absent.
Dashboard and backoffice traffic passes through Cloudflare. Because the connection terminates at that service, Cloudflare may process session and screen-related personal data as well as IP addresses. Physical infrastructure in Türkiye does not mean all processing occurs there or that external transfers are absent.
Cloudflare Workers AI receives review text, reviewer names and relevant staff information for analysis, translation, replies and staff matching. The Google Gemini-based panel chat processes messages and added hotel context. The active OpenRouter route may send messages, reviews and necessary PMS/hotel context to the actual inference provider for selected models, including Google/Gemini and Anthropic/Claude; actual recipients/endpoints, processing countries, retention and onward recipients are established separately from the model brand. Fallback to Cloudflare depends on account and routing settings. OpenAI may be considered in future and is not identified as a confirmed active recipient in this version. The active Channex channel connection processes property, rates/availability and reservation fields. Apify and selected Actors support public-review collection; standard input is a hotel URL/identifier, rather than a PMS file. User-enabled email, maps, remote images and external AI connections introduce further recipients. See Subprocessors and Data Flows for details.
Our authorised personnel access information as necessary. Limited information may also be disclosed to advisers, financial services and competent authorities subject to applicable obligations and procedural safeguards. These categories do not mean public disclosure or that every provider receives every category.
5. International processing
Cloudflare, Google, OpenRouter and enabled international integrations may involve processing or access outside Türkiye. A provider's headquarters country does not necessarily identify every processing, storage or remote-access location. Regular transfers require both an applicable processing basis and an available adequacy decision or appropriate safeguard. Where official Turkish standard contracts are required, the correct parties, annexes, signatures and notification must be completed separately. Reading this notice or ticking a box does not replace those formalities. A route lacking its required conditions must not be used for personal data.
6. Retention and security
Retention takes account of the specific enquiry/service purpose, customer relationship, applicable legal duties and what is necessary for concrete legal claims. PMS files, reviews, account/acceptance evidence, security logs and backups are not all subject to one period. When processing conditions end, deletion, destruction or genuine anonymisation is required; legally retained records are segregated with restricted access. Hotel-data return and deletion are addressed in the DPA.
Measures appropriate to the activity, including access limits, secure connections and incident response, must be applied. A datacentre's certification is not an independent Guester certification. We do not give a blanket assurance of immediate deletion, zero retention by every provider, or no training use across every AI route. The specific provider, account type, configuration and purpose must be considered.
7. Rights and requests
Under Article 11 of Law No. 6698, you may learn whether data is processed, its purposes and recipients; request correction, conditional deletion/destruction and notification to recipients; object to adverse results arising solely from automated analysis; and seek compensation for unlawful processing. You may begin through our contact channel and use legally permitted methods such as a written request, registered electronic mail, qualified electronic signature or an email previously registered with us, with appropriate identity verification. Requests are handled promptly and within thirty days; charges are limited to what the law permits.
Requests concerning guest/staff data processed on hotel instructions are referred to the hotel and supported by us. Applicable US state laws may provide additional rights to access, delete, correct, obtain portable data, opt out of certain sales/sharing or profiling, and avoid discrimination. Scope and exemptions are assessed; this notice does not claim every state's thresholds automatically apply. Cookie and communication choices can be changed separately. Material changes are communicated through suitable channels, with separate action where a new purpose or consent requires it.
Where applicable US state law provides an appeal against a rejected data-rights request, an appeal may be sent to info@theartifics.com with the subject “data-rights appeal”. It is assessed within the time and procedure required by the applicable law; a reasoned decision and any available regulator complaint route following a continued denial are supplied. Eligibility, rights and deadlines vary by state and the actual activity.
8. The Artifics website: contact and careers
Email enquiries involve your name, address, correspondence and business information you provide. Career applications are received by email; this website is not assumed to have a CV-upload form. Education, experience, skills and contact details in your CV/correspondence are processed to assess suitability for the current/near-term position applied for or under consideration and to respond, relying on the legitimate interest in necessary, proportionate candidate assessment under Article 5(2)(f) of Law No. 6698. This basis requires a documented assessment balancing the applicant’s rights and freedoms; data or uses lacking the required conditions are not processed on this basis. Application/dispute evidence necessary to establish, exercise or defend a right is retained under Article 5(2)(e), only for the necessary scope and period. Do not send unnecessary identity documents, health or other special-category information; a genuinely necessary exception requires a separate process and lawful condition.
Emails are handled through the selected email service and authorised personnel. An application is not marketing permission. Retention is limited by assessment, suitability for current/near-term roles and necessary legal/rights records. A separate candidate pool or new purpose requires additional assessment and any necessary choice. Exact candidate-email deletion and mail-backup periods depend on the actual system lifecycle; indefinite retention of every CV is not permitted.
9. The Artifics website: site measurement
The website has configuration for Google Analytics/Google tags through Google Site Kit. Active measurement may transmit page usage, technical browser/connection information, IPs and measurement identifiers to Google. Statistics requiring consent must use a separate choice. Marketing or advertising personalisation cannot be added to that statistics choice. The panel’s no-analytics finding does not apply to this website.
Guester’s guester_attr campaign entry or Cal.com demo calendar is not assumed present on this site. If you follow a link to the Guester website, its page/application functions separately apply. The Cookie Notice explains choices and browser technologies.