AI assistants and guest data: KVKK questions for your adviser

KVKK, Türkiye's personal data protection law (Law No. 6698, as amended), makes the hotel the data controller for anything an AI assistant reads, keeps or sends. Before launch, give your adviser written answers on five points: what the assistant reads and why, where processing happens, what logs are kept, how guests are told and handed to staff, and how properties are separated.

A guest writes in the hotel's web chat about a late check-out and mentions, in passing, a medical reason. The assistant drafts a reply and stores the conversation. Nobody at the hotel has decided whether that text should be kept, for how long, or who is allowed to read it. This article turns that gap into a written file you can put in front of your KVKK adviser, covering what the assistant reads, where processing happens, what the logs keep, how guests are told, and how one property's data stays apart from another's.

Why should your KVKK adviser see the AI assistant before it goes live?#

Because the hotel is the data controller, and the decisions an assistant forces you to make are the controller's decisions. An adviser can shape them in an afternoon before launch and cannot undo them after a complaint.

KVKK (Kişisel Verilerin Korunması Kanunu, Law No. 6698, published in the Official Gazette on 7 April 2016) defines the data controller as the person who sets the purposes and means of processing, according to the consolidated text on the Presidency's legislation portal (opens in a new tab). When an assistant answers reservations or drafts guest replies, the hotel is still the one setting the purpose. The same law makes the controller jointly responsible for technical and administrative measures with anyone processing data on its behalf, so "the vendor handles security" is not a position that survives contact with a regulator.

An assistant changes the shape of processing in three ways a booking form does not: it reads unstructured text, it keeps transcripts, and it may send messages on the hotel's behalf. Each of those is a decision, not a feature. Bring your adviser a written description of the assistant's job, not a product demo. Demos answer "what does it look like"; advisers need "what does it read, where does it run, what does it keep". This article lists the questions; it does not answer them, because the answers depend on your contracts, your property and your adviser's reading of the law.

For background on how a stay in Türkiye always involves payment, a fiscal document, a guest identity notification and personal data, see the four steps every stay involves in Türkiye.

What does the assistant read, and why does it need it?#

Write down every category of guest data the assistant can reach, with the purpose next to it. Any category without a stated purpose should be switched off or masked before launch.

Start from the assistant's actual job. A reservations assistant needs name, stay dates, rate and room type. A message-drafting assistant needs the guest's message and the booking it refers to. Neither needs a passport scan. Free-text messages are the hard case: a guest writing "my father uses a wheelchair" has volunteered health information, which the law treats more carefully than a room number. Ask counsel whether that text may be stored at all, or only read and discarded.

Identity documents belong to the KBS (misafir kimlik bildirimi) flow, which has its own rules; keep the assistant out of it unless someone can explain, in writing, why it needs access. Payment card data should never pass through an assistant: if a design requires it, that is a design problem, not a legal question. The law allows processing without explicit consent only where one of its listed conditions applies, among them that processing is necessary to set up or perform a contract with the person. "Necessary" is the word your adviser will test each category against.

For example, a useful model of the shape to aim for is a facility integration service whose privacy policy states that the service does not request or store direct guest personal data such as names, identity numbers or contact details, and that each facility remains responsible for informing its own guests under KVKK. Record who inside the hotel approved each category, so that when the assistant later gains a new ability, that record tells you the scope changed.

Where does the processing happen, and what has the provider told you in writing?#

Ask the provider for a dated written statement of where the assistant's processing and storage take place and which subcontractors are involved. A sales page is not an answer, and neither is the phrase "KVKK compliant".

The law, as amended, allows transfers of personal data abroad on the basis of a Board adequacy decision or, without one, appropriate safeguards such as a standard contract announced by the Board, subject to the Authority's notification procedures. Whether your setup is a transfer at all is a question for counsel. That is why the written answer matters: the hotel cannot describe its own processing to a guest, or to anyone else, using a claim it cannot evidence.

Ask specifically about prompts and outputs: are conversations retained by the provider, for how long, and are they used to improve or train anything. Get the answer in writing even when the answer is "no". Ask for the current list of subcontractors and the countries involved, and ask to be told when it changes; a list that cannot change is a list nobody maintains. Separate the question "where is it stored" from "who can read it": a provider may store data in one place and support it from another.

What do the logs keep, for how long, and who can see them?#

Every assistant keeps records. The hotel must be able to say what is in them, how long they stay and who reads them, because the law puts a limit on retention and gives guests a right to ask.

KVKK requires data to be kept no longer than the period set by the relevant legislation or needed for the purpose, and once the reasons for processing end, the controller deletes, destroys or anonymizes the data on its own initiative or at the person's request. A log with no retention period fails that test by default. Distinguish three kinds of record: operational logs (who did what, when), conversation transcripts (what the guest wrote), and decision records (what the assistant proposed and who approved it). They have different purposes and should not share one retention period by accident.

Name the people inside the hotel who can read transcripts. Front office, IT and the general manager may all need access for different reasons, and each reason is a purpose to write down. Ask whether the provider's own staff can read transcripts, under what conditions, and whether that access is logged. Guests can apply to learn whether their data is processed, ask for correction, and ask for deletion or destruction; the controller must conclude the request as soon as possible and within thirty days at the latest. A transcript the hotel cannot locate or delete is a request it cannot answer.

For example, a guest who used the chat asks for their conversation to be deleted after checkout. The hotel should know today whether that is possible, who performs it, and what evidence remains afterwards.

For how the desk should handle such requests day to day, see the front office procedure for guest data requests under KVKK.

How do you tell guests, and how do they reach a person?#

The duty to inform applies in every case of processing, whatever the legal basis, and it does not wait for the guest to ask. For a guest-facing assistant, that means a notice the guest can actually see and a handover to staff that actually works.

The Personal Data Protection Authority's communiqué on the duty to inform (Official Gazette, 10 March 2018 (opens in a new tab)) says the notice must be provable by the controller, must be given separately by each department processing data for a different purpose, and, where processing relies on explicit consent, must be carried out separately from obtaining that consent. In practice: the registration form's notice does not automatically cover a chat assistant, and a consent checkbox is not a notice. Take both to counsel rather than editing one to look like the other.

Tell guests when they are talking to an assistant rather than a person, and show how to reach a person. The law gives people the right to object to a result against them that comes solely from automated analysis, and a visible handover is how that right becomes usable at a reception desk. Log the handover: if a guest asks for a person, the record should show that it happened and who took over.

The same law requires the controller, when collecting data, to state its identity, the purpose of processing, to whom and why data may be transferred, the method and legal basis of collection, and the guest's rights. Check that the assistant's screens can carry that, or that they point to somewhere that does. Where data is not obtained from the person, the communiqué requires information within a reasonable time, at the start of communication, or at the latest when the data is transferred: an assistant drafting a reply about a guest from a travel agency's message is exactly that situation.

For the wider picture on notices, consent and staff access, see KVKK for hotels: notices, consent, staff access and retention.

What about staff pasting guest messages into public AI chat tools?#

That is processing by the hotel, done by an employee, and it needs a written staff policy that counsel has reviewed. The policy itself is a separate subject; here it is only a line on the list you take to your adviser.

Ask counsel to review the written policy before it is issued, not after the first incident, and ask what evidence the hotel should keep that staff have read it. The review should cover which tools are permitted, what may never be pasted (identity documents, card numbers, health details, full guest messages), what happens when someone breaks the rule, and whether the tool retains what is pasted. Commercial electronic messages are a separate regime: under Law No. 6563, messages may be sent to recipients after their prior approval, the content must match the approval given, and recipients may refuse at any time without giving a reason. If an assistant sends offers, that question belongs in the same review. The staff policy is covered in more detail in what hotel staff may share with AI chat tools.

How do you keep one property's data apart from another's?#

Separation is a technical question with a legal consequence: an assistant that answers across properties is processing data for a purpose the guest never expected. Ask for a plain description of how accounts, roles and data are separated, and put it in the file.

Ask whether separation is enforced in the database or only in the screen. A screen that hides another property's records is a display choice; separation at the data level is a control. For groups, ask how a regional manager's access is scoped, who grants it, and how it is removed when the person leaves. The law requires the controller to take all necessary technical and administrative measures to prevent unlawful processing of and access to personal data, and makes it jointly responsible for those measures with anyone processing on its behalf. A one-paragraph description of separation belongs in that file.

What to do next#

Assemble a single file: the data map from the table above, the provider's dated written answers, the retention periods, the privacy notice, the handover route, the staff policy and the separation description. Book the review before the assistant handles a live guest message, and diarise a re-review for the moment it gains a new ability, a new channel or a new subcontractor. Each link in the chain is a written answer you either have or do not have, and the ones you do not have are the agenda. Confirm dates, penalties and your own case with your accountant or legal adviser; this article describes duties in general terms and states no legal conclusion about your property.