Data controller or data processor: hotel, software vendor, agency and booking site

The data controller decides why and how personal data is processed and answers for it. The data processor processes data only on the controller's behalf, on its instructions. A hotel is normally the controller; its software vendor, channel manager or agency is normally a processor, but the contract and the facts decide, not the label.

A hotel signs a new channel manager contract, and page nine of the vendor's template calls the vendor the data controller. Nobody in the meeting is sure whether that sentence is wrong, harmless or expensive, so it gets signed. It is the same sentence that decides who answers when a guest asks what the hotel knows about them. After reading this article you will be able to place every party around your hotel in the right role, spot the contracts that contradict the facts, and know which duties never leave the hotel.

What do data controller and data processor mean under KVKK?#

The controller decides why and how personal data is processed and answers for it; the processor carries out processing on the controller's behalf, inside the authority the controller gives. KVKK, Türkiye's law on the protection of personal data, sets both definitions in Article 3. The controller is the person who "determines the purposes and means of processing and is responsible for setting up and managing the data recording system". The processor "processes personal data on the controller's behalf under the authority it gives" (Mevzuat Bilgi Sistemi, Law No. 6698 (opens in a new tab), Articles 3 and 12).

In a hotel, the data recording system is concrete, not abstract. It is the reservation file, the guest card, the bill, the key-card log and the camera recorder. Whoever is responsible for setting up and managing that system is the controller: normally the hotel itself.

The distinction is about decision power, not about who holds the data, who runs the servers or who has the admin login. A vendor can host everything and still be a processor. The words matter because they fix four practical things: who signs the guest notice text, who answers a guest's request, who registers in VERBİS where registration applies, and who is answerable when something goes wrong.

One company can hold both roles at once. A software vendor is a processor for the hotel's guest data and a controller for its own invoices, support tickets and marketing list. Both roles are legal descriptions of a real relationship. Writing "processor" in a contract does not create one, and leaving the word out does not prevent one.

Who decides why and how: how do you tell a controller from a processor?#

Whoever decides most of the essential elements of processing is the controller; whoever takes instructions and decides only the technical detail is the processor. Guidance from the Personal Data Protection Board sets out the indicators it uses to tell the two apart. Check the official KVKK website or ask a legal adviser for the current rulings before you rely on them.

The Board's controller indicators include: collecting the data and choosing the method of collection; deciding the types of data and whose data is collected; whether to process and who processes; the essential elements of processing; whether and with whom data is shared; deciding at the top level without instructions; dealing directly with the people concerned; appointing a processor; and benefiting from the processing. The processor indicators are the mirror image: taking instructions to process, having no decision power over collection, purposes, disclosure, access or retention, and not being responsible for the results of processing.

Autonomy is not disqualifying. With the controller's authorisation, a processor may decide non-essential elements, for example which IT systems are used, storage and security methods, transfer methods and deletion methods. A vendor that chooses its own database engine is not thereby a controller.

A three-question test works for almost any hotel supplier: who decided this field should be collected, who decides how long it is kept, and who decides who else receives it. If the hotel answers all three, the supplier is a processor.

Score each answer "hotel", "partner" or "both". The grey zone is reuse. A vendor that mines guest data for its own product development, benchmarking or marketing has stepped outside the mandate, and that activity needs its own legal basis.

Who is who among the hotel's partners?#

In the usual setup the hotel is the controller and its suppliers are processors, but several partners are independent controllers for their own processing, and some are both at once. The Board's indicators place each one; the contract should then match.

This table is an example of typical setups, not a ruling; the contract and the facts decide each case. Do not assume how a named booking site acts: read its notice and its contract. The rule of thumb is simple: the further a party is from the hotel's instruction and the closer to its own commercial purpose, the more likely it is a controller. Where hotel software serves many hotels from one system, it is worth reading how each hotel's data stays apart in multi-tenant hotel software, because separation between tenants is a security measure, not a change of role.

For its own part, AI Otel's hotel operating system is built so that each hotel's data is separated at the database level. That is a technical measure supporting the hotel's own Article 12 duty; it does not change who the controller is, and AI Otel does not take over the hotel's compliance duties.

When are two parties jointly responsible?#

Two different things get confused: joint controllership, where two parties decide the purpose together, and the controller's joint responsibility with its processor for security measures under Article 12.

Article 12 requires the controller to take all necessary technical and administrative measures for an appropriate level of security, to prevent unlawful processing of and unlawful access to personal data and to keep it safe. The same article makes the controller jointly responsible for those measures with anyone who processes the data on its behalf. A vendor's weak access control is therefore the hotel's problem too.

Joint controllership is a different situation: two parties independently determine the purposes and means together, for example a group and its hotel running one loyalty programme on one guest database. The Board's indicators still apply: who decides the essential elements, who deals with the guest, who benefits from the processing. The practical consequence is documentation. Write down who does what, so a guest's request does not bounce between the hotel and the vendor for three weeks. If AI assistants are in the picture, the same role questions arise, and AI assistants and guest data lists the questions to put to your adviser.

What should a data processor contract contain?#

A processor contract should fix the subject, duration, purpose, scope and instructions in writing, and say how security, sub-processors, deletion and audit are handled. Everything else hangs from the instruction clause, because it is the instruction that makes the processor a processor.

The core prohibition matters most: the processor may not process the data for its own purposes or pass it to third parties without instruction. Security obligations should match Article 12, plus a duty to tell the controller about an incident without delay; describe the duty, and do not invent an hour count. Sub-processors should be named or defined by category, authorised by the controller, with the same obligations passed down in writing.

Access control and logging deserve a line of their own, so the hotel can answer "who looked at this guest's record". Deletion or return when the contract ends should say what happens to backups, and the processor should assist with guests' requests. For a small hotel this can be a two-page annex to the main contract, not a separate document nobody reads.

Which duties stay with the hotel even when a processor is involved?#

The hotel keeps the duties that belong to the controller: informing guests, handling their requests, deciding retention, registering where required, and answering for security.

The duty to inform belongs to the controller. The Board's 2020/71 summary allows the processor to carry it out on the controller's instructions, but the responsibility for the text and for its accuracy stays with the hotel. Rights requests arrive at the hotel, not at the vendor, so set an internal route: who receives the request, who logs it, who instructs the processor, who replies, and by when.

Retention is a controller decision. A vendor's default setting, or the fact that deleting is awkward, is not a retention policy. Registration in VERBİS, where it applies to the hotel, is the controller's duty and does not move to the software vendor; VERBİS for hotels explains when registration applies. Security measures under Article 12 stay with the hotel too: shared logins, staff access, leavers who keep their accounts, and the incident log.

Keep the paper: signed contracts, written instructions, sub-processor lists and incident records. In a dispute, the hotel that can produce them is in a different position from the one that cannot. For the wider picture of notices, consent and staff access, see KVKK for hotels.

How do you review the contracts you already have?#

List every party that touches guest data, write one sentence about what each one actually does, and compare that sentence with the role the contract gives it.

Start with the list: PMS, channel manager, booking sites, travel agencies, payment provider, door-lock system, guest messaging, accountant, OSGB. Most hotels find two or three they had forgotten. For each party write four things: what data, for what purpose, who decided the purpose, and how long it is kept. Four lines per supplier is enough.

Compare with the contract's label. Where the label contradicts the facts, the facts usually win, and the label needs fixing. Look for the missing clauses rather than the wrong words: written instructions, sub-processor list, deletion on exit, incident notice, audit right. Ask each vendor for its sub-processor list and where it hosts. Hosting location is a separate question from the role; a vendor can be a processor in any country, and that raises its own transfer questions for your adviser.

Fix the largest gap first. In most hotels it is the missing written instruction and the missing deletion clause, not the wording of the definition. Then take the finished list to your legal adviser. This article is a map of the questions, not a ruling on your contracts.

What to do next#

Build the one-page list this week: every supplier that touches guest data, what it actually does, and the role the contract gives it. Where the two disagree, the facts decide, and the contract gets fixed. The definitions, the Board's indicators and the Article 12 security duty all point the same way: the hotel stays answerable for the guest, and the processor answers to the hotel. If you want to see how we approach the technical side of this, you can request a briefing.