Hotel privacy notice under KVKK: a template, section by section

A hotel's KVKK privacy notice (aydınlatma metni) is the short text that tells guests who controls their data, why it is processed, who receives it, how and on what legal ground it was collected, and what rights they have. Turkish law requires it for every processing activity, whatever the legal basis, and it must stay separate from consent.

A guest asks at the desk what the hotel does with the passport details it just photographed. The receptionist hands over a printed page that talks about a human resources file and a supplier portal this hotel has never used. The notice exists; it simply does not describe this property. This article walks through a hotel privacy notice template for KVKK section by section, so you can write one that matches what your hotel actually does.

What must a hotel's KVKK privacy notice contain?#

Five items, listed in Article 10 of Law No. 6698 (opens in a new tab), and nothing beyond them is mandatory: who controls the data, why it is processed, who receives it, how and on what legal ground it was collected, and the rights the person can use.

Start with the controller's identity and of its representative, if one is appointed. For a hotel this means the legal entity name and address exactly as they appear on the invoice, not the brand name on the sign. Then the purpose of processing, written as concrete purposes. "Service quality and improvement" tells a guest nothing; "confirming your reservation, assigning your room and charging extras to your bill" does.

Name the recipients and the purpose of each transfer, not a single sentence about business partners. State the channel the data arrived through (booking site, desk, guest app, camera) and which condition in Article 5 the hotel relies on. Finally, list the rights the law gives people under Article 11 and the route to use them: an application address, an email address and, if the hotel uses one, a registered electronic address.

The law itself sets the shape of the notice. Article 10 applies to every processing activity whatever the legal basis, and the notice is a separate text from any consent. Read the current guidance with your adviser before you draft, because the wording and the examples change. The notice is short by design. One page in plain Turkish beats four pages of statutory quotation that the desk cannot explain.

For the wider picture on notices, consent, staff access and retention, see KVKK for hotels: notices, consent, staff access and retention.

How do you write each section for a hotel?#

Write it in the order Article 10 gives, one short paragraph per element, in plain language, and keep every sentence specific to this property.

Open with the controller. For example: "This notice explains how [legal entity name] processes the personal data of guests, visitors and people who request a reservation." The name must match the invoice, or a guest cannot tell who is answering for the data.

The purpose paragraph lists what the hotel actually does: taking and confirming the reservation, running the stay (room assignment, key card, restaurant and bar charges on the guest bill), the identity notification, invoicing, security cameras, answering requests, and the guest app if the hotel uses one. The recipients paragraph groups them by purpose: the booking site or agency that sent the reservation, the payment provider, the hotel software provider, the e-invoice integrator and accountant, the security provider if footage is shared, and public authorities where the law requires a notification.

For method and legal ground, write for example: "Your data reaches us through the booking site you used, the registration form at the desk, the guest app or our cameras. We rely on the need to perform our contract with you, on our legal obligations and, for cameras, on our legitimate interest in the security of the property." Each ground must point at a named activity.

The rights paragraph says what a guest can ask for under Article 11 and where to send it, and the desk must know the procedure behind that address. Retention is not one of the five elements, but one sentence on how long records are kept stops the desk from improvising an answer; take the figure from the hotel's own retention table.

Keep a Turkish master text, add versions only for languages the property actually serves, and state which version prevails if they differ. Have counsel read the final wording; the sentences here are illustrations, not a legal document.

For what happens after a guest uses that route, see how the front office handles a guest data request.

Which legal ground and recipient belongs to each hotel activity?#

Each activity carries its own purpose, its own condition under Article 5 and its own recipients, and a notice that gives one blanket ground for everything is neither accurate nor useful.

The reservation before arrival sits under the ground that processing is necessary to set up or perform the contract. The stay and the bill, room assignment, key card, minibar and restaurant charges, sit under the same contract ground. The identity notification (KBS, the guest identity notification) and invoicing sit under legal obligation. Do not print a deadline or a named authority for the notification unless your adviser confirms it for your facility, and describe invoicing duties in general terms, leaving dates and thresholds to the adviser.

Cameras need a purpose fixed at the outset, such as workplace security, preventing and detecting crime, or occupational health and safety. The Authority's announcement of 8 June 2026 (opens in a new tab) says recording people is processing, asks for data minimisation, rules out audio unless its necessity is clearly shown, keeps cameras out of toilets, changing rooms, prayer rooms and rest areas, and requires a notice that the area is recorded (Kişisel Verileri Koruma Kurumu, 8 June 2026).

Marketing messages are a separate act with their own permission, not something the stay contract covers. If any supplier processes data outside Türkiye, that has its own conditions; say nothing settled about it in the notice until counsel has reviewed the actual supplier list.

For camera placement and footage in detail, see CCTV in hotels under KVKK: notices, placement and footage.

Where must the notice appear?#

Wherever the hotel collects personal data, at the moment it collects it: the website and booking engine, the desk, the guest app, the camera signs and any form that asks for personal details.

On the website and booking engine, put a visible link on every page where a reservation starts and on the confirmation page, not only in the footer of the home page. At the desk, keep a printed copy the guest can read and take away, and a registration form that points to it rather than repeating it badly. In the guest app, show it before the first data entry, not buried in a settings menu.

Camera signs carry a short notice at the entrance to each recorded area saying the area is recorded and where the full notice can be read; the June 2026 announcement ties this directly to the duty to inform. For group, corporate and agency bookings, the agency informs its own customer for its own processing, and the hotel still informs for the stay; the notice should say the reservation reached the hotel through an agency. Employees get their own notice, and cameras that watch staff need the employee notice to say so.

What must a notice never do?#

It must not collect consent, and it must not promise things the hotel does not do.

No "I have read and understood, I consent" tick box inside the notice. The law keeps the notice and consent apart: Article 10 is a duty to inform, not a consent form. Where consent is genuinely needed, for example for a guest photo used in marketing, it goes in its own text with its own signature or tick. Marketing permission has its own route and its own record. There should be no blanket statement that data may be shared with all business partners, no list of purposes the hotel does not carry out, and no claim of a certificate or security guarantee the hotel does not hold.

Do not copy another hotel's or another sector's text. Purposes and recipients must match this property, and a copied text usually names both the wrong purposes and the wrong recipients. Silence is not a saving: a purpose the hotel actually carries out but leaves out of the notice is a gap, not a simplification.

How do you keep the notice current before the season?#

Review it once a year before the season opens, and again whenever a system, a supplier or a purpose changes.

Triggers for an early review include a new booking engine or channel, a new payment provider, a new camera, a new guest app, a new outlet such as a spa or beach, or a change of legal entity or address. Walk the desk and the reservations screen and list every field the hotel actually collects, then read the notice against that list. Check the recipients paragraph against the current supplier list and remove suppliers the hotel no longer uses, and check the retention sentence against the hotel's retention and destruction table so the notice and the practice agree.

Date and version the notice, keep the old versions, and record who approved the text and when. Have counsel read the final wording; nothing in this article is a legal document, and the examples are illustrations.

On tooling: in AI Otel's hotel operating system, which is built and working ahead of launch, KVKK consent, data export and retention periods are structured into the data model. That keeps the notice, the practice and the retention table pointing at the same data.

What to do next#

Take the five Article 10 elements, fill them for one property from what the hotel actually does, have counsel read the result, and publish it in the five places guests meet the hotel: website, booking engine, desk, guest app and camera signs. The notice is the cheapest compliance document a hotel owns, and the only one a guest reads at the moment they hand over their passport.

For the retention figures behind that one sentence, see building a retention and destruction table for guest records. If you want to see how the data model behind consent and retention works, request a briefing.