Recording phone calls at the front desk and reservations: what the data protection notice must say

Under article 10 of Law 6698, a hotel recording calls must tell the caller the controller's identity, the purpose, to whom and why data is transferred, the method and legal basis of collection, and the article 11 rights. The Communiqué on the notice duty allows informing by voice recording, call center scripts, oral notice, written notice or electronic notice. This guide explains the general framework; confirm your own obligations and wording with a legal adviser.

A reservations line rings at 23:40. The agent says "this call may be recorded", takes the booking, and the audio sits on a provider's server for years with no stated purpose, no stated recipient and no deletion date. This is a common failure mode in hotel phone call recording and data protection in Türkiye, and it is fixable with three short documents. After reading, you will be able to write the opening line, the notice it points to, and the retention rule behind both.

Is a recorded reservation call personal data?#

Yes. A recording that carries a caller's name, phone number, dates and room preferences relates to a person who can be identified, and that is what makes it personal data.

Listen to what the audio actually holds: a voice, a name, a mobile number, arrival and departure dates, a rate discussed, sometimes an invoice address, and sometimes a request that reveals a health need, such as a step-free room or a late check-in for a medical appointment. Each of these points to one person.

A voice is not anonymous. It identifies a person to anyone who knows them, and it sits next to the number the call came from. Business callers count too: a travel agency clerk, a corporate booker or a supplier's representative is a person whose data you are collecting, so the same duty applies on those lines.

The duty attaches at the moment of collection. For a recorded call that is the first seconds, which is why the opening line matters more than the page on the website. A quality or training purpose explains why you record; it does not move the recording outside the law, and it does not remove the duty to inform.

Keep two records separate in your head: the booking itself and the audio of how it was made. They have different purposes and can have different retention periods. If your team handles inquiries across channels, the same thinking applies when turning phone, email and WhatsApp inquiries into reservations.

What must the hotel tell the caller?#

Article 10 of Law 6698 names five items, and a hotel that records calls has to cover all five for the person on the line. The text of article 10 on the Mevzuat Bilgi Sistemi (opens in a new tab) is short and worth reading in the original.

Controller identity: the legal name of the hotel or the operating company, not only the brand on the door. Purpose: what the recording is for, stated concretely, such as keeping the booking accurate, settling a dispute about what was agreed, or training agents. Recipients and why: who receives the audio, for example the call-recording provider, a group's central reservations team, or an adviser handling a complaint.

Method and legal basis: the method is a recorded telephone call; the legal basis is the condition the hotel relies on, which is a decision for the hotel and its adviser, not something the notice can invent. The rights in article 11: the notice should point to the article itself rather than paraphrase it loosely, so the list the caller reads is the list the law gives.

Write the five items once, in one place, and let the spoken line and the web page draw on the same text. Two independently written versions drift apart within a month. The same discipline matters for other data the desk handles, including ID photocopies at hotel check-in under the KVKK principle decision.

Give each item a column for "where it appears": opening message, website notice, confirmation email.

Can the notice be given by voice recording?#

Yes. Article 5 of the Communiqué on the notice duty lists voice recording and the call center among the ways the duty may be performed, next to oral, written and electronic notice. The Communiqué on the KVKK website (opens in a new tab) sets out the full list.

That makes the message you already play the natural carrier of the notice, provided it carries the article 10 content or a clear pointer to where the content sits. Combining methods is normal and usually best: a short spoken line, the full text on the website, and the same text in the confirmation email.

It settles how you inform. It does not settle whether the recording itself is lawful: the legal basis is a separate entry in the same notice and depends on the hotel's own case. It does not bless a bare sentence either. "This call is recorded" states the method and nothing else; purpose, recipients and rights are still missing.

Keep a dated copy of the exact message you played. In a dispute the question is what this caller heard on that day, not what the script says today.

What should the opening line of the call say?#

A workable opening line names the hotel, says the call is recorded, gives the purpose in a few words, and says where the full notice is.

Keep it short. The caller wants a room; a recital read at speed gets tuned out and protects nobody. Name the purpose in plain words: "so that your booking is accurate and we can check what was agreed" does more work than "for quality purposes". Point to the full notice in two places, the website address and the confirmation email that follows the call, and say what the caller can do next: ask for the notice by email now, or ask to speak to someone about it.

Do not present the message as a consent request. It delivers a notice; calling it consent changes what you are claiming and leaves a record that contradicts your own text. Play it before any collection begins, on every recorded line: reservations, the group desk, the out-of-hours line and the sales office. Re-record when the notice changes, because a message recorded two years ago usually describes a purpose and a provider that no longer exist.

Where does the full notice live?#

In one canonical text that a caller can reach from every place they might look: the website, the confirmation email, the desk, and the recorded line itself.

One text, one version, one date. If the desk card and the website disagree, you have two notices and no way to say which one a caller saw. The confirmation email is the natural carrier, because it already goes to the person whose data you collected minutes earlier. The desk needs a printed card or a code the caller can scan, for the inquiries that happen by phone at reception rather than through the reservations line.

Keep the notice family consistent: the same page should cover cameras, key cards and the guest app, so a guest is not reading three unrelated documents. The camera part has its own rules; see CCTV notices, placement and footage under KVKK. Do not promise what the systems do not enforce: a stated retention period that no job deletes, or a recipient list that omits the recording provider, turns the notice into a false statement.

Archive old versions with their live dates. A complaint about a call from last spring needs the text that was live in the spring.

Where are recordings kept, who may listen, and for how long?#

An accurate notice describes what actually happens: where the audio sits, who may hear it, and the period after which it is deleted. Article 10 requires the recipients and the reason; the storage location and the period are the hotel's own commitments, and they must be true.

Access by role, not by habit. Name the roles that may open a recording, such as the reservations manager, the front office manager and whoever handles disputes. Keep a listening log of who opened which recording and when; without it the access list is a promise nobody checks.

The provider is a recipient. If the audio sits with a call-recording or cloud provider, that company belongs in the transfer entry of the notice, with the reason it receives the data. Check the country: if the provider stores outside Türkiye, say so in the transfer entry, because the notice must match where the audio actually sits. Do not write that recordings stay in the country unless that is where they are.

Write the period down and automate the deletion. Tie the period to a purpose you can defend, such as the window in which a booking dispute can arise, and let the system delete without anyone remembering. Plan for the exception: a recording tied to a live complaint, a court request or an audit stays until that is closed, and the notice should say that exceptions exist. Test the routine once a quarter: pick a date, confirm the recordings from before the cut-off are gone, and note who checked.

The period itself is part of a wider exercise; the same method works when building a retention and destruction table for guest records.

Where the text stops for your hotel#

The two texts settle the notice duty and the methods of performing it; they do not settle the legal basis for recording, the retention period, or the exact wording for your property.

What you have: the article 10 content list and the article 5 method list, both readable on the official sources. What you do not have from them: the condition the hotel relies on to record, the period it keeps, the transfer route if a provider stores abroad, and the sentences themselves. Confirm those for your own case with your legal adviser.

The finish is three artifacts kept together: the opening script, the notice page, and the retention and deletion table. A change in one is a change in all three. Have the set checked once, together, and date the version so the hotel can show what was in force when.

A practical test before you go live: play the message to someone who has never heard it and ask where they would find the full notice. If they cannot answer, the line is too long or too vague.

What to do next#

Write the three artifacts this week, in this order: the opening line, the notice page it points to, and the retention and deletion table behind both. The parts fit together as one chain. Article 10 says what the caller must be told, article 5 of the Communiqué says it can be told by voice recording, and the storage, access and deletion facts decide whether what you told them is true.