← Back

Data Protection Notice & Processing Agreement

This notice explains how personal data is handled in Genix Hotel and sets out the terms on which Genix Bilgisayar — Cansu Aydin ("Genix", "Processor") processes personal data on behalf of the customer ("you", "Controller"). It forms part of the Terms of Service and serves as the data processing agreement required by Article 28 GDPR. By ticking the consent box during sign-up you confirm that you have read it.

1. Who is responsible for what

Data	Controller	Our role
Your account: name, e-mail, phone, business name, subscription status	Genix	Controller — see the Privacy Policy
Guest and business records you enter: reservations, guests, payments, identity documents, notes	You	Processor — we act only on your documented instructions

2. Subject matter and duration

We process personal data only to provide the Service described in the Terms, for as long as your account exists. On termination we delete or return the data as described in section 8.

3. Categories of data and data subjects

• Data subjects: your staff users and your hotel guests.
• Personal data: names, contact details, nationality, dates of birth, identity or passport numbers and (optionally) photographs of identity documents, stay dates and room details, payment records and balances, free-text notes.
• Special category data: the Service is not designed to process special category data. Do not enter health, religious, biometric or similar data into free-text fields.

4. Our obligations as processor

• Process personal data only on your documented instructions, including for international transfers, unless required otherwise by law.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement the technical and organisational measures set out in section 6.
• Engage sub-processors only as set out in section 5, under equivalent obligations.
• Assist you, taking into account the nature of the processing, in responding to data subject requests and in meeting your obligations under Articles 32–36 GDPR.
• Notify you without undue delay after becoming aware of a personal data breach.
• Make available the information necessary to demonstrate compliance and allow for audits, on reasonable notice.

5. Sub-processors

You give general authorisation for the following categories of sub-processor. We will inform you of intended changes and you may object on reasonable data-protection grounds.

Purpose	Provider	Location
Hosting and storage	Genix-operated servers	Türkiye
Transactional e-mail	E-mail delivery provider	EU / EEA
Push notifications	Apple Push Notification service; browser web-push services	United States / EEA
Payments	App store providers (Apple, Google) and our web payment provider	Depends on provider
Guest messaging (only if you enable it)	WhatsApp Business Cloud API (Meta)	United States / EEA

6. Security measures

• Encryption of data in transit (HTTPS/TLS).
• Passwords stored only as salted hashes; sensitive credentials encrypted at rest.
• Role- and permission-based access control inside the application; each hotel's data is isolated.
• Access to production systems restricted to authorised personnel.
• Regular encrypted backups and the ability to restore availability after an incident.
• Logging of security-relevant events.

7. International transfers

Our servers are located in Türkiye, which is not covered by a European Commission adequacy decision. Where personal data is transferred from the EEA or the UK, the transfer is made under the European Commission's Standard Contractual Clauses (Module Two, controller to processor), together with the UK International Data Transfer Addendum where the UK GDPR applies, and supplementary measures including encryption in transit. A copy of the safeguards is available on request.

8. Deletion and return of data

You may export or delete your data at any time from within the Service. When your account is closed, live data is deleted; copies held in encrypted backups are removed when those backups are rotated. We retain only what applicable law requires us to keep, such as invoices.

9. Rights of data subjects

Individuals have the right to access, rectify, erase, restrict and object to the processing of their personal data, to data portability, and to withdraw consent at any time. Guests should address their requests to the hotel that holds their booking, as that hotel is the controller. If a request reaches us directly, we will forward it to the relevant hotel and assist as required.

Individuals in the EEA or the UK may lodge a complaint with their supervisory authority. California residents may exercise the rights described in the Privacy Policy. We do not sell or share personal information.

10. Consent statement (sign-up)

11. Contact