Privacy Policy

1. Data Controller

For the purposes of Turkey's Law on the Protection of Personal Data No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), the data controller is RACKLE TECH TRAVEL AGENCY, operating under the Stayax brand.

Address: Ehlibeyt Mah. Ceyhun Atuf Kansu Cad. No: 124 İç Kapı No: 27 Çankaya / Ankara, Türkiye. TÜRSAB Licence No: 18730. Email: [email protected]. Phone: +90 312 499 36 95.

2. Personal Data We Process

To provide the Service we may process the following categories of personal data:

• Identity and contact data: full name, address, phone number, email address.
• Account and listing data: username, property/listing details, reservation and guest records.
• Payment and payout data: payment method, transaction details, bank name, IBAN and the bank-account details used to receive payouts (we do not store your full card number; card payments are processed via licensed payment institutions).
• Business and legal-verification data: legal company name, tax office, tax number or national identity number (TCKN), and tax-certificate, operating-licence and similar verification documents.
• Transaction-security and usage data: IP address, mobile device identifiers, location, navigation and click-stream data, time of access, listings viewed, search history and duration of visit.
• Mobile-device and notification data: device type, operating system and app version; notification permission and preferences; and the push-notification device token created by APNs on iOS or Firebase Cloud Messaging (FCM) on Android. This token is not an advertising identifier and is used only to deliver app notifications to the relevant device.
• Optional mobile usage analytics: product interactions such as screen views, time spent on screens and feature usage, only after you opt in. Guest names, email addresses, reservation codes, message contents and price data are not added to analytics events.
• Support data: the topic and description of your support request, and an optional screenshot only when you choose to attach and send one; plus validation information such as file name, type and size.
• Data collected through cookies and similar technologies (see the relevant section below).

3. Purposes of Processing

We process your personal data for the following purposes:

• To provide the services you request and optimize your use of the Service.
• To contact you with user or service updates.
• To deliver reservation, cancellation, guest-message and other operational notifications you select to your device.
• To review, respond to and securely resolve your support request and any optional screenshot you submit.
• To improve the user experience by measuring app screen and feature usage only when you opt in.
• To customize, measure, report on and improve our services, content and advertising.
• To promote Stayax services that are relevant to you.
• To compare information for accuracy and verify it with third parties where needed.
• To prevent, investigate or prosecute activity that may be illegal, unlawful or harmful.
• To enforce this Policy, our Terms and our legal obligations.

4. Legal Bases for Processing

We process your personal data under KVKK Arts. 5-6 and GDPR Art. 6 on the following legal bases: performance of a contract; compliance with legal obligations; our legitimate interests (service security, fraud prevention, service improvement); and, where required, your explicit consent (e.g. marketing communications and non-essential cookies).

5. Disclosure of Personal Data

We may disclose your personal data to enforce our policies or where permitted by applicable law (such as a request from a law-enforcement or governmental authority, actual or proposed litigation, or to protect our rights and interests). We may also share your personal data with:

• Partners whose services you have requested.
• Other users you do business with (e.g. host-guest communication).
• Third-party processors acting on our behalf (such as hosting, payments, analytics, customer support and OTA/channel integrations).
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) to deliver push notifications; and Google Firebase Analytics for mobile usage analytics that activates only after you opt in.
• Competent administrative or judicial authorities pursuant to a legal request.

6. International Transfers

Some of our service providers may be located abroad. Any transfer of your personal data outside Turkey/the EEA is carried out in accordance with KVKK Art. 9 and GDPR Chapter V — relying on countries that provide adequate protection, appropriate safeguards (e.g. standard contractual clauses), or, where required, your explicit consent. In the unlikely event that RACKLE TECH TRAVEL AGENCY or some of its assets are transferred to a third party, your personal data may also be transferred and will remain subject to this Policy.

7. Storing Personal Data

We retain your personal data only as long as necessary for the purposes you consent to under this Policy and our Terms, or as required by applicable law, after which it is deleted, destroyed or anonymized.

A push-notification device token is retained while the device subscription remains active and is detached from the server subscription or disabled when you sign out, remove the notification registration, or when your verified account-deletion request is processed. Support requests and optional screenshots are retained only as needed to resolve the request and meet security or audit needs; unless legal retention is required, they are deleted or anonymized through the deletion process.

8. Cookies, Mobile Analytics and Notifications

A “cookie” is a small file placed on your device by some of our web pages. We, or third parties we work with, may use cookies and similar technologies to analyze page flow, customize services and content, measure promotional effectiveness and promote security. The Site uses its own first-party, cookieless measurement for usage statistics. We also use Google Analytics 4 (Google Ireland Ltd.); it places a cookie on your device and processes usage data including your IP address on Google infrastructure. Measurement runs if you continue using the Site. If you choose “Decline” in the cookie notice, Google Analytics measurement is stopped and its cookies are deleted; if your browser sends a “Do Not Track” signal, measurement never starts.

Firebase Analytics usage measurement in the Stayax Partner app is off by default and starts only when you actively opt in. You can withdraw consent at any time by turning off Settings > Usage analytics; new mobile analytics events stop being collected after it is disabled. Analytics measures screen and feature usage and does not add guest, reservation, message or price content to analytics events. Firebase Analytics masks the IP address before storage and may use it to derive approximate country/city-level location; the mobile app does not access device location services for this analytics measurement.

If you allow push notifications, the app registers a device-specific token supplied by Apple APNs or Google FCM with our server. The token is used only to deliver the operational notifications you select, manage delivery status and prevent abuse; it is not used to build an advertising profile.

9. Data Security

We apply reasonable administrative and technical measures (including access controls, encryption and transport security) to protect your personal data against unauthorized access, loss, misuse and disclosure. Please note that no method of transmission over the internet is 100% secure.

10. Your Rights as a Data Subject (KVKK Art. 11)

Under KVKK Art. 11 you have the right to:

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties to whom data is transferred domestically or abroad.
• Request correction of incomplete or inaccurate data.
• Request erasure or destruction of data under KVKK Art. 7.
• Request that corrections/erasures be notified to third parties to whom data was transferred.
• Object to a result reached solely through automated analysis.
• Claim compensation for damages arising from unlawful processing.

11. Additional Notice for EU/EEA and Swiss Residents (GDPR)

The following additional notice applies to residents of the EU, EEA and Switzerland who visit the Site. Under the GDPR you have the following rights, except as limited by applicable law:

• Right of access to the data we hold about you.
• Right to correction of inaccurate data.
• Right to erasure (“right to be forgotten”), subject to legal limits.
• Right to restrict processing.
• Right to object to processing in certain situations.
• Right to data portability.
• Right not to be subject to automated decision-making.
• Right to lodge a complaint with your local Data Protection Authority (DPA).

12. Children's Privacy

We do not knowingly collect or process data from anyone under the age of eighteen (18). If we become aware that we have collected data from a child, we will delete it.

13. Inquiries and Messages

Users may send inquiries and messages to one another via tools on the Site. When you send an inquiry through a link, your email address and other information you supply become visible to the relevant user so they can reply directly. These communications may be hosted on, processed by or transmitted through our servers, and we may have access to them for trust and security purposes. Do not share information you are not prepared to disclose — including credit card or bank account details — in an email or message.

14. Phishing or False Emails

If you receive an unsolicited email that appears to be from us or another user requesting personal information (such as your card, login or password), or asking you to verify your account by clicking a link, it was likely sent by someone trying to obtain your information unlawfully. We do not request this type of information by email. Do not provide it or click the link, and please contact us if you receive such an email.

15. Changes to this Policy

We may update this Policy from time to time. The current version is effective when published on the Site; please revisit this page regularly to view the most up-to-date version.

16. Contact and Requests

For questions about this Policy or to exercise your rights under KVKK/GDPR, contact us at [email protected]. We will handle requests in accordance with applicable law within a reasonable period of time and may need to verify your identity before processing your request.

You can request deletion of your Stayax Partner account in the app through Settings > Account security > Account deletion options or at https://stayax.com/en/account-deletion. Account ownership is verified by email or by re-entering the password in an authenticated session. Once verified, account access, active sessions and notification devices are revoked, and profile, support and upload data that is not legally required is deleted or anonymized. Invoice, payment, contract and audit records that must be retained under applicable law are removed from active use and kept under restricted access only for the relevant legal obligation. We aim to complete the legal retention review within 30 days; this operational target does not mean that data is retained for 30 days.