Privacy notice on the processing of personal data
If the English and Turkish texts differ, the Turkish text prevails.
This notice explains how the personal data of persons who make a booking, personal offer or security deposit transaction through linkinn.net, who write to LINKINN by e-mail / WhatsApp, and who stay in LINKINN apartments are processed.
1. Data controller
| Legal name | LİNK MESKEN TURİZM TİCARET ANONİM ŞİRKETİ (LINKINN) |
|---|---|
| Address | Yeşilkent Mah. 1880. Sk. C Blok No: 60/2 İç Kapı No: 174, Esenyurt / İstanbul |
| Tax office / no. | Esenyurt / 6091263629 |
| MERSİS no. | 0609126362900001 |
| hello@linkinn.net | |
| Phone / WhatsApp | +90 539 411 41 20 |
2. Personal data processed
| Data category | Data | Source |
|---|---|---|
| Identity | Full name | Booking form; for a personal offer, the channel through which we correspond with you |
| Contact | E-mail address, phone number, country | Booking form; offer / security deposit link |
| Customer transaction | Booking number; apartment type and apartment; check-in and check-out dates; number of guests; estimated arrival time; what you write in the notes field (e.g. vehicle licence plate, special requests); website language; the payment method you choose; offer and security deposit details; cancellation and refund records; your correspondence with us | Booking form, e-mail, WhatsApp |
| Finance | Amount paid (euro and Turkish lira), the exchange rate applied and its date; only the brand and the last 4 digits of the card; the bank's transaction references (order no., authorisation no., RRN, STAN); payment result; refund records | Payment step and the bank's response |
| Transaction security | IP address, browser information (User-Agent), the website address and time of the transaction, system logs | Automatic records of the website and the server |
| During the stay | Identity document details of the persons staying (Turkish identity card / passport), vehicle licence plate; full name and identity details of persons added to the booking later | At check-in and during the stay, from each person staying |
| Stay records | Photos and written reports on the assessment of damage and missing items; warnings about rule breaches; records on early check-in / late check-out and on the identification of unregistered persons | By LINKINN during the stay and at check-out |
Card details: The card number, expiry date, security code (CVC) and name on the card are transmitted to Kuveyt Türk during payment via the LINKINN server over an encrypted connection; LINKINN does not write them to any file, record or log. Only the card brand and the last 4 digits remain on record. To be able to display the payment return screen, the name on the card is kept only in your browser's session storage, for a maximum of 3 hours; it is not stored on the LINKINN server.
Special categories of personal data (health, religion, etc.) are not requested. Please do not write such information in the notes field or in correspondence.
Stored in the browser: The website keeps your booking selection and the payment return in session storage (sessionStorage), which is deleted when the browser tab is closed; it does not use advertising or analytics cookies. When the Google map, Google Fonts and Cloudflare (cdnjs) scripts on the page load, your IP address and browser information are transmitted to these providers. Photos of apartments that do not have their own photos are loaded from Airbnb's image server; in doing so, your IP address is transmitted to Airbnb. Our e-mails use Google Fonts; when you open the e-mail, your IP address may be transmitted to Google.
3. Purposes of processing and legal bases
| Purpose | Legal basis (Personal Data Protection Law No. 6698 (KVKK), Art. 5(2)) |
|---|---|
| Receiving the booking request, checking availability, assigning the apartment, concluding and performing the contract (confirmation, check-in details, smart lock, accommodation service) | (c) Being directly related to the conclusion or performance of a contract |
| Preparing and sending personal offer and security deposit links | (c) Conclusion or performance of a contract (at your request) |
| Taking card payment, currency conversion, refunds and security deposit refunds | (c) Performance of a contract |
| Entering the booking in the channel manager (Homesberg) to prevent calendar conflicts | (c) Performance of a contract |
| Issuing invoices, accounting and tax records | (a) Expressly provided for by law; (ç) Fulfilment of a legal obligation (Tax Procedure Law (Vergi Usul Kanunu, VUK), Turkish Commercial Code (Türk Ticaret Kanunu, TTK)) |
| Reporting the identity details of persons staying to the law enforcement authorities | (a) Expressly provided for by law; (ç) Legal obligation (Identity Notification Law No. 1774 (1774 sayılı Kimlik Bildirme Kanunu); Law No. 7464) |
| Retaining the pre-contractual information and contract approval, and the transaction records | (ç) Legal obligation (Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği), Art. 20) |
| Preventing payment fraud and misuse, system security (limit on attempts per IP, review of suspicious transactions) | (f) Legitimate interest, provided that it does not harm your fundamental rights and freedoms |
| Resolving complaints, payment objections and disputes, protecting rights | (e) Establishment, exercise or protection of a right |
| Sending full name, stay dates and vehicle licence plate to the residence management for car park use and residence access | (c) Performance of a contract (the car park and residence access are included in the stay) |
| Assessing and collecting damage, early check-in / late check-out and unregistered person fees | (c) Performance of a contract; (e) Establishment, exercise or protection of a right |
LINKINN does not send you advertising or promotional messages (commercial electronic messages). If it does so in the future, your consent will be obtained separately.
4. Method of collection
Data are collected electronically from the booking, offer and security deposit forms on linkinn.net, from the automatic records of the website and the server, from the bank's response during payment, from e-mail and WhatsApp correspondence, from each person staying at check-in and during the stay, and from LINKINN's findings during the stay or at check-out (photos, written reports, warnings about rule breaches).
5. Transfer of personal data
5.1 Within Türkiye
| Recipient | Data transferred | Purpose |
|---|---|---|
| Kuveyt Türk Katılım Bankası A.Ş. (virtual POS) | Card details (transmission only), amount, order no., e-mail, IP address | Card payment, 3D Secure verification, refunds |
| Authorised public institutions and bodies (law enforcement, Revenue Administration (Gelir İdaresi), Ministry of Culture and Tourism (Kültür ve Turizm Bakanlığı), Consumer Arbitration Committees (tüketici hakem heyetleri), courts) | Data requested and permitted by law | Legal obligations, disputes |
| Certified public accountant (mali müşavir) | Invoice and payment information | Accounting and tax |
| Önay Life Rezidans management | Full name, stay dates, vehicle licence plate | Car park and residence access |
| Homesberg (channel manager) | Full name, e-mail, phone, notes, dates, number of guests, accommodation price and cleaning fee, payment plan (cash discount, advance payment, balance), booking no. and booking time | Blocking the calendar, preventing double bookings |
5.2 Outside Türkiye
| Recipient | Country | Data transferred | Purpose |
|---|---|---|---|
| Hetzner Online GmbH (server hosting) | Germany (Nuremberg data centre) | All data in this notice (excluding card details; these are held in memory only during transmission) | Hosting the booking system and records |
| Google (Workspace e-mail service) | Google's data centres (EU, USA and other countries) | Name, e-mail, phone, booking and payment summary, correspondence | Sending booking, confirmation and offer e-mails; correspondence |
| Google (Maps; fonts — on the website and in e-mails) and Cloudflare (cdnjs) | USA and other countries | IP address, browser information | Map, fonts and scripts on the website; fonts in e-mails |
| Airbnb (some of the apartment photos) | USA and other countries | IP address, browser information | Displaying photos of apartments that do not have their own photos |
| WhatsApp service provider (Meta) | USA and other countries | Your correspondence, when you write via WhatsApp | Communicating with you (when you choose WhatsApp) |
Transfers abroad are made in accordance with KVKK Art. 9: for ongoing transfers (server hosting, e-mail), the standard contract announced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) is used and notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); for channels you choose, such as WhatsApp, and for services loaded when the page opens (map, fonts, photos), the transfer is an incidental transfer under Art. 9(6) that is necessary for the performance of the contract or made at your request.
6. Retention periods
Data are retained for as long as necessary for the purpose for which they are processed and for the period prescribed by law; when the period ends, they are deleted, destroyed or anonymised (Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik)).
| Data / record | Period | Reason |
|---|---|---|
| Records of confirmed bookings, contracts, payments, invoices and refunds (identity, contact, transaction, finance) | 10 years, starting from the year following the year in which the stay took place | 10 years for commercial books and documents (TTK Art. 82); 5 years for tax documents (VUK Art. 253); general limitation period of 10 years for claims arising from contracts (Turkish Code of Obligations (Türk Borçlar Kanunu, TBK) Art. 146). The longest period was applied. |
| Pre-contractual information and contract approval (time of approval, document version, IP) | 10 years together with the booking record (at least 3 years) | Distance Contracts Regulation Art. 20: at least 3 years; as it is part of the contract record, it is retained together with it |
| Unconfirmed requests (unpaid, unapproved or expired requests and offers) | 1 year | As no contract is concluded, no specific period could be found in the legislation; proposed as a reasonable period for questions the guest may ask later and possible complaints |
| IP address and browser information (in booking and payment records; excluding the IP in the approval record) | 2 years, then deleted from the record | For card payment disputes (chargebacks) and fraud investigation; dispute periods should be confirmed with the bank |
| Server logs | 6 months | Investigation of security incidents; no specific obligation requiring longer retention was found |
| Security deposit records | 10 years, like payment records | They are financial records |
| Records of identity notification of persons staying | Period prescribed by the relevant legislation | Law No. 1774 and the related regulation |
| Stay records (damage, rule breaches, early check-in / late check-out and identification of unregistered persons: photos, written reports, correspondence) | Until any security deposit or fee dispute is resolved, at least 2 years | Protection of rights |
| E-mail / WhatsApp correspondence not related to a booking | 1 year | Responding to the request; no specific obligation was found |
Periodic destruction: data whose period has expired are deleted in a destruction process carried out at least once every 6 months.
7. Your rights (KVKK Art. 11)
By applying to the data controller, you can exercise the following rights:
- (a) to learn whether your personal data are processed,
- (b) if they have been processed, to request information about this,
- (c) to learn the purpose of the processing and whether the data are used in accordance with that purpose,
- (ç) to know the third parties to whom the data are transferred within Türkiye or abroad,
- (d) to request correction if the data are processed incompletely or inaccurately,
- (e) to request deletion or destruction within the framework of the conditions in KVKK Art. 7,
- (f) to request that the operations under (d) and (e) be notified to the third parties to whom the data have been transferred,
- (g) to object to a result against you arising from the analysis of the processed data exclusively by automated systems,
- (ğ) to claim compensation for the damage if you suffer damage because of unlawful processing
You have these rights.
8. How to apply
In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), you can submit your application in writing by one of the following means: You can submit your application in Turkish or English.
- By a petition bearing a wet-ink signature, delivered by hand or by post to the address in section 1,
- By e-mail signed with a secure electronic signature or mobile signature, to hello@linkinn.net,
- From the e-mail address you gave us in the booking and that is registered in our system, to hello@linkinn.net.
In your application, you must state your full name, Turkish identity number (for foreigners, nationality and passport or identity number), your address for notifications, your e-mail / phone if any, and your request. Your application will be concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee schedule set by the Board may be applied. If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days from the date you learn of the response and, in any case, within 60 days from the date of application.
Text version: 2026-11-12 · Last updated: 12.11.2026