These texts are drafts under legal review. · Version 1.2

Guestkite Data Processing Agreement (DRAFT)

Last updated: 7 October 2026 (draft) · Version 1.0. The Turkish version prevails in case of conflict.

This agreement forms part of the Guestkite Terms of Service between:

• Controller: the business using Guestkite ("Business").
• Processor: TAG Yazılım ve Bilgi Teknolojileri Sanayi Ticaret Limited Şirketi, Kundu Mah. 33006 Sok. No:8/N Aksu / Antalya, Türkiye, MERSİS 0815117464000001 ("Guestkite").

1. Subject and roles

1.1. The Business messages its customers (guests, patients, clients; "Data Subjects") through Guestkite. For these conversations and for data the Business uploads or sends through integrations, the Business is the controller and Guestkite the processor (KVKK art. 3/1-ğ; GDPR art. 28 where it applies). 1.2. Guestkite is a separate controller for the Business's account, users and invoices, under the Guestkite Privacy Policy. 1.3. Subject, duration, nature, purpose, data categories and Data Subject groups are in Annex 1.

2. Processing on instructions

2.1. Guestkite processes personal data only on the Business's documented instructions: the Terms, this agreement and the Business's settings in the panel (features switched on, retention period, integrations). 2.2. Guestkite does not use the data for its own purposes, does not sell it, does not use it for advertising and does not use it to train AI models. 2.3. Guestkite tells the Business without delay if it believes an instruction breaches data protection law.

3. Confidentiality

Guestkite binds its staff and helpers with access to personal data to confidentiality without time limit, continuing after the agreement ends (KVKK art. 12/4).

4. Security

4.1. Guestkite applies and maintains the technical and organisational measures in Annex 2 (KVKK art. 12/1). Under KVKK art. 12/2 the Business and Guestkite are jointly responsible for these measures. 4.2. Guestkite does not make changes that lower the overall level of protection.

5. Personal data breaches

5.1. Guestkite notifies the Business within 48 hours of becoming aware of a breach affecting the Business's data, with what is known at the time: what happened and when, data categories and approximate number of people affected, likely consequences, measures taken and proposed, and a contact person. The notice is completed as facts become clear. 5.2. Notifying the Authority (72 hours) and Data Subjects is the Business's duty; Guestkite provides the information and documents needed.

6. Data Subject requests

6.1. Guestkite provides tools for Data Subjects' rights: the "🔒 Privacy" button and /privacy in the chat with the notice and "Delete my data"; deleting a customer's data in the panel; the retention setting; reading customer data through the API. 6.2. Guestkite does not answer requests sent directly to it; it forwards them to the Business within 5 business days. The Business answers within 30 days. 6.3. The Business authorises Guestkite to show its privacy notice in the bot on its behalf. The Business is responsible for the content and for its own details (legal name, contact, own policy). The disclosure obligation stays with the Business.

7. Sub-processors

7.1. The Business gives general authorisation for the sub-processors in Annex 3. 7.2. Guestkite notifies the Business in the panel and by email at least 30 days before adding or replacing a sub-processor. The Business may object on reasonable grounds within that period; if no solution is agreed, the Business may terminate the affected service without penalty. 7.3. Guestkite imposes on sub-processors obligations no less protective than this agreement (within their standard terms) and remains liable to the Business for them.

8. Transfers abroad

8.1. Because the service runs on Cloudflare, personal data is stored and processed outside Türkiye (United States, European Union and other countries; Annex 3). 8.2. Guestkite has applied to Cloudflare to sign KVKK Standard Contract 3 (processor to processor). If it is signed, Guestkite notifies the Authority within 5 business days of signature and informs the Business. 8.3. Status on 7 October 2026: the KVKK standard contract with Cloudflare is not signed; Guestkite has applied. Until it is signed, Guestkite applies the risk-reducing measures in Annex 2 and informs the Business openly. The Business must state the transfer abroad in its own privacy notice and in VERBİS (if registration applies to it). 8.4. Telegram is an independent platform chosen by the Data Subject and governed by its own privacy policy.

9. Audits

9.1. Guestkite answers the Business's reasonable questionnaires and provides the information needed to show compliance. 9.2. On-site audits: at least 30 days' written notice, at most once a year, during business hours, protecting the confidential information of Guestkite and its other customers, at the Business's cost. These limits do not apply after a breach or on the Authority's request.

10. Retention, return and deletion

10.1. Guestkite applies the retention period the Business chooses in the panel (Annex 1). 10.2. When the agreement ends, the Business may export its data for 30 days. After that Guestkite deletes all personal data; copies in automatic backups expire within 30 more days. Data that must be kept by law is excepted. 10.3. On request, Guestkite confirms the deletion in writing.

11. Assistance

Guestkite provides reasonable information and help for the Business's data protection duties (notices, requests, VERBİS details, breach notices, impact assessments for AI features).

12. Liability

Liability under this agreement follows s.11 of the Terms. The limits do not apply to intent or gross negligence.

13. Term and precedence

This agreement takes effect with the Terms and lasts as long as Guestkite processes data for the Business. On personal data matters this agreement prevails over the Terms.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Access and identity

• Panel login only with a one-time code through Telegram; no passwords stored.
• Session cookie HttpOnly and SameSite; 30 days; ended server-side on logout.
• Role-based access (owner, admin, staff); staff cannot see phone and booking numbers.
• API keys stored only as SHA-256 hashes, scoped, revocable, rate-limited.

Separation and encryption

• Each business's data is kept in its own database (Cloudflare Durable Object); one business's key cannot reach another's data.
• Bot and integration secrets (Telegram bot tokens, HotelRunner tokens) are stored encrypted with AES-GCM.
• HTTPS everywhere; strict Content Security Policy in the panel.

Minimisation and retention

• Customer photos are kept in private storage and opened only through short-lived signed links; metadata such as location is removed; photos are deleted after 30 days.
• Data past the retention period is deleted daily; a Data Subject can delete all their data at once with "Delete my data"; a deleted guest is not re-imported from an integration (HotelRunner).
• Integrations import only the fields needed (no national ID, birth date, address or payment data from HotelRunner).

Safety controls

• Content check of team replies (word list + AI), approved team members, hourly message limit, spam holding, safety log (90 days).
• Outgoing webhooks signed with HMAC; no webhooks to local-network addresses.

Backup and continuity

• Cloudflare's automatic database backups and point-in-time recovery (up to 30 days).
• A nightly copy of each business's data, encrypted (AES-256-GCM) and stored separately within the same provider, kept 30 days and then deleted. Only Guestkite platform administrators can restore it. A restore never brings back data a guest asked to delete.

Organisational

• Code changes pass automated tests and a security review before release.
• Access to production data is limited to authorised Guestkite staff, for support and at the Business's request. [To verify/complete: access logging policy]

Risk reduction for transfers abroad (until the standard contract is signed)

• Short retention options, automatic deletion, data minimisation.
• AI features (assistant, translation, voice) can be switched off per business.
• [Planned: Cloudflare EU jurisdiction for new businesses]

Annex 3: Sub-processors

Current list: Sub-processors. At the date of this agreement: