Notice on the Processing of Personal Data

1. Data Controller

For the processes covered by this Notice, IHATECH LTD (Registpass) acts as the data controller:

• Company: IHATECH LTD (trading as Registpass)
• Registration: Registered in England and Wales under company number 16676486.
• Registered Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
• ICO Registration: We are registered with the Information Commissioner's Office (ICO) under reference number ZC117625, in line with the UK Data Protection Act 2018.
• Contact: [email protected]

Any questions, requests or complaints regarding this Notice or your personal data can be sent to [email protected].

2. Important: Our Role Regarding Guest Data

This Notice covers only the personal data of visitors who request a demo. For the guest personal data that hotels process using the Registpass platform, Registpass acts as a data processor, not a data controller.

If you wish to exercise your rights regarding personal data held by the establishment where you stayed as a guest, you must first apply to that hotel. For details, please see our Privacy Policy.

3. Personal Data Processed

Through the demo form we process the following categories of personal data that you provide:

• Identity data: first name, last name.
• Contact data: email address, phone number.
• Professional data: job title, hotel name, city.
• Business data: approximate room count range of the hotel.
• Marketing and consent records: commercial communications consent, consent timestamp, IP address and user agent used to give the consent (audit trail).
• Anti-spam data: outcome of the Cloudflare Turnstile challenge.

4. Purposes of Processing

• Evaluating the demo/trial request you submit and reaching out to you.
• Conducting product demos, quoting and contracting processes.
• Where you have given explicit consent, sending commercial electronic communications and making commercial phone calls via phone, email and SMS.
• Tracking your requests and complaints, managing customer relationships.
• Detecting and preventing spam or abusive use of the website.
• Running information security processes and complying with legal obligations.

5. Legal Basis for Processing

Your personal data is processed on the basis of KVKK Art. 5/2 (necessity for the formation or performance of a contract and our legitimate interests). Data processed for the purpose of commercial electronic communications and commercial phone calls is processed based on your explicit consent under KVKK Art. 5/1 and the Turkish E-Commerce Law No. 6563.

6. Recipients of Your Data

Your personal data may be shared with the following parties, to the extent necessary to deliver the service and pursue the purposes set out above:

• Our cloud infrastructure and hosting providers.
• Email, SMS and call-centre providers we rely on for communications.
• Cloudflare, Inc. for anti-spam protection.
• Our CRM and sales tooling.
• Competent public authorities, where required by law.

7. Cross-Border Transfers

Some of our cloud and communications providers may be located outside Turkey. In such cases, transfers are made under appropriate safeguards under KVKK Art. 9 (such as standard contractual clauses or other mechanisms approved by the Authority) or based on your explicit consent.

8. Collection Method

Your personal data is collected directly from you, electronically, through the form on our website.

9. Retention

Your data is retained for up to 24 months following the evaluation of your demo/trial request. Your consent to commercial electronic communications is kept until you withdraw it; once withdrawn, the consent record is retained for the statutory evidentiary period for audit purposes.

Once the retention period expires, the data is deleted, destroyed or anonymised.

10. Your Rights (KVKK Art. 11)

Under KVKK Art. 11 you have the following rights as a data subject:

• Learn whether your personal data is being processed.
• Request information about the processing if it has occurred.
• Learn the purpose of the processing and whether the data is used in line with that purpose.
• Know the third parties to whom your data is transferred domestically or abroad.
• Request rectification of incomplete or inaccurate data.
• Request erasure or destruction of your data under KVKK and applicable law.
• Request that any rectification, erasure or destruction be communicated to the third parties to whom the data was transferred.
• Object to any outcome adverse to you that results from purely automated analysis of your data.
• Claim compensation for damages arising from unlawful processing.

Note: These rights can be exercised directly against us for the processes where Registpass is the data controller (demo form, subscription account, website use). For guest data processed during your stay at a hotel, you must apply to the hotel where you stayed.

11. How to Apply

To exercise the rights above you may email [email protected] or submit the form at /data-deletion-request. Your requests are resolved within 30 days at the latest, in line with the Communiqué on Application Procedures and Principles to the Data Controller.

12. Withdrawal of Consent

You may withdraw your explicit consent for commercial electronic communications and phone calls at any time, by emailing [email protected] or by clicking the unsubscribe link in the messages we send. Withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.