Privacy policy

What we collect

• Booking details: name, email, phone, party size, stay dates and your postal address
• Guest manifest: the full name of every guest in your party
• Identity documents: the lead guest’s T.C. Kimlik number, or passport number and nationality — required by Turkish law so we can register guests
• Payment: processed entirely by Stripe — card numbers never reach our systems
• Villa-owner enquiries: the details you submit on the "Rent your villa" form
• Technical basics: IP address and browser data used for security (fraud and abuse prevention)

Why we process it

To take and manage your booking (performance of a contract), to send booking-related emails, and to protect the platform against fraud and abuse (legitimate interest).

Identity documents are processed solely to meet our legal obligation to register guests with the Turkish authorities, and for no other purpose. We do not use them for marketing, and we never sell them.

Who processes it for us

• Stripe — payment processing
• Google Firebase (EU region) — database, hosting of booking data
• Vercel — website hosting
• Resend — transactional email delivery
• Google reCAPTCHA — bot protection

Retention

Booking records are kept for as long as legally required for tax and accounting purposes. Owner enquiries are kept until resolved and then archived or deleted on request.

Identity documents are stored separately from your booking record, are readable only by authorised staff, and are deleted once the guest-registration and statutory retention periods have passed. They are never shown on any public page, and never included in marketing or analytics.

Your rights

Under the GDPR and the Turkish KVKK you may request access to, correction of, or deletion of your personal data, object to processing, and lodge a complaint with your supervisory authority. Write to bookings@bestkalkanvillas.com and we will respond promptly.

Guest reviews

After an eligible stay, we may send a review invitation and one reminder. You can decline the invitation to stop the reminder. If you choose to submit a review, we keep its connection to your booking private and publish your chosen first name and surname initial, rating, review, stay month and our response with your agreement. Your email, booking reference and exact stay dates are not published.

Reviews are checked for spam, abuse, private information and unrelated content, regardless of their score. Contact bookings@bestkalkanvillas.com if you want to withdraw a review or correct personal information.

Cookies

The site uses only functional storage needed to operate: the session that keeps your booking attached to you, security tokens used by our fraud and abuse protection (Firebase App Check and reCAPTCHA), payment and fraud cookies set by Stripe during checkout, and your language preference. We do not run advertising or cross-site tracking cookies, and we do not use analytics.

To save you retyping, the booking form also remembers the details you enter (name, contact details, address, the names of your party and your ID type and nationality — never your ID number) in your own browser, for up to 13 months. They never leave your device except when you submit a booking, and “Not you? Clear details” in the form deletes them.

Because none of this is optional — the site cannot take a booking without it — we show a notice rather than ask for consent. Your acknowledgement of that notice is stored in your own browser, never on our servers, and you can revisit it from the “Cookie settings” link in the footer.