Privacy Policy

Effective date: 13 September 2026
Last updated: 22/August/2026
Version: 1.0

Introduction

This Privacy Policy explains how Rudax collects, uses, stores, shares and protects personal data when you visit our website, create an account, search for accommodation, or complete a booking.

We have written this document to be read, not to be skimmed past. If anything here is unclear, or if you want to know exactly what we hold about you, write to us at privacy@rudax.com.tr and we will answer.

This policy applies to the Rudax website at rudax.com.tr and to any related pages, forms and email communications operated by us. It does not apply to the hotels, payment providers or other independent businesses you may interact with through our platform — each of those handles your data under its own policy, and we explain that separation in Section 6.

1. Who we are

Rudax operates an online accommodation booking platform connecting travellers with hotels and other lodging providers in Türkiye.

For the purposes of Turkish and European data protection law, Rudax is the data controller for the personal data described in this policy.

Privacy contact: main@rudax.com.tr
General support: main@rudax.com.tr

2. The legal frameworks we work under

Rudax was built from the outset to comply with the following regimes simultaneously, rather than retrofitted to one of them afterwards.

2.1 Turkish Personal Data Protection Law (KVKK — Law No. 6698)

As a company established in Türkiye processing personal data on Turkish territory, we are subject to KVKK in full. This governs our lawful bases for processing, our obligations when transferring data abroad, our breach notification duties, our registration with VERBIS where applicable, and the rights we owe you under Article 11.

2.2 Russian Federal Law No. 152-FZ "On Personal Data"

A substantial share of our guests are citizens and residents of the Russian Federation. Where Russian law applies to the collection of their personal data, Article 18(5) of 152-FZ requires that the recording, systematisation, accumulation, storage, amendment and retrieval of that data be carried out using databases physically located within the territory of the Russian Federation.

How we address this in practice:

• Personal data collected from users identified as being in the Russian Federation is written first to a primary database hosted on infrastructure located inside Russian territory.
• Any subsequent transfer of that data outside Russia — for example, to send a booking to a hotel in Antalya — is a secondary transfer made from that primary Russian database, not a substitute for it.
• Personal data collected from users in the Russian Federation is stored on Yandex Cloud infrastructure located in Moscow, Russian Federation, in compliance with Federal Law No. 152-FZ.

We consider this an architectural commitment, not a paperwork exercise. If our infrastructure changes in a way that affects this arrangement, we will update this policy and notify affected users.

2.3 EU General Data Protection Regulation (GDPR — Regulation 2016/679)

Where we offer services to individuals located in the European Economic Area, or monitor their behaviour within it, GDPR applies to that processing under Article 3(2). Users in the EEA have the full set of rights described in Section 9, and the transfer safeguards described in Section 7 apply to any movement of their data outside the EEA.

2.4 Other applicable law

• Turkish Law No. 5651 on regulation of internet publications, which governs our retention of certain traffic and access logs.
• Turkish Tax Procedure Law No. 213 and the Turkish Commercial Code No. 6102, which impose minimum retention periods on commercial and financial records.
• Identification requirements for accommodation providers, under which hotels in Türkiye are legally obliged to record identity document details of guests and report them to the relevant authorities.

Where these obligations conflict with a request from you — for example, a deletion request that would remove records we are legally required to keep — we will explain the conflict rather than silently ignore the request.

3. What we collect

3.1 Information you give us directly

When you create an account:

• Full name
• Email address
• Password (stored only as a salted cryptographic hash — we cannot read it, and neither can anyone who obtains our database)
• Phone number
• Passport number (if written)
• Nationality
• Preferred language and currency

When you make a booking:

• Guest name or names
• Contact email and phone number
• Number of adults, number of children, number of rooms
• Check-in and check-out dates
• Passport or national identity document number, where provided
• Nationality and country of residence, where required by the property
• Special requests you choose to submit
• Payment details, handled as described in Section 3.4

When you contact us:

• The content of your message, our replies, and any attachments
• Records of support conversations, including timestamps

When you leave a review or rating:

• The content you submit and the display name attached to it

3.2 Identity document data — handled separately

• Why we collect it: Accommodation providers in Türkiye are legally required to record identity document details for every guest and to report guest records to the authorities. Collecting the number in advance allows check-in to proceed without delay and allows the property to prepare your registration.
• Whether it is optional: On Rudax, providing a passport number at the time of booking is optional. If you leave the field blank, your booking still completes. The property will collect the information from you in person at check-in instead.
• How it is stored: Identity document numbers are encrypted at rest and access is restricted to the systems and personnel that require it to fulfil the booking.
• How long we keep it: See the retention table in Section 8. We do not retain identity document numbers for marketing, analytics or profiling purposes under any circumstances.
• What we do not collect: We do not ask for or store scanned images or photographs of passports, identity cards or visas through the Rudax platform. If you are ever asked to upload such an image on a page presenting itself as Rudax, do not do so, and report it to us at security@rudax.com.tr.

3.3 Special requests and sensitive information

The "Special Requests" field is free text, and guests sometimes use it to communicate things that qualify as special categories of personal data under Article 6 of KVKK and Article 9 of GDPR — for example, a mobility impairment requiring an accessible room, a food allergy, a dietary restriction connected to religious observance, or a medical condition affecting the stay.

If you enter such information:

• You are providing it voluntarily and, by submitting it, you give explicit consent for us to transmit it to the accommodation provider for the sole purpose of accommodating your request.
• We pass it to the property and to no one else. It is not used for marketing, segmentation, profiling or analytics.
• We retain it only for the period stated in Section 8, after which it is deleted along with the rest of the special requests field.
• You are never obliged to use this field. If you would rather communicate a sensitive requirement directly to the property after booking, or verbally at check-in, that is entirely your choice and it will not affect your reservation.

3.4 Payment data

We do not store your full card number or security code at any point. We retain only the cardholder name, the last four digits of your card number, and the expiry date in our database for reference purposes (for example, to help you identify which card was used for a booking).

Payment is processed by regulated third-party payment providers. When you pay, your card details are transmitted directly to the payment provider over an encrypted connection. What returns to us is a transaction reference, the amount, the currency, the payment status, and a masked identifier such as the last four digits of the card.

Our payment providers are:

• Russian payment gateway: YooKassa (NBCO LLC) — used for payments originating in the Russian Federation, processed within Russian territory.
• International card payments: a regulated third-party card payment provider, used where available for payments originating outside the Russian Federation.

Each provider is an independent data controller for the payment data it handles and processes it under its own privacy policy and its obligations under card scheme rules and PCI DSS.

Where a booking is payable at the property rather than online, no payment data is collected by Rudax at all — the transaction takes place entirely between you and the accommodation provider.

3.5 Information collected automatically

• IP address and derived approximate location at city level
• Browser type and version, operating system, device type and screen dimensions
• Referring page and exit page
• Pages viewed, searches performed, filters applied, and time spent
• Date and time of each request
• Session identifiers and cookie identifiers
• Error and diagnostic logs generated when something on the site fails

3.6 Information from third parties

• Accommodation providers, who may inform us of changes to your reservation, no-shows, or issues arising during your stay.
• Payment providers, who confirm the outcome of transactions and may flag a payment as suspected fraud.
• Third-party sign-in services, if you choose to register or log in using an external account. In that case we receive the name, email address and account identifier that the service releases to us, and nothing more.

3.7 Booking for someone other than yourself

If you make a booking for other guests, you will be asked to provide their names and, in some cases, their identity document details.

By submitting that information, you confirm that you are authorised to do so, and that you have informed those individuals that their data is being provided to Rudax and to the accommodation provider, and directed them to this policy. We rely on that confirmation. If you are not able to give it, please ask each guest to book separately.

3.8 Children

Rudax is intended for use by adults. You must be at least 18 years old to create an account or complete a booking.

We do not knowingly collect personal data directly from anyone under 18. Where a booking includes children as guests, the data relating to those children — typically a count, sometimes a first name and age required by the property's occupancy or pricing rules — is provided by the booking adult, who is responsible for having the authority to provide it.

We collect the minimum necessary: we do not ask for a child's identity document number, contact details, or any information beyond what the property requires to confirm the reservation.

If you believe a child has provided us with personal data directly, contact privacy@rudax.com.tr and we will delete it.

4. Why we process your data, and on what legal basis

Every processing activity we carry out rests on a specific lawful basis. We set them out here rather than leaving you to infer them.

Where we rely on legitimate interest, we have assessed our interest against your rights and freedoms and concluded that the processing is proportionate and would be reasonably expected. You may object to any such processing under Section 9, and we will stop unless we can demonstrate compelling grounds that override your objection.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

5. Automated decision-making and personalisation

What we do:

• Order and filter search results based on your search criteria, availability, price, property rating and relevance.
• Display prices in your selected currency and content in your selected language.
• Show properties or destinations you have previously viewed.

What we do not do:

• We do not vary the price of a room based on your browsing history, device type, inferred wealth, or how many times you have viewed a listing.
• We do not carry out automated decision-making that produces legal effects concerning you, or similarly significantly affects you, within the meaning of Article 22 GDPR.
• We do not build behavioural advertising profiles, and we do not sell or share data for cross-context behavioural advertising.

If this ever changes, we will update this section and, where the change requires it, obtain your consent before implementing it.

6. Who we share your data with

We do not sell your personal data. We have never done so and our business model does not depend on it.

6.1 Accommodation providers — an important distinction

When you complete a booking, we transmit your booking details to the property so that it can honour your reservation. This typically includes your name, contact details, dates of stay, room and occupancy details, any identity document number you provided, and any special requests.

From the moment the property receives your data, it acts as an independent data controller in its own right, not as a processor acting on our instructions. The property determines how it uses that data, how long it keeps it, and how it complies with the legal obligations that apply to accommodation businesses — including its statutory duty to register guests with the authorities.

This means:

• The property's own privacy policy governs its handling of your data.
• We are not able to delete data from a property's systems on your behalf, and we cannot control its retention practices.
• Requests concerning data held by the property should be directed to the property. We will help you identify the right contact if you ask.

6.2 Service providers

We use third-party providers to operate the platform. Each is bound by a written data processing agreement requiring it to process data only on our instructions, apply appropriate security measures, and assist us with your rights requests.

We keep this table current. If we add a provider that handles personal data in a materially different way, we update this policy.

6.3 Legal and regulatory disclosure

We may disclose personal data where we are legally compelled to do so — by a court order, a lawful request from a competent authority, or a statutory obligation. Where the law permits us to inform you of such a request, we will.

6.4 Fraud prevention

We may share limited data with payment providers, accommodation providers and fraud prevention services where necessary to investigate or prevent fraudulent transactions, chargeback abuse, or misuse of the platform.

6.5 Business transfers

If Rudax is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy, and the receiving entity will be bound by commitments no less protective than those in this document.

7. International data transfers

A single Rudax booking can involve several jurisdictions. A guest in Moscow books a hotel in Istanbul, pays through a Russian gateway or through an international card payment provider, and receives a confirmation email routed through a provider elsewhere. We would rather explain this plainly than bury it.

Transfers out of the Russian Federation. As described in Section 2.2, personal data of users in Russia is first recorded in a database located in Russian territory. Where that data must then be transferred abroad — principally to the accommodation provider in Türkiye — we do so on the basis of your consent to the transfer, obtained at the point of booking, and in accordance with Article 12 of 152-FZ.

Transfers out of Türkiye. Under Article 9 of KVKK as amended, transfers abroad are made on the basis of an adequacy decision where one exists, or otherwise on the basis of appropriate safeguards, including standard contractual clauses notified to the Personal Data Protection Authority, or on the basis of your explicit consent where no other mechanism is available.

Transfers out of the EEA. For users protected by GDPR, transfers to countries without a European Commission adequacy decision are made under Standard Contractual Clauses adopted under Article 46(2)(c), supplemented where necessary by additional technical and organisational measures identified through a transfer impact assessment.

You may request a copy of the safeguards applicable to a specific transfer by writing to privacy@rudax.com.tr.

8. How long we keep your data

We do not keep personal data indefinitely, and we do not keep it "just in case". Each category has a defined retention period, driven either by a statutory requirement or by a specific operational need.

When a retention period expires, data is deleted or irreversibly anonymised. Where deletion is not technically possible immediately — for example, within backup archives — the data is isolated from active processing and deleted on the next scheduled backup rotation.

Where deletion is refused. If you request deletion of data we are legally required to retain, we will not delete it, but we will restrict its processing so that it is used for no purpose other than the legal obligation, and we will tell you which obligation applies and when the period ends.

9. Your rights

9.1 Rights under KVKK (Article 11)

You have the right to:

• Learn whether your personal data is being processed
• Request information about the processing, if it has taken place
• Learn the purpose of processing and whether the data is used in accordance with that purpose
• Know the third parties to whom your data is transferred, domestically or abroad
• Request correction of incomplete or inaccurate data, and require that the correction be communicated to third parties to whom the data has been transferred
• Request deletion or destruction of your data where the grounds for processing have ceased, and require that this be communicated to third parties
• Object to a result arising from analysis of your data by exclusively automated means, where it produces an outcome to your detriment
• Claim compensation for damage arising from unlawful processing

9.2 Rights under GDPR

If you are in the EEA, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, together with the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

9.3 Rights under Russian law

If you are in the Russian Federation, you have the right to obtain information about the processing of your data, to demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, to withdraw consent, and to complain to Roskomnadzor or to seek judicial protection of your rights.

9.4 How to exercise your rights

Write to privacy@rudax.com.tr, or use the account settings page where the relevant tool is available directly.

To protect you, we will need to verify your identity before acting on a request concerning personal data. We will ask for the minimum necessary to do so and will not use anything you send us for verification for any other purpose.

Our response times:

• KVKK: within 30 days, free of charge unless the request requires additional cost, in which case the tariff set by the Personal Data Protection Board applies.
• GDPR: within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
• Russian law: within the periods prescribed by 152-FZ.

If we decline a request, we will explain why, and we will tell you how to challenge that decision.

9.5 Withdrawing consent

Marketing emails contain an unsubscribe link in every message, and unsubscribing takes effect immediately. You can also withdraw consent by writing to us, or by adjusting your preferences in your account.

Withdrawing marketing consent does not stop transactional messages — booking confirmations, changes, cancellations and payment receipts — because those are necessary to perform the contract between us and are not sent on the basis of consent.

Cookie consent can be withdrawn at any time through the cookie settings link in the site footer.

9.6 Complaints

If you believe we have handled your data unlawfully, we would prefer that you tell us first, so that we have the opportunity to put it right. But you are entitled to go directly to a regulator, and doing so does not require our involvement or agreement.

• Türkiye: Kişisel Verileri Koruma Kurumu (KVKK) — kvkk.gov.tr. Note that Turkish law generally requires you to apply to us first and to wait for our response, or for the 30-day period to expire, before applying to the Board.
• Russian Federation: Roskomnadzor — rkn.gov.ru
• European Economic Area: the supervisory authority of your country of residence, place of work, or the place of the alleged infringement.

10. Cookies and similar technologies

We use a small number of cookies, all of them strictly necessary to run the site and keep it secure. We do not use analytics, functional or advertising cookies, and we do not track you across other websites. Because every cookie we set is essential to providing a service you have asked for, none of them require consent.

10.1 Strictly necessary cookies

10.2 Managing cookies

You can delete or block cookies through your browser settings. Because the cookies above are essential, blocking them will prevent you from logging in, submitting forms, or keeping your language and currency choices.

10.3 Do Not Track

There is no common standard for how websites should respond to Do Not Track browser signals, so we do not respond to them. As we set no tracking cookies, this makes no practical difference to your privacy on Rudax.

11. Security

Technical measures

• All traffic between your browser and our servers is encrypted using TLS.
• Passwords are stored as salted hashes generated with a modern password-hashing algorithm. Plain-text passwords are never written to disk or logs.
• Identity document numbers are encrypted at rest.
• Access to production systems is restricted, individually authenticated, and requires multi-factor authentication.
• Administrative access is logged and reviewed.
• Backups are encrypted and stored separately from production systems.
• Dependencies are monitored for known vulnerabilities and patched on a defined schedule.

Organisational measures

• Access to personal data is granted on a need-to-know basis and revoked when no longer required.
• Personnel with access to personal data are bound by confidentiality obligations.
• Service providers are engaged only under written data processing agreements.
• We maintain an inventory of processing activities and review it periodically.

What we ask of you

Use a password you do not use elsewhere, keep it to yourself, and tell us at security@rudax.com.tr if you suspect your account has been accessed by someone else.

An honest limitation. No system connected to the internet is perfectly secure, and any company claiming otherwise is either mistaken or misleading you. What we commit to is applying appropriate measures, reviewing them, and telling you promptly if they fail.

12. Data breaches

If a breach of personal data occurs, we will:

1. Contain and investigate it immediately.
2. Notify the Turkish Personal Data Protection Board within 72 hours of becoming aware of it, as required by KVKK.
3. Notify the competent supervisory authority within 72 hours where GDPR applies, and Roskomnadzor within the periods required by Russian law.
4. Notify affected individuals directly and without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
5. Publish information about the incident where direct notification is not possible.

Our notification will describe what happened, what data was involved, what we are doing about it, and what you can do to protect yourself. We will not delay notification in order to complete an investigation first.

13. Links to other websites

Our site contains links to external websites, including accommodation providers, mapping services and payment providers. Following such a link takes you outside Rudax, and this policy no longer applies. We are not responsible for the privacy practices of those sites, and we encourage you to read their policies before providing personal data to them.

14. Changes to this policy

We may update this policy to reflect changes in our services, our infrastructure, or the law.

• The version number and last-updated date at the top of this page will change.
• For material changes — a new category of data, a new purpose, a new category of recipient, or a change in the legal basis for processing — we will notify registered users by email at least 30 days before the change takes effect.
• Where a change requires your consent under applicable law, we will obtain that consent before the change applies to your data.
• Changes do not apply retroactively to processing already carried out under a previous version.

Previous versions are available on request from privacy@rudax.com.tr.

15. Language

This Privacy Policy is published in English and may be made available in translation for convenience.

The English-language version is the authoritative text and prevails in the event of any discrepancy, ambiguity or conflict between versions, except where mandatory local law requires a translated version to govern, in which case that requirement applies to the extent required and no further.

16. Contact

We aim to acknowledge privacy correspondence within 3 business days and to resolve it within the statutory periods set out in Section 9.4.

Rudax — Istanbul, Türkiye