Privacy policy
Last updated: 18 August 2026
Unsere Rechtstexte liegen auf Englisch vor; verbindlich ist die englische Fassung. Bei Unklarheiten schreiben Sie uns auf WhatsApp — wir erklären es vor der Buchung.
This policy explains what we do with your personal data when you use www.touristurkey.com or book a tour with us. It is written to be read, not to be survived.
Who is responsible
The data controller is TURAN NAZGUL KALEKE TURİZM, licensed travel agency number 16585, Hüseyinağa Mah. Sahne Sok. Ali Han No:1/47, Beyoğlu / İstanbul, Türkiye. Contact: info@touristurkey.com.
We process personal data under Turkish data protection law (KVKK). Where you are in the European Economic Area or the United Kingdom, we also process it in line with the GDPR, because we offer our services to travellers there.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone/WhatsApp number | To create your booking, confirm it and reach you before departure | Performance of a contract |
| Number of guests, date, add-ons, special requests | To operate the tour you booked | Performance of a contract |
| Hotel address, if you book pickup | To collect you | Performance of a contract |
| Payment confirmation (never your full card number) | To take and reconcile payment | Contract and legal obligation |
| Messages you send us | To answer you and keep a record of what was agreed | Legitimate interest |
| Website usage and advertising identifiers | To measure how the site is used and how our ads perform | Your consent |
We do not ask for and do not want special category data. Please do not send us health or identity documents unless we specifically ask for them for a legal reason.
Cookies and measurement
We do not set analytics or advertising cookies until you accept them. The banner you see on your first visit is a real choice: declining costs you nothing and changes nothing about your booking. Your choice is stored for six months, and you can change it at any time by clearing the TourisTurkey cookies in your browser.
Cookies that are strictly necessary — keeping your session, remembering your language, protecting forms against abuse — are set without consent because the site cannot function without them.
Who else processes your data
- Supabase — our database, hosted in Frankfurt, Germany (EU)
- Vercel — website hosting and delivery
- Meta Platforms — WhatsApp Business messaging, and advertising measurement if you consent
- Google — Analytics and Ads measurement, if you consent
- Resend — sending your confirmation emails
- Partner boat operators — the minimum needed to run your tour: name, guest count, time and any pickup address
We do not sell your personal data, and we do not share it for anyone else’s marketing.
International transfers
Our database is in the EU. Some of the services above are operated by companies based in the United States and may process data there. Where that happens, transfers rely on the European Commission’s standard contractual clauses or an equivalent approved mechanism.
How long we keep it
- Booking and payment records — ten years, as required by Turkish tax and commercial law
- Messages — three years after your last contact with us
- Analytics data — fourteen months
- Bookings that were started but never completed — thirty days
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interest. Where processing is based on consent, you can withdraw that consent at any time — this does not affect what we did lawfully before you withdrew it.
Email info@touristurkey.com and we will respond within thirty days. If you are not satisfied, you may complain to the Turkish Personal Data Protection Authority (KVKK Kurumu), or to the data protection authority in your EU or UK country of residence.
Note that we cannot delete booking and payment records we are legally required to keep for tax purposes, even at your request. We can delete everything else.
Security
Data is transmitted over encrypted connections and stored in a database with row-level access controls, so that customer records are not readable by the public parts of the website. Access is limited to the people who need it to run tours.
Changes
If we change this policy in a way that affects you, we will update the date at the top and, where the change is significant, tell you directly.