Privacy Policy

This text is an informational translation. The legally binding version is the Turkish text. View the Turkish version

1. Parties and Scope

Data Controller: Turla360 Turizm A.Ş.

Every natural person who visits the Turla360 website or application, becomes a member, or makes a booking declares that they have read, understood and accepted this Privacy Policy.

2. Personal Data Collected

Identity: first name, surname, Turkish ID or passport number
Contact: e-mail, telephone, address details
Payment: card details are processed solely within the PayTR 3D Secure infrastructure and are not stored on Turla360 servers
Transaction: booking history and tour preferences
Technical: IP address, cookie data, session information
Marketing: e-mail campaign interactions (only with explicit consent)

3. Purposes of Processing

Creating and managing bookings
Executing payment transactions
Customer support and complaint handling
Fulfilling legal obligations
Platform security and fraud prevention
Personalised campaigns and newsletters, with explicit consent

4. Legal Basis (KVKK Art. 5)

Performance of a contract (Art. 5/2-c): booking and payment data
Legal obligation (Art. 5/2-ç): accounting, tax and official notifications
Legitimate interest (Art. 5/2-f): security, analytics, fraud detection
Explicit consent (Art. 5/1): marketing e-mails and SMS notifications

5. Data Transfers

PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. (payment processing)
Tour operators (fulfilling the booking)
Hosting and infrastructure provider
E-mail service provider
Authorised public institutions and bodies (where legally required)

Transfers abroad: carried out only to countries for which the Turkish Data Protection Board has issued an adequacy decision, or subject to explicit consent.

6. Retention Periods

Booking and payment: 10 years (as required by the Turkish Tax Procedure Law)
Membership details: 2 years after account deletion
Marketing data: until consent is withdrawn, at most 3 years
Log data: 1 year

7. Rights of the Data Subject (KVKK Art. 11)

To learn whether your personal data is being processed
To request information if it has been processed
To request rectification, erasure or destruction, and notification of third parties to whom the data was transferred
To object to the processing
To object to adverse outcomes arising from analysis by automated systems
To claim compensation for damage suffered due to unlawful processing

Applications: you may apply by e-mail to [email protected] or by registered mail with return receipt. Your requests are answered within 30 days at the latest.