In short, we collect only the personal data we need to plan and run your trip, take payment, and answer your messages. We share it with the hotels, airlines, guides and other suppliers involved in your booking, and with the service providers that keep our website running. We do not sell your data, and you have rights under the EU/UK GDPR and Turkish Law No. 6698 (KVKK).
1. Who we are
The data controller for this website and our bookings is [COMPANY LEGAL NAME], trading as Tubos Travel. We are a Turkish travel agency based in Cappadocia and a member of TÜRSAB (license no. [TÜRSAB LICENCE NO]).
- Address: [FULL STREET ADDRESS], Ürgüp, Nevşehir, Türkiye
- E-mail: info@tubostravel.com
- Phone and WhatsApp: +90 544 674 42 28
- Website: https://tubostravelturkey.com
- VERBIS registration: [VERBIS registration no., if applicable]
- EU/UK representative: [none appointed / EU-UK REPRESENTATIVE]
2. What data we collect
Booking and contact details
Your name, e-mail address, phone number, nationality, travel dates, number of travelers, and any requests you send us.
Passport and ID data
Your name as shown on your passport, passport number and date of birth. We ask for this only when we need it, for example for domestic flights, hotel check-in and certain activities.
Health and dietary information
You may choose to tell us about allergies, dietary needs or mobility needs so we can plan your trip. We treat this as sensitive data and use it only with your explicit consent and only for that purpose.
Payment data
You type your card details on the bank’s 3-D Secure payment page, through our payment gateway providers (pos-entegrator / GurmePOS). We do not see or store your full card number. We receive the payment status and masked card details, such as the last four digits.
Messages
What you send us through contact forms, e-mail or WhatsApp. Our WhatsApp button (JoinChat) opens WhatsApp. When you click it, you leave our site, and WhatsApp’s and Meta’s own terms and privacy policy apply.
Technical data
Your IP address, device and browser type, and the pages you view. We collect this through cookies, Google Analytics and Google Tag Manager. See our Cookie Policy for details.
3. Why we use your data and our legal basis
Under the EU/UK GDPR
- Contract (Art. 6(1)(b)): to take your booking, arrange tours, transfers, balloon flights, hotels and flights, take payment, and send you trip details.
- Legal obligation (Art. 6(1)(c)): to meet accounting, tax and tourism rules, and to answer lawful requests from authorities.
- Legitimate interests (Art. 6(1)(f)): to keep our site secure, understand how visitors use it, improve our services, and answer your inquiries.
- Consent (Art. 6(1)(a)): for optional marketing messages and non-essential cookies. For health or dietary data, we rely on your explicit consent (Art. 9(2)(a)).
Under KVKK (Law No. 6698)
- Art. 5(2)(c): processing is needed to set up or perform a contract with you.
- Art. 5(2)(ç): processing is needed to meet our legal obligations.
- Art. 5(2)(f): processing is needed for our legitimate interests, without harming your basic rights and freedoms.
- Art. 5(1): your explicit consent, for example for marketing.
- Art. 6: special categories of data, such as health information, which we process only on the conditions this article allows, including your explicit consent.
4. Who we share your data with
We share data only as needed for the purposes above:
- Hotels, airlines, transport and activity suppliers, balloon operators and local guides, only as needed to deliver your booking.
- Banks and payment and POS providers, to process your payment.
- Hosting and IT providers that run our website and e-mail.
- Google, for Google Analytics, Google Tag Manager and the Google Translate widget.
- Public authorities, courts or regulators when the law requires it.
We do not sell your personal data.
5. Transfers abroad
Some suppliers and services may be located outside your country or outside Türkiye. Google services, for example, may process data in other countries, including the United States.
For Turkish law, we follow KVKK Art. 9 as amended in 2024. For booking suppliers abroad, we rely on the transfer being necessary to perform your contract. For other transfers, we use appropriate safeguards or another lawful ground where required.
For the GDPR, we transfer data to Türkiye and other countries where this is necessary for your contract, or where safeguards such as EU Standard Contractual Clauses or an adequacy decision apply.
6. How long we keep your data
- Booking and accounting records: as long as Turkish commercial and tax law requires, up to [10 years].
- Inquiries that do not become bookings: [2 years].
- Analytics data: [14 months].
- Passport data: deleted [90 days] after your trip, unless the law requires us to keep it longer.
- Marketing based on consent: until you withdraw your consent.
When the retention period ends, we delete, destroy or anonymize the data.
7. Security
We use technical and organizational measures to protect your data. These include HTTPS encryption on our site, access limits so only the staff who need data can see it, and careful choice of service providers. No system is 100% secure, so we cannot guarantee complete security. If a data breach affects you, we will notify you and the relevant authorities as the law requires.
8. Your rights under the GDPR
If you are in the EU or the UK, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain cases;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting earlier processing;
- complain to your local data protection authority, such as the UK Information Commissioner’s Office (ICO) or your EU national authority.
To use these rights, e-mail us at info@tubostravel.com.
9. Your rights under KVKK and how to apply
Under Article 11 of Law No. 6698, you have the right to:
- learn whether we process your personal data;
- request information about that processing;
- learn the purpose of the processing and whether we use the data for that purpose;
- know the third parties in Türkiye or abroad that receive your data;
- request correction of incomplete or inaccurate data;
- request deletion or destruction of your data;
- request that we notify third parties of any correction, deletion or destruction;
- object to a result against you that comes only from automated analysis;
- claim compensation if you suffer damage from unlawful processing.
How to apply
Under the Communiqué on Procedures and Principles of Application to the Data Controller, send us a written application with your identity details and your request. You can use one of these methods:
- a signed letter delivered to our address;
- notarized or registered mail to our address;
- Registered Electronic Mail (KEP) to [KEP ADDRESS];
- a message signed with a secure electronic signature;
- an e-mail to info@tubostravel.com from the e-mail address already registered with us.
We will reply free of charge within 30 days of receiving your application at the latest. If the answer needs more than 10 pages, or a storage medium, a fee may apply in line with the Communiqué.
If you are not satisfied with our reply, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, KVKK) within 30 days of our reply, or within 60 days of your application at the latest.
10. KVKK Aydınlatma Metni (Disclosure Text under Law No. 6698)
[COMPANY LEGAL NAME], trading as Tubos Travel, at [FULL STREET ADDRESS], Ürgüp, Nevşehir, Türkiye, is the data controller for your personal data. We process your data to take and deliver your bookings, take payment, meet our legal obligations, answer your inquiries, and keep our website secure. We share your data with hotels, airlines, transport and activity suppliers, guides, payment providers, IT providers and authorities, in Türkiye and abroad, only for these purposes. We collect your data through our website, booking and contact forms, e-mail, WhatsApp, phone and cookies, based on KVKK Art. 5(2)(c), 5(2)(ç) and 5(2)(f), and on your explicit consent under Art. 5(1) and Art. 6 where required. You may use your rights under KVKK Art. 11 by applying to us as described in section 9.
For Turkish residents, the Turkish version of this text prevails: [TURKISH TEXT LINK OR TO BE ADDED].
11. Children
Our services are for adults booking for themselves and their travelers. We collect data about children only when a parent or guardian provides it as part of a booking. We do not knowingly collect data directly from children. If you think a child has sent us personal data, please contact us and we will delete it.
12. Cookies
We use cookies and similar tools, including Google Analytics and Google Tag Manager, to run our site and understand how visitors use it. You can find out more and manage your choices in our Cookie Policy.
13. Changes to this policy
We may update this policy when our services or the law change. We will post the new version on this page and update the date below. For other terms that apply to your use of our site and bookings, see our Terms of Use, Distance Sales Agreement and Cancellation and Refund Policy.
14. Contact
[COMPANY LEGAL NAME], trading as Tubos Travel, [FULL STREET ADDRESS], Ürgüp, Nevşehir, Türkiye. TÜRSAB license no. [TÜRSAB LICENCE NO]. Tax office / tax no. [TAX OFFICE / TAX NO]. MERSIS no. [MERSIS NO].
Last updated: [DATE]
Questions? Contact Tubos Travel at info@tubostravel.com or +90 544 674 42 28 (also on WhatsApp).
