KVKK Privacy Notice

We have prepared this notice, as data controller, to inform you in line with Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and the Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ (Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform). Reading this notice does not mean that you give any approval or consent.

Data controller

Your personal data is processed by Murat Atalay Turizm Ticaret Limited Şirketi (the "Company") as data controller.

• Address: Side Mah. 1075_2 Sk. No: 9 İç Kapı No: 27, Manavgat / Antalya
• Tax office and number: Manavgat Vergi Dairesi, 6241096597
• MERSİS no.: [MISSING: MERSİS no]
• KEP (registered electronic mail) address: Muratatalayturizm@hs01.kep.tr
• UETS no.: 1571-17177-97492
• Email: muratatalay0721@gmail.com
• Phone / WhatsApp: +90 536 603 75 84
• TÜRSAB licence no.: 11294

The sapaderecanyon.com website belongs to and is operated by the Company.

What personal data do we process?

When you send a booking request

• Identity: first name and surname
• Contact: phone number, email address, whether you use WhatsApp, nationality / country code
• Customer transaction: the service you choose, date and time, number of people and their age groups, price, payment method and status, booking number, notes and requests you write, language preference
• Pickup details: hotel name, room number (if you give it), pickup point and time

When you write to us through the contact form, by email, by phone or on WhatsApp

• Your name, your contact details and the content of the message you send us

When you visit the website

• Transaction security: IP address, browser and device information, pages visited and time information, security logs
• For details, see the Cookie Policy

For what purposes and on what legal basis do we process it?

The letters in brackets refer to the legal ground in Art. 5(2) KVKK.

• Receiving your booking request, checking availability, confirming the booking and providing the service (hotel pickup, organising the tour/activity/transfer, informing the operator and the driver): (c) it is directly related to the conclusion or performance of a contract.
• Necessary communication about your booking (confirmation, pickup time, weather or programme changes, cancellation notices): (c) performance of the contract.
• Accounting, invoicing and tax records; keeping distance contract records; requests from authorised bodies: (ç) the data controller's legal obligation.
• Resolving complaints and disputes, proving legal claims: (e) establishing, exercising or protecting a right.
• Security of the website and booking system, preventing misuse and duplicate/fake bookings: (f) the Company's legitimate interest, provided this does not harm your fundamental rights and freedoms.
• Campaign and promotional messages (email, SMS, WhatsApp): only with the separate and optional approval you give under Law No. 6563 on the Regulation of Electronic Commerce. Not giving approval does not affect your booking.

We do not ask for your explicit consent for a booking; your booking data is processed on the legal bases above.

How do we collect personal data?

Your data is collected through the booking and contact forms on the website, email, phone and WhatsApp conversations, and the website's technical infrastructure (server logs), by partly or fully automated means, and by you sending it to us directly. When someone else books on your behalf, that person passes on your data; in that case that person is responsible for informing you.

Who do we share personal data with?

Your data may be shared only to the extent necessary for the purpose and in line with Art. 8 and Art. 9 KVKK with the following groups of recipients:

• local operators and suppliers who actually run the tour, activity or transfer (Türkiye) — for example your name, number of people, hotel and pickup time;
• transport companies and drivers who provide the hotel pickup and transfer service (Türkiye) — name, phone, hotel/address and pickup time;
• business partners who provide our server hosting and email services (see "Transfers abroad" below);
• people we rely on for legal obligations, such as our accountant and lawyer;
• public authorities and bodies authorised by law (on request).

We do not sell your personal data.

Transfers abroad

The servers of our websites and booking system are located in Germany (Hetzner Online GmbH); booking and contact emails are received through an email service whose servers are located abroad. Your data is therefore transferred abroad. This transfer is based on the following safeguard under Art. 9 KVKK: [MISSING: KVKK m.9 yurt dışı aktarım güvencesi (standart sözleşme + Kurum bildirimi)].

When you write to us on WhatsApp, the conversation takes place through the WhatsApp service you have chosen (WhatsApp Ireland Ltd. / Meta).

How long do we keep it?

• Records of bookings that took place and accounting documents: for the period set by the relevant legislation (10 years under Art. 82 of the Türk Ticaret Kanunu (Turkish Commercial Code); distance contract transaction records for at least 3 years);
• Booking requests that did not result in a contract and contact form messages: [MISSING: saklama süresi] from the date of the request;
• Records of marketing approvals: 3 years from the end of the approval;
• Server security logs: [MISSING: saklama süresi].

When the period ends, your data is deleted, destroyed or anonymised in line with the Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik (Regulation on the Deletion, Destruction or Anonymisation of Personal Data).

Your rights (Art. 11 KVKK)

By applying to the Company, you have the right to:

• find out whether your personal data is processed,
• request information about it if it has been processed,
• find out the purpose of the processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom it has been transferred,
• ask for it to be corrected if it is incomplete or inaccurate,
• ask for it to be deleted or destroyed under the conditions in Art. 7 KVKK,
• ask for the correction, deletion or destruction to be notified to the third parties to whom the data was transferred,
• object to a result to your detriment arising from analysis exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

How to apply

In line with the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ (Communiqué on the Procedures and Principles of Application to the Data Controller), you can send your application in Turkish:

• in writing (with a wet-ink signature) to Side Mah. 1075_2 Sk. No: 9 İç Kapı No: 27, Manavgat / Antalya,
• with a secure electronic signature to the KEP address Muratatalayturizm@hs01.kep.tr,
• or from the email address you previously gave us and that is registered in our system, to muratatalay0721@gmail.com.

Your application must state your first name and surname, your Turkish identity number (for Turkish citizens) or your nationality and passport/identity number (for foreign nationals), your address for official notifications, your email and phone if any, and what you are requesting. Your application will be concluded free of charge within 30 days at the latest; if the action involves an additional cost, the fee schedule set by the Kişisel Verileri Koruma Kurulu (Personal Data Protection Board) may apply.

Changes

This notice may be updated to reflect changes to our services or to the law. The current version is always published on this page. Text version: 446d2a250503.