Privacy Policy
A plain-language explanation of which personal data Tours Alanya collects, why we process it, who we share it with and how you can exercise your rights.
Last updated: Version: 1.0
In short
You do not need to give us any information to browse tours. We only process data when you register, send a booking request, write to us, or through measurement cookies you have permitted. We never sell your data.
This policy covers the website at toursalanya.com and our mobile app. Cookies are described in a separate document: Cookie Policy. For the notice prepared under Turkish data protection law, see the KVKK Notice page.
Data controller
The legal entity identified below is responsible for the processing of your personal data.
| Data controller | Tours Alanya |
| Website | toursalanya.com |
| Address | Alanya Merkez |
| hi@toursalanya.com | |
| Phone | +905303329999 |
What data do we collect?
Data reaches us in three ways: you give it to us, it arises from use, or it comes from a partner.
| Data | Source | Why |
|---|---|---|
| Name, e-mail, phone, country, language | Registration and profile | To create your account and contact you |
| Cryptographic hash of your password | Registration | To verify logins securely (the password itself is never stored) |
| Booking details: tour, date, number of guests, hotel/pickup point, notes | Booking request form | To pass the request to the tour operator and organise participation |
| Message content and contact details | Contact form | To answer your question |
| Reviews and comments | After a tour you joined | To publish them and run moderation |
| Favourites, recently viewed tours, search history | Site usage | To let you continue where you left off |
| IP address, browser and device information, session records | Automatic | Security, abuse prevention, debugging |
| Aggregate usage statistics | Measurement cookies, if permitted | To improve the site |
We do not request special category data (health, beliefs, biometrics, etc.). If you voluntarily write such information in a booking note (for example a food allergy), we use it solely to inform the operator running that tour.
The site is not directed at people under 18 and we do not knowingly collect children’s data. If you believe your child has given us data, write to us — we will verify and delete it.
Purposes and legal bases
| Purpose | Basis (GDPR) | Basis (KVKK) |
|---|---|---|
| Creating and performing the membership agreement | Performance of a contract — Art. 6(1)(b) | Art. 5/2-c |
| Receiving a booking request and passing it to the operator | Performance of a contract — Art. 6(1)(b) | Art. 5/2-c |
| Security, fraud and abuse prevention | Legitimate interests — Art. 6(1)(f) | Art. 5/2-f |
| Statutory retention and disclosure duties | Legal obligation — Art. 6(1)(c) | Art. 5/2-a and 5/2-ç |
| Statistics and marketing cookies | Consent — Art. 6(1)(a) | Explicit consent — Art. 5/1 |
| Commercial e-mail about tour offers | Consent — Art. 6(1)(a) | Explicit consent — Art. 5/1 and Law no. 6563 |
You can withdraw consent at any time: use the cookie preferences button at the bottom of the page for cookies, and the notification settings in your account — or the unsubscribe link in every e-mail — for messages. Withdrawal does not affect processing lawfully carried out beforehand.
International transfers
Our servers are hosted in Türkiye. Some services such as measurement and e-mail delivery may nevertheless process data abroad. Where such a transfer occurs, we rely on the transfer regime of KVKK (explicit consent or safeguards based on standard/Board-approved contracts) and, under GDPR, on the European Commission’s standard contractual clauses.
How long do we keep it?
| Data | Retention period |
|---|---|
| Account data | While the account exists; anonymised 30 days after a deletion request |
| Bookings and financial records | 10 years, as required by law |
| Contact messages | 2 years after the matter is closed |
| Session and security records | 12 months |
| Cookie consent records | 3 years from consent (as proof) |
| Reviews | For as long as they remain published |
After requesting deletion you can change your mind within 30 days. At the end of that period your account is anonymised: your name and contact details are erased, while rows tied to financial records remain without identity — this is required by our statutory retention duty.
Security
- All traffic is encrypted with HTTPS.
- Passwords are hashed irreversibly (scrypt); plain-text passwords are stored nowhere.
- Sessions are held in the database and can be revoked individually — you can also close them yourself from your account security page.
- IP addresses in consent and message records are stored as hashes, not in raw form.
- Access to the admin panel is role-based and logged.
No system is absolutely secure. In the event of a data breach we notify the competent authority within the statutory period and inform the people affected.
Your rights
Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to:
- Learn whether your data is processed and request information about it
- Learn the purpose of processing and the parties data is transferred to
- Have inaccurate or incomplete data corrected
- Request erasure or destruction
- Restrict processing and object to it
- Receive your data in a portable format
- Withdraw your consent
- Object where an automated decision produces an adverse effect for you
If you have an account you can exercise two rights immediately yourself: download your data as a JSON file from your account privacy page, and start an account deletion request.
Send requests to the e-mail or registered e-mail address in the identity panel; we answer within 30 days at the latest. If our answer does not satisfy you, you may complain to the Turkish Personal Data Protection Authority or to the data protection authority of your own country.
Changes to this policy
When we update this policy the version number and date on this page change. For substantial changes we announce it on the site and — if you are a member — by e-mail; where a change affects cookie use we ask for your cookie consent again.