Privacy & KVKK

Controller and scope

Istanbul Tour Map is the website’s travel-agency brand. [To be completed: registered legal entity, registered address, verified contact address and any representative details.] This notice concerns visitors, booking customers, agency partners and account holders. Contact us using the details on the Contact page; the formal KVKK request channel must be verified before final publication.

Information and purposes

We collect information you provide: name, email, phone, tour/date, participant count, selected package, hotel, address/location if supplied, and notes. Account and agency application details are processed when you use those services. We use necessary information to handle reservation requests, coordinate pickup, send service emails, manage accounts and prevent abuse. No online card payment is collected here. Avoid putting health, passport or other sensitive information in notes.

Sharing with the tour operator

The separate booking checkbox records permission to share the name, phone, hotel/address and necessary booking details with the operator running the selected tour, for delivery and pickup only. It is not permission for advertising or unrelated sharing. The operator may be identified on the tour page; if it is not named, ask us before providing permission. [Legal review: confirm recipient identity/categories, minimum data fields and whether contract performance rather than explicit consent is the correct legal basis.] Currently an online request cannot be sent without this checkbox; contact us if you do not wish to grant permission. Permission must not be presented as freely given if a legally unnecessary transfer is made a condition of service. Agency submissions record the agency’s declaration of customer authorization, not independent proof of customer consent.

Legal bases, providers and transfers

Under KVKK Articles 5, 6, 8 and 9, the applicable basis must be established for each purpose (for example contract necessity, legal obligations, a documented legitimate interest or valid explicit consent). This draft does not establish those bases. Hosting/authentication, service email, Mapbox hotel/map services when enabled and the AI tour assistant use technical providers. Map searches send the query/location and connection information to Mapbox. Do not send personal or sensitive data to the AI chat; messages are transmitted for answering and are not saved as chat history by this app, but provider retention must be reviewed. [Confirm provider list, country of processing, contracts, retention and lawful international-transfer safeguards; cookie acceptance alone is not a KVKK international-transfer mechanism.] WhatsApp opens only when you choose it and is subject to WhatsApp’s own policy.

Cookies and similar storage

Essential storage supports login/session security and remembers this consent choice (up to 180 days). Optional browser storage remembers language (itm-lang), currency (itm-currency) and agency referral attribution (itm_ref, up to 30 days). Optional tracking is denied by default. Accept or reject using the banner, or reopen Cookie preferences in the footer. Rejection/withdrawal removes these optional local keys and blocks their use; it does not prevent an ordinary booking. Mapbox hotel suggestions/maps are disabled until optional acceptance; manual hotel entry remains available. Global Privacy Control is respected. [Confirm the live inventory of analytics cookies, provider durations and any hosting-level logs before final approval.]

Retention and security

Permission text, version, language and server timestamp are recorded with new reservations. Old bookings are not retrospectively marked as consented. Access restrictions separate customer, agency and admin records. [Set verified retention periods for bookings, accounts, permission records, logs and statutory obligations, deletion/anonymisation rules and data-request handling.] We do not promise absolute security or a fixed deletion deadline without legal review.

Your rights and withdrawal

KVKK Article 11 rights include learning whether data is processed, obtaining information, learning purposes and recipients, requesting correction, requesting deletion/destruction where applicable, notification of those actions to recipients, objecting to adverse automated analysis and seeking compensation for unlawful processing. You may withdraw explicit permission for future processing by contacting us; withdrawal does not invalidate past lawful processing and statutory retention may apply. We will explain any effect on tour delivery. Cookie permission is independently reversible in the footer. [Verify the formal application procedure and response periods; this draft is not a compliance certification.]