Privacy Policy and KVKK Disclosure

1. Data Controller

Controller

BYGNG Seyahat Acentesi Turizm Ticaret Limited Şirketi

Agency name

Sunbliss Tourism (TÜRSAB 16968)

Contact

[email protected]

Address

Alanya, Antalya, Türkiye

2. Data We Process

• Identity and contact: name, email address, phone number.
• Booking data: the service purchased, date, number of participants and where given, passenger names, pickup point or hotel.
• Service-specific details: flight number and time for transfers; age group and similar where the product requires it.
• Payment data: amount, currency and transaction reference. Your card number is never sent to us and is not stored on our systems.
• Account data: if you create an account, your email address and an irreversible hash of your password.
• Technical data: IP address, session and preference cookies, error logs.

3. Purposes and Legal Bases

• Creating your booking and providing the service — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Invoicing, accounting and travel-agency record keeping — legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Sending transactional emails about your booking — performance of a contract.
• Fraud prevention, security and service improvement — legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Marketing emails and non-essential cookies — only with your consent, which you can withdraw at any time.

4. Who We Share It With

• The supplier actually performing the service: only what is needed to perform it (name, participant count, pickup point, flight details where relevant).
• PayTR, our payment institution: the minimum needed to take the payment.
• Our email infrastructure provider: to deliver booking emails.
• Mapbox, our map provider: your IP address and the map area you view, transmitted when a page renders a map.
• Cloudflare, our content delivery and analytics provider: your IP address and technical request data, processed to serve the site and to produce cookieless, aggregated visit statistics.
• Google (Analytics and Tag Manager): your IP address, device and browsing information, used to produce visit statistics. Loaded only after you accept analytics cookies.
• Public authorities: only where the law requires it.

We do not sell or rent your personal data to third parties for marketing.

5. Retention

Booking and payment records are kept for the period required by tax and commercial law — as a rule, ten years. Account data is kept while your account is open, and marketing consent until you withdraw it.

6. Your Rights

Under Article 11 of the KVKK you may ask whether we process your data, access it, have it corrected or erased, object to processing, and claim compensation for damage. If you are in the European Union, the GDPR additionally gives you a right to data portability.

Write to [email protected]. We respond within thirty days at the latest. If our response does not satisfy you, you may complain to the Turkish Personal Data Protection Board, or to your local supervisory authority in the EU.

7. Security

Data is carried over encrypted connections, passwords are stored only as irreversible hashes, and session credentials are held in cookies the browser will not expose to scripts. Access to our internal panels is restricted by permission.