Privacy Policy and KVKK Disclosure

1. Data Controller

Controller

BYGNG Seyahat Acentesi Turizm Ticaret Limited Şirketi

Agency name

Sunbliss Tourism (TÜRSAB 16968)

MERSIS no.

0195088438500001

Trade registry

Alanya Ticaret Sicili Müdürlüğü · 29146

Tax office / number

Alanya · 1950884385

Address

Kargıcak Mah. Tevfik Müftüoğlu Caddesi, Plumeria AVM No: 2/15, 07400 Alanya / Antalya, Türkiye

Contact

[email protected]

Registered e-mail (KEP)

[email protected]

2. Data We Process

We collect this information electronically, through our website: part of it you give us when you book, and part of it arises automatically as you use the site.

• Identity and contact: name, email address, phone number.
• Booking data: the service purchased, date, number of participants and where given, passenger names, pickup point or hotel.
• Service-specific details: flight number and time for transfers; age group and similar where the product requires it.
• Payment data: amount, currency and transaction reference. Your card number is never sent to us and is not stored on our systems.
• Account data: if you create an account, your email address and an irreversible hash of your password.
• Technical data: IP address, session and preference cookies, a random identifier assigned to your browser (when you are not signed in, it also stops actions such as marking a review as helpful from being repeated), error logs, and records of the searches you make and the products you view on the site (section 6).
• Advertising and attribution data: the campaign labels on the link you arrived by (utm_source, utm_medium, utm_campaign and similar), advertising click identifiers (gclid from Google, fbclid and the _fbp/_fbc values from Meta), the page you landed on and the referring site; and, when you complete a booking, your IP address and browser identification at that moment.

3. Purposes and Legal Bases

• Creating your booking and providing the service — performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Invoicing, accounting and travel-agency record keeping — legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).
• Sending transactional emails about your booking — performance of a contract.
• Fraud prevention, security and service improvement — legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Marketing emails, analytics cookies and marketing cookies (advertising measurement) — only with your consent, which you can withdraw at any time.
• Recording the searches made and the products viewed on the site, to improve search, our range of products, the ranking of search results and our recommendations, and to measure demand (section 6) — legitimate interests for records linked to no one (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)); your explicit consent for records linked to your browser or your account (KVKK Art. 5/1; GDPR Art. 6(1)(a)).
• Recording which campaign a booking came from (the attribution record described in section 8) — legitimate interest for the campaign labels; the click identifiers in it and anything sent to an advertising platform only with your marketing consent.

4. Who We Share It With

• The supplier actually performing the service: only what is needed to perform it (name, participant count, pickup point, flight details where relevant).
• Our payment institution, Türkiye Garanti Bankası A.Ş. (Garanti BBVA): the minimum needed to take the payment through the bank's virtual POS (order number, amount, e-mail address and IP address). Your card details are entered on the bank's own payment page and never reach us.
• Our email infrastructure provider: to deliver booking emails.
• Mapbox, our map provider: your IP address and the map area you view, transmitted when a page renders a map.
• Cloudflare, our content delivery and analytics provider: your IP address and technical request data, processed to serve the site and to produce cookieless, aggregated visit statistics.
• Google (Google Analytics with Consent Mode, and Google Ads): after you allow analytics cookies, Google Analytics receives your IP address, device and browsing information to produce visit statistics. After you allow marketing cookies, completed bookings measured by Google Analytics are imported into Google Ads as conversions so we can see which advertisement led to a booking. Without your permission Google receives only cookieless, identifier-free signals (Consent Mode). We also keep a copy of the Google Analytics data, together with campaign and search-performance data from Google Ads and Google Search Console, in our own Google Cloud (BigQuery) space located in the European Union. In this copy, visitor-level data is deleted after 25 months; only aggregate figures that cannot be linked to anyone remain.
• Meta (Facebook and Instagram — Meta Pixel and Meta Conversions API): only after you allow marketing cookies, the pixel on our pages and our own server tell Meta that a booking was completed, with the booking reference, value and currency, the click identifiers (fbclid, _fbp, _fbc), your IP address and browser identification at the time of booking, and your e-mail address and telephone number in hashed (SHA-256) form, so Meta can match the booking to an advertisement you saw. Nothing is sent to Meta without your marketing consent.
• Public authorities: only where the law requires it.

We do not sell or rent your personal data to third parties for marketing.

5. Cookies and Your Choice

Non-essential cookies fall into two categories you decide on separately: analytics (Google Analytics) and marketing (Google Ads, Meta). Linking your searches and the products you view to your browser, however, happens in every country only if you yourself allow analytics cookies (section 6). If you visit from the European Economic Area, the United Kingdom, Switzerland or Türkiye, both categories stay off until you allow them; from any other country they are on from the first page and you can switch them off at any time. Your choice, the notice version and the time of the choice are stored in a cookie for one year and are recorded with any booking you make. You can change it at any time from the "Cookie settings" link at the bottom of every page. The Cookie Policy lists every cookie, and the other information we keep in your browser, by name.

6. Search and Viewing Records

As you use the site, we automatically record the searches you make, the results you click and the products you view. These records contain what you searched for, how many results were found, the site's language and currency, and from which country and with what kind of device you connected. Your name, e-mail address, telephone number, IP address and browser identification are not added to these records. We do not record information such as an e-mail address or telephone number that may have been typed into the search box.

We keep these records in two ways:

• For everyone, linked to no one: the record holds nothing that points to you, your browser or your account. Our aim is to see what travellers look for and what they cannot find, and to improve our site accordingly. The legal basis is our legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• Only if you yourself allow analytics cookies, linked to your browser: we link the records to a random identifier assigned to your browser and, if you are signed in, to your account. The legal basis is your explicit consent (KVKK Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw your permission at any time from the "Cookie settings" link at the bottom of every page; this does not affect the lawfulness of earlier processing.

We use these records to improve search, our range of products, the ranking of search results and our recommendations, and to measure demand. No decision that has legal effects for you or affects you in a similarly significant way is taken automatically on the basis of these records (GDPR Art. 22).

We do not build a personal recommendation profile for you today: the recommendations on the home page are prepared only from the place and products you last looked at, which are kept in your browser (Cookie Policy, sections 3 and 6). If we ever build a recommendation profile, we will announce it in advance and make it subject to a separate choice of yours.

If you have allowed analytics cookies, when you sign up or sign in we note that your browser's identifier belongs to your account. When your account is deleted, this note is deleted too, and earlier records can no longer be linked to your account. We do not give this identifier or this note to Google, Meta or any other third party.

7. Transfers Abroad

Google and Meta process the data described in section 4 on servers outside Türkiye (in the European Union and the United States). Under Article 9 of the KVKK this transfer abroad rests on your explicit consent, which you give through the cookie settings and can withdraw at any time; withdrawing it stops further transfers and does not affect the lawfulness of what was done before. For visitors in the European Union, both providers additionally rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. No other recipient in section 4 receives your data outside Türkiye or the European Union except our e-mail infrastructure, content delivery and map (Mapbox) providers, which operate under the same safeguards. The copy of the Google Analytics data described in section 4 is kept in our Google Cloud space in the European Union.

8. Retention

Booking and payment records are kept for the period required by tax and commercial law — as a rule, ten years. Account data and your on-site notifications are kept while your account is open, and marketing consent until you withdraw it.

The attribution record of a booking (section 2) keeps your IP address and browser identification for 90 days after the booking, after which they are deleted; the campaign labels and click identifiers remain with the booking record for as long as the booking itself, and the consent state you had at the time is kept with it as evidence of your choice.

The link between the search and viewing records (section 6) and you, your browser or your account is removed after 25 months; after that, the records continue to be kept without being linked to anyone.

Security and activity records (for example sign-in attempts) are kept for ten years; the e-mail address, IP address and browser identification in them are deleted after 24 months.

Backups of our systems exist only to restore data after a failure: daily backups are kept for 35 days and monthly backups for 12 months. Data we delete is also removed from the backups at the end of these periods. In addition, a single archive copy of the database from before the site's launch is kept separately for ten years, as evidence that the pre-launch data was deleted.

9. Your Rights

Under Article 11 of the KVKK you may ask, with regard to your personal data:

• to learn whether your data is processed and, if so, to request information about it;
• to learn the purpose for which it is processed and whether it is used in line with that purpose;
• to know to whom it is transferred, in Türkiye or abroad;
• to have it corrected if it is incomplete or inaccurate, to have it erased or destroyed where the conditions are met, and to have these steps notified to those to whom it was transferred;
• to object to a result to your detriment that arises from an analysis made solely by automated systems;
• to have your damage compensated if you suffered damage because your data was processed unlawfully.

If you are in the European Union, the GDPR additionally gives you the rights to restriction of processing, to object to processing and to data portability.

You can delete your account yourself in your account settings, or ask us to delete it by writing to us. Before deleting it, you can remove your reviews in the My reviews section of your account; after your account is deleted, your reviews stay published without your name. The legal basis for this is our legitimate interest in sharing travellers' experiences with other visitors (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)). When your account is deleted, we send one e-mail to the address you registered with to confirm it, and booking and payment records are kept for the period in section 8.

Write to [email protected] or to our registered e-mail (KEP) address in section 1. We respond within thirty days at the latest. If our response does not satisfy you, you may complain to the Turkish Personal Data Protection Board or, if you are in the European Union, to the supervisory authority of your country.

10. Security

Data is carried over encrypted connections, passwords are stored only as irreversible hashes, and session credentials are held in cookies the browser will not expose to scripts. Access to our internal panels is restricted by permission.