Privacy Policy

Last updated: 24 October 2026

1. Data Controller

This Privacy Policy explains how İlke Seyahat Turizm Ticaret Gıda Orman Ürünleri Gemi Acenteliği İthalat İhracat Sanayi Limited Şirketi (“İlke Seyahat”, trading as TurkeyVia), acting as the Data Controller, collects, uses, and protects your personal data in accordance with the Law on Protection of Personal Data (KVKK).

2. Personal Data Collected

We collect the following categories of personal data:

Identity Data: Name, surname, passport number (for bookings).
Contact Data: Email address, phone number, physical address.
Financial Data: Billing details. (Note: We do NOT store credit card information).
Audio-Visual Data: Photos or videos taken during tours (with your consent).
Technical Data: IP address, browser type, device characteristics, and aggregated usage information collected through cookies and similar technologies (see Section 8).

3. Collection Methods and Legal Basis

Data is collected through online booking forms, contact forms, cookies, and sometimes through third-party travel agencies. The legal basis for processing is the performance of a contract, compliance with legal obligations, and our legitimate interests.

4. Purpose of Processing

Your data is processed for:

Managing tour bookings and providing travel services.
Processing payments and invoicing.
Improving our website experience.
Sending marketing communications (only with your explicit consent).
Fulfilling legal and regulatory requirements.

5. Payment Security

Online card payments are processed by our bank’s virtual POS (Türkiye İş Bankası, through its payment processor) over encrypted (TLS) connections and confirmed with 3-D Secure. Your card details are entered on a form that sends them directly to the bank: they never reach or are stored on our servers. We receive only the payment result and a masked card number.

We do not see or store your full credit card information on our servers.

Warning: Never send your credit card details via email. If you need to discuss payment, contact us on WhatsApp or by phone.

6. Third-Party Data Transfer

Your personal data may be transferred to:

Service providers that deliver your trip (hotels, airlines, transport companies, local guides).
Our IT providers: website hosting and security (cloud hosting, Cloudflare), email delivery (Zoho).
Under your cookie choice: Google (Google Analytics, Google Ads), Microsoft (Clarity) and Meta Platforms (Facebook / Instagram ads). Google Analytics and Google Ads run until you decline, everywhere; Meta only if you accept (section 8). For advertising measurement we send Google and Meta a one-way hashed version of your email address and phone number, the booking reference and value. Never your message or travel details in readable form. (One more case, limited to clicks from outside the EEA, UK, Switzerland and Türkiye: Google Ads click reporting, section 8.)
WhatsApp (Meta), if you choose to contact us there.
Judicial and administrative authorities as required by law.

Some of these providers process data outside Türkiye and the EEA (for example in the United States). Such transfers rely on your consent (Meta) or our legitimate interest (Google Analytics, Google Ads), together with the safeguards required by KVKK Article 9 and the GDPR (standard contractual clauses or an adequacy decision).

7. Your Rights

Under Turkish law (KVKK Article 11) and, where they apply to you, the EU and UK General Data Protection Regulations (GDPR / UK GDPR), you have the right to:

Learn whether your personal data is processed, why, and by whom it is received.
Get a copy of your data (access) and receive it in a portable format.
Have incomplete or inaccurate data corrected.
Have your data deleted when we no longer need it.
Restrict or object to processing, including any use for marketing.
Withdraw your consent at any time (for cookies: “Change cookie settings” on our Cookie Policy page), without affecting earlier processing.
Object to decisions based solely on automated processing.
Complain to a supervisory authority (in Türkiye the KVKK Authority, in the EU your local authority, in the UK the ICO) and claim compensation for unlawful processing.

Send requests to [email protected]. We reply within 30 days.

8. Cookies, Measurement and Advertising

Essential technologies run the site, keep it secure and handle your enquiry or booking. They include a note of which page or campaign link brought you to us, which we keep with your enquiry or booking so we can answer and count it (legitimate interest). Our own visitor statistics (Umami, self-hosted) set no cookies and do not identify you.

Analytics (Google Analytics 4) and Advertising(Google Ads, Meta Pixel and Conversions API) work the same way in every country, including the EEA, the UK and Switzerland. Google Analytics and Google Ads run from your first page and the banner tells you so; press “Decline” (or switch them off in the cookie settings) at any time and we stop them, delete their cookies and remember your choice (legal basis: our legitimate interest in measuring our site and ads, and your right to object at any time). A Global Privacy Control signal counts as Decline. Meta runs only after you accept. Microsoft Clarity runs for every visitor, in every region, until you decline: it records anonymous usage (scrolls, taps, clicks, page layout) to show us where the site confuses people. All page text and form input is masked in your browser before anything is sent, so no personal data is recorded; without Analytics consent in force it sets no cookies (legal basis: our legitimate interest in improving the site, and your right to object). Decline, switching Analytics off or a Global Privacy Control signal stops it and deletes its cookies. Advertising tools tell us which ads led to an enquiry or booking and let us show our tours again to past visitors. We do not sell personal data.

Google Ads click reporting without cookies. A link from a Google ad carries a click ID (“gclid”), which we keep with the campaign note above. If you send us an enquiry or booking request and our Google Ads tag could not run (for example because it was blocked), and Google reports that the ad click came from outside the EEA, the UK, Switzerland and Türkiye, we tell Google Ads that this click led to a request: the click ID, the time and our reference number only, never your name, email, phone or trip details. This lets us see which ads bring real requests (legal basis: our legitimate interest in measuring our own advertising). If you chose “Decline” (or switched Advertising off in the settings), we never report your request, wherever you are. To object, email [email protected] and we will not report your request.

How long we keep data: booking and invoice records as long as Turkish commercial and tax law requires (up to 10 years); enquiries that did not become a booking, 2 years; Google Analytics data, 14 months; your cookie choice, 180 days.

Full list of cookies, providers and durations: Cookie Policy.

9. Contact Information

For any questions regarding your privacy or data protection, please contact us:

Email: [email protected]
Address: TurkeyVia (İlke Seyahat Turizm Ticaret Gıda Orman Ürünleri Gemi Acenteliği İthalat İhracat Sanayi Limited Şirketi), Turgut Ozal Bulvari 67/1, Kusadasi, Aydin 09400, Turkey.