Draft: the parts in [brackets] must be completed and checked by the company before launch.
1. Scope
This policy applies to this website, operated by [COMPANY LEGAL NAME] ("Bosphora Prestige", "we"), and to bookings made through it. It applies together with the KVKK Privacy Notice; if they conflict, the KVKK Privacy Notice prevails.
2. What we collect
Information you give us: when you book, your name, email address, phone number, the names of the other passengers, the trip details and, optionally, your flight details; what you write in the contact or custom tour form; and, if you create an account, your name, email address and password.
Information collected automatically: when you visit the site, your IP address, browser and device details, the time of the request and the pages you visit are written to server logs. We use these logs only to run the site, fix errors and prevent abuse.
We do not use analytics, advertising or profiling tools that track how visitors behave on the site.
3. How we use it
We use the information we collect to take and carry out your booking, send you confirmations and updates, answer your questions, manage your account, meet our legal obligations and keep the site secure. We do not sell your information or share it with third parties for advertising.
4. Cookies
We only use cookies that are strictly necessary for the site to work. Because they are needed to provide the service, they do not require your separate consent.
Session cookie: recognises your account when you sign in; it stops working when you sign out or the session expires.
Language cookie (NEXT_LOCALE): remembers the site language you chose.
Currency cookie (CURRENCY): remembers the currency prices are shown in.
You can delete or block cookies in your browser settings; some features, such as signing in and remembering your preferences, may then stop working.
5. Security
The site only runs over an encrypted connection (HTTPS). Passwords are stored irreversibly hashed. Booking details can only be viewed when the booking reference and the email address used for the booking are entered together. Only authorised staff can access the admin area, and every access is checked on the server. Forms are rate-limited against abuse, and browser security headers are in place.
No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your information and review them regularly. If we become aware of a security breach, we will inform you and the Personal Data Protection Board as the law requires.
6. Third-party services
Hosting and infrastructure: the site, its database and photos run on Cloudflare, Inc. infrastructure; Cloudflare processes your requests to protect the site against attacks.
Email: booking confirmations and account emails are sent through Cloudflare's email sending service. Emails you send us and copies of messages from the site's forms are kept in our company mailbox hosted on Google (Gmail).
WhatsApp: if you tap the WhatsApp button and message us there, the conversation is subject to WhatsApp's (Meta's) own terms and privacy policy.
Maps: maps on the site are loaded from OpenFreeMap and OpenStreetMap; your browser sends these services your IP address and the map area you are viewing.
Address search and flight tracking: the address you type is sent from our server to the Photon (komoot) address search to fetch suggestions, and the flight number you give is sent to AeroDataBox to fetch flight times.
These providers may process information outside Türkiye. Details of transfers abroad are in the KVKK Privacy Notice.
7. Children
The site is not intended for anyone under 18; bookings and accounts must be made by people aged 18 or over. Children may only appear as passengers in a booking made by their parent or the adult travelling with them. If we learn that someone under 18 has given us information directly, we delete it.
8. Links to other sites
The site may link to other sites such as TÜRSAB, WhatsApp or map providers. We are not responsible for their content or privacy practices; please read their own privacy policies when you visit them.
9. Changes to this policy
We may update this policy when our services or the law change. The current version is always published on this page, and the date at the top of the page changes. We also announce significant changes on the site or by email.
10. Contact
For questions about this policy, write to [EMAIL] or to [ADDRESS]. How to exercise your rights under the KVKK is explained in the KVKK Privacy Notice.