Draft: the parts in [brackets] must be completed and checked by the company before launch.
1. Data controller
Your personal data is processed by [COMPANY LEGAL NAME] ("Bosphora Prestige" or the "Company") as the data controller.
Address: [ADDRESS]. Tax office and number: [TAX OFFICE / TAX NO]. MERSIS number: [MERSIS NO]. Email: [EMAIL]. Registered electronic mail (KEP): [KEP ADDRESS].
2. Categories of personal data
Identity: the first and last name of the booking holder and, when you give them, of the other passengers.
Contact: email address and phone number (including your WhatsApp number).
Customer transaction: booking reference; pickup and drop-off addresses, date and time; the chosen vehicle; the number of passengers and bags; extras and your notes; the price breakdown and booking status; flight number and times when you give them; questions, quote requests and complaints you send us.
Membership: if you create an account, your name, email address and an irreversibly hashed form of your password. We never see or store the password itself.
Transaction security: IP address, browser and device details, session and access logs, and your language and currency preference.
We do not ask for special categories of personal data (such as health data). Please do not write such information in the notes fields. If you have a special need for your trip, contact us; we will process that information only with your explicit consent and only to arrange your trip.
3. Purposes of processing
To receive, review and confirm your booking request; to plan your trip, assign a driver and vehicle and provide the service.
To send booking confirmations, changes, cancellations and reminders, and to follow your flight for airport pickups.
To answer your questions, quote and custom tour requests and complaints, and to create and manage your account.
To meet our record-keeping, documentation and reporting obligations under tax, commercial and tourism law.
To keep the site and our systems secure, prevent abuse and fraud, and protect our rights in a possible dispute.
4. Legal grounds
We process your personal data on the following grounds listed in Article 5(2) KVKK: it is directly related to the conclusion or performance of a contract (Art. 5/2-c); it is necessary for us to comply with a legal obligation (Art. 5/2-ç); it is necessary to establish, exercise or protect a right (Art. 5/2-e); and it is necessary for our legitimate interests, provided this does not harm your fundamental rights and freedoms (Art. 5/2-f).
We do not use your personal data for marketing. If we ever want to send campaigns or newsletters, we will first ask for your explicit consent under Article 5(1) KVKK and your consent to commercial electronic messages under Law No. 6563.
5. Transfers of personal data
Within Türkiye (Art. 8 KVKK): the driver assigned to your trip, and the vehicle owners and tour guides we work with, only as far as needed to carry out the trip; our legal and financial advisers; and authorised public bodies and courts when they request it or the law requires it.
Abroad (Art. 9 KVKK): Cloudflare, Inc. (USA), which hosts the site, its database and file storage and sends our emails; Google (Gmail; Google LLC, USA and Google Ireland Ltd.), which hosts our company mailbox; WhatsApp (Meta Platforms Ireland Ltd.) if you choose to message us there; Photon (komoot GmbH) for address search; and AeroDataBox for flight tracking. These providers' servers may be located outside Türkiye.
Transfers abroad are made under Article 9 KVKK: to countries with an adequacy decision; where there is none, by signing the standard contracts published by the Personal Data Protection Board and notifying the Board; or in the incidental cases listed in Article 9(6), for example where the transfer is necessary to perform the contract. Transfers to Cloudflare and Google are made under the standard contracts published by the Board, which are notified to the Board within five business days of signing. Transfers to WhatsApp happen under Article 9(6) when you choose to message us there.
6. How we collect personal data
We collect your personal data directly from you, partly by automated and partly by non-automated means, through the booking, contact, custom tour and sign-up forms on the site, and by email, WhatsApp and phone. Transaction security data is collected automatically through server logs and essential cookies while you use the site. If you book on behalf of other passengers, please make sure they have seen this notice before you share their details with us.
The data is collected for the purposes and on the legal grounds described above.
7. Retention
We keep booking and accounting records for as long as tax and commercial law require [PERIOD, e.g. 10 years under Article 82 of the Turkish Commercial Code], account data until you close your account and for [PERIOD] after that, messages for up to [PERIOD], and transaction security logs for [PERIOD].
Personal data whose retention period has ended, or whose reason for processing no longer exists, is deleted, destroyed or anonymised in the next periodic destruction run under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
8. Your rights under Article 11 KVKK
Under Article 11 KVKK you can apply to the data controller to: (a) learn whether your personal data is processed, (b) request information if it is, (c) learn the purpose of processing and whether the data is used accordingly, (ç) know the third parties in Türkiye or abroad to whom it is transferred, (d) ask for it to be corrected if it is incomplete or inaccurate, (e) ask for it to be deleted or destroyed under the conditions of Article 7 KVKK, (f) ask for the actions under (d) and (e) to be notified to the third parties to whom the data was transferred, (g) object to a result against you that arises solely from the analysis of your data by automated systems, and (ğ) claim compensation if you suffer damage because your data was processed unlawfully.
9. How to apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your application in Turkish and in writing: as a wet-signed letter delivered in person or through a notary to [ADDRESS]; by registered electronic mail (KEP) to [KEP ADDRESS]; with a secure electronic or mobile signature; or from the email address you previously gave us and that is registered in our system, to [EMAIL].
Your application must include your first and last name and, if made in writing, your signature; your Turkish ID number, or for foreign nationals your nationality and passport number or ID number if you have one; the residential or business address for notifications; your email address, phone or fax number for notifications if any; and the subject of your request. You may attach supporting information and documents.
We will conclude your application free of charge as soon as possible and within 30 days at the latest, depending on its nature. If the action involves an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your application is refused, you find our answer insufficient, or we do not reply in time, you may complain to the Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your application (Art. 14 KVKK).
10. Cookies
The site only uses cookies it needs to work: your sign-in session (if you are signed in), your language and your currency. We do not use advertising, analytics or tracking cookies. See the Privacy Policy for details.