This Privacy and Personal Data Protection Policy ("Policy") explains how Karaca 61 Tourism ("Karaca 61", "we") processes personal data collected via karaca61.com, our mobile apps, and our customer communication channels. This document serves as the disclosure statement required under Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK") and applies to every person who visits our website, uses our services, or contacts us.
1. Data Controller
For the purposes of KVKK, Karaca 61 Tourism acts as the data controller. You can reach us through the following channels:
Email: [email protected] (general inquiries and KVKK requests) Phone: +90 542 237 50 61 Address: Ortahisar / Trabzon, Türkiye Status: A-category travel agency, registered with TÜRSAB
Detailed corporate registration information (tax number, MERSİS number, TÜRSAB registration number) is available upon written request.
2. Personal Data We Collect
We process the following categories of personal data — either provided by you directly, by someone on your behalf, or collected automatically:
Identity data — name, surname, date of birth (for child passengers); Turkish national ID number is collected only when required for invoicing and only upon your request.
Contact data — phone number, email address, pickup and drop-off address, location information.
Reservation data — selected tour, date, number of passengers, pickup point, special requests, health notes (optional — for passengers who need special assistance).
Financial data — amount, payment method, wire transfer reference, credit card transaction token. Your card number is never stored on Karaca 61 systems; payment is processed via 3D Secure by Kuveyt Türk Katılım Bankası.
Transaction history — past reservations, cancellations, refunds, payments.
Automatically collected data — IP address, user-agent (browser), visit timestamps, pages visited, device type, and language preference. Used for service security, debugging, and site improvement.
Marketing preference data — the email / SMS / WhatsApp channel opt-ins you provide with explicit consent.
Visual and audio data (optional) — photos and videos captured by our team during tours that you explicitly consent to share on our social media.
Location data — only if you use our mobile app and grant location permission; used to surface upcoming tours near you and local weather.
3. Purposes of Processing and Legal Bases
Your personal data is processed under the legal bases enumerated in KVKK Article 5:
Performance of a contract (KVKK Art. 5/2-c) — creating reservations, preparing quotes, running tours, organizing pickup and drop-off, cancellations and refunds.
Compliance with the law (KVKK Art. 5/2-a) — tourism regulations, TÜRSAB rules, Law No. 5651 on internet services, retention requirements under the Turkish Tax Procedure Law.
Legal obligation (KVKK Art. 5/2-ç) — issuing e-invoices and e-archives, VAT and income tax filings, accountant audits, official authority requests.
Legitimate interest (KVKK Art. 5/2-f) — site security, fraud prevention, audit trails, service quality measurement, and improvement.
Explicit consent (KVKK Art. 5/1) — marketing communications (email / SMS / WhatsApp campaigns), analytics and marketing cookies, sharing your tour photos on social media, and processing any special category data (health notes). Where explicit consent is required, we ask for a specific opt-in at the relevant step; you may withdraw consent at any time.
4. Recipients of Personal Data
We share your data only with the limited parties below, for the limited purposes stated:
Service providers (acting as data processors): • Twilio Inc. (USA) — SMS and WhatsApp one-time verification codes, and optional WhatsApp communication. • Meta Platforms Inc. (USA) — WhatsApp Business Cloud API messaging, after your explicit consent. • Kuveyt Türk Katılım Bankası A.Ş. (Türkiye) — Virtual POS card payments. • Microsoft Corporation / Azure (EU and Türkiye regions) — Application hosting, database, file storage, email. • Google LLC (USA) — Google Analytics 4 (anonymized), after your consent. • Meta Platforms Inc. (USA) — Meta Pixel, after your consent.
Legally mandated recipients: • T.R. Ministry of Culture and Tourism, TÜRSAB — regulatory reporting. • Tax offices, certified accountants — as required by tax legislation. • Courts, prosecutors, law enforcement — upon lawful request.
We do not sell, rent, or trade your personal data to any third party beyond the purposes listed above.
5. Cross-Border Data Transfer
Under KVKK Article 9, limited personal data is transferred abroad because some of our service providers are based outside Türkiye:
• Twilio (USA) — phone number, SMS and WhatsApp message content. • Meta (USA and EU) — WhatsApp Business message content and Meta Pixel event data (both after your explicit consent). • Google (USA) — Google Analytics event data (after your consent).
These transfers are governed by Data Processing Agreements (DPA), Standard Contractual Clauses (SCC), and your explicit consent where required. Microsoft Azure's Türkiye and EU regions, along with Kuveyt Türk, remain within domestic processing.
6. Retention Periods
We retain personal data for as long as the processing purpose requires, or for the longest of the following statutory retention periods, whichever is longer:
• Reservation, invoice, and customer records: 10 years under Art. 253 of the Turkish Tax Procedure Law. • Payment transaction data: at least 10 years under the Payment Systems Regulation. • Web server logs and IP addresses: at least 2, at most 3 years under Law No. 5651. • Marketing communication records: until you withdraw consent; up to 90 days after withdrawal. • Visual/audio media shared on social channels: until you withdraw consent. • Cookie and tracker data: for the durations disclosed in the Cookie Policy.
At the end of the retention period, data is irreversibly deleted, destroyed, or anonymized.
7. Children's Data
Karaca 61 services are designed for adults over 18. When making a reservation that includes child passengers, only a parent or legal guardian may share the child's name and date of birth. This information is used solely to transport the child safely and to have contact details available in emergencies. Completing the reservation constitutes your consent as parent or guardian.
We do not otherwise collect personal data from children. If you believe a child's data was collected without proper authorization, please contact us — we will erase it immediately.
8. Cookies and Trackers
In addition to strictly necessary cookies, we may use analytics and marketing cookies with your explicit consent. You can change your cookie preferences at any time via the preferences panel at the bottom of the website.
For the full list of cookies (name, duration, purpose), see our Cookie Policy at karaca61.com/cerez-politikasi
9. Your Rights under KVKK Article 11
Under KVKK Article 11, you have the right to:
1. Learn whether your personal data is being processed. 2. Request information about how it is processed, if it has been. 3. Learn the purpose of processing and whether the data is used in accordance with that purpose. 4. Know the third parties to whom the data has been transferred, whether domestically or abroad. 5. Request correction of any incomplete or inaccurate data. 6. Request deletion or destruction of your personal data under KVKK Article 7. 7. Request that the correction, deletion, or destruction be notified to the third parties to whom the data was transferred. 8. Object to any decision made exclusively by automated processing that produces an adverse result for you. 9. Claim compensation for damages arising from unlawful processing of your personal data.
10. How to Submit a Request
To exercise the rights above or to request deletion of your data, contact us via:
• Email: [email protected] (subject line: "KVKK Request") • Postal address: Karaca 61 Tourism, Ortahisar / Trabzon, Türkiye
To help us verify your identity, please include your name, email or phone number, and describe your request clearly. For deletion requests, naming the data category you want removed speeds up the process.
Response time: we conclude requests within 30 days at no charge. If processing your request incurs additional cost, we may charge the fee set by the Personal Data Protection Board.
Deletion specifics: data still under a statutory retention period (e.g., 10-year invoice retention under tax law) is kept until that period ends and then erased. Beyond that exception, all records are deleted or anonymized within 30 days.
Right to complain: if our response is unsatisfactory or missing, you retain the right to lodge a complaint with the Personal Data Protection Board at kvkk.gov.tr.
11. Security Measures
We apply industry-standard technical and organizational measures to protect your data: TLS in transit, encryption for sensitive fields, role-based access control, audit logging, periodic security testing, data processing agreements with our vendors, and KVKK awareness training for staff.
No system is 100% secure. In the event of a data breach, we notify the Personal Data Protection Board and affected data subjects within 72 hours, as required by KVKK Art. 12/5.
12. Changes to This Policy
We may update this Policy in response to legal changes, service updates, or changes to our business processes. The current version is always published on this page, with the effective date and version number updated at the top.
For material changes, we notify your registered email address and re-request your explicit consent where relevant.
This Policy is published in Turkish, English, and Arabic. In case of any interpretation conflict between languages, the Turkish text prevails.