Privacy Policy

1. Who is the data controller

The data controller is Tufan Albaycan Seyahat Acentası, trading as TourThese, a licensed travel agency registered with the Association of Turkish Travel Agencies (TURSAB) under licence number 18704. Our office is at Hobyar Mah. Cagaloglu Yokusu Sk. Evren Han No:17 Ic Kapı No:210 Fatih/Istanbul. For any privacy question, including access, correction or deletion requests, write to info@tourthese.com with the subject line “KVKK / GDPR request”. We respond within 30 calendar days, which is the shorter of the two statutory windows.

2. What we collect and why

When you submit a tour request through the website or by WhatsApp, we collect: your name, a contact email, a WhatsApp or phone number, the hotel or pickup address, intended tour date, number of travellers (including child ages if seat or ticket pricing depends on them), any accessibility or dietary notes you share, and free-text comments about what you want to see. This minimum set is what our operator needs to confirm guide availability, reserve museum tickets in your names where required (Topkapi Harem, Hagia Sophia upper gallery and Galata Tower all require named ticketing), and arrange transport.

Payment is taken either in cash on the day, by a Stripe payment link sent for the deposit, or by direct bank transfer. We never see or store your full card number — the payment processor holds it. We only store the last four digits and the authorisation reference for our accounting records.

3. Lawful basis

Under GDPR Article 6(1)(b) the lawful basis for handling tour request and reservation data is “performance of a contract” — we cannot quote, confirm or run a private tour without it. Under KVKK Article 5(2)(c) the equivalent ground is “processing necessary for the conclusion or performance of a contract”. Marketing messages, where you actively opt in, sit under Article 6(1)(a) consent — you can withdraw that consent at any time by replying “STOP” on WhatsApp or emailing us.

4. Who sees your data

Inside TourThese, only the founder, the reservations coordinator and the guide assigned to your specific tour see your contact details. We share the bare minimum with third parties only when it is required to deliver your tour: museum ticketing portals (name plus passport number when the venue mandates it), the vehicle supplier we sub-contract for your transfer (pickup point, time and lead-passenger name), and our accountant who handles e-archive invoices under Turkish Revenue Administration rules. We do not sell data, we do not feed marketing lists to advertising networks, and we do not share your itinerary with any other agency.

5. How long we keep records

Reservation and invoice records are kept for ten years from the end of the calendar year of your tour. That period is set by Article 82 of the Turkish Commercial Code and Article 253 of the Tax Procedure Law for commercial books. WhatsApp conversation logs and the original tour-request email are deleted after twenty-four months, which is enough to handle return visits without retaining contact data indefinitely. Anything you mark as a one-off enquiry that never converts to a booking is deleted after six months.

6. Your rights and how to use them

You can ask for a copy of the data we hold on you, correction of anything that is wrong, deletion once any contractual or legal retention period has lapsed, restriction of processing while a dispute is open, and portability of your reservation history in a machine-readable format. Email info@tourthese.com with your full name and the approximate date of your tour so we can locate the right record. If you are not satisfied with our response, you can lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu) or, if you are EU-resident, with your national data protection regulator.

7. International transfers

Our website is served from a European data centre operated by Vercel. Analytics counters are run by Google Analytics 4 and Microsoft Clarity. Both providers process pseudonymised identifiers in the United States under the EU–US Data Privacy Framework and equivalent UK and Swiss adequacy bridges. We do not transfer reservation data to providers outside Türkiye and the European Economic Area.

8. Changes

When the wording materially changes — a new processor, a shorter retention window, a new lawful basis — we update the “last reviewed” date at the top of this page and note the change in plain English. We do not silently swap in a boilerplate template.