Personal Data Notice

Data controller

To be verified before live sales · To be verified before live sales · To be verified before live sales

Data categories

Identity and contact data (name, phone, email); reservation and transaction data (tour date, guest and age categories, reservation code, special requests); invoice data; payment method, status and provider transaction reference; agreement/acknowledgement records; security and technical transaction logs. Card numbers and CVV are not stored by Kaptan Salazar.

Processing activities, purposes and legal bases

• Receive the request, calculate price/capacity, establish the agreement and provide the tour. · Data: Identity, contact, reservation and guest age-category data. · Legal basis: Article 5/2-c of Law No. 6698: directly necessary to establish or perform the agreement. · Retention: At least three years from the transaction; longer while a dispute remains active. · Recipients: Authorized operations staff and technical infrastructure providers, limited to the purpose.
• Verify payment, reconcile collection and issue fiscal documents. · Data: Invoice data, payment method, amount, status and provider transaction reference. · Legal basis: Articles 5/2-c and 5/2-ç: performance of the agreement and compliance with legal obligations. · Retention: Periods required by applicable tax, accounting and commercial law. · Recipients: Bank/payment provider, accounting service and legally authorized public bodies.
• Evidence of the electronic transaction, customer document access and dispute management. · Data: Agreement version/hash, presentation and acceptance/acknowledgement records, reservation and transaction times. · Legal basis: Articles 5/2-ç and 5/2-e: legal obligation and establishment, exercise or protection of rights. · Retention: At least three years from the transaction, plus any period required by a legal claim or dispute. · Recipients: Authorized staff, legal/accounting advisers and legally authorized bodies.
• Prevent fraudulent bookings, unauthorized access and abuse; secure the service. · Data: Limited connection, session, error, rate-limit and security event data. · Legal basis: Article 5/2-f: legitimate interests of the controller without harming fundamental rights. · Retention: A limited period determined by incident risk and strictly necessary for security. · Recipients: Authorized technical staff and hosting/security infrastructure providers.
• Measure site performance and advertising conversions only when the relevant category is consented. · Data: Cookie/local-storage identifiers, campaign parameters and consented usage events. · Legal basis: Separate explicit consent and cookie choice under Article 5/1 where required. · Retention: Provider-specific periods in the cookie policy or until consent is withdrawn. · Recipients: Configured analytics/advertising providers only after consent.

Purposes

Receiving the reservation request, capacity and price calculation, establishing and performing the agreement, payment verification and reconciliation, invoicing, operations and customer communication, security and abuse prevention, legal compliance, establishment of rights and dispute management.

Legal bases and collection method

• Under Article 5/2 of Turkish Law No. 6698: necessity for establishing or performing a contract, legal obligations, establishment/exercise/protection of rights and legitimate interests that do not harm fundamental rights. Separate explicit consent is obtained where required for marketing or non-essential cookies; this privacy notice is not conditional on consent.
• Electronically or physically through web forms, the private reservation link, payment-provider notifications, email, phone and official business communication channels.

Recipients

Authorized public bodies, payment/banking providers, accounting, hosting, email and reservation infrastructure providers, limited to the relevant purpose.

Special-category data

Health, allergy, disability or dietary-sensitivity information that may be special-category data is not mandatory for booking. If a guest shares it to request assistance, it is processed only for the necessary operational support, with restricted access and an appropriate legal condition.

International transfers

Non-essential analytics and advertising providers activate only after the user’s choice. Where a service causes an international transfer, recipient countries and parties are disclosed and the transfer does not begin until an adequacy decision or appropriate safeguard under Article 9 of Turkish Law No. 6698 is in place.

Retention and deletion

Reservation, agreement and acknowledgement records are retained for at least three years from the transaction date; fiscal records for the applicable tax and commercial-law periods; security records only for the limited period required for their purpose. Data is then deleted, destroyed or anonymized through the periodic disposal process.

Data-subject rights and applications

• Data subjects may exercise the rights in Article 11 of Turkish Law No. 6698, including asking whether data is processed, requesting information and correction, deletion where conditions apply, notification to recipients, objecting to automated analysis and seeking compensation for unlawful processing.
• Requests under Turkish data-protection law may be submitted with the request subject and sufficient identity-verification information through the registered email, email or postal channels on the commercial information page. Requests are answered free of charge as soon as possible and within 30 days, subject to any fee tariff set by the Authority where additional cost arises.