Privacy and personal data
This explains what Karaz Tourism collects, why, and what you can do about it. It is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK).
Data controller
The data controller is HITALANI SEYAHAT TURİZM OTOMOTİV İNŞAAT İTHALAT İHRACAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ, trading as Karaz Tourism, a travel agency licensed by TÜRSAB under number 16096.
Tax office: Hocapaşa
Tax number (VKN): 4631389133
MERSIS number: 0463138913300001
Trade registry number: 436840-5
Registered office: Hocapaşa Mah. Savfetipaşa Sk. No:7 İç Kapı No:301, Fatih/İstanbul
Branch office: Binbirdirek Mah. Piyer Loti Cad. Onur Apt. No:27/4, Fatih/İstanbul
You can reach us about anything on this page at [email protected].
What we collect
When you book: your name, email address, telephone number, the travellers on the booking, and any notes you give us such as a flight number, a hotel name or a dietary requirement.
When you create an account: the same contact details, plus a cryptographic hash of your password. We never store the password itself and cannot read it.
When you pay by card: nothing. Card details are entered on the payment provider's own secure page. Card numbers, expiry dates and security codes never reach our servers, and we cannot see them.
When you contact us: whatever you write in an enquiry form or a WhatsApp message, and the contact details you send it with.
When you use the site: technical records needed to run and protect it — your IP address for rate limiting and abuse prevention, and aggregate usage events that tell us which pages and experiences are being viewed.
Why we collect it, and on what legal basis
| What for | Basis under KVKK |
|---|---|
| Arranging and delivering your booking | Necessary for the performance of a contract |
| Confirmation, reminders and messages about your booking | Necessary for the performance of a contract |
| Invoicing, accounting and tax records | Compliance with a legal obligation |
| Protecting the site from abuse and fraud | Legitimate interest |
| Travel ideas and offers by email | Your explicit consent, which you give by ticking the box and can withdraw at any time |
We do not sell personal data, and we do not share it for anyone else's marketing.
Who we share it with
Only those who need it to deliver what you booked, and only what they need:
- The guide, driver, hotel or local operator running your experience — normally the lead traveller's name, the party size and a contact number
- Our payment provider, which processes the card payment and holds the payment record
- Our email provider, which sends booking confirmations and messages
- Our hosting and infrastructure providers, which run the servers and databases
- Error monitoring, which records technical faults so we can fix them
- Public authorities, where the law requires it
Where a provider is located outside Türkiye, the transfer is made under the conditions KVKK sets for transfers abroad.
The booking assistant
The assistant on this site answers from a set of approved answers written by our team. It is deliberately not allowed to state prices, cancellation terms, availability or visa rules. Do not send personal data, passport details or card numbers to it; use email or WhatsApp for anything that needs them.
How long we keep it
Booking and payment records are kept for the period Turkish tax and commercial legislation requires. Account details are kept while the account exists. Enquiries that do not become bookings are kept only as long as they are useful for answering you. Marketing consent is kept until you withdraw it.
How we protect it
The site is served over HTTPS. Passwords are stored only as hashes. Access to the booking system is restricted to named staff accounts with roles, and administrative actions are recorded in an audit log. Card data never enters our systems at all.
Your rights
Under Article 11 of KVKK you may ask us whether we hold data about you, what it is and why; ask for it to be corrected if it is wrong; ask for it to be erased where the law allows; ask us to tell anyone we shared it with about a correction or erasure; object to a result produced solely by automated analysis; and claim compensation for damage caused by unlawful processing.
Write to [email protected] with enough detail to identify you. We answer within thirty days at the latest. If you are not satisfied, you may complain to the Personal Data Protection Authority (KVKK Kurumu).
The one limit: booking and accounting records we are legally required to keep cannot be erased on request until that period has passed.
Cookies
We use cookies that are necessary for the site to work — keeping your selected booking while you complete it, keeping you signed in, and protecting forms from abuse. These are not used to track you across other websites and are not sold to advertisers.
Changes
If this page changes materially we will say so on the page itself.