Skip to content
Karaz Tourism

Privacy and personal data

This notice explains what personal data Karaz Tourism processes, why, who receives it and what rights you have. It is our information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). Last updated: 22 October 2026.

Data controller

HITALANI SEYAHAT TURİZM OTOMOTİV İNŞAAT İTHALAT İHRACAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ, trading as Karaz Tourism, a travel agency licensed by TÜRSAB under number 16096.

Tax office: Hocapaşa

Tax number (VKN): 4631389133

MERSIS number: 0463138913300001

Trade registry number: 436840-5

Registered office: Hocapaşa Mah. Savfetipaşa Sk. No:7 İç Kapı No:301, Fatih/İstanbul

Branch office: Binbirdirek Mah. Piyer Loti Cad. Onur Apt. No:27/4, Fatih/İstanbul

Email for privacy requests: [email protected]

What we collect

Your account. Your name and email address, and an account identifier. Sign-in is handled by our sign-in provider, WorkOS: with your email address or, if you choose, with Google, in which case we receive your name, your email address, whether it is verified and an account identifier, never your Google password. Older accounts may also hold a password, which we keep only as a one-way hash that cannot be read back.

Your bookings. The lead traveller's name, email address and telephone number; the name of every traveller; the hotel or address for pickup or drop-off; flight numbers and luggage counts for transfers; any notes you give us; and the experiences, dates, prices, statuses and history of your bookings, cancellations and refunds.

Payments. When online card payment is available, the card details you type on our payment page are sent over an encrypted connection to our server, which passes them straight on to our bank, Kuveyt Türk Katılım Bankası A.Ş., for authorisation and the 3-D Secure check. They are used only for that and are never stored: card numbers, expiry dates and security codes do not appear in our records or our system logs. We record the amount, the status of each payment and refund, and the bank's references for the transaction.

Messages and requests. What you send through the contact form (name, email address, telephone number if given, message), the hotel request form (your name and the details of the request, including the dates of birth of any children), a review (the name and country you give, your rating and text), and the emails and WhatsApp messages you send us.

Using the website. Your IP address, used for security and to limit abuse; technical records needed to run the site; your cookie choice; and anonymous usage events, such as which pages and steps are viewed, that are not linked to your name or account.

The booking assistant. The questions you type into it. Questions it cannot answer are kept so that our team can improve its answers.

Why we use it, and on what legal basis

  • To create and run your account, make and deliver your bookings, take payment and handle cancellations and refunds: necessary for the performance of a contract (KVKK Article 5(2)(c)).
  • To send you messages about your bookings: necessary for the performance of a contract.
  • To keep invoicing, accounting and other records the law requires: compliance with a legal obligation (Article 5(2)(ç)).
  • To answer your enquiries and requests: necessary to prepare or perform a contract you ask for, or our legitimate interest in answering you (Article 5(2)(c) and (f)).
  • To protect the site, our customers and us against abuse and fraud: our legitimate interest (Article 5(2)(f)).
  • To establish, exercise or defend a legal claim: Article 5(2)(e).
  • To publish a review you submit: your explicit consent, given when you submit it.
  • To measure the use of the site with Google Analytics cookies: your explicit consent, given in the cookie banner and withdrawable at any time.
  • To send you travel ideas and offers by email: your explicit consent, given by ticking the optional box at checkout and withdrawable at any time.

We do not sell personal data and do not share it for anyone else's marketing.

Who receives it

Only those who need it, and only what they need:

  • The partners who deliver your booking, such as hotels, airlines, transport companies, guides and venues: normally the travellers' names, the party size, pickup details and a contact number
  • Kuveyt Türk Katılım Bankası A.Ş., our bank, which processes card payments and refunds
  • WorkOS, which handles sign-in, and Google, if you choose to sign in with Google
  • Resend, which sends our emails
  • Amazon Web Services, which hosts our servers and database in Frankfurt, Germany, and Cloudflare, which delivers and protects the website
  • Google, for Google Analytics and Google Tag Manager, only once you accept analytics cookies
  • Anthropic, when the booking assistant uses an AI model to compose an answer to your question
  • WhatsApp (Meta), when you choose to contact us on WhatsApp, under WhatsApp's own terms
  • Public authorities and courts, where the law requires it

Transfers abroad

Several of these providers process data outside Türkiye, in the European Union, the United States and other countries. These transfers are made under Article 9 of KVKK. You can ask us which provider processes your data and on what basis.

How long we keep it

Booking, payment and invoicing records are kept for the periods Turkish tax and commercial law requires. Account details are kept while your account exists. Enquiries that do not become bookings are kept only as long as they are useful for answering you. Marketing consent is kept until you withdraw it. When a period ends, the data is deleted, destroyed or anonymised.

How we protect it

The site is served only over an encrypted connection. Passwords and sign-in sessions are stored only as one-way hashes. Access to the booking system is limited to named staff accounts with roles, and administrative actions are recorded. Card data never enters our systems. If personal data were obtained unlawfully by others, we would inform you and the Personal Data Protection Board as soon as possible, as Article 12 of KVKK requires.

Your rights

Under Article 11 of KVKK you may ask us whether we process data about you and, if so, for information about it; learn the purpose of the processing and whether the data is used for that purpose; know the third parties in Türkiye or abroad to whom it is transferred; ask for it to be corrected if it is incomplete or wrong; ask for it to be deleted or destroyed where the conditions of Article 7 are met; ask us to notify those corrections or deletions to the third parties who received the data; object to a result against you that arises solely from automated analysis; and claim compensation for damage caused by unlawful processing.

Send your request in writing to [email protected] from the email address registered with us, or by post to our registered office, with enough detail to identify you. We answer free of charge within thirty days at the latest. If your request is refused or not answered, you may complain to the Personal Data Protection Board (KVKK).

Records we are legally required to keep, such as booking and accounting records, cannot be deleted on request until that period has passed.

If you are in the European Economic Area or the United Kingdom and the GDPR or UK GDPR applies to our processing of your data, you also have the rights those laws give you, including the rights to restrict processing, to data portability and to complain to your local supervisory authority.

Cookies

We use cookies that are necessary for the site to work: keeping you signed in, completing a sign-in securely, remembering your basket and the orders placed from your browser, and remembering your cookie choice. These are always on and are not used to track you on other websites.

Google Analytics cookies are set only if you select Accept in the cookie banner. Until then, and if you decline, Google receives only cookieless measurement signals with no identifier stored on your device. You can change your choice at any time through Cookie settings at the foot of every page.

Changes

If this notice changes materially, we update the date at the top of the page and, where appropriate, tell you by email.