Introduction
Murat Atalay Turizm Ticaret Limited Şirketi, trading as Murat Atalay Travel Agency (“we”, “us”, “our”), respects the privacy of our customers and takes the protection of personal data seriously.
This Privacy Policy explains how we collect, use, store, protect and, where necessary, share personal information when you visit sideturkishbaths.com, contact us, request a quotation, or book a tour, excursion, activity, private tour or transfer.
We handle personal data in accordance with applicable data protection law, including Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the European Union General Data Protection Regulation (“GDPR”).
The personal data we process depends on the service you request, the information you provide and the legal requirements that apply to the transaction.
Who is responsible for your personal data?
The data controller for the processing described in this notice is Murat Atalay Turizm Ticaret Limited Şirketi, trading as Murat Atalay Travel Agency, a licensed travel agency (TÜRSAB) that runs the sideturkishbaths.com website sideturkishbaths.com. Its details are below. Please use them if you have questions about this Privacy Policy or the handling of your personal data.
How we collect personal data
We collect personal data directly from you or, where appropriate, through booking platforms, authorised business partners or service providers involved in arranging your reservation. Information may be collected through:
- booking forms and quotation request forms on our website;
- email, telephone calls and messaging services such as WhatsApp;
- social media and other customer contact channels;
- booking confirmations, payment processes and customer service;
- an authorised person making a reservation on your behalf;
- website cookies and similar technologies, where used and permitted by law;
- tour operators, transfer providers or other partners, where the information is needed to arrange the service you requested and its use is lawful.
We collect only the information reasonably necessary for the relevant purpose.
What personal data may we process?
Depending on how you interact with us, we may process the following categories of personal data.
Identity and booking information
- First and last name
- Booking reference and reservation details
- Number of adults and children in a booking
- Other participant information where needed to arrange the service
- Passport or identification details, only where genuinely required for the service or by law
Contact information
- Telephone and mobile number
- Email address
- WhatsApp or other messaging contact details
- Hotel name, pickup location and meeting-point information
Travel and service information
- The tour, excursion, activity or transfer requested
- Booking date and scheduled service date
- Pickup time, hotel, destination and itinerary requirements
- Language preference where needed to arrange the service
- Special requests and communication about the booking
- Information needed to arrange a private tour or transfer
Payment and transaction information
- Payment status and amount due
- Deposit, refund and transaction records
- Payment confirmations and accounting information
We do not ask for or store payment card details on this website. Where a payment is made online, the card details are entered with, and processed by, the payment provider.
Customer communications
- Questions, requests, complaints and feedback
- Messages exchanged about a booking
- Information needed to resolve a booking issue or respond to a request
Technical and website usage information
Where our website and its technology providers collect it: IP address, device and browser information, website usage data, security logs and cookie identifiers, subject to applicable law and your cookie settings.
Special categories of personal data
We do not need sensitive personal data to make a standard tour or transfer booking. If information about health, disability, allergies or mobility is needed to assess safety or arrange a service you request, we handle it only where a lawful basis and any additional conditions required by law are met. Please do not send sensitive information unless your request needs it.
Why we process personal data
Managing bookings and providing services
To receive and confirm reservations, check availability, arrange tours and transfers, coordinate pickup details, communicate itineraries and provide the services you request.
Customer communication
To answer enquiries, send booking confirmations and pickup information, tell you about necessary schedule changes and respond to your questions.
Payments, refunds and accounting
To record payments, manage deposits and outstanding balances, process eligible refunds, keep financial records and meet accounting and tax obligations.
Safety and operational coordination
To give tour operators, drivers, guides, activity providers or other parties the information reasonably needed to deliver the booked service safely and correctly.
Customer service and complaints
To investigate and resolve complaints, correct booking errors, respond to feedback and keep the records needed to handle disputes or to establish, exercise or defend legal claims.
Website operation and security
To maintain the website, prevent misuse, protect the booking systems, fix technical problems and keep our services reliable and easy to use.
Marketing communications
Where the law allows it and any required consent has been given, we may use your contact details to send offers, updates or information about our services. You can opt out at any time with the unsubscribe method provided or by contacting us. Messages needed for an existing booking may still be sent.
Legal and regulatory obligations
To comply with applicable law, respond to lawful requests from competent authorities, keep required business records and protect our legitimate legal interests.
Legal bases for processing
Depending on the circumstances and the applicable law, we process personal data on one or more of these legal bases:
- Contract: where processing is necessary to respond to a booking request or to perform a contract for a tour, activity or transfer.
- Legal obligation: where processing is required by applicable law and regulation.
- Legitimate interests: where processing is necessary for legitimate business purposes, provided the law and your rights are respected.
- Consent: where consent is legally required, including for certain marketing, cookies or sensitive personal data.
- Other lawful grounds permitted by applicable data protection law.
The legal basis depends on the processing activity. We do not rely on consent where another lawful basis applies, and we ask for consent where the law requires it.
Who may receive your personal data?
Where necessary and lawful, we may share relevant personal data with:
- tour operators and excursion providers;
- drivers, transfer companies, guides and activity providers;
- booking, reservation and customer communication platforms;
- payment service providers and financial institutions;
- website hosting, technical support, security and IT service providers;
- accountants, legal advisers and other professional service providers, where necessary;
- public authorities or other recipients where the law requires or permits it.
We share only the information needed for the purpose. A transfer provider, for example, may need your name, hotel, pickup time and phone number; a tour operator may need the number of participants and the booking details.
We do not sell customers’ personal data.
International data transfers
Some service providers or digital platforms we use may process personal data outside Türkiye or outside your country of residence. Where personal data is transferred abroad, we take the steps the applicable law requires, including any transfer conditions, safeguards or authorisations. The countries and recipients involved depend on the platforms and service providers used for your booking and communication.
How long do we keep personal data?
We keep personal data only as long as reasonably necessary for the purposes in this notice and as required by law. How long depends on:
- whether a booking was requested, confirmed, completed or cancelled;
- accounting, tax and commercial record-keeping obligations;
- the need to resolve complaints, refunds or disputes;
- website security and technical requirements;
- the time needed to establish, exercise or defend legal claims.
When personal data is no longer needed and no legal basis remains for keeping it, we delete, destroy or anonymise it in accordance with applicable law.
Cookies and similar technologies
Our website uses cookies and similar technologies for essential functions, to remember your preferences and, only with your consent, for analytics. Our Cookie Policy lists the cookies and browser storage this website uses, what they are for and how long they are kept, and you can change your choice at any time.
Data security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Depending on the systems involved, these include access controls, account security, secure hosting, software updates, backups and limiting access to the people who need the information for their work.
No website, online service or method of electronic transmission can be guaranteed to be completely secure. We handle personal data incidents in accordance with our legal obligations.
Your data protection rights
Subject to the conditions and limits of applicable law, you may have the right to:
- learn whether we process your personal data;
- request information about that processing;
- learn the purposes of the processing and whether the data is used in line with them;
- learn which third parties receive your personal data, where applicable;
- ask for incomplete or inaccurate personal data to be corrected;
- ask for personal data to be deleted or destroyed where the legal conditions are met;
- ask for recipients to be notified of certain corrections or deletions, where the law requires it;
- object to certain processing where the legal conditions are met;
- claim compensation for damage caused by unlawful processing, where the law provides for it;
- withdraw your consent where processing is based on consent, without affecting processing carried out before.
Additional rights may apply under the GDPR or other laws, depending on where you live and your circumstances.
How to exercise your rights
To make a data protection request, contact us using the details in the section “Who is responsible for your personal data?”. Please describe your request clearly and give enough information for us to find the relevant records and, where reasonably necessary, to verify your identity.
We may ask for more information to verify your identity or to clarify your request. We respond within the time limits set by applicable law and charge a fee only where the law allows it.
Children’s personal data
Some tours and activities are booked for children by a parent, guardian or other responsible adult. We process children’s information only where it is necessary for the booking, the service, safety or another lawful purpose. The person making the booking must be authorised to give the information about the other participants. Where the law requires parental or guardian consent or other safeguards, we comply with those requirements.
Third-party websites and services
Our website and messages may contain links to third-party websites, booking systems, payment providers or messaging services. They have their own privacy policies and practices, which we encourage you to read before giving them your information. This Privacy Policy does not apply to services operated independently by third parties.
Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, data processing or legal obligations. The latest version is published on this website with its revision date. Where the law requires it, we give additional notice of material changes.
Please read this Privacy Policy together with our Terms and Conditions, Cancellation Policy and Cookie Policy.
Contact us
For questions about this Privacy Policy or the processing of your personal data, contact Murat Atalay Turizm Ticaret Limited Şirketi (Murat Atalay Travel Agency) using the details on this page or our contact page.