Privacy Notice (KVKK)
Prepared under article 10 of Turkish Personal Data Protection Law no. 6698 ("KVKK").
1. Data controller
Until the selling travel agency is determined, the data controller is temporarily the platform operator of Turquoise Stays (https://turquoisestays.com):
YCF Digital — Mansur Sarı · Adalet Mah. Manas Bulv. No:39, Folkart Towers B Kule, Bayraklı/İzmir · info@ycfdigital.com
When the selling travel agency is determined, this notice will be renewed and the agency will be named as the data controller; the renewed notice will be published on this page.
2. Data processed and purposes
- Request form details (name, phone, e-mail, your message, preferred time to be called, the product you are interested in, date and number of guests) — contacting you, providing availability and price information, preparing a quote. Legal ground: steps prior to entering into a contract (art. 5/2-c).
- Quote details (name, e-mail, the products and dates included in the quote) — sending you the quote prepared at your request. Legal ground: entering into a contract (art. 5/2-c).
- Name, e-mail, phone — creating and performing the booking, delivering the voucher. Legal ground: performance of a contract (art. 5/2-c).
- Stay / tour details — passing the booking to the supplier. Legal ground: performance of a contract (art. 5/2-c).
- Payment transaction records (NOT card details) — collection, accounting and refunds. Legal ground: legal obligation (art. 5/2-ç).
- Special request note — passing your request to the supplier. Legal ground: performance of a contract (art. 5/2-c).
- Names of room guests, adult/child status and child age (optional) — passing the booking to the property and handover at check-in. Legal ground: performance of a contract (art. 5/2-c). ID numbers and dates of birth are not requested online; the guest registration required by Turkish Law no. 1774 is filed by the property at check-in.
- Names of tour passengers (optional) — passing the passenger list to the tour company. Legal ground: performance of a contract (art. 5/2-c).
- Booking change and cancellation records (changes to dates, number of guests, room type; cancellation reason; staff member handling the request) — performing the contract, settlement with the property and evidence in case of dispute. Legal ground: performance of a contract (art. 5/2-c) and legal obligation (art. 5/2-ç).
- Nationality and ID/passport number for bookings taken by phone (optional) — kept only in the operational record; the ID/passport number is not printed on the voucher and is not included in the notice sent to the property. Legal ground: performance of a contract (art. 5/2-c).
- On-site traffic measurement (without any identifier) — time, page viewed, device type, language of the page, where the visit came from (domain name of the referring site; advertising or campaign source if present in the link) and whether cookie consent was given; for add-to-basket, payment and purchase steps, the product, date, number of guests and amount. IP address and browser identification string (user-agent) are not stored under any circumstances; if you have not given consent to cookies, the ad click identifier is not stored either, nothing is written to your device and the record does not identify you; records are not combined with other data on a per-person basis. Purpose: aggregate statistics on how many visits the site and the product pages receive, through which channels, and whether the visits turn into sales. Legal ground: legitimate interest (art. 5/2-f; KVKK Cookie Guide 2025 §5.9 — first-party analytics); for visitors in the EU, GDPR art. 6(1)(f). Your device is not accessed. You may object with the "Do not count this browser" link in the page footer.
- Analytics data when you give consent to cookies — unique visitor identifier (hr_sid) and, when Google tags are installed on the site, Google Analytics 4 cookies. Purpose: counting unique visitors and detailed usage analysis. Legal ground: explicit consent (KVKK art. 5/1; for visitors in the EU, GDPR art. 6(1)(a)) — "Accept" in the cookie banner.
- Marketing data when you give consent to cookies — the identifier of the ad click that started your visit, campaign details, entry channel, the domain name of the referring site and the first page opened (hr_attr); when Google tags are installed on the site, Google Ads cookies; if you make a purchase, the matching of this information with your order. Purpose: measuring which sales the ads bring and reporting conversions to the advertising platform. Legal ground: explicit consent (KVKK art. 5/1; GDPR art. 6(1)(a)) — "Accept" in the cookie banner; for transfer abroad, KVKK art. 9 (see below).
- You may withdraw your consent at any time with the "Cookie preferences" link in the page footer; when you withdraw it, these cookies are deleted. Your sales record is kept for order management independently of your cookie choice; it is passed to advertising providers only with your consent.
- Marketing consent — sending campaign messages. Legal ground: explicit consent (art. 5/1).
We do not store your card details. Payment is taken through a licensed payment institution.
3. Transfers
Your data may be transferred to the accommodation provider or tour operator to perform the service, and to competent public authorities where legally required. The property receives only the booker's and room guests' names, nationality (if given), stay details, special request and arrival notes, and change/cancellation notices; your e-mail, phone number, ID number, payment and invoice details are not passed to the property. The details in your request form may be shared with the relevant accommodation provider or tour company where needed to fulfil your request.
Transfer abroad. If you have given consent to cookies and your order began with a click on a Google ad, the ad click identifier, together with the time and amount of the order, may be passed to Google Ads (Google Ireland Limited / Google LLC) to measure whether the ad brought a sale. This notification is made by the platform operator, or by the accommodation provider or tour company that runs the ad, from its own advertising account; your name, e-mail or phone number is not included in the notification. When Google tags (Google Analytics / Google Ads) are installed on the site, the measurement data you have consented to is also passed to Google. These transfers take place only if you have given consent to cookies (explicit consent under KVKK art. 9); for visitors in the EU, Google's EU–US Data Privacy Framework certification and standard contractual clauses are relied upon. On-site traffic measurement records stay on our own server and are not shared with anyone. Other than these, no transfer abroad takes place.
4. Retention
Booking and accounting records are retained for the periods required by law (as a rule, 10 years). Requests and quotes that do not turn into a booking are anonymised after 12 months. Marketing consent records are retained after withdrawal, because the burden of proof rests with the sender. On-site traffic measurement and measurement event records are retained for at most 25 months and then deleted; the durations of the measurement and advertising cookies are stated in the Cookie Policy.
5. Your rights
Under article 11 of the KVKK you may learn whether your data is processed, request information, request correction or erasure, object to processing, and claim compensation for damages. Visitors in the EU may also exercise their rights under GDPR articles 15–22 (access, correction, erasure, restriction, portability, objection). To lodge a complaint, you may apply, in Turkey, to the Turkish Personal Data Protection Board (KVKK Board) and, in the EU, to the data protection authority of the country where you are located. You may object to traffic measurement without any identifier using the "Do not count this browser" link, and withdraw the consent you have given to cookies at any time using the "Cookie preferences" link; both are in the page footer.
You may send your requests by e-mail to info@ycfdigital.com or in writing to the postal address above. Requests are answered within 30 days at the latest.
Last updated: 1 October 2026 · Text version: v4-2026-10