Privacy policy.

Let's go Türkiye is a privately run travel company with a team in Türkiye. We decide how your personal information is used, which makes us the “controller” under the UK and EU General Data Protection Regulation (GDPR) and the “data controller” (veri sorumlusu) under Türkiye’s Personal Data Protection Law No. 6698 (KVKK). Contact us about anything on this page at almamuntr@yahoo.com or on WhatsApp.

• Booking and trip requests: travel dates or month, number of guests, the package or route you chose, your phone number, your email if you give it, and anything you write in “special requests”.
• Travellers: the full name and nationality of each traveller you add. If you book for other people, please make sure they know you are sharing their details with us.
• e-Visa support: if you ask us to help with a visa, we collect passport details directly from you over WhatsApp or email, never through this website, and only for that application.
• Accounts: your name, email and a password (stored only as a secure hash) if you create a customer account.
• Partner agencies: company name and registration details, website, contact name and job title, email, phone and address.
• Messages: what you send us on WhatsApp or by email.
• Technical data: your IP address, used briefly to block abuse and too many requests, and anonymous page statistics. Google Analytics data only if you accept analytics cookies (see our cookie policy).

If you tell us about a medical condition, mobility needs or dietary requirements (for example halal or vegetarian meals), this can reveal health or religious information, which the law protects more strictly. Only share what we need to arrange your trip. By sending it, you give us your explicit consent to use it for that purpose and to pass it only to the hotel, guide or driver who needs it. You can withdraw that consent at any time by telling us.

• To quote, book and run your trip - steps you ask us to take before and under a contract with you.
• To keep booking and accounting records - to meet our legal obligations, including tax law.
• To protect the site and stop fraud and abuse - our legitimate interest in keeping the service secure.
• To review and approve partner agencies - steps towards a contract with the agency.
• Analytics cookies - only with your consent, which you can withdraw at any time.
• Health, diet or religious information - your explicit consent.

We do not sell your information, use it for advertising, or make decisions about you by automated means.

We share only what each one needs:

• Trip suppliers - hotels, transfer drivers, guides, balloon operators and domestic airlines on your itinerary.
• Visa authorities - the Turkish e-Visa system or embassy, only if you ask for visa support.
• Service providers who process data for us: Vercel (website hosting and cookieless analytics), Supabase (database and customer sign-in), Upstash (abuse and rate-limit protection), Resend (email delivery), Google (analytics, only with consent), WhatsApp / Meta (messaging, when you contact us there), and our email provider. If card payment is offered, Stripe processes card payments on its own secure page; we never see your card number.
• Authorities - where the law requires it.

Our team is in Türkiye and several of our service providers store or process data in other countries, including the United States, the European Union and India (our website’s servers run in Mumbai). Where data leaves the UK, the EU or Türkiye, we rely on the safeguards in our providers’ data processing terms, such as the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, or on the transfer being necessary to deliver the trip you booked.

• Enquiries that do not become a booking: up to 2 years after we last hear from you.
• Confirmed bookings and payment records: up to 6 years after your trip ends, for tax and accounting rules and to handle any claims.
• Passport details for visa support: deleted within 3 months after your trip.
• Customer accounts: until you ask us to delete them, or after 2 years without use.
• Partner agency records: for the partnership plus 6 years; rejected applications after 12 months.
• Rate-limit data: minutes. Analytics data: no more than 14 months.

Data is encrypted in transit and kept in a database with access rules that let a signed-in customer see only their own records. Only staff who need it can see booking details. Passwords are stored as secure hashes, and staff sign-in uses short sessions with two-factor authentication available. If a breach puts you at risk, we will tell you and the relevant regulator as the law requires.

You can ask us to: tell you what we hold and give you a copy; correct it; delete it; limit or object to how we use it; send it to you or another company in a usable format; and withdraw any consent you gave. Under KVKK you also have the rights in Article 11, including learning whether your data is processed and who it was shared with. Email almamuntr@yahoo.com. We reply within one month (30 days under KVKK) and do not charge.

Please tell us first so we can fix it. You can also complain to a data protection regulator: in the UK the Information Commissioner’s Office (ico.org.uk), in Türkiye the Personal Data Protection Authority (kvkk.gov.tr), or the regulator in the EU country where you live.

Bookings must be made by an adult. We hold children’s names and nationalities only when a parent or guardian adds them as travellers.

We will update this page when how we use data changes, and change the date at the top. See also our cookie policy and booking terms.