Data protection

GDPR Privacy Notice

Last updated: 31 August 2026

This notice explains how the operator of the Kusadasi Travel Agency service processes personal data when an EU or EEA visitor asks about or requests a tour or transfer.

Controller and contact

The controller for reservation activity on this website is KCAN TURİZM TAŞIMACILIK LTD. ŞTİ., operating under the licensed agency title CAN PRIVET TRAVEL AGENCY (TÜRSAB operating licence 17338, Group A). Its registered address is Değirmendere Mah. 3526 Sok. Güneş Sitesi F Blok No: 1/1, Kuşadası/Aydın, Türkiye. “Kusadasi Travel Agency” is the service name used on this website. Contact [email protected] or the reservation line +90 535 853 54 69 for privacy requests.

Data we process

We may process your name and contact details; selected service, date, party size and pickup; cruise ship or flight information; child-seat, mobility and practical service notes; request reference, status and communications; and limited security, referral and campaign data. This website does not collect credit or debit card data.

Purposes and lawful bases

We use the information to answer enquiries, take steps requested before a contract, check availability and pricing, plan pickup and timing, send written confirmation, deliver a confirmed service, support customers, prevent abuse, comply with law and establish or defend legal claims. The usual bases are steps before or performance of a contract, legal obligation and legitimate interests in secure and effective operations. Consent is requested separately only where it is the appropriate legal basis.

Optional marketing consent

Communications about a reservation are separate from promotional messages. If you actively select the optional offers checkbox, we may use your email address or WhatsApp number for occasional Kusadasi tour and transfer offers on the basis of consent. The choice is not required to submit a request and may be withdrawn at any time for future processing.

Analytics consent

Google Analytics 4 is configured through Google Consent Mode. We also operate first-party analytics on this server after “Allow analytics” is selected. It stores anonymous visitor and 30-minute session identifiers, page paths, UTM/referral source, network-provided country code, language, device/browser category, interaction and booking-funnel events, and real-user performance measurements. Raw IP addresses, names, email addresses and phone numbers are not written to the analytics table; events are removed automatically after 400 days. “Essential only” disables first-party collection and keeps Google analytics storage denied.

Recipients and international transfers

Data is shared only as needed with assigned guides and transport, vessel or activity suppliers, and with hosting, email and messaging infrastructure providers. It may also be disclosed when lawfully required by an authority. We assess the applicable GDPR transfer mechanism and safeguards where a recipient processes data outside the EEA. We do not sell personal data.

Retention and security

Records are kept only for as long as needed to manage the enquiry or confirmed service, resolve disputes and meet applicable legal record-keeping duties. The retention decision depends on whether a request became a confirmed service and whether a legal claim or mandatory period applies. Data is then deleted, destroyed or anonymised. Operational notification destinations and mailbox credentials are kept on the server and are not included in public pages, browser code or reservation records.

Transfer price calculations

Supported transfer routes may receive a price estimate based on the route, vehicle class, travel time and requested child seats. The displayed amount is checked again when the request is submitted. It does not create a legally binding confirmation or make a decision with legal or similarly significant effects; our reservations team reviews every request.

Your GDPR rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent for future processing where consent is the basis. You may also complain to the competent data protection authority. We may request reasonable information to verify identity before acting on a request.

Exercise your rights

Email [email protected] with the subject “GDPR request”. Also read our general privacy policy and, for processing in Türkiye, the KVKK notice.

Official references: Regulation (EU) 2016/679 and the European Commission’s guide to individual rights.