Privacy notice

Last updated: 7 November 2026

This notice explains how we handle your personal data when you visit sedaturizm.com and write to us through the forms on the site. We publish it under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK").

1. Who is responsible for your data

The data controller for personal data processed on this site is Seda Turizm.

  • Registered name: Seda Seyahat Acenteliği Turizm Organizasyon Danışmanlık ve Reklamcılık Ticaret Limited Şirketi ("Seda Turizm", "we")
  • MERSİS number: 0758048252200001
  • TÜRSAB licence number: A-5486
  • Address: Altayçeşme Mah. Çamlı Sk. Dap Royal Center Sitesi A Blok No:16A İç Kapı No:78 Maltepe/İstanbul, Türkiye
  • Registered electronic mail (KEP): sedaseyahat@hs01.kep.tr
  • Email: info@sedaturizm.com
  • Phone: +90 216 306 22 55

2. What we process and why

Your form request. Your name, email address, country, subject and message, and if you choose to give them, your phone number, company name and city. We use them to answer your request, prepare a quote and stay in touch with you about it. If you write on your own behalf, the legal basis is that the processing is directly related to a contract you want to enter into (KVKK Art. 5(2)(c)). If you write on behalf of a company or organisation, the legal basis is our legitimate interest in answering the request (Art. 5(2)(f)).

Where the request came from. The page you sent the form from, the site language, the first page you opened and where you came from, such as a search engine, a social network or a campaign tag. This reaches us only if you send the form. We use it to see which pages bring in requests, based on our legitimate interest (Art. 5(2)(f)).

Security. The IP address and browser details you send the form from appear in the request email. Cloudflare Turnstile also processes your IP address and browser details to check for bots. We use this to block automated submissions, check suspicious requests and, if needed, show when a request was sent. The legal bases are our legitimate interest (Art. 5(2)(f)) and establishing, exercising or protecting a right (Art. 5(2)(e)).

Site visits. The hosting service's access logs record the IP address, browser details, the page opened and the time. We use them to run the site and spot attacks, based on our legitimate interest (Art. 5(2)(f)).

Language choice. If you pick a language in the language menu, we store it so the site opens in that language next time, based on our legitimate interest (Art. 5(2)(f)).

Legal duties. We may use the relevant records to answer requests from the authorities (Art. 5(2)(ç)).

Please do not put identity or passport numbers, health information or passenger lists in the message. We do not need them for a quote. If your request turns into a booking, we will tell you separately about the data processed at that stage.

3. How we collect data

We collect data electronically and by automated means, from what you type into the forms and from the information your browser sends to the site. The legal bases are listed in section 2.

4. Who we share data with

We do not sell your data. We share it only with the recipients below, and only as far as the purposes in section 2 need.

  • Our service providers: Amazon Web Services, which hosts the site and delivers your request to us by email, Cloudflare, which protects the form, and our email service provider. Their servers may be outside Türkiye.
  • Our business partners: Our business partners in Türkiye (intermediary companies, accommodation and service providers), for quotes and bookings.
  • Authorities: Courts and bodies with legal powers, as far as they require.

5. Cookies and browser storage

The site has no analytics, advertising or tracking cookies.

  • seda-turizm-lang (cookie): Stores the language you pick in the language menu for 1 year.
  • seda-lead-source (session storage): Stores the first page you opened and where you came from. It is deleted when you close the tab.
  • Cloudflare Turnstile: Loads on pages with a form to check for bots.

6. How long we keep data

  • Requests and correspondence: We keep them for as long as we need to answer your request and carry out any booking or contract, and for the periods the law requires. The IP address and browser details in the request email are kept for the same time.
  • Hosting access logs: For as long as the site is hosted.
  • Language cookie: 1 year. Session storage: Until you close the tab.

7. Your rights

Under Article 11 of the KVKK you can ask us:

  • whether we process your data
  • for information about it if we do
  • why we process it and whether we use it for that purpose
  • who we have shared it with in Türkiye or abroad
  • to correct it if it is incomplete or wrong
  • to delete or destroy it under the conditions in Article 7 of the KVKK
  • to tell the recipients about any correction or deletion
  • to object to a result against you that comes solely from automated analysis
  • for compensation if you suffer loss because of unlawful processing

8. How to contact us about your data

You can send your request in one of these ways:

Please include your full name and your address for correspondence. Turkish citizens should add their Turkish ID number, others their nationality and passport number. Add your email and phone number if you have them, and describe your request. A written request must be signed.

We will reply free of charge within 30 days at the latest. If the request involves an extra cost, we may charge the fee set by the Board.

If we refuse your request or do not reply in time, or if you find our reply unsatisfactory, you can complain to the Turkish Personal Data Protection Board. You must do this within 30 days of learning our reply, and in any case within 60 days of your request.

9. If you write from the EU or the UK

If the GDPR or UK GDPR applies to your request, we process your data to take steps at your request before a contract (GDPR Art. 6(1)(b)) and for our legitimate interests (Art. 6(1)(f)). You can also ask to receive your data or have it passed to someone else. You can object to processing based on legitimate interests and complain to the data protection authority in your country.