Turlago
Privacy Notice

Privacy Notice (KVKK)

Last updated: 4 October 2026

In short

Turlago is the data controller for your personal data.
We process your data to handle your booking and meet our legal obligations; marketing messages and advertising cookies are used only with your consent.
We never sell your data; we share it only with the partners providing your service, and only as far as necessary.
We answer requests about your rights free of charge within 30 days.

Data controller

This notice is provided under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform you about the personal data processed through the turlago.com website and our mobile apps.

The data controller is Turlago Global Turizm ve Denizcilik Ticaret Limited Şirketi ("Turlago"), whose details are given below.

Legal name: Turlago Global Turizm ve Denizcilik Ticaret Limited Şirketi
MERSIS no: 0871130279400001
Address: Kocatepe Mahallesi, Recep Paşa Caddesi, İç Kapı: Selçuk Apartmanı No:9 No: 14, 34437 Beyoğlu/İstanbul
E-mail: info@turlago.com
KEP (registered e-mail): turlagoglobal@hs01.kep.tr

What personal data do we process?

Identity: Name, surname, date of birth; where required by law (e.g. international tours, passenger notifications), Turkish ID or passport number.
Contact: Phone number, e-mail address, postal address.
Traveller details: Name, age or date of birth and, where required, ID details of the people you book for.
Customer transactions: Booking, cart, favourites, cancellation, refund and support records; your reviews and ratings.
Financial: Payment amounts and invoice details. Card details are processed only by the payment institution and are not stored on Turlago systems.
Transaction security: IP address, device and browser information, session and log records.
Marketing: Your commercial message consent, cookie preferences and, if you consent, data collected by analytics and advertising cookies.
Location: Only in the mobile app, and only if you allow it.

If you book on behalf of others, please let them know about this notice.

Why and on what legal basis do we process it?

Making and managing your booking: Availability checks, booking and payment, passing the booking to the service provider, changes, cancellations and refunds. Legal basis: performance of a contract (KVKK Art. 5/2-c).
Account management: Sign-up, sign-in, password reset, favourites. Legal basis: performance of a contract (Art. 5/2-c).
Customer support: Answering your questions, requests and complaints. Legal basis: performance of a contract and legitimate interest (Art. 5/2-c, f).
Legal obligations: Invoicing and accounting records, statutory notifications, requests from authorities. Legal basis: expressly provided by law and legal obligation (Art. 5/2-a, ç).
Security: Account and payment security, fraud prevention, keeping log records. Legal basis: legal obligation and legitimate interest (Art. 5/2-ç, f).
Protecting our rights: Establishing, exercising or defending legal claims. Legal basis: Art. 5/2-e.
Campaigns and newsletter: Offers sent by e-mail, SMS or notification. Legal basis: explicit consent (Art. 5/1) and commercial message consent under Law No. 6563. You can withdraw your consent at any time.
Analytics and advertising cookies: Measuring site usage and showing relevant ads. Legal basis: explicit consent (Art. 5/1). See our Cookie Policy for details.

How do we collect your data?

Your personal data is collected electronically, partly by automated and partly by non-automated means, through sign-up, booking, payment and contact forms on our website and mobile apps, through phone and e-mail conversations, and through cookies.

Who do we share your data with?

Service providers: The boat owner or operator, car rental company, tour operator or agency fulfilling your booking; only the details needed to provide the service (name, contact details, booking details).
Payment institutions and banks: To take payments and process refunds.
Technical service providers: Servers and hosting, e-mail and SMS delivery, notification infrastructure; acting on our behalf and within our instructions.
Advisers: Accountants, lawyers and auditors, for legal obligations and to protect our rights.
Public authorities: Where required by law or upon a lawful request.

Servers of Google, Meta and TikTok (analytics and advertising) and of some infrastructure services may be located outside Türkiye. Transfers abroad are made in line with Article 9 of the KVKK; for analytics and advertising cookies they rely solely on your explicit consent.

How long do we keep your data?

We keep personal data for as long as the purpose of processing requires and for the periods set by law. For example, invoices and accounting records are kept for 10 years as required by law; account details are kept while your account remains open.

When the retention period ends, data is deleted, destroyed or anonymised.

Your rights under Article 11 of the KVKK

To learn whether your personal data is processed,
To request information if it has been processed,
To learn the purpose of processing and whether it is used accordingly,
To know the third parties in Türkiye or abroad to whom it is transferred,
To request correction if it is incomplete or inaccurate,
To request deletion or destruction under the conditions of Article 7 of the KVKK,
To request that corrections, deletions or destructions be notified to the third parties it was transferred to,
To object to a result against you arising solely from automated analysis,
To claim compensation for damages caused by unlawful processing.

How to make a request

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your request in writing to our address, to our KEP (registered e-mail) address, or to info@turlago.com from the e-mail address registered in our system.

Your request should include your name and surname, Turkish ID number (for foreign nationals, nationality and passport number), postal address for notifications, e-mail and phone number if any, and the subject of your request.

We will conclude your request free of charge within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your request is rejected, you find the answer insufficient or we do not reply in time, you may lodge a complaint with the Board.

Write to us

Changes to this notice

We update this notice when our processing activities change. The current version is always published on this page, with the last updated date at the top.