Privacy Policy
Last updated: 10 August 2026
Ephesus Private Tours is operated by TUNCHER TURİZM LİMİTED ŞİRKETİ, a limited liability company registered in Türkiye and licensed by the Association of Turkish Travel Agencies (TÜRSAB) under the agency title Tuncher Prive Tourism Agency, licence document no. 18210, based in Kuşadası, İzmir, Türkiye. This Privacy Policy explains what personal data we collect when you visit tunchertourism.com or contact us about a tour, how we use it, who we share it with, and what rights you have over it.
We have written this policy to meet the requirements of Turkey’s Law on the Protection of Personal Data No. 6698 (KVKK) and, because we welcome visitors from the European Union and United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR. Where the two frameworks use different language for similar ideas, we explain both.
Who we are
The data controller responsible for your personal data is TUNCHER TURİZM LİMİTED ŞİRKETİ, a limited liability company registered in Türkiye, trading as Ephesus Private Tours and licensed by the Association of Turkish Travel Agencies (TÜRSAB) under the agency title Tuncher Prive Tourism Agency, licence document no. 18210.
You can reach us by email at info@tunchertourism.com or by WhatsApp/phone at +90 542 307 0236. The same email address should be used for any question or request about your personal data.
- Registered address: Cumhuriyet Mah. 1595 Sk. Kazım Sop No: 223, İç Kapı No: 303, Karşıyaka / İzmir, Türkiye.
- MERSIS number: 0865033286400001.
- Trade registry number: 259617, İzmir Ticaret Sicili Müdürlüğü (İzmir Trade Registry Directorate).
What information we collect
We collect the following categories of personal data:
- Enquiry and booking data you give us directly, through our website enquiry form or over WhatsApp: your name, email address, phone number, ship name, tour date, number of guests, the tour you selected, and any message you add.
- The content of messages you send us on WhatsApp, including any details or attachments you choose to share with us.
- Payment information, where you choose to pay online. We never receive or store your card details: where you pay by link, your card details are entered directly on the payment provider’s secure page. If you pay by bank transfer instead, we receive the payment details that accompany the transfer, such as your name, bank, and account or IBAN reference, from our own bank records.
- Technical and usage data collected automatically while you browse our website, such as your IP address, device and browser type, approximate location, and the pages you view. We gather this through Google Analytics.
How we use your information
We only use your personal data for the purposes set out below, and we do not sell it. The table shows what we use it for, which data is involved, and the legal basis we rely on under both GDPR and KVKK.
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to your enquiry and arranging your tour | Name, email, phone, ship name, tour date, guest count, tour selected, message | GDPR Art. 6(1)(b) – steps taken at your request prior to, and performance of, a contract. KVKK Art. 5(2)(c) – necessary for the establishment or performance of a contract. |
| Running your booked tour, including guide and driver pickup arrangements | Name, guest count, ship name, pickup details | GDPR Art. 6(1)(b) – contract performance. KVKK Art. 5(2)(c) – necessity for performance of a contract. |
| Processing your payment, where you choose to pay online | Payment and transaction details | GDPR Art. 6(1)(b) – contract performance, and Art. 6(1)(c) – legal obligation for tax and accounting records. KVKK Art. 5(2)(c) – necessity for performance of a contract, and Art. 5(2)(ç) – compliance with a legal obligation. |
| Keeping our website secure and working correctly | IP address, device and browser data | GDPR Art. 6(1)(f) – our legitimate interests. KVKK Art. 5(2)(f) – legitimate interests of the controller. |
| Understanding how visitors use our site (analytics) | IP address, device, browser, pages viewed, via Google Analytics | GDPR Art. 6(1)(f) – our legitimate interests in measuring and improving the site. KVKK Art. 5(2)(f) – legitimate interests of the controller. |
| Advertising and measuring the performance of our ads | Technical and usage data collected via advertising cookies, through Google Ads | GDPR Art. 6(1)(a) – your consent. KVKK Art. 5(1) – explicit consent. |
International data transfers
Some of the organisations listed above, particularly Google, Formspree and Netlify, are based in the United States. This means your personal data is transferred outside Türkiye and outside the European Economic Area.
Under KVKK Art. 9, as amended by Law No. 7499 (in force since 1 September 2024), transferring personal data abroad requires an adequacy decision, appropriate safeguards – such as KVKK-approved standard contractual clauses notified to the Personal Data Protection Board within five business days – or a narrow case-by-case exception. Under GDPR, international transfers rely on the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU–US Data Privacy Framework.
We are honest that this is an area we are still working on: we are in the process of putting the appropriate safeguards in place with each of our processors, and we have not yet completed this with all of them. We will update this policy as that work progresses.
How long we keep your information
We keep your enquiry correspondence for as long as your enquiry is live, and for a reasonable period afterwards in case you contact us again or a question arises about your tour.
Booking and accounting records are kept for as long as Turkish tax and commercial law requires – currently ten years for commercial books under the Turkish Commercial Code.
Analytics data is retained according to the retention setting we have configured in Google Analytics.
In every case, we aim to keep personal data no longer than necessary for the purpose it was collected for.
Your rights under KVKK (Türkiye)
KVKK Art. 11 gives you the right to:
- Learn whether your personal data is being processed.
- Request information about the processing, if it has taken place.
- Learn the purpose of processing and whether your data is used in accordance with that purpose.
- Know the third parties, in Türkiye or abroad, to whom your data is transferred.
- Request correction of incomplete or inaccurate data.
- Request erasure or destruction of your data.
- Request that any correction or erasure be notified to the third parties your data was shared with.
- Object to a result that is to your detriment, produced solely by automated analysis of your data.
- Claim compensation for damage arising from unlawful processing of your data.
Your rights under GDPR (EU and UK)
If you are in the European Economic Area or the United Kingdom, GDPR and UK GDPR give you the following rights over your personal data:
- Access – obtain confirmation that we process your data, and a copy of it.
- Rectification – have inaccurate or incomplete data corrected.
- Erasure – ask us to delete your data where there is no overriding reason for us to keep it. Records we must retain under Turkish tax and commercial law are an exception to this.
- Restriction – ask us to pause processing of your data while a concern you have raised is investigated.
- Data portability – receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
- Objection – object to processing based on our legitimate interests, and object at any time to processing for direct marketing.
- Withdrawal of consent – withdraw your consent at any time where we rely on it, without affecting the lawfulness of processing carried out before you withdrew it.
- Automated decision-making – not be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you. We do not make decisions of this kind.
How to exercise your rights
To exercise any of the rights above, send your request to info@tunchertourism.com.
We may need to verify your identity before acting on a request, particularly for access or erasure requests.
We respond within 30 days as required by KVKK Art. 13, and within one month as required by GDPR Art. 12. If a request is complex, we will let you know that we need more time.
Exercising these rights is free of charge in normal circumstances. If you are unhappy with our response, please see the “How to complain” section below.
How we protect your information
We take proportionate technical and organisational measures to protect your personal data. Our website uses HTTPS encryption, and access to enquiry and booking data is limited to the staff who need it to do their jobs.
No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. We work to keep the risk as low as reasonably possible.
Children’s privacy
Our tours and services are sold to adults, and our website is not directed at children. Where a child joins a tour as part of a family or group, their details are provided to us by the adult making the booking, who is responsible for that information.
How to complain
If you are unhappy with how we have handled your personal data, we would like the chance to put it right – please contact us first at info@tunchertourism.com.
You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). If you are resident in the European Union or United Kingdom, you may instead complain to your local data protection supervisory authority, or, in the UK, to the Information Commissioner’s Office (ICO) at ico.org.uk.
Changes to this policy
We may update this Privacy Policy from time to time, for example if our practices or the law change. The “Last updated” date at the top of this page shows when it was last revised, and we will publish any new version on this page.
Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at info@tunchertourism.com or by WhatsApp/phone at +90 542 307 0236.
This policy is meant to be a clear, honest starting point for how we handle your data. Because KVKK and GDPR compliance is a specialist area, we recommend that it be reviewed by a qualified Turkish lawyer before it is relied upon as a complete legal document.