Privacy Policy

Tolira operates toliratours.com. We are the data controller for the activities described in this policy. This means we are responsible for deciding how your personal data is used. Under Turkish law, this role is called veri sorumlusu under KVKK.

For any question about your data, or to use any of the rights explained below, write to info@toliratours.com or use the contact form and say that the message is about privacy. We read your message ourselves.

What you give us

• Enquiries and quotes: your name, email address, phone number and whatever you write in the message.
• Bookings: the lead traveller's contact details, plus each traveller's name, age band and, where an airline or a hotel requires it, date of birth, nationality and passport number.
• Account: your name, email address, a cryptographic hash of your password (a protected version that cannot be read as your password), and anything you save, such as traveller profiles and trip designs.
• What you write to us: messages, reviews and correspondence, including anything you type into the trip planner.

What we record as you use the site

• Technical logs: IP address, browser and device type, the pages requested and when. We keep these records for security and to find the cause of technical problems.
• Preferences: the currency you chose and what is in your cart.
• Help centre searches: the words typed into the search box on a FAQ page, stored without anything that identifies you. These search terms help us find questions that our help pages do not yet answer.
• Analytics: combined page statistics, where analytics is switched on. See the cookies section.

Each way we use your data has a legal basis under the GDPR. A legal basis is the reason the law allows us to use that data. KVKK recognises equivalent legal grounds.

The Turkey trip planner builds an itinerary from what you type into it. To do that, your dates, the number of travellers, the places you named and the wishes you wrote are sent to a third-party AI provider, along with our own catalogue and operating rules. That provider processes the request outside Turkey and returns the itinerary. It is not permitted to use your text to train its models.

Please do not type passport numbers, card details, health information or anything else sensitive into the planner. It does not need them, and the booking form is where traveller details belong.

How long we keep your trip design depends on whether you were signed in when you made it. A design saved to an account is kept until you delete it, and appears under Trip designs. A design made as a guest is temporary and is cleared automatically after about 48 hours, because a guest has no page to come back to. We keep a design if you have booked it, added it to your cart or sent it to us to review. This applies whether you were signed in or using the site as a guest.

The planner does not decide anything about you. It suggests an itinerary and a price. You can always ask us for help instead.

• Essential cookies keep you signed in, remember your cart and protect forms against abuse. The site cannot work without them.
• Preference cookies remember the currency you chose, so you do not pick it again on every visit.
• Analytics cookies tell us which pages are useful. We receive combined statistics and do not use them to identify you.

You can block or delete cookies in your browser at any time. Blocking the essential ones will stop parts of the site working, including the cart and signing in.

• Travel suppliers. Hotels, airlines, transfer companies, guides and activity operators receive the traveller details needed to deliver their part of your booking, and nothing beyond that.
• Our bank. Processes your card payment under its own regulated terms.
• The AI provider behind the trip planner, as described above, and only for what you typed into it.
• Service providers. Hosting, email delivery and error monitoring, each acting on our written instructions and allowed to use the data only for those instructed services.
• Authorities, when we must share information under a law, a court order or a border control requirement.

We do not sell personal data, we do not share it with advertisers, and we do not pass it to anyone for their own marketing.

Your data is processed in Turkey, where the trip takes place, and in the EU and the EEA by our hosting and email providers. The AI provider behind the trip planner processes requests outside both.

When we send data to another country, we use safeguards provided by the GDPR and KVKK. These include protections in our contracts with each provider. To provide your booked trip in Turkey, we must send the necessary details to suppliers in Turkey. This sharing is required for the booking and is not optional.

• Enquiries that never became a booking: up to two years, so a follow-up question can still be answered.
• Bookings, invoices and payment records: for as long as Turkish tax and commercial law requires, which is typically ten years.
• Accounts: until you delete yours. Deleting an account makes your personal details anonymous and removes saved traveller profiles. We keep only the information that must remain in the records listed above.
• Guest trip designs: about 48 hours. Designs saved to an account stay until you remove them.
• Technical logs: replaced on a schedule measured in weeks. We keep a log longer if it is needed for an ongoing security investigation.
• Help centre searches: kept as aggregated counts, with no identifier attached to them.

We use TLS encryption to protect information as it travels between your browser and this site. Passwords are stored only as salted cryptographic hashes, which means we cannot read yours and will never send it to you. Card data is never stored on our systems.

Access to booking data inside Tolira is limited to the people whose work needs it, and administrative access is separately protected.

No system is perfect. If a data breach put your rights at risk, we would tell you and the responsible authority within the legal deadline. We would explain what happened and what action to take.

Under the GDPR, and under KVKK for residents of Turkey, you may at any time:

• Ask for a copy of the personal data we hold about you. Your account page will export it for you without waiting for us.
• Correct anything that is wrong or incomplete.
• Delete your data, when we have no legal duty to keep it. Your account page has a deletion tool.
• Object to processing we base on legitimate interest, and withdraw consent for marketing with one click in any email we send.
• Ask us to restrict processing while a dispute about it is resolved.
• Complain to your national data protection authority, and in Turkey to the Personal Data Protection Authority.

Write to info@toliratours.com from the address on your booking, and include enough for us to identify you: the name on the booking and the reference if you have one. We need to confirm which account or booking the request belongs to. We cannot safely act on it until we can make that connection. We answer within one month, usually much sooner, and we do not charge for it.

Accounts and bookings are for adults. We collect a child's details, meaning name, age and where required passport data, only for a booking made by a parent or guardian. We collect these details only because airlines, hotels and authorities require them.

We do not market to children and we do not knowingly collect data from them directly.

When this policy changes, the new version is published here with an updated date. If a change has a significant effect on how we use data we already hold, we email the people affected wherever we reasonably can. We do this so you do not have to discover the change yourself.