Data Protection (KVKK)
Last updated: 16 September 2026
This notice is provided under Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how we process the personal data you give us on rotanur.com and in your correspondence with us. For more detail, see our Privacy Policy and Cookie Policy.
1. Data controller
Data controller: Markention Dijital Pazarlama San. ve Tic. Ltd. Şti. (RotaNur brand)
Address: Cevizli Mah. Zuhal Cad. Ritim İstanbul A5 Blok No:46E/179, 34846 Maltepe / Istanbul, Türkiye
Tax: Kartal Tax Office, tax ID 6121767816
Phone: +90 534 021 47 45 · Email: info@rotanur.com
2. Personal data we process
- Identity: First and last name; where required, date of birth, nationality, Turkish ID number and passport details.
- Contact: Phone, email and contact preference; for product orders, delivery and billing address.
- Customer transaction: Requested tours and products, date, departure city, number of travellers, room type, notes, request and order details, payment record.
- Travel documents: Passport copy, passport photo and documents required for the visa.
- Special categories of data: Where required, health documents such as a vaccination card, health information you choose to write in a notes field, and information on religious belief that follows from the nature of hajj and umrah services. We process such data only under the conditions in Article 6 of the KVKK.
- Transaction security: IP address, browser and device details, server logs and the request form consent record, kept with its date and IP address.
- Usage and advertising data (only with your consent): Cookie IDs, page and interaction data, approximate location, device type and traffic source.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK) |
|---|---|
| Receiving your umrah, hajj, culture tour and product requests, contacting you, concluding and performing the contract | Art. 5(2)(c) |
| Handling flights, accommodation, transfers, insurance and visa procedures | Art. 5(2)(c); Art. 9 for transfers abroad |
| Meeting invoicing, accounting, tax and consumer law obligations | Art. 5(2)(ç) |
| Handling requests, complaints, cancellations and returns; protecting our rights in legal disputes | Art. 5(2)(e) and Art. 5(2)(f) |
| Keeping information secure and preventing abuse | Art. 5(2)(f); Art. 5(2)(ç) for server logs |
| Measuring site use (Google Analytics 4) | Explicit consent (Art. 5(1)) |
| Showing and personalising ads (Google AdSense) | Explicit consent (Art. 5(1)) |
| Processing special categories of data | The conditions in Art. 6; explicit consent where required |
4. How we collect data
We collect personal data through the cart, reservation, tour request and contact forms on our site, through WhatsApp, phone and email, through conversations with our advisors, and through cookies and server logs, by fully or partly automated means and by non-automated means as part of a filing system.
5. Analytics and advertising cookies
- Google Analytics 4: Runs with Google’s Consent Mode. Until you give explicit consent to analytics cookies, Google Analytics is not loaded and no measurement data is sent to Google. Once you consent, page view and interaction data is measured with pseudonymous cookie IDs, and event data is kept for up to 14 months.
- Google AdSense: We may show Google AdSense ads on this site. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. For visits from Türkiye and from outside Europe, no ad request is sent unless you consent to advertising cookies. You can turn off personalised ads in Google Ads Settings, and opt out of third-party cookies at www.aboutads.info and www.youronlinechoices.eu.
- Your choices: You can change or withdraw your consent at any time with the “Cookie preferences” link at the bottom of every page.
6. Transfers
Within Türkiye: Limited to the purposes above, data is transferred to the travel agency and tour service providers we run tours with; to airline, accommodation, transfer, insurance and courier companies; to business partners providing accounting, legal and IT services; and, where the law requires, to authorised public bodies (including the Presidency of Religious Affairs for hajj registration), courts and administrative authorities.
Abroad: Data is transferred to hotel, transfer and guiding service providers in Saudi Arabia and on the tour route; to the official authorities and platforms that handle visa and registration procedures; to airlines; to Hostinger International Ltd., which hosts our site (servers in Germany); to Cloudflare, Inc.; to Google LLC and its affiliates for email, analytics, advertising, map and font services; and, for WhatsApp correspondence, to the WhatsApp (Meta Platforms) infrastructure.
Transfers abroad follow Article 9 of the KVKK as amended by Law No. 7499. A transfer relies first on an adequacy decision of the Personal Data Protection Board. Where there is none, it relies on one of the appropriate safeguards in Article 9(4), such as the standard contract announced by the Board; signed standard contracts are notified to the Personal Data Protection Authority within five business days. Where neither exists, we rely on the exceptions in Article 9(6) only for incidental transfers. These exceptions include transfers necessary to perform the contract and explicit consent given after being informed of the risks.
7. Retention periods
- Contract, invoice and accounting records for confirmed bookings and orders: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
- Unconfirmed requests and request form records: 1 year after the request is closed.
- Passport copies, photos and visa documents: no later than 6 months after the tour ends, or longer if the law requires.
- Server access and security logs: up to 2 years. Google Analytics event data: up to 14 months. Cookies: the periods in our Cookie Policy.
When the period ends, or the reason for processing no longer exists, your data is deleted, destroyed or anonymised.
8. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed and, if so, to request information about it; to learn the purpose of processing and whether the data is used for that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to ask for incomplete or inaccurate data to be corrected; to ask for deletion or destruction under the conditions in Article 7; to ask for these actions to be notified to the third parties who received the data; to object to an outcome against you that results solely from automated analysis; and to claim compensation for damage caused by unlawful processing. Where processing relies on your explicit consent, you can withdraw it at any time.
9. How to apply
Send your application in Turkish: in writing to our address above together with a document proving your identity, signed with a secure electronic or mobile signature, or from the email address you gave us before and that is registered in our system, to info@rotanur.com. Your application must include your first and last name, your signature for written applications, your Turkish ID number (for foreign nationals: nationality and passport or ID number), your address for notifications, your email address if any, your phone number and the subject of your request.
We conclude applications free of charge as soon as possible and within 30 days at the latest; if the process involves an additional cost, the fee set by the Board may be charged. If your application is rejected, if you find our answer insufficient or if we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application.
Language: This English text is a translation. If the Turkish and English versions differ, the Turkish KVKK Aydınlatma Metni prevails.
