Privacy Policy
Last updated: 16 September 2026
At rotanur.com we care about the privacy of your personal data. This policy explains which personal data we process when you visit our site, leave a reservation or order request, or write to us; why and on what legal basis we process it; who we share it with; how long we keep it; and how you can exercise your rights. Cookies are covered in our Cookie Policy, and the notice required by Turkish Personal Data Protection Law No. 6698 (KVKK) is our Data Protection (KVKK) Notice.
1. Data controller
Site owner and data controller: Markention Dijital Pazarlama San. ve Tic. Ltd. Şti. (RotaNur brand)
Address: Cevizli Mah. Zuhal Cad. Ritim İstanbul A5 Blok No:46E/179, 34846 Maltepe / Istanbul, Türkiye
Tax: Kartal Tax Office, tax ID 6121767816
Phone: +90 534 050 72 71 · Email: [email protected]
2. What personal data we process
- Identity: Your first and last name. Once your booking is confirmed, and only as far as tour, visa and invoicing procedures require: your date of birth, nationality, Turkish ID number or passport details.
- Contact: Your phone number, email address, preferred contact channel and, for product orders, your delivery and billing address.
- Customer transaction: The tours or products you request, the date, departure city, number of travellers, room type, your notes, the request and order number, the status of your request and payment record details (amount, date, method).
- Travel documents: A copy of your passport, a passport photo and similar documents required for visa and registration procedures.
- Special categories of data: Health documents such as a vaccination card where visa or health rules require them, and any health information you choose to write in a notes field. By their nature, hajj and umrah services may also reveal your religious belief. We process such data only for the service you request and in line with Article 6 of the KVKK.
- Transaction security: Your IP address, browser and device details, server access logs and the record of the consent you gave in the request form, kept with its date and IP address.
- Usage and advertising data (only with your consent): Cookie IDs, the pages you visit, actions on the site (adding to cart, sending a request, clicking WhatsApp, phone or email links), approximate location, device type and the source that brought you to the site.
- Correspondence: Information you share with us over WhatsApp, email and phone.
No online payment is taken on our site and no card details are requested, so your card details are neither processed nor stored on our site.
3. How we collect data
We collect personal data through site forms such as the cart and reservation page, the tour request form and the contact form; through WhatsApp, phone and email; through conversations with our advisors; through cookies and similar technologies; and through server logs. Data is collected by fully or partly automated means and by non-automated means as part of a filing system.
4. Purposes and legal bases
| Purpose | Legal basis (KVKK) |
|---|---|
| Receiving your reservation or order request, contacting you, confirming the programme and availability | Conclusion and performance of a contract (Art. 5(2)(c)) |
| Running the tour: flights, accommodation, transfers, insurance and visa procedures | Conclusion and performance of a contract (Art. 5(2)(c)); Art. 9 for transfers abroad |
| Preparing and delivering product orders | Conclusion and performance of a contract (Art. 5(2)(c)) |
| Issuing invoices, keeping accounting and tax records, meeting consumer law obligations | Legal obligation (Art. 5(2)(ç)) |
| Handling requests, complaints, cancellations and returns; protecting our rights in disputes | Establishment, exercise or protection of a right (Art. 5(2)(e)) and legitimate interest (Art. 5(2)(f)) |
| Keeping the site secure and preventing spam and abuse | Legitimate interest (Art. 5(2)(f)); legal obligation for server logs (Art. 5(2)(ç)) |
| Measuring how the site is used and improving our services (Google Analytics 4) | Explicit consent (Art. 5(1)) |
| Showing and personalising ads (Google AdSense) | Explicit consent (Art. 5(1)) |
| Sending campaign and information messages | Only if you give separate consent (Law No. 6563 and Art. 5(1)) |
| Processing special categories of data such as health documents | The conditions in Art. 6; explicit consent where required |
We do not make automated decisions about you that have legal effects.
5. Google Analytics 4 and consent mode
We use Google Analytics 4, a service of Google LLC, to understand how our site is used. Google Analytics runs with Google’s Consent Mode. Until you consent to analytics cookies, Google Analytics is not loaded, no cookie is set and no measurement data is sent to Google.
Once you consent, we measure the pages you visit, time spent on the site, your device and browser type, your approximate location (country and city level), the source that brought you to the site and certain actions, together with pseudonymous cookie IDs. These actions are sending a reservation or order request, adding a product to the cart and clicking a WhatsApp, phone or email link. Your IP address is used to estimate your approximate location; according to Google, Google Analytics 4 does not log or store IP addresses.
Event-level data is kept for the period set in our Google Analytics settings, up to 14 months. We review reports in aggregate and statistical form and do not try to identify you from this data. You can withdraw your consent at any time with the “Cookie preferences” link at the bottom of every page. To stop Google Analytics measurement on all sites, you can use the Google Analytics opt-out browser add-on.
6. Google AdSense and third-party advertising cookies
We may show ads on this site through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. Google processes the data it obtains through these cookies under its own privacy policy.
- Your consent: For visits from Türkiye and from outside Europe, no ad request is sent unless you consent to advertising cookies. If you consent, ads may be personalised to your interests. Visitors from the European Economic Area, the United Kingdom and Switzerland give their choices through Google’s certified consent management platform.
- Turning off personalised ads: You can turn off personalised advertising in Google Ads Settings. You can opt out of third-party vendors’ use of cookies for personalised advertising at www.aboutads.info and, in Europe, at www.youronlinechoices.eu.
- How Google uses data: Google explains how it uses information from sites that use its services.
7. Other third-party services
- Hosting: Our site and its database are hosted on servers of Hostinger International Ltd. in Germany.
- Content delivery and security: Traffic to the site passes through the infrastructure of Cloudflare, Inc. Cloudflare processes your IP address and request details to protect the site from attacks and to deliver it quickly.
- Email: Emails sent to [email protected] are kept in the mailbox on our server and are also forwarded to our business email account on Google LLC infrastructure.
- Fonts and map: The fonts on the site are loaded from Google Fonts, and the map on our contact page from Google Maps. Your IP address is sent to Google when they load.
- WhatsApp: When you write to us on WhatsApp, your messages are also processed on the WhatsApp (Meta Platforms) infrastructure and WhatsApp’s own privacy policy applies.
- External links: When you click a link to another site, such as umrah financing information, that site’s own privacy policy applies.
8. Sharing and transfers
Within Türkiye: As far as the service requires, we share personal data with: the travel agency and tour service providers we run tours with; airline, accommodation, transfer and insurance companies; the courier company for product deliveries; business partners who provide us with accounting, legal and IT services; and authorised public bodies, courts and administrative authorities where the law requires. For hajj, registration follows the rules of the Presidency of Religious Affairs (Diyanet).
Transfers abroad: Because of the nature of the service, some data is transferred abroad. The recipients are: hotel, transfer and guiding service providers in Saudi Arabia and in countries on the tour route; the official authorities and platforms that handle visa and registration procedures; airlines; Hostinger International Ltd., which hosts our site (servers in Germany); Cloudflare, Inc.; Google LLC and its affiliates for email, analytics, advertising, map and font services; and WhatsApp (Meta Platforms).
Transfers abroad are made under Article 9 of the KVKK, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:
- Where one of the processing conditions in Article 5 or 6 of the KVKK exists and the Personal Data Protection Board has issued an adequacy decision for the destination country, sector within that country or international organisation, the transfer relies on that decision.
- Where there is no adequacy decision, the transfer relies on one of the appropriate safeguards in Article 9(4) of the KVKK, such as the standard contract announced by the Board, provided that data subjects can also exercise their rights and access effective legal remedies in the destination country. Signed standard contracts are notified to the Personal Data Protection Authority within five business days of signature.
- Where there is neither an adequacy decision nor an appropriate safeguard, we rely on the exceptions in Article 9(6) of the KVKK only for incidental transfers, meaning transfers that are not regular or repeated. Examples are transfers that are necessary to perform our contract with you, such as visa and accommodation procedures, and your explicit consent given after you have been informed of the possible risks.
9. Retention periods
| Data | Retention period |
|---|---|
| Contract, invoice and accounting records for confirmed bookings and orders | 10 years (Turkish Commercial Code Art. 82 and Tax Procedure Law Art. 253) |
| Unconfirmed reservation and order requests and request form records, including the consent record in the form | 1 year after the request is closed |
| Passport copies, passport photos and visa documents | No later than 6 months after the tour ends, or longer if the law requires |
| WhatsApp, email and phone correspondence | The same period as the related booking, order or request record |
| Server access and security logs | Up to 2 years |
| Google Analytics event data | Up to 14 months |
| Cookies | The periods in our Cookie Policy |
When the retention period ends, or the reason for processing no longer exists, personal data is deleted, destroyed or anonymised. If a dispute, audit or investigation is ongoing, the related records may be kept until it is concluded.
10. Data security
Our site uses an encrypted HTTPS connection. Only authorised staff and service providers who need personal data for their work can access it. If we detect unauthorised access, loss or a leak, we notify the people affected and the Personal Data Protection Board within the period set by law, under Article 12 of the KVKK.
11. Your rights and how to apply
Under Article 11 of the KVKK, you can apply to us to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether the data is used for that purpose,
- know the third parties in Türkiye or abroad to whom your data is transferred,
- ask for incomplete or inaccurate data to be corrected,
- ask for your data to be deleted or destroyed under the conditions in Article 7 of the KVKK,
- ask for corrections, deletions and destructions to be notified to the third parties who received your data,
- object to an outcome against you that results from analysis of your data solely by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
Where processing relies on your explicit consent, you can withdraw it at any time. You can change your cookie consent with the “Cookie preferences” link at the bottom of every page.
How to apply: Send your application in Turkish: in writing to our address above together with a document proving your identity, signed with a secure electronic or mobile signature, or from the email address you gave us before and that is registered in our system, to [email protected]. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your first and last name, your signature for written applications, your Turkish ID number (for foreign nationals: nationality and passport or ID number), your address for notifications, your email address if any, your phone number and the subject of your request.
We conclude applications free of charge as soon as possible and within 30 days at the latest. If the process involves an additional cost, a fee set by the Personal Data Protection Board may be charged. If your application is rejected, if you find our answer insufficient or if we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application.
12. Children’s data
Our site is not directed at people under 18. For family tours, the details of travellers under 18 are provided by their parents or guardians and are processed only to organise the tour.
13. Changes
We may update this policy when the law or our services change. The current version is always published on this page, with the date at the top. For questions, email [email protected] or message us 24/7 via the WhatsApp button on the page.
Language: This English text is a translation. If the Turkish and English versions differ, the Turkish Gizlilik Politikası prevails.
