Personal Data Protection
Sativa Tour & Travel considers the lawful, secure, proportionate and transparent protection of personal data belonging to guests, visitors, employees, suppliers and business partners to be one of its fundamental responsibilities.
1. Our approach to data protection
Personal data means any information relating to an identified or identifiable natural person. Obtaining, recording, storing, altering, disclosing, transferring, classifying, deleting or restricting access to personal data constitutes processing.
We process personal data only for specified, explicit and legitimate purposes, on an applicable legal basis and to the extent necessary for the relevant purpose.
2. Our fundamental processing principles
3. Categories of personal data
Identity data
Name, surname, date of birth and, where required, identity, passport and travel-document details.
Contact data
Telephone number, email address, postal address and preferred communication channel.
Customer transaction data
Booking, participant, service, request, amendment, cancellation and complaint records.
Financial data
Payment status, billing, refund and bank-transfer transaction information.
Transaction security data
IP address, session, access, confirmation, contract version and security records.
Legal transaction data
Applications, disputes, legal requests and communications with competent authorities.
Special categories of personal data
Health, disability, allergy, mobility or similar sensitive information is processed only where necessary for travel safety, accessibility or compliance with a legal obligation and subject to the conditions of Article 6 of the KVKK.
4. Purposes of processing
- Receiving tour and travel-service requests;
- Creating, verifying and managing bookings;
- Preparing participant lists and operational plans;
- Coordinating accommodation, transportation and transfers;
- Processing payments, refunds, invoices and accounting records;
- Providing reservation and service notifications;
- Responding to customer requests and complaints;
- Maintaining passenger and tour safety;
- Keeping contractual acceptance and transaction records;
- Preventing fraud, unauthorised access and misuse;
- Complying with legal obligations and defending legal rights;
- Sending marketing communications only where the necessary permission exists.
5. Legal grounds
Personal data is processed on one or more of the legal grounds provided by Articles 5 and, where applicable, 6 of the KVKK, including:
- Processing expressly provided for by law;
- Necessity for the establishment or performance of a contract;
- Compliance with a legal obligation;
- Processing of data made public by the data subject in accordance with that intention;
- Necessity for the establishment, exercise or protection of a legal right;
- Legitimate interests that do not prejudice fundamental rights and freedoms;
- Explicit consent where no other applicable processing condition exists.
Not all processing depends on explicit consent. Where another statutory legal ground applies, processing is based on that ground. Consent may be withdrawn prospectively at any time.
6. Data transfers
Personal data may be transferred, only to the extent necessary, to:
- Accommodation, transport, transfer and tour-service providers;
- Banks and authorised payment service providers;
- Accounting, legal, information-technology, hosting and support providers;
- Insurers and relevant service partners;
- Courts, public authorities and other legally authorised bodies.
Where a transfer outside Türkiye is necessary, it will be conducted under one of the conditions and appropriate safeguards set out in Article 9 of the KVKK.
7. Retention and disposal
Personal data is retained with regard to applicable statutory periods, the duration of the contractual relationship, limitation periods, dispute-management requirements and the processing purpose.
Once all grounds requiring processing cease to exist, data is deleted, destroyed or anonymised in accordance with applicable law and authorised Company procedures.
8. Data security
Under Article 12 of the KVKK, the Company implements appropriate technical and administrative measures designed to:
- Prevent unlawful processing of personal data;
- Prevent unlawful access to personal data;
- Ensure the secure preservation of personal data.
Measures may include access controls, account security, transaction records, software and security controls, backups, personnel awareness, supplier obligations and incident-management procedures, as appropriate to the relevant data and risk.
9. Your rights under the KVKK
Under Article 11 of the KVKK, you may request:
- Confirmation as to whether your personal data is processed;
- Information concerning processing;
- The purpose of processing and whether data is used accordingly;
- Information about recipients in Türkiye or abroad;
- Correction of incomplete or inaccurate data;
- Deletion or destruction where the statutory conditions are met;
- Notification of correction or deletion to relevant recipients;
- An objection to an adverse result arising exclusively from automated analysis;
- Compensation for damage caused by unlawful processing.
10. Our data protection documents
Applications and contact
You may use the KVKK Data Subject Application Form to obtain information or exercise your rights concerning personal data.
Applications are concluded as soon as possible and no later than 30 days, depending on their nature. Proportionate additional information may be requested to verify identity and authority. This English version is provided for information; the Turkish text and Turkish law prevail.