AIA Travel

Privacy Notice (KVKK) and Cookie Policy

This notice is provided under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK"). Your personal data is processed by the data controller AIA Travel ("AIA Travel", "we").

1. Data controller

  • Address: Bahçelievler Mah. Konyaaltı Cad. Kasapoğlu Apt.
  • E-mail: info@aia-travel.com
  • Phone / WhatsApp: +90 545 823 05 22

2. Personal data we process

  • Booking: full name, phone number, hotel name or the location link you share, hotel area, tour date, number of guests (adults / children / infants), tour language, your note, site language, booking / ticket number.
  • Contact and transfer forms: your name and message, or transfer details (route, date, time, passengers, flight number). These forms do not send data to our server: they open WhatsApp on your device and you send the message yourself.
  • AI assistant: the messages you type and the tour page you are viewing.
  • Technical data: IP address, browser information and a session cookie (see section 8).

We ask only for the data needed for your booking. Payment is not taken on the website. We do not ask for special categories of personal data (such as health data); if you nevertheless write them in the note field, we use them only to provide the service and treat them as shared with your explicit consent — please do not write them unless necessary. Please never enter passport, ID or card numbers in the note field or the assistant.

3. Purposes and legal bases

  • Taking and confirming your booking, issuing your ticket (PDF), organising hotel pick-up and contacting you by WhatsApp or phone — necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).
  • Answering your contact and transfer requests — pre-contractual steps (Art. 5/2-c) and legitimate interest (Art. 5/2-f).
  • Answering your questions through the AI assistant, improving the service and preventing abuse — legitimate interest (Art. 5/2-f).
  • Accounting, tax and commercial record-keeping and requests from authorities — legal obligation (Art. 5/2-ç).
  • Information security, rate limiting and bot prevention — legitimate interest (Art. 5/2-f).

We do not use your data for marketing and we do not send newsletters. If this ever changes, we will ask for your separate, optional consent first.

4. Who receives your data

We do not sell personal data. It may be shared, limited to the purposes above, with:

  • tour, transfer, guide, yacht, accommodation and transport partners and suppliers who deliver your service (name, phone, hotel / pick-up location, number of guests, date);
  • our hosting and IT infrastructure provider (Hostinger), to run the website and database — servers may be located abroad;
  • WhatsApp (Meta Platforms) when you send a message there or when we send your ticket and confirmation — Meta is located abroad;
  • our AI assistant provider, Google (Gemini) or OpenAI — your chat messages are sent to servers in the United States to generate replies;
  • Google Maps — loaded only if you click "Show map"; your IP address is then sent to Google;
  • competent public authorities, where required by law.

Transfers abroad are made in accordance with KVKK Art. 9 and the related legislation.

5. How data is collected

Through the booking form on the website, the contact and transfer forms, the AI chat, WhatsApp and phone — by automatic or partly automatic means.

6. Retention periods

  • Booking records: for as long as needed to provide the service and for the periods required by law (commercial and tax records: generally up to 10 years); afterwards they are deleted, destroyed or anonymised.
  • AI chat logs: at most 30 days; phone numbers and e-mail addresses are masked in the log. The chat history in your browser is deleted when you close the tab.
  • IP address used for rate limiting: 10 minutes for bookings; a hashed form for 1 hour for the chat.
  • Session cookie: until you close the browser.
  • WhatsApp conversations: kept on the business phone while needed for the service or required by law, then deleted.

7. Your rights (KVKK Art. 11)

By applying to the data controller you may:

  • learn whether your personal data is processed;
  • request information if it has been processed;
  • learn the purpose of processing and whether it is used accordingly;
  • know the third parties to whom it is transferred in Türkiye or abroad;
  • request correction if it is incomplete or inaccurate;
  • request deletion or destruction under Art. 7 and request that this be notified to the third parties to whom data was transferred;
  • object to a result against you arising from analysis exclusively by automated systems;
  • claim compensation if you suffer damage due to unlawful processing.

Send your request in writing to info@aia-travel.com (with information that lets us verify your identity) or to the address above. We reply free of charge within 30 days at the latest, depending on the nature of the request (a fee under the tariff set by the Personal Data Protection Board may apply if the process requires additional cost). If you are not satisfied, you may complain to the Turkish Personal Data Protection Authority. If you live in the European Economic Area, you may use the same address for your rights under the GDPR.

8. Cookies and similar technologies

  • Essential session cookie (PHPSESSID): needed for the site to work, for security (CSRF) and to keep your AI chat going; it is deleted when you close the browser. It is not used for advertising, analytics or tracking.
  • Browser storage (sessionStorage): your AI chat history is kept only in your own browser and removed when the tab is closed.
  • We do not use analytics (such as Google Analytics), advertising or pixel cookies. Fonts are served from our own site, so no request is sent to third parties for them.
  • Google Maps: the map is not loaded until you click "Show map". After you click, Google may set its own cookies and process your IP address under Google's privacy policy.

Essential cookies need no consent. You can delete or block cookies in your browser settings (the site keeps working, but the AI chat may not).

9. AI assistant

The assistant uses Google Gemini or OpenAI ChatGPT. The messages you write are sent to these companies (United States) and processed to produce a reply. The assistant can make mistakes — please check the tour page before booking. Do not write phone numbers, passport or card details to it. Messages are used only to produce replies and improve the service.

10. Security and updates

We protect your data against unauthorised access, loss and misuse with reasonable technical and organisational measures (access control, encrypted connection, rate limiting, restricted staff access). This notice may be updated; the latest version is always published on this page.

Last updated: 11.10.2026