PRIVACY AND PERSONAL DATA PROTECTION POLICY

This Privacy and Personal Data Protection Policy explains how your personal data is collected, used, stored, protected, and shared when you visit our website, contact us, make a tour reservation, or use our services under the Sunride Adventure brand.

The Sunride Adventure website and tour services are operated by HANTUR TURİZM TAŞIMACILIK, whose details are provided below.

1. Data Controller

In accordance with the Personal Data Protection Law No. 6698, the data controller for your personal data is:

• Commercial Title: HANTUR TURİZM TAŞIMACILIK
• Brand: Sunride Adventure
• Address: Sarılar Mahallesi, Hastahane (Şelale) Caddesi No: 16, İç Kapı No: 4, Manavgat / Antalya
• Website: www.sunrideadventure.com
• Email: info@sunrideadventure.com
• Phone & WhatsApp: +90 532 705 10 93

2. Collected Personal Data

Depending on your relationship with Sunride Adventure and the services you use, the following personal data may be collected:

2.1. Identity and Contact Information

• Name and surname
• Phone number
• WhatsApp number
• Email address
• Preferred language of communication

2.2. Reservation and Tour Information

• Selected tour or activity
• Tour date
• Transfer preference
• Name of the hotel stayed at
• Hotel room number
• Pick-up and drop-off points
• Number of adult, child, and infant passengers
• Reservation amount
• Reservation modification or cancellation details
• Special requests and remarks
• Customer service interactions

Hotel room numbers are processed solely for the accurate execution of transfers and passenger pick-ups.

2.3. Information Regarding Children

During the reservation, the number of child and infant passengers and, when necessary, their age information may be requested.

Reservations involving children must be made by a parent, legal representative, or an adult authorized to act on behalf of the child.

Unless necessary to provide the service safely, names, contact details, identity information, or any other personal data belonging to children are not requested.

2.4. Website and Technical Data

When you visit our website, the following technical data may be processed automatically:

• IP address
• Browser type and version
• Device type used
• Operating system
• Date and time of website access
• Pages visited
• Referring website
• Session information
• Security and error logs
• Cookies and similar technology information

2.5. Communication Records

Conversations and correspondence conducted through the following channels may be processed:

• WhatsApp
• Email
• Phone
• Website reservation forms
• Contact forms
• Social media accounts

2.6. Photo and Video Content

Photos and videos taken during tours or activities can optionally be shared with us via WhatsApp, email, or social media channels.

Sending a photo or video to us does not imply automatic consent for its publication on our website, social media, or advertising campaigns.

For the promotional use of photos and videos where identifiable individuals are present, explicit consent is additionally obtained when necessary.

2.7. Special Categories of Personal Data

Unless strictly necessary for the safe provision of the service, the following information should not be written in the special notes field of the reservation form:

• Health information
• Identity or passport information
• Financial information
• Disability information
• Medication usage
• Other special categories of personal data

If it is mandatory to share such information for tour safety or passenger health, personal data is processed by applying the additional security measures stipulated in the legislation.

3. Methods of Personal Data Collection

Your personal data may be collected through the following methods:

• Website reservation forms
• Contact forms
• WhatsApp conversations
• Phone calls
• Email correspondence
• Social media messages
• Tour and transfer operations
• Hotels and accommodation businesses
• Tour operators and business partners
• Website cookies and server logs
• Reservations made by another person on your behalf

If a person creates a reservation on behalf of other passengers, the person creating the reservation accepts that they have informed the relevant passengers about this Privacy Policy and are authorized to share this information.

4. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Receiving tour and activity reservations
• Creating and confirming reservations
• Calculating tour fees
• Determining passenger counts and age groups
• Organizing hotel pick-ups and drop-offs
• Planning tour, transfer, and activity operations
• Ensuring coordination with guides, drivers, and operations personnel
• Executing reservation modification, cancellation, and refund processes
• Answering customer inquiries and requests
• Evaluating complaints
• Ensuring tour safety
• Executing accounting and financial transactions
• Carrying out invoicing and payment transactions
• Fulfilling tax and other legal obligations
• Ensuring website security
• Preventing fraud and abuse
• Improving service quality
• Measuring customer satisfaction
• Managing legal disputes
• Establishing, exercising, and protecting legal rights
• Meeting requests from authorized public institutions
• Conducting promotional and marketing activities (with explicit consent)
• Publishing photos and videos (with explicit permission)

5. Legal Grounds for Processing Personal Data

Your personal data may be processed based on the following legal grounds, depending on the nature of the data processed and the purpose of the processing:

• Directly related to the establishment or performance of a contract
• Necessary for the fulfillment of the reservation and tour service
• Fulfillment of the data controller's legal obligation
• Mandatory for the establishment, exercise, or protection of a right
• Mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject
• Made public by the individual themselves
• Mandatory for the protection of life or bodily integrity of the person or someone else
• Explicit consent of the data subject where explicitly required

Explicit consent is separately obtained when necessary for marketing, advertising, promotion, photo publication, and similar activities that are not mandatory for the reservation service.

You can withdraw your explicit consent at any time. The withdrawal of consent does not affect the lawfulness of the data processing activities carried out before the withdrawal date.

6. Reservations via WhatsApp

When you use the "Complete Reservation via WhatsApp" or similar button on our website, the information you enter into the reservation form may be transferred to the WhatsApp application.

WhatsApp is an independent third-party service provider and may process the following data under its own policies:

• Phone number
• Account information
• Device information
• IP address
• Message content
• Message and communication metadata

The use of WhatsApp is additionally subject to WhatsApp's own terms of use and privacy policy.

Individuals who do not wish to communicate via WhatsApp can contact us via email or phone.

7. Parties to Whom Personal Data is Transferred

Your personal data may be shared with the following individuals and organizations solely to the extent necessary to provide the service:

• Tour guides, Drivers, and transfer companies
• Boat tour, Jeep safari, Rafting, and activity operators
• Restaurants, Museum, entertainment, and visit point operators
• Hotels and accommodation businesses
• Insurance companies
• Persons providing accounting and financial advisory services, Legal advisors
• Banks and payment service providers
• Website hosting, software, and IT service providers
• Communication service providers, WhatsApp, and similar third-party platforms
• Authorized public institutions, Courts, execution offices, and Law enforcement forces
• Other institutions authorized to request information under legislation

Your personal data is not sold or rented to third parties for commercial purposes.

8. International Transfer of Personal Data

Some personal data may be processed on servers located abroad due to the use of technological services such as the website, WhatsApp, Google, YouTube, social media, email, and hosting.

When it is necessary to transfer personal data abroad, we act in accordance with the transfer conditions and security measures stipulated in the applicable legislation.

Transfers abroad may be based on one of the following methods:

• Adequacy decision, Standard contractual clauses, Appropriate safeguards
• Exceptional transfer conditions specified in the law
• Explicit consent when required

Third-party service providers may additionally process personal data within the scope of their own privacy policies and legal responsibilities.

9. Cookies and Similar Technologies

Cookies and similar technologies may be used on our website for the following purposes:

• Ensuring the website works properly, Ensuring security
• Remembering language and user preferences
• Measuring page performance, Understanding visitor behaviors
• Detecting technical errors, Improving the website
• Displaying third-party content

Mandatory cookies are necessary for the functioning and security of the website and can be used without explicit consent to the extent permitted by legislation.

Analytical, advertising, targeting, or functional cookies are activated after obtaining user consent when required.

Users can change their cookie preferences from the cookie management panel on the website or their browser settings. Disabling some cookies may cause certain features on the website to not function correctly.

10. Third-Party Websites and Services

Our website may contain links or content belonging to the following third-party services:

• WhatsApp
• Google Maps, Google Reviews, YouTube
• Instagram, Facebook, and other social media platforms

When you click on third-party links or interact with third-party content, the respective service provider may process your personal data independently.

HANTUR TURİZM TAŞIMACILIK is not responsible for the privacy practices, security, or content of third-party websites.

11. Retention Period of Personal Data

Your personal data is retained for the period required by the purpose of processing and in accordance with the legal retention periods stipulated in the legislation.

The following criteria are considered in determining the retention periods:

• Completion time of the reservation and tour service
• Evaluation time of customer requests and complaints
• Retention periods in accounting and tax legislation
• Invoice and payment records, Insurance and incident records
• Legal statute of limitations
• Establishment, exercise, or protection of a right
• Duration of validity of the consent in consent-based processing

Personal data whose retention period has expired is deleted, destroyed, or anonymized in accordance with the legislation.

12. Security of Personal Data

Reasonable technical and administrative measures are taken to ensure the security of personal data. These measures may include:

• Limiting unauthorized access, Protecting user and administrator accounts
• Server security, Firewall and access controls
• Backup processes, Logging of system and errors
• Limiting personnel access authorizations, Confidentiality obligations
• Establishing data security provisions with service providers
• Not collecting unnecessary personal data

However, no data transmission over the internet or electronic storage system can be guaranteed to be entirely secure.

Users are advised not to share unnecessary sensitive information such as identity, health, finance, etc., via WhatsApp, email, or reservation forms.

13. Automated Decision Making

An automated decision-making system solely based on automated data processing that produces legal effects concerning individuals or similarly significantly affects them is not used.

Automatic price calculations can be made on the website based on the selected tour, number of passengers, child age, transfer preference, or similar options. This process is not profiling or automated decision making producing legal effects.

14. Rights of the Data Subject

Within the scope of Article 11 of the Personal Data Protection Law No. 6698, you have the following rights as a personal data subject:

• To learn whether your personal data is processed or not
• If processed, to request information regarding this
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose
• To know the third parties to whom your personal data is transferred domestically or abroad
• To request correction of your personal data if it is incomplete or inaccurately processed
• To request deletion or destruction of personal data in the event that the conditions stipulated in the legislation are met
• To request notification of correction, deletion, or destruction processes to third parties to whom data is transferred
• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems
• To demand the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data

Where the European Union General Data Protection Regulation (GDPR) applies, you may also have the rights to data access, rectification, erasure, restriction of processing, objection, data portability, objection to direct marketing, withdrawal of explicit consent, and lodging a complaint with the competent authority.

15. Exercising Rights and Application

You can submit your requests regarding your personal data to us via the following communication channels:

Your application must include your name-surname, contact information, relationship with Sunride Adventure, subject of the request, and any supporting information/documents. Additional information may be requested to verify your identity for security purposes.

16. Right to Complain

If you believe that your personal data is processed unlawfully, you can contact us first.

In case the application is rejected, the response provided is deemed insufficient, or a response is not provided within the period stipulated by legislation, you can file a complaint with the Personal Data Protection Board provided the legal conditions are met.

17. Commercial Electronic Messages

Emails, SMS, or WhatsApp messages for advertising, campaign, discount, and promotional purposes are only sent where permitted by legislation and by obtaining separate consent when required.

Commercial message approval is not a mandatory condition of the reservation process, is obtained separately from the Privacy Policy approval, can be withdrawn at any time, and a suitable opt-out method is provided.

Reservation confirmations, tour times, hotel pick-up details, cancellations, changes, and operational notifications are not marketing messages but mandatory notifications related to the provision of the service.

18. Changes to the Privacy Policy

This Privacy Policy may be updated due to changes in services, third-party providers, or legislation. The updated text will be published on the website along with the new "Last Updated" date.

19. Contact

For questions regarding our Privacy Policy or the processing of your personal data, you can contact us: