A Bosphorus cruise booking involves more than a ticket — a boat, a boarding time, a meal plan for the dinner option, a private host for the yacht. This policy covers what we collect to coordinate all of that, why it's needed, and who else sees it. Plain English. GDPR + KVKK aligned.
This site is operated by Istanbul Tourist Information Ltd., TÜRSAB licence A-7812, VAT 3470891204. Registered office: Sultanahmet Mah. Divan Yolu Cad. 17, 34122 Fatih, Istanbul. Data officer: privacy@istanbul-tourist-information.com.
Covers bosphorus-tour.com — the booking site for the four cruise products (Regular, Sunset, Dinner, Private Yacht). Does not cover boat operators' own sites or third-party resellers.
Four categories. More for private yacht bookings (host needs to know dietary preferences and group profile), less for the regular day cruise.
Contact & booking data — cardholder name, email, phone, boarding date + slot, cruise type, guest count, dietary preferences (dinner option), occasion notes (private yacht).
Payment data — card entered on Stripe. Last four + brand retained for invoice.
Usage data — which pages, referrer, device class. Anonymised.
Support data — email and reply, 36-month retention.
Contract performance — we cannot brief the captain and host without booking data. Art. 6(1)(b) GDPR.
Legal obligation — Turkish tax law requires 10-year transaction records. Art. 6(1)(c) GDPR.
Legitimate interest — analytics, fraud detection, crash reports. Opt-out via cookie panel. Art. 6(1)(f) GDPR.
Consent — marketing and newsletters, explicit opt-in. Art. 6(1)(a) GDPR.
Directly from you. We don't buy data lists, don't enrich with third-party sources, don't device-fingerprint. Card data goes to Stripe; they return a token.
Booking record: reference (BO- prefix), cruise type, boarding date + time, cardholder name, contact email, phone, guest count, dietary preferences (where applicable), occasion notes, VAT amount, total paid, refund history.
Visible to: you, our support team, the captain and host on the day (first name, guest count, dietary + occasion notes only — never contact details).
Front as helpdesk. 36 months. Not used for AI training. Not shared with marketing.
GA4 with IP anonymisation, ad-signals disabled, demographics off. Sentry for crash reports with PII scrubbing. We see what broke, not who it broke for.
| Vendor | Purpose | Data held | Region |
|---|---|---|---|
| Stripe | Payments | Card tokens | EU + US |
| External sales API | Boat inventory + slot hold | Cruise type, slot, quantity | Türkiye |
| Transactional email | Confirmation + voucher | Email, summary | EU |
| Google Analytics 4 | Anonymised usage | Anonymous session ID | EU + US |
| Meta Pixel | Ad attribution (opt-in) | Opaque ID | EU + US |
| Sentry | Scrubbed crash reports | Error trace, no PII | EU |
| Hosting & CDN | Serving the site | IP, user-agent (transient) | EU |
Each vendor DPA-signed, annually audited.
We don't sell, rent, or share for partner marketing. Only the vendors in section 08, under processor instructions. Legal order exception: you're notified unless forbidden.
Booking records — 10 years. Support — 36 months. Analytics — 24 months. Crash reports — 14 days. Marketing cookies — 90 days or until revoked.
Primary infrastructure: EU (Frankfurt, Amsterdam). Stripe and Google route through US under EU-US Data Privacy Framework + SCCs.
TLS 1.3. DB encryption at rest. 2FA for all staff. Quarterly pen-tests. 72-hour breach notification commitment.
Eight rights under GDPR + KVKK.
Full copy, 30-day SLA.
Same-day fixes.
Outside 10-year retention.
Freeze during disputes.
JSON/CSV export.
Stop legitimate-interest processing.
None. No profiling.
KVKK or EU DPA directly.
No knowing collection of under-16 data. Parents booking for children: cardholder is the parent; only first names appear on the voucher.
Material changes: 30-day email notice. Minor edits: version number increments in header.
One person, in-house. First reply within eight business hours, 98% of cases resolved in fifteen business days.