Privacy
Data controller
Ali Tur Turizm Otelcilik Tic. Ltd. Şti., Tahılpazarı Mahallesi, Adnan Menderes Bulvarı, Beyaz Saray Apartmanı No: 27/3, Muratpaşa, Antalya, Türkiye.
What we collect
When you book a transfer we collect what you enter in the form: your name, email address, the travel date and time, flight number, destination address, number of passengers, chosen vehicle, any notes you add and — only if you want an invoice — your billing address. We do not ask for a phone number. Before we ask for your name, you confirm your email address with a 6-digit code we send you; the time of confirmation is stored with the booking. The contact form works the same way.
What we use it for
Solely to arrange, confirm and carry out your transfer, and to reach you with questions about the booking. Your flight number is used to look up the flight status and adjust the pick-up time.
Legal bases
Everything on this page is processed for one of four reasons, and never for a fifth. Your booking, because a transport contract with you has to be concluded and carried out (Article 6(1)(b) GDPR; Article 5/2-c of Turkish law 6698 (KVKK)). Invoices and accounting records, because the law requires us to keep them (Article 6(1)(c) GDPR; Article 5/2-ç KVKK). An irreversible hash of your IP and email address, stored when you confirm the code, to stop the forms being abused by automated tools — the addresses themselves are not stored — our legitimate interest, balanced against yours (Article 6(1)(f) GDPR; Article 5/2-f KVKK). Analytics cookies, only on your explicit consent (Article 6(1)(a) GDPR and section 25(1) TDDDG; Article 5/1 KVKK).
We do not collect special categories of personal data through this website — no health data, no biometric or genetic data, nothing about religion, belief or political opinion, no trade-union membership, and nothing about sex life or sexual orientation. Please do not put such information into the free-text note; if we need to know something of that kind to arrange the journey, please tell us by phone.
Who sees it
The driver carrying out the journey receives only what the journey requires: your name, the pick-up time and place, the destination address, and, where available, a phone number for contact on the day. Nothing is passed on for marketing purposes. Within our company, your booking (name, email, flight, hotel, notes — not the billing address) is passed to the booking and operations system at agnetours.com, where our office handles it; it is the same controller and the same hosting provider. The same applies to messages sent through the contact form (name, email, message), so that no question goes unanswered.
When our office answers your message, it may have an AI service write a draft of the reply: Anthropic, PBC, San Francisco, United States, acting as our processor. Only the content of your request is sent — what you asked for, your travel dates and your message. Your name, email address and phone number are not sent, and any contact details or ID numbers inside your message are removed first. A member of our team reads, corrects and sends every reply; nothing is decided or sent automatically. The transfer to the United States is covered by the Standard Contractual Clauses in Anthropic's data processing terms.
The vehicle and the driver are provided by a separate company — the supplier carrying out the transport — and not by us. It receives only the details listed above, and may use them for nothing but carrying out your journey.
Hosting and where the data is held
This website and the booking data collected through it are hosted with Hostinger International Ltd., Larnaca, Cyprus. The servers are in Frankfurt am Main, Germany; the backups are held in France. Both locations are inside the European Union, and there is a data processing agreement with the provider under Article 28 GDPR. The mailbox you reach us on is run by the same provider.
Pages are delivered through that provider's content delivery network. At the network node nearest to you, technical connection data is processed — IP address, time, the address requested and the browser identification — in order to serve the page and to block abuse. Those nodes may sit outside the European Union. Your booking data is not stored there; it is processed only on the server in Frankfurt.
Which law applies here
The controller is established in Türkiye — KVKK applies primarily. Ali Tur Turizm Otelcilik Tic. Ltd. Şti. is based in Antalya, which makes Turkish law 6698 (KVKK) the law that primarily governs this processing. The GDPR applies in addition, because this service is offered to customers in the European Union. Both directions are therefore described below rather than one being folded into the other.
Seen from Türkiye, holding your data on a server in Germany is itself a transfer abroad within the meaning of Article 9 KVKK — and so is the use of Google Analytics, which involves Google Ireland Limited and may involve Google LLC in the United States. Those transfers cover only the hosting, mail, the AI service used for reply drafts (Anthropic, United States) and — with your consent — measurement described above.
Transfer to Türkiye
The transfer takes place in Türkiye and the company carrying it out is based there. Your booking data is therefore seen by our staff in Antalya, who schedule the journey, and the driver carrying it out receives the details listed above. Where the statutory passenger report applies to your journey, we pass the details it requires to the transport company carrying you, which reports them to the Turkish U-ETDS system on its own responsibility.
There is no adequacy decision by the European Commission for Türkiye. The transfer is necessary in order to perform the transport contract concluded with you, and is made on that basis (Article 49(1)(b) GDPR). Without it the transfer you booked could not be carried out.
How long we keep it
Each kind of record has its own period, and it is the longest obligation applying to that record which sets it.
Bookings and invoices: ten years from the end of the financial year. Turkish commercial law requires commercial books and the records behind them to be kept for ten years (Article 82 TTK) and tax law requires five (Article 253 VUK); the longer period governs. Enquiries that do not become a booking: one year, then deleted. Hashes from email confirmation: 30 days. Server access logs: two years — Turkish law 5651 requires traffic records to be kept for at least one year and at most two. Analytics cookies: up to two years in your browser, and only if you accepted them; withdrawing your consent deletes them straight away.
How your data is protected
Everything you send this site travels over an encrypted connection (TLS). Passwords are never stored as text anyone can read — only as a cryptographic hash. Access to booking data is restricted to the staff whose work requires it, and every read of identity data is logged before it happens. The servers are backed up. If a personal data breach nevertheless occurs, we notify the competent supervisory authority within 72 hours of becoming aware of it, and the people affected as soon as is reasonably possible.
Cookies
Unless you explicitly consent, this site sets a single strictly necessary session cookie and nothing else. It holds your progress through the booking form and protects the form against cross-site request forgery, carries no advertising or tracking identifier, and is deleted when you close your browser.
Web analytics (Google Analytics)
If you consent in the cookie prompt, we use Google Analytics 4 to understand which pages of this site are being read. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent the service is not loaded at all: no connection is made to Google and no analytics cookie is set.
Once you consent, the cookies _ga and _ga_<identifier> are set, with a lifetime of up to two years. The data processed is pseudonymous usage data: the pages you open, an approximate location at country or city level, device type, browser, and the page you arrived from. Advertising features are not enabled; the advertising and personalisation signals are explicitly switched off.
The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Data may be transferred to Google LLC in the United States; Google relies on the Standard Contractual Clauses for that transfer and is certified under the EU-US Data Privacy Framework.
You can withdraw your consent at any time using “Cookie settings” in the footer of every page. Withdrawing deletes the analytics cookies and stops the service loading on this device.
Your rights
Under Articles 15 to 22 GDPR and Article 11 of Turkish law 6698 (KVKK) you have the right to find out whether we process personal data about you at all; to ask for information about it and receive a copy; to learn what it is being processed for and whether it is used in line with that purpose; to know which third parties it is transferred to, in Türkiye or abroad; to have it corrected if it is incomplete or wrong; to have it erased or destroyed once the reasons for processing it have fallen away; to require that any correction or erasure be notified to the third parties the data was passed to; to object to a result produced solely by analysing your data automatically where that result works against you; and to claim compensation if unlawful processing has caused you loss.
Where processing rests on your consent — on this site that means the analytics cookies and nothing else — you can withdraw it at any time using “Cookie settings” in the footer of every page. Withdrawing does not affect anything done before you withdrew. You also have the right to data portability and the right to object to processing based on our legitimate interest.
Making a request, and your right to complain
An informal message to support@privat-flughafentransfer.com is enough; there is no form to fill in. Please write from the email address the booking was made with, or give us enough detail to identify you with confidence. We answer within thirty days at the latest, and free of charge.
You have the right to lodge a complaint with a supervisory authority. In the European Union that is the authority of the country you live in, work in, or where you believe the problem occurred. Under Turkish law you may complain to the Personal Data Protection Authority (kvkk.gov.tr), within thirty days of our answer and in any case within sixty days of your original request.
Last updated: 28.09.2026