KVKK Privacy Notice

This privacy notice explains how personal data is processed through the Visit Urla website, iOS/Android apps and membership services.

Data controller

NGTA TURİZM SEYAHAT TİCARET LİMİTED ŞİRKETİ, AKDENİZ MAHALLESİ AKDENİZ CAD. AKDENİZ İŞHANI NO: 5/207 KONAK İZMİR. For requests under the KVKK, you may use bilgi@rehberle.com or the postal address above.

Data processed

Membership may involve processing names, surnames, email addresses and verification and security records; contact and booking requests may involve phone numbers, messages and request details; business account applications may involve contact, category, membership and photograph information; newsletter registration may involve email addresses and consent times. Favourites, calendars and saved routes are linked to your account. When Google sign-in is selected, the Google account identifier, verified email address, name and, if available, profile photograph are received; your Google password is not received. If you enable notifications, the device notification token, operating system, app version, language and permission preference are processed. Artı points transactions retain account/business matching, QR verification, points movements, amounts, dates and transaction records that prevent misuse.

Purposes and legal grounds

Account and transaction data necessary for membership, favourites, calendars, routes and requested Artı points services are processed for entering into or performing a contract (KVKK Art. 5/2-c); proportionate technical records for fraud prevention and service security are processed on the basis of legitimate interests that do not prejudice fundamental rights (Art. 5/2-f); statutory retention and official requests are processed to meet legal obligations (Art. 5/2-ç); dispute records are processed to establish, exercise or protect a right (Art. 5/2-e). Optional marketing communications and related processing require a separate preference or consent. Indicating that you have read the privacy notice does not constitute explicit consent or permission for marketing.

Transfers and retention

Data may be shared only to the extent required for the service with hosting and email providers, the business concerned by a requested booking and the Google sign-in or map service selected by the user. Google Firebase and Apple/Google notification infrastructure, depending on the device platform, are used to deliver app notifications you have permitted. Only the transaction information needed for verifying Artı points transactions is shown to the relevant business. Your data is not sold for advertising. These providers may process data abroad. Such transfers require an applicable adequacy decision, appropriate safeguards or an exception specified by legislation under KVKK Art. 9; selecting Google sign-in or granting notification permission does not remove obligations concerning transfers abroad.

Retention approach

• Account data: while the account remains open and, after closure, for the applicable legal claim periods,
• contact and booking messages: until the request is resolved and the relevant legal periods expire,
• archived panel messages: for the period specified in the administration panel,
• newsletter consent records: after consent is withdrawn, for the period required by the obligation to provide evidence,
• security and transaction records: for the limited period required for attack prevention and legal obligations.

Once the purpose and retention obligation end, the data is deleted, destroyed or anonymised.

Account security and deletion

Email-login passwords are stored as secure hashes; your plaintext password is not retained. Partner applications assess only the information needed for the selected account type and manage its scope of permissions. You can submit a request using the “Create an account deletion request” button in your profile. The request is verified and processed; personal data is deleted, destroyed or anonymised, except records that legislation requires to be retained.

Artı points and the revenue model

NGTA earns no commission, transaction fee or revenue from earning or using Artı points. Artı points records are processed solely to deliver the service, verify transactions with the business and prevent misuse; points data is not sold for advertising. Artı points are not a deposit, cash or investment product; the terms of use and benefits offered by the relevant business apply.

Collection methods and your rights

Data is collected electronically through website and app forms, Google authentication, device notification registration, QR/Artı points and account transactions, security logs and preference records. You may exercise the rights under Article 11 of Law No. 6698 to request information, rectification, deletion or destruction, learn about recipients of transfers, object and seek compensation for damage by applying to the data controller. For the detailed procedure, see the KVKK Request Procedure page.