Clarification Text under the Personal Data Protection Law (KVKK)

Data controller

The data controller is TALİA SU ALTI KÜLTÜR TURİZMİ ANONİM ŞİRKETİ, trading as DiveTalia. Registered office: Söğütözü Mah. 2176 Cad. No: 7, İç Kapı No: 86, Çankaya, Ankara, Turkey. Tax office and number: Maltepe, 8170684078. The dive centre operates at Anthaven marina, Akyarlar Mah. Atatürk Cad. No: 352, Blok 20/6 E-F, Aspat Bay, Bodrum, Muğla, Turkey. Phone: +90 533 810 51 48. E-mail: info@divetalia.com. Data protection contact person: Fırat Balkan.

Personal data processed

Through the contact form on this website we process: identity data (your name), contact data (your e-mail address), and inquiry data (certification level, preferred dates, area of interest, and your message), together with the technical processing records strictly necessary for the server to receive and deliver your submission.

Through the booking form we process: identity data (your name), contact data (your e-mail address and phone number), customer transaction data (the dive, trip or course you book, its dates, the number of guests, the order number, the amount and the payment result reported by the bank), accommodation data you choose to give (the hotel where you are staying), the diving certification level you choose to give and any note you add to your booking (used only to prepare your dive and respond to what you tell us), and, only when your booking includes equipment hire and only if you choose to give them, equipment sizing data (clothing size, shoe size, height and weight) used to prepare rental gear in your size.

Your card details are never processed by us: you enter them only on the bank's own payment page, and they do not reach or pass through our systems.

When you accept analytics cookies, we also process site-usage data through them: an online identifier held in a cookie, the pages you visit, your device and browser type, and your approximate location (country and city). No other personal data is collected through this website, and we use no advertising cookies.

Purposes of processing

Contact-form data is processed to receive your inquiry, to respond to it, and to carry out the related communication with you.

Booking data is processed to establish and perform the booking contract: to reserve your place, collect the deposit through the bank, prepare the dive, trip or course including rental equipment in your size, communicate with you about the booking, fulfil our legal obligations such as invoicing, and establish, exercise or protect our rights in a possible dispute.

Your data is not used for profiling and is not used for marketing without your separate, explicit consent.

With your consent, site-usage data is also processed to measure and improve how the site is used.

Legal grounds

Contact-form processing rests on your explicit consent, given through the checkbox on the contact form (KVKK Article 5/1), and on our legitimate interest in responding to inquiries addressed to us, provided your fundamental rights and freedoms are not harmed (KVKK Article 5/2(f)).

Booking processing rests on its being directly necessary for the establishment and performance of a contract to which you are a party (KVKK Article 5/2(c)), on the fulfilment of our legal obligations (Article 5/2(ç)), and, for the keeping of transaction records, on the establishment, exercise or protection of a right (Article 5/2(e)).

Analytics-cookie processing rests on your explicit consent (KVKK Article 5/1; GDPR Article 6(1)(a)), and the transfer of that data abroad rests on your explicit consent given with the possible risks disclosed (KVKK Article 9/6-a). You give both by clicking Accept in the cookie banner.

Method of collection

Your personal data is collected electronically and by automated means: through the contact form and the booking form when you choose to submit it, and, if you accept analytics cookies, automatically through those cookies as you use the site.

Transfers

Your personal data is not sold and is not shared with third parties for marketing purposes without your separate consent.

To take an online payment, your booking's order number and the amount are shared with Türkiye İş Bankası, which processes the payment on its own page together with its payment infrastructure provider Payten. Your card details never pass through us.

The website and the booking system are hosted on Google Cloud Platform in a European Union region; booking e-mails are sent through Brevo, an e-mail provider based in France; and the staff calendar, where the crew see each day's reservations with the guest's name, phone number, hotel and equipment sizes, runs on Google Workspace. Because these servers are located abroad, storing your submission or your booking there constitutes a transfer of personal data abroad within the meaning of KVKK Article 9. The Personal Data Protection Board has not issued an adequacy decision for any country. For the contact form, the transfer rests on your explicit consent, given by ticking the consent box on the form. For a booking, the transfer takes place because the booking contract cannot be performed without it.

The possible risk we are required to tell you about: once your data is held on servers outside Turkey, Turkish authorities cannot enforce your rights over it as directly as they can inside Turkey, and the data is subject to the laws of the country where those servers are located. If you would prefer your data not to leave Turkey, do not use the contact form or the online booking; telephone us instead on +90 533 810 51 48, where a booking can also be made.

When you accept analytics cookies, your site-usage data is transferred to an analytics provider that processes it on our behalf in the United States (USA). The Personal Data Protection Board has issued no adequacy decision for the USA, so the same risk applies: Turkish authorities cannot enforce your rights there as directly as inside Turkey, and the data is subject to that country's laws. This transfer rests on the explicit consent you give by clicking Accept in the cookie banner (KVKK Article 9/6-a). If you do not accept, no analytics data is collected or transferred.

Retention

Your data is retained only as long as required for the purposes above and for any legal obligations. Contact-form submissions, and booking attempts that never became a paid booking, are kept for 24 months from our last contact with you. Records of a completed booking and its payment are kept for the longer periods Turkish tax and commercial legislation sets for transaction records. When the retention grounds expire, data is deleted, destroyed, or anonymised in accordance with the law.

If you accept analytics cookies, visitor-level and event-level analytics data are kept for 14 months, then deleted; aggregated reports that identify no one may be kept longer. The analytics cookies stay in your browser for up to 13 months, and your cookie choice is remembered for 12 months.

Your rights under Article 11

Under KVKK Article 11, you have the right to: learn whether your personal data is processed; request information about the processing if it is; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties, in Turkey or abroad, to whom the data is transferred; request rectification of incomplete or inaccurate data; request deletion or destruction of the data under the conditions of Article 7; request that rectification, deletion, or destruction be notified to third parties to whom the data was transferred; object to a result arising against you from analysis of the data exclusively by automated systems; and claim compensation for damage caused by unlawful processing.

How to apply

You may exercise these rights by sending your request to info@divetalia.com, in accordance with the Communique on the Procedures and Principles of Application to the Data Controller. Your request will be answered free of charge and no later than thirty days, unless the law permits a fee.

If your application is refused, answered insufficiently, or not answered in time, you may lodge a complaint with the Personal Data Protection Board (Kisisel Verileri Koruma Kurulu).