Privacy Notice

Who we are

The data controller is TALİA SU ALTI KÜLTÜR TURİZMİ ANONİM ŞİRKETİ, trading as DiveTalia. Registered office: Söğütözü Mah. 2176 Cad. No: 7, İç Kapı No: 86, Çankaya, Ankara, Turkey. Tax office and number: Maltepe, 8170684078. The dive centre operates at Anthaven marina, Akyarlar Mah. Atatürk Cad. No: 352, Blok 20/6 E-F, Aspat Bay, Bodrum, Muğla, Turkey.

You can reach us about anything in this notice by phone at +90 533 810 51 48 or by e-mail at info@divetalia.com. Our data protection contact person is Fırat Balkan, who can be reached at the same telephone number and e-mail address.

What we collect

Through the contact form, we collect what you choose to submit: your name, e-mail address, certification level, preferred dates, area of interest, and the message you write.

When you book online, we collect what the booking form asks for: your name, e-mail address and phone number, the dive, trip or course you choose with its dates and the number of guests, and, if you wish to give them, the name of the hotel where you are staying, your diving certification level, and any note you add to your booking. The certification level and your note are seen only by our crew, so they can prepare for your dive and answer anything you asked; they are never shown on a payment page or added to any marketing.

If your booking includes equipment hire, you can also give body measurements so the crew can prepare a wetsuit, boots, fins and BCD in your size before the boat leaves: clothing size, shoe size, height and weight. These fields are optional. Leaving them empty never blocks a booking; the crew simply ask you in person instead. We use these measurements for nothing else.

We never collect your card details. When you pay, you enter them on the bank's own payment page, and they do not reach or pass through our systems. See the online bookings section below.

In addition, the server that receives a submission processes the technical data strictly necessary to deliver it, such as the connection details of the request itself. We do not use this data for any other purpose.

There are no user accounts and no visitor profiles. If you accept analytics cookies, this site also collects site-usage data through them: an online identifier held in a cookie, the pages you visit, your device and browser type, and your approximate location (country and city), used only to improve the site. If you do not consent, and you send no form and make no booking, we collect nothing about you.

Why we process it, and on what legal basis

We process contact-form data for one purpose: to read your inquiry and reply to it well. The legal bases are your consent, given through the explicit checkbox on the form (GDPR Article 6(1)(a); KVKK Article 5/1), and our legitimate interest in responding to inquiries addressed to us (GDPR Article 6(1)(f); KVKK Article 5/2(f)).

We process booking data to take your booking, hold your place, collect the deposit through the bank, prepare your dive, trip or course, and reach you about it. The legal bases are the performance of the contract you make with us (GDPR Article 6(1)(b); KVKK Article 5/2(c)) and our legal obligations as a business, such as issuing invoices and keeping transaction records (GDPR Article 6(1)(c); KVKK Article 5/2(ç)).

Equipment measurements are processed only to prepare rental gear in your size, on the same contractual basis, and only when you choose to give them.

Your data is never sold. It is never shared or used for marketing without your separate, explicit consent.

If you accept analytics cookies, we also process your site-usage data on the basis of your explicit consent (GDPR Article 6(1)(a); KVKK Article 5/1), and we transfer that data abroad on the basis of your explicit consent given with the possible risks disclosed (KVKK Article 9/6-a). You give both by clicking Accept in the cookie banner, and you can withdraw either at any time under Cookie settings.

Cookies and tracking

With your consent, this site uses analytics cookies to understand, in aggregate, how the site is used. Nothing loads until you accept them in the cookie banner, and you can change your choice at any time through Cookie settings in the footer. We use them only for analytics, never for advertising. The Cookie Policy lists the cookies they set, how long they and the data last, and the transfer to our analytics provider in the USA.

The booking flow stores one temporary technical key in your browser, valid only in that tab, so you can resume an interrupted payment. It identifies your booking, not you; it does not track you, and your browser discards it when you close the tab. When you pay, your browser is taken to the bank's own payment page, which operates under the bank's own privacy terms.

Where your data is stored

The website and the booking system are hosted on Google Cloud Platform in a European Union region, chosen deliberately for GDPR and KVKK compliance. Contact-form submissions and booking records are processed and stored on that infrastructure.

For people writing or booking from Turkey, storage in the EU constitutes a transfer of personal data abroad under KVKK Article 9, and the Personal Data Protection Board has not issued an adequacy decision for any country. For the contact form, we make the transfer on the basis of the explicit consent you give when you tick the consent box on the form. For a booking, the transfer takes place because performing the booking contract requires it: the systems that hold your booking, send your confirmation e-mail and show the crew your reservation run on that EU infrastructure.

The possible risk, which we are required to tell you about: once your data is on servers outside Turkey, Turkish authorities cannot enforce your rights over it as directly as they can inside Turkey, and it becomes subject to the laws of the country where the servers sit.

If you would rather not have your data leave Turkey, do not use the contact form or the online booking. Telephone us instead on +90 533 810 51 48; a booking can also be made by phone.

If you accept analytics cookies, your site-usage data is also transferred to our analytics provider, which processes it on our behalf in the USA. There is no adequacy decision for the USA either, so the same risk applies, and this transfer rests on the explicit consent you give by clicking Accept in the cookie banner (KVKK Article 9/6-a). If you do not accept, no analytics data is collected or transferred.

Who can see your data

Your inquiry or booking is seen by the DiveTalia team members who handle it. On a booking, the crew see your name, phone number, hotel and any equipment sizes you gave, so they can prepare your dive and reach you; this access is limited to the dive centre's own staff accounts.

Four service providers process data on our behalf. Google Cloud Platform hosts the website and the booking records. Türkiye İş Bankası, with its payment infrastructure provider Payten, processes your payment on the bank's own page. Brevo, an e-mail service based in France, sends our booking e-mails. Google Workspace runs the staff calendar, where the crew see each day's reservations with the guest's name, phone number, hotel and equipment sizes.

We do not sell personal data and we do not share it with third parties for their own marketing.

How long we keep it

We keep contact-form submissions, and booking attempts that never became a paid booking, for 24 months from our last contact with you, then delete them. Diving trips are planned a season or more ahead, so this period lets us pick up an earlier conversation without keeping your details longer than the purpose needs.

Records of a completed booking and its payment are different: Turkish tax and commercial law obliges us to keep transaction records, such as invoices and payment results, for the periods those laws set, which are longer than 24 months. We keep such records for as long as the law requires and no longer.

You can ask us to delete your data sooner, at any time, by writing to info@divetalia.com. We will delete everything the law does not oblige us to keep.

If you accept analytics cookies, visitor-level and event-level analytics data are kept for 14 months, then deleted; aggregated reports that identify no one may be kept longer. The analytics cookies stay in your browser for up to 13 months, and your cookie choice is remembered for 12 months.

Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Under KVKK Article 11 you hold the corresponding rights set out in the KVKK Clarification Text published on this site, including the rights to learn whether your data is processed, to request correction or deletion, and to claim compensation for damage caused by unlawful processing.

To exercise any of these rights, e-mail info@divetalia.com. We will respond as the law requires.

If you are in the EU or EEA, you may also lodge a complaint with your local data protection supervisory authority. If you are in Turkey, you may apply to the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu).

Online bookings and payments

When you book online, we hold your place while you pay. The card payment happens on the secure payment page of Türkiye İş Bankası, with 3-D Secure verification. Your card number and other card details are entered only on the bank's own page; they are never transmitted to, processed by, or stored on our systems. What we send the bank to start the payment is your booking's order number and the amount, nothing more.

The bank reports the result back to us: the order number, an approval or decline code, and whether 3-D Secure verification succeeded. That result is stored with your booking; your card details never are.

We send booking e-mails through Brevo: a confirmation when your payment succeeds, a reminder with a secure resume link if a payment is interrupted, and a notice when a refund is started. These are e-mails about your booking only; we do not add you to any marketing list.

Refunds are issued to the card you paid with, through the bank. The deposit, the cancellation windows and the refund rules are set out in our Cancellation and Refund Terms.

Changes to this notice

If our data practices change, we will update this notice and revise the date at the top. Significant changes, such as introducing analytics, will be announced clearly on the site.

Contact

DiveTalia, Anthaven marina, Akyarlar Mah. Atatürk Cad. No: 352, Blok 20/6 E-F, Aspat Bay, Bodrum, Muğla, Turkey. Phone: +90 533 810 51 48. E-mail: info@divetalia.com.