Privacy Policy

Data Controller: Moon Shine Travel -- license number : 13782
Address: Çavuşin Köyü Yolu NO:98 A, 50502 Avanos/Nevşehir • TURSAB No: A-13782 • E-mail: [email protected]

Scope: This policy covers the personal data processed through our website, mobile platforms, reservation/contact forms, WhatsApp, email, and call center. It has been prepared in line with Law No. 6698 on the Protection of Personal Data (KVKK) and international best practices (such as transparency and plain language principles).

1) Data We Collect

• Identity and contact: name, surname, email, phone, country, language preference.
• Reservation: accommodation/activity dates, passenger details, flight times (if any).
• Payment: payment amount, transaction time, response codes from the payment provider (we do not store card data; only the mandatory records returned by the provider).
• Marketing preferences: newsletter/consent boxes, cookie preferences.
• Technical data: IP, browser/device, cookie IDs, referring page, session/performance metrics.
• Call/message records: conversation/message summaries for customer relations quality and evidence purposes.

2) Purposes and Legal Grounds

• Contract/pre-contract: reservations, ticketing, operator confirmation, customer support.
• Legal obligations: accounting/tax records, invoices, audits, responses to KVKK requests.
• Legitimate interest: fraud prevention, system security, basic analytics/improvements.
• Explicit consent (when required): newsletters, offers, marketing cookies.

3) Collection Methods

Forms, WhatsApp/email/call center communications, payment provider responses, cookies, and log records.

4) Cookies and Similar Technologies

We use mandatory, analytical, and marketing categories. Preferences can be managed through the cookie panel with options that are not pre-selected; consent can be withdrawn anytime.

5) Data Transfers and Recipients

• Operational partners: balloon/ATV/horse tour operators, transfer companies (only necessary details).
• Suppliers: hosting, email/SMS, call center, security, and analytics providers.
• Payment institutions: PCI-DSS compliant intermediaries (we do not store card details).
• International transfer: Depending on server/SAAS location, data may be transferred abroad under KVKK safeguards.

6) Retention Periods

• Reservations/transactions: for the period required by financial regulations.
• Customer communications and requests: for the statute of limitations on disputes.
• Cookie logs: for reasonable durations depending on category/purpose.

7) Security

Access authorizations, TLS encryption during transmission, network and application security, backups, and KVKK clauses in supplier contracts.

8) Your Rights and Application

Under KVKK Art.11, you have the right to learn whether your data is processed, request information, learn the purpose of processing, know third-party transfers, request correction/deletion/anonymization, object to processing, and claim compensation for damages.

Applications: [email protected] or Çavuşin Köyü Yolu NO:98 A, 50502 Avanos/Nevşehir .
Response time: Applications are finalized as soon as possible and no later than 30 days.

9) Additional Transparency for EU/EEA Visitors

Information is provided in clear, accessible language in compliance with GDPR transparency principles.

10) Changes

This policy may be updated due to operational/legal changes. The latest version will always be published on this page.