Privacy Policy

1. What we collect

• Identity and contact: name, email, telephone, and WhatsApp number if you message us.
• Booking: experience, date, participant count, hotel or pickup address, special requests.
• Health-adjacent details you volunteer — pregnancy, mobility, age or weight for balloon eligibility — used only to confirm eligibility and deleted after the experience.
• Payment reference: transaction identifier and result. Full card numbers are held by the payment provider, never by us.
• Technical: IP address, device and browser type, pages viewed, and your cookie consent choice.

2. Why we use it, and on what basis

• To create and perform your reservation — performance of a contract.
• To send pickup times, changes and cancellation notices — performance of a contract.
• To keep accounting and travel-agency records — legal obligation.
• To prevent fraudulent bookings and chargebacks — legitimate interest.
• To measure site performance and marketing — consent only, via the cookie banner.

3. Who else receives it

Only what each recipient needs: the operator running your experience (name, participant count, pickup point), the transport provider (pickup address and phone), the payment provider (billing details), and public authorities where a legal duty applies. We do not sell personal data or share it for third-party marketing.

4. International transfers

Some processors — hosting, email and, where you consented, analytics — operate outside Türkiye. Transfers rely on the safeguards required by applicable data protection law, and are limited to the data those services need to function.

5. How long it is kept

• Booking and payment records: retained for the statutory accounting period, then deleted.
• Support conversations: 12 months after the last message.
• Eligibility details you volunteered: deleted once the experience has taken place.
• Analytics data: for the retention period of the analytics tool, and only if you consented.

6. Your rights

You can ask what we hold, have it corrected, have it deleted where no legal duty requires us to keep it, object to processing based on legitimate interest, and withdraw analytics consent at any time by clearing site storage. Write to info@kapheratravel.com; we may verify your identity before acting, and we respond within the statutory period.

7. Security

The site is served over TLS, payment pages are hosted by the payment provider, and access to reservation data is limited to staff who need it operationally. No system is perfectly secure; if a breach affects you, we notify you and the authority as the law requires.