GDPR Policy

GDPR Policy

This policy applies to individuals in the European Economic Area (EEA) and sets out our obligations under the EU General Data Protection Regulation (GDPR). For general information on how your data is collected and used, please see our Privacy Policy.

Data Controller

For guests travelling from the EU/EEA, personal data is processed by Joy Deep Travel Turizm Tic. Ltd. Şti., which is responsible for all stages of the booking and tour organisation — including booking and communication, payment processing, ground operations, accommodation and transport.

Joy Deep Travel Turizm Tic. Ltd. Şti. is based in Türkiye. Data transfers from the EEA to Türkiye are carried out in accordance with applicable GDPR transfer mechanisms.

Legal Bases for Processing

• Performance of contract — processing your booking, communicating about your tour, sharing necessary data with accommodation providers and transport suppliers
• Legal obligation — providing passport information for mandatory hotel registration under Turkish law
• Legitimate interest — customer support, fraud prevention, improving our services
• Consent — marketing communications and non-essential cookies. You may withdraw your consent at any time.

Your Rights under GDPR

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion where there is no longer a legal basis for retaining your data
• Right to restriction of processing — request that the use of your data be limited under certain conditions
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest or direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

Data Transfers Outside the EEA

Your data is processed in Türkiye by Joy Deep Travel Turizm Tic. Ltd. Şti. Transfers are carried out with appropriate safeguards in accordance with Chapter V of the GDPR where required. Türkiye has not yet been recognised as providing adequate protection under EU law; transfers are therefore conducted under standard contractual clauses or other approved mechanisms.

How to Exercise Your Rights

To exercise your GDPR rights, contact us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.