Last updated: 11 September 2026
1. Identity of the Data Controller
Higgstour Turizm İşletmeciliği Ticaret Limited Şirketi (“Higgs Tour” or the “Company”), acting as data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”), processes the personal data it obtains through the higgstour.com website (the “Site”) in accordance with this Privacy Policy and Privacy Notice.
| Company Name | Higgstour Turizm İşletmeciliği Ticaret Limited Şirketi |
| Address | Barbaros Mah. 3001 Sk. No: 1 İç Kapı No: 19 Aksu / Antalya |
| Phone | +90 554 568 91 44 |
| Email | info@higgstour.com |
| Tax Office / Tax No. | Antalya Kurumlar Tax Office / 4620811287 |
| Field of Activity | Travel agency activities (NACE 791101) |
By using the Site, submitting a booking request or contacting us through our communication channels, you are deemed to have accepted the principles set out in this policy.
2. Personal Data We Process
In connection with the bus rental, minibus rental, airport transfer and hotel booking services we provide, our Company processes the following categories of personal data:
- Identity Data: First name, last name.
- Contact Data: Mobile phone number, email address, pick-up/drop-off address.
- Customer Transaction Data: Booking date and time, route information, trip type (one way / round trip), vehicle preference, number of passengers, request and complaint records, call and correspondence records.
- Transaction Security Data: IP address, browser and device information, site navigation and cookie records, transaction timestamp.
- Financial Data: Payment amount, order/transaction number, payment status, refund records.
Important: Your credit and debit card details (card number, expiry date, CVV) are never seen, recorded or stored by our Company. Payments are processed through the infrastructure of iyzico Ödeme Hizmetleri A.Ş., a payment institution licensed by the BDDK (Banking Regulation and Supervision Agency of Türkiye), in compliance with PCI DSS security standards.
3. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Receiving, assessing and completing your booking and rental requests,
- Preparing price quotes and sending them to you,
- Providing the transportation, transfer and accommodation services you purchase,
- Processing payments and keeping invoicing and accounting records,
- Contacting you before and during your trip and sharing vehicle and driver details,
- Managing cancellation, change and refund requests,
- Measuring customer satisfaction and handling requests and complaints,
- Improving service quality and the Site’s user experience,
- Fulfilling our legal obligations (tax, commercial and road transport legislation),
- Preventing fraud and ensuring transaction security,
- Sending campaign and promotional messages, where you have given explicit consent.
4. Legal Grounds for Processing
Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:
- Art. 5/2-c: Processing is necessary for the establishment or performance of a contract, provided that it directly relates to the parties to that contract (booking and transportation contract).
- Art. 5/2-ç: Processing is mandatory for the data controller to fulfil its legal obligations (tax and commercial legislation, road transport legislation).
- Art. 5/2-e: Processing is mandatory for the establishment, exercise or protection of a right.
- Art. 5/2-f: Processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (transaction security, service quality).
- Art. 5/1: Explicit consent (for commercial electronic messages and non-essential cookies).
5. Transfer of Personal Data
To the extent necessary to achieve the purposes listed above, and in accordance with Articles 8 and 9 of the KVKK, your personal data may be shared with the following parties:
- Payment institution: iyzico Ödeme Hizmetleri A.Ş. and the relevant banks/card organizations, to process payments.
- Suppliers and business partners: The drivers and vehicle operators who actually carry out the transportation, and hotels and accommodation providers (only the data strictly required to provide the service).
- Service providers: Server/hosting, email delivery and map/distance calculation service providers (Google Maps Platform).
- Authorized institutions: Public institutions and judicial authorities legally authorized to request it, within the scope of obligations arising from legislation.
- Advisors: Financial advisors, legal counsel and auditors, only to the extent necessary.
Your personal data is never sold, rented or transferred to third parties for marketing purposes.
6. Payment Security
All payments made on the Site are processed using the infrastructure of iyzico Ödeme Hizmetleri A.Ş., a payment institution licensed by the BDDK.
- Your card details are sent directly to iyzico’s secure payment page and are not kept on Higgs Tour servers.
- All data transmission is encrypted with an SSL/TLS certificate. The entire Site is served over HTTPS.
- Transactions are carried out with 3D Secure verification, to the extent supported by your bank.
- The payment infrastructure is PCI DSS (Payment Card Industry Data Security Standard) compliant.
Never share your card details with us by email, SMS, WhatsApp or phone under any circumstances. Higgs Tour staff will never ask you for this information.
7. Cookie Policy
The Site uses cookies to improve the user experience and ensure technical operation.
- Essential cookies: Required for session management, security and forms to work; they cannot be disabled.
- Functional cookies: Remember your language, currency and previous search preferences.
- Analytics cookies: Collect page view and navigation statistics anonymously.
You can delete or block cookies in your browser settings. If essential cookies are blocked, some parts of the Site may not work.
8. Retention Period
Your personal data is kept for as long as necessary for the purpose for which it is processed, and until the statutory limitation periods under the relevant legislation expire:
- Booking and service records: 10 years from the performance of the service (general limitation period, Turkish Code of Obligations Art. 146).
- Invoice and accounting records: 10 years (Tax Procedure Law and Turkish Commercial Code).
- Communication and request records: 3 years from the conclusion of the request.
- Site traffic and log records: 2 years (Law No. 5651).
At the end of these periods, your data is deleted, destroyed or anonymized.
9. Data Security Measures
Our Company applies the following technical and administrative measures to prevent unlawful processing of and access to your personal data:
- SSL/TLS encryption across the Site and mandatory HTTPS,
- A strong password policy and access-authorization matrix against unauthorized access,
- Up-to-date software versions and regular security patches,
- Regular backups, with backups stored in a separate environment,
- Confidentiality undertakings for staff with access to data,
- Payment data is never kept on Company systems at any stage.
10. Your Rights Under the KVKK
Under Article 11 of the KVKK, you have the following rights regarding your personal data, which you may exercise by applying to the data controller:
- To learn whether your personal data is being processed,
- To request information if it has been processed,
- To learn the purpose of processing and whether it is used in line with that purpose,
- To know the third parties in Türkiye or abroad to whom it has been transferred,
- To request correction if it has been processed incompletely or inaccurately,
- To request its deletion or destruction under the conditions set out in Article 7 of the KVKK,
- To request that correction, deletion and destruction be notified to the third parties to whom the data has been transferred,
- To object to any outcome against you resulting from analysis exclusively by automated systems,
- To claim compensation if you suffer damage due to unlawful processing.
You can send your requests by email to info@higgstour.com or in writing to Barbaros Mah. 3001 Sk. No: 1 İç Kapı No: 19 Aksu / Antalya, Türkiye. Your application will be concluded free of charge within 30 days at the latest, depending on the nature of the request.
11. Changes and Effective Date
Our Company reserves the right to amend this Privacy Policy and Privacy Notice in line with changes in legislation or updates to the scope of our services. The current version is always published on this page and takes effect on the date of publication.
For questions: info@higgstour.com · +90 554 568 91 44