Privacy and Cookie Policy

1. Data Controller

This policy has been prepared by KEP HOMES VACATIONS TRAVEL AGENCY (hereinafter "KepTransfer", "we") to explain how we process personal data collected through the keptransfer.com website (hereinafter the "Site") under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and — for visitors accessing from the European Economic Area (EEA) — the European Union General Data Protection Regulation ("GDPR").

KepTransfer, acting as the data controller under the KVKK, can be reached at info@keporganization.com. TÜRSAB License No: 17953.

2. Personal Data We Process

We process the following categories of personal data through the Site:

• Identity and contact data: first name, last name, e-mail address, phone number (collected when a booking is made).
• Travel data: pick-up/drop-off location, date, time, flight number (optional), number of passengers, selected vehicle type.
• Booking and transaction data: the PNR code generated on the server, booking status, calculated price, payment method information (card details are not stored on our Site).
• Account data: authentication data managed via Firebase Authentication when you create an account (e-mail, hashed password).
• Consent and proof records: the version of the KVKK notice (kvkkVersion) and the consent timestamp (kvkkAgreedAt).
• Technical data: IP address, browser type, device information, language preference, pages visited, browsing duration (see the cookie section below).

3. Purposes and Legal Bases of Processing

• Providing the transfer booking service — KVKK Art. 5/2(c) (conclusion and performance of a contract) / GDPR Art. 6(1)(b).
• Fulfilling legal obligations (invoicing, accounting, notification to competent authorities) — KVKK Art. 5/2(a) and (ç) / GDPR Art. 6(1)(c).
• Legitimate interest in ensuring service security and preventing fraud — KVKK Art. 5/2(f) / GDPR Art. 6(1)(f).
• Analytics and advertising cookies for measurement and marketing — based solely on explicit consent / GDPR Art. 6(1)(a), managed through the cookie consent banner.

4. Cookie Policy

Cookies are small text files placed on your device by the websites you visit. In line with the Turkish Data Protection Authority's "Guidelines on Cookie Practices" (July 2025), the cookies we use are classified as follows.

4.1 Strictly Necessary Cookies

These are strictly required for the Site to function and are not subject to your consent. Examples: remembering booking form preferences during the session, your language preference (i18nextLng), your theme preference, and your cookie consent state (keptransfer-consent). These are stored in your device's local storage (localStorage) and are not shared with third parties.

4.2 Analytics Cookies (Optional)

We use Google Analytics 4 (GA4) to measure the performance of the Site, understand which pages attract interest, and improve the experience. GA4 may process the following data:

• Anonymized IP address, device and browser information
• Pages visited, session duration, the source you arrived from
• Conversion events such as booking completion (contains no personal name/contact details)

Provider: Google Ireland Ltd. Retention period: 14 months. These cookies are loaded only with your explicit consent.

4.3 Advertising and Marketing Cookies (Optional)

We may use the relevant Google cookies for Google Ads conversion measurement and remarketing. Provider: Google Ireland Ltd. These cookies are also loaded only with your explicit consent; if you decline, advertising storage is blocked via Google Consent Mode v2 and only limited/anonymous signals are transmitted.

4.4 Manage Your Preference

You can update your consent at any time using the buttons below. Your current preference: No choice made yet.

You can also delete or block all cookies through your browser settings; however, blocking strictly necessary cookies may cause some parts of the Site to stop working.

5. Transfers and Recipient Groups

Your personal data may be transferred to the following recipient groups for the stated purposes:

• Google LLC / Google Ireland Ltd. — Firebase Firestore (booking database and authentication) and GA4/Google Ads (consent-based measurement only).
• Vercel Inc. — Site hosting service; server logs are processed temporarily.
• Telegram Messenger LLP — only the necessary travel summary details are shared in order to deliver booking notifications to our operations team.
• Competent public authorities — in the event of a legal obligation, limited to the requested data.

6. International Transfers

Services such as Firebase and GA4 may result in personal data being processed in the USA and/or EU member states. These transfers are carried out under KVKK Art. 9 and Chapter V of the GDPR (Standard Contractual Clauses / SCC). Transfers for analytics and advertising purposes are made only with your explicit consent.

7. Retention Periods

• Booking and invoice data: 5 years pursuant to the Turkish Tax Procedure Law.
• Account data: for as long as your account is active; within 30 days at the latest upon a deletion request.
• Analytics data (GA4): 14 months.
• Consent proof records (kvkkAgreedAt): same as the booking retention period.

8. Your Rights

Under KVKK Art. 11 and — to the extent applicable — GDPR Art. 15-22, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn whether it is used in accordance with its purpose; know the third parties to whom it has been transferred domestically or abroad; request the correction of incomplete or inaccurately processed data; request its erasure or destruction where the conditions are met; request that these actions be notified to the third parties to whom the data has been transferred; and object to any adverse outcome resulting from the processing being analyzed exclusively by automated systems.

To exercise these rights, you may send your requests to info@keporganization.com. Your request will be answered free of charge within 30 days at the latest. If you find our response insufficient, you have the right to lodge a complaint with the Turkish Personal Data Protection Board.

9. Changes

This policy may be updated due to changes in legislation or updates to our services. The current version is always published on this page, with the effective date shown above.

10. Contact

For your questions: info@keporganization.com