1. Controller
The controller is ALI TARHINI — TARHINI SYSTEMS, a Turkish sole proprietorship. Kemer Tax Office: 8240760220; Tradespeople and Craftspeople Registry No. 313614. Address: Yeni Mahallesi, Akdeniz Caddesi No: 30 C, Kemer / Antalya, Türkiye. Contact: info@toursico.com; +90 555 178 2207.
This covers visitors, accounts, service/reservation/transfer requests, provider representatives/staff and support/job-application communications. Providers may separately control fulfilment data; any software processor role is assessed under the actual service agreement.
2. Collection and categories
Information is collected through electronic forms, accounts/sessions, quotations/reservations, provider content, email/phone and system records, by automatic means or non-automatic means forming part of a filing system. Categories include identity/contact, accounts/permissions, business/project, reservation/transfer/participants, financial/document, correspondence/application and technical security information.
Selected locations/routes serve the requested function; device location requires your request and browser permission. Original payment/collection records exist even though online card collection is inactive. Do not send unnecessary identity documents, sensitive data, passwords or card security information.
3. Activity, purpose and processing condition
- Requested accounts, offers, reservation/transfer coordination, software and support: information directly necessary for contract formation/performance (Article 5/2-c).
- Invoices/accounting, required records and lawful authority requests: the necessary information for statutory requirements/legal obligations (Article 5/2-a and ç).
- Necessary request/dispute, contract, acceptance, delivery and payment evidence: establishing, exercising or protecting rights (Article 5/2-e).
- Security, session/role control, abuse and error investigation: proportionate legitimate interests without harming fundamental rights (Article 5/2-f).
- Job-application communications: information necessary to assess the requested employment relationship (Article 5/2-c); necessary legal defence evidence has a separate rights-protection ground.
- Marketing: accounts/reservations/enquiries do not create consent. Any separately consent-based purpose needs specific information and a free choice.
4. Recipients and transfers
Necessary information may go to the identified activity provider, authorised business/fulfilment staff, actual infrastructure including Vercel, Supabase, Resend and Google email/identity/maps services, configured OpenAI services when an authorised content tool is invoked, professional advisers and entitled authorities. Roles, scope and permissions depend on the actual processing.
International providers require an applicable Article 9 mechanism. This notice is not an assertion of signed/notified standard contracts or verified safeguards; continuous transfers are not described as occasional exceptions. Google sign-in and historical Gmail authorisation details are in the Privacy policy.
5. Retention and security
Purpose-based necessity and applicable statutory retention/limitation periods govern retention. Once the ground ends, lawful deletion, destruction or anonymisation applies, with assessment of backups/provider lifecycles and other persons’ rights. Branding changes do not delete historical records or assign them to a different business. Session/permission boundaries remain applicable.
6. Rights and applications
Article 11 provides processing/purpose/recipient information, correction, conditional deletion/destruction and notification, objection to an adverse automated result and compensation rights. Start at info@toursico.com or write to the registered address. Statutory application methods, registered-email conditions and proportionate identity verification apply.
State your request and reply channel without unnecessary sensitive attachments. Requests are answered as soon as possible and within thirty days. Any fee is limited to the statutory tariff; Board/court remedies remain intact. Reading this notice requires no consent checkbox or marketing permission.