Privacy Policy and KVKK Notice

This notice explains how TOROTIC TURİSTİK HİZMETLER YAZILIM VE BİLİŞİM ÇÖZÜMLERİ TİCARET LİMİTED ŞİRKETİ (the "data controller") processes personal data on the toroti platform, in line with the information obligation under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").

Who we are

Legal name	TOROTIC TURİSTİK HİZMETLER YAZILIM VE BİLİŞİM ÇÖZÜMLERİ TİCARET LİMİTED ŞİRKETİ
Trade name	toroti
Company type	Limited liability company (Limited Şirket)
Registered office	Dolbazlar Mah. Merkez_1 Küme Evleri No: 153, İç Kapı No: 1, Manavgat / Antalya, Türkiye
Trade registry	Manavgat Ticaret Sicili Müdürlüğü, No. 15875
MERSİS no	0856086479600001
Tax number	8560864796
Website	https://toroti.com
Contact	Contact page

1. Data We Process

Identity and contact: name, e-mail address. Account: password hash, preferences, language and notification settings. Security: IP address, session records, device/browser information, guest session identifier. Usage: trips, routes, notes, favourites, uploaded images, text you send to the AI assistant. Location: only with your explicit permission, to show your position on the map. Financial: transaction results and invoice details returned by the payment institution; we never see or store your card number.

2. Purposes

Creating and managing your account; providing the trip-planning service; running subscription and payment processes; handling support requests; measuring and improving service quality; ensuring security and preventing abuse and fraud; meeting our legal obligations.

3. Legal Grounds

Under Article 5 of the KVKK we rely on: necessity for the conclusion or performance of a contract (account, subscription, payment), compliance with a legal obligation (invoicing, tax and retention duties), legitimate interest (security, abuse prevention, service improvement) and, where required, explicit consent (location data, marketing messages, non-essential cookies).

4. Sharing

Data is shared, only as far as necessary to run the service, with: the payment institution (iyzico — subscription payments), hosting and infrastructure providers, the e-mail delivery provider, the map and location service provider, and the product analytics provider. Transfers to providers located abroad are made in accordance with Article 9 of the KVKK. We do not sell your data to third parties for marketing.

Disclosure to public authorities is made only where legislation requires it and limited to what is requested.

5. Retention

Account and usage data is kept while your account is open and thereafter for the applicable limitation periods. Commercial and financial records are retained for 10 years as required by law. Once the periods expire, data is deleted, destroyed or anonymised.

6. Your Rights (KVKK Art. 11)

You have the right to learn whether your data is processed and to request information about it; to learn the purpose and whether it is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to request correction of incomplete or inaccurate data; to request erasure or destruction where the conditions are met; to request that corrections and erasures be notified to recipients; to object to results produced solely by automated analysis that work against you; and to claim compensation for damage caused by unlawful processing.

Send requests through our contact page or in writing to our registered address. Requests are answered within 30 days at the latest.

7. Security

Data is encrypted in transit with TLS, passwords are stored irreversibly, and role-based access control and logging are applied against unauthorised access. In the event of a breach we notify the Personal Data Protection Board and the individuals concerned within the statutory period.

8. Cookies

Cookie use is described separately in our Cookie Policy.