Company Logo
Belge no:17771
img

Privacy Policy

Last updated: 1 May 2026

1. Who we are (Data Controller)

This website (https://welcomeapp.org) and the WelcomeApp mobile application are operated by LEADERHOMES EMLAK İNŞAAT TURİZM VE TİC. LTD. ŞTİ., trading as TRUE WAYS TRAVEL AGENCY (TÜRSAB A-17771), with registered office at Kızlar Pınarı Mah., Kızlar Pınarı Cad., İlçi Apt. No:70/A, Alanya / Antalya, Türkiye (the "Company", "we", "our", "us"). For the purposes of the Turkish Personal Data Protection Law No. 6698 (KVKK) we act as the Data Controller.

For privacy-related questions you can reach us at [email protected] or at our KEP address —.

2. What personal data we collect

We collect only the data we need to provide our services:

  • Account data: e-mail, password (stored in hashed form), full name, country of residence, language preference.
  • Booking data: tour name, date, number of travellers, pickup address (textual address and / or geo-coordinates), special requests.
  • Payment data: the last four digits of your card, card type, transaction ID, billing address. Full card numbers, expiry dates and CVV codes are entered directly on the iyzico payment screen and never touch our servers.
  • Device data: device identifier, push notification token, app version, IP address, language and time zone.
  • Location data: the address / geo-coordinates that you set as the pickup point. We do not track your location continuously — only the pickup point you explicitly enter.
  • Communications: messages you send us by e-mail, contact form, or via messengers (WhatsApp / Telegram), if you choose to contact us through these channels.

3. Why we collect it (purposes and legal grounds — KVKK Art. 5)

  • To perform the contract you entered into with us (booking tours, organising the pickup at the address you provided).
  • To process payments and prevent fraud, together with our payment service provider iyzico.
  • To send you push notifications about the status of your bookings (booking confirmation, pickup reminders, changes).
  • To comply with our legal obligations, including bookkeeping, invoicing, tax, tourism and consumer protection regulations.
  • For our legitimate interests: customer support, service improvement, security of the website and the app.
  • With your explicit consent, where required: marketing communications, non-essential cookies and analytics.

4. Who we share your data with

We share your personal data only with parties that need it to deliver our services:

  • iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) — for processing card payments. iyzico is licensed by the BDDK and PCI-DSS compliant.
  • Local tour operators / partners in Türkiye — strictly the data needed to perform the pickup (name, pickup address, group size, language).
  • Push notification providers (Apple Push Notification Service, Firebase Cloud Messaging) — for delivering push notifications to your device.
  • Hosting and IT providers acting as our processors.
  • Tax authorities, courts and public authorities, when required by law.
  • Professional advisors (lawyers, accountants), under confidentiality.

We do not sell your personal data and we do not use it for profiling that produces legal effects on you.

5. International transfers

Some of our service providers may be located outside Türkiye. Where this is the case, transfers are made on the basis of your explicit consent (KVKK Art. 9) or other legal grounds permitted by KVKK and, where applicable, GDPR safeguards.

6. How long we keep your data

  • Booking and invoicing data: 10 years from the end of the calendar year in which the transaction occurred (Turkish Tax Procedure Law).
  • Account data: while your account is active, plus up to 3 years after deletion for legal record-keeping.
  • Customer support correspondence: up to 3 years.
  • Marketing data (if you opted in): until you unsubscribe.
  • Push notification tokens: while your app installation is active.

7. Your rights under KVKK (and GDPR, where applicable)

You have the right to:

  • learn whether we process your personal data, and if so, request information about it;
  • request the correction of incomplete or inaccurate data;
  • request deletion or destruction of your data within the limits of the law;
  • object to processing that produces a result against you, where carried out exclusively by automated means;
  • request compensation for damages caused by unlawful processing.

To exercise these rights, write to [email protected] or to our KEP address —. We will reply within 30 days.

You can also delete your account from the Settings screen of the WelcomeApp mobile application.

8. Security

We use SSL/TLS encryption everywhere, restrict access to personal data on a need-to-know basis, log administrative actions, and rely on PCI-DSS compliant providers for any card data.

9. Cookies

We use cookies that are strictly necessary for the website to work (session, security, language) and, with your consent, analytics and marketing cookies. You can manage your preferences at any time from the cookie banner.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page reflects the latest version. Material changes will be communicated by an in-app notice and / or by a notice on the website.

← Back to home