1. Data controller and contact details
For the activities described in this notice, the data controller is the operator of the Casa Miller Travel brand and website.
Casa Miller Travel
Hacımimi Mahallesi, Kemeraltı Caddesi No: 37/A,
Beyoğlu, İstanbul, Türkiye
Email: info@casamillertravel.com
Phone: +90 546 258 50 61
TÜRSAB No: 14286
2. Personal data we may collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, surname, email address, phone number, nationality and preferred language. |
| Booking and travel data | Travel date, destination, guest count, itinerary, pickup details, booking reference, requests and service history. |
| Traveller documentation | Passport, identity or date-of-birth details where required for a confirmed supplier, ticket, permit or legal reporting obligation. |
| Payment and transaction data | Payment status, amount, currency, invoice information and transaction reference. Full card data is normally handled by the payment provider. |
| Communication data | Contact form messages, email correspondence, WhatsApp messages, support notes and preferences. |
| Technical and usage data | IP address, browser, device, page activity, security logs and cookie identifiers where relevant. |
| Special request data | Mobility, dietary, allergy or health-related information only when you choose to provide it and it is relevant to safe service delivery. |
3. How we collect personal data
We may collect personal data:
- directly from you through contact, booking, account or payment forms;
- through email, telephone, WhatsApp or in-person communications;
- from another person making a booking on your behalf;
- from travel agencies, accommodation providers, transport operators, guides or other suppliers involved in your itinerary;
- automatically through necessary website logs, security tools and cookies;
- from public or official sources where verification is reasonably required.
4. Purposes and legal grounds
Depending on the interaction and applicable law, personal data may be processed to take steps at your request, perform a travel contract, comply with legal obligations, protect legitimate business and security interests, establish or defend legal claims, or where necessary rely on your explicit consent.
| Purpose | Typical basis |
|---|---|
| Responding to an enquiry or preparing a quotation | Steps requested before entering into a contract; legitimate interest in responding to customer requests. |
| Creating and managing a booking | Performance of the travel service agreement. |
| Sharing necessary details with suppliers | Performance of the booking and delivery of requested services. |
| Payments, invoicing and accounting | Contractual necessity and compliance with financial or tax obligations. |
| Customer support, complaint handling and dispute management | Contract, legitimate interests and establishment or defence of legal claims. |
| Website security and fraud prevention | Legitimate interests and compliance with security obligations. |
| Optional marketing communications | Your consent or another lawful basis permitted by applicable electronic communication rules. |
| Health, dietary or accessibility requests | Your explicit request or consent and, where relevant, protection of vital interests. |
5. Who personal data may be shared with
We may share only the information reasonably needed with recipients such as:
- tour guides, vehicle and transfer operators, boat operators, hotels, restaurants, attractions and other itinerary suppliers;
- payment processors, banks and financial service providers;
- website hosting, email, customer support, analytics and security service providers where enabled;
- accountants, auditors, insurers and professional advisers;
- public authorities, law enforcement, courts or regulatory bodies where legally required;
- a successor or transaction adviser in connection with a lawful business reorganisation.
Service providers are expected to use personal data only for the agreed service and to apply appropriate confidentiality and security controls.
6. International transfers
Travel arrangements may require information to be sent to a supplier or technology provider located outside Türkiye or outside the country where you live. Where an international transfer occurs, we seek to use an applicable legal transfer mechanism, contractual protection or another lawful safeguard required by the relevant rules.
7. How long we keep personal data
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, including booking fulfilment, customer support, accounting, tax, legal reporting, security, complaint handling and limitation periods.
Retention periods vary by data type. Data may be deleted, anonymised or securely archived when the relevant purpose and mandatory retention period end.
8. Cookies and similar technologies
The website may use strictly necessary cookies for functions such as security, session continuity, language preference, forms and account access. Analytics, advertising or other optional technologies are used only where enabled and handled in accordance with the applicable consent requirements.
You can control cookies through the cookie preference tool where available and through your browser settings. Disabling necessary cookies may prevent parts of the website from operating correctly.
9. Data security
We use organisational and technical measures designed to protect personal data against accidental loss, misuse, unauthorised access, alteration or disclosure. Measures may include access controls, authentication, secure transport, logging, backups and restricted supplier access.
No online service can guarantee absolute security. Please do not send full payment card details or unnecessary identity documents through ordinary email or website message fields.
10. Your privacy rights
Subject to the law that applies to your request, you may have the right to:
- learn whether your personal data is being processed;
- request access to information about the processing;
- ask for inaccurate or incomplete data to be corrected;
- request deletion, destruction or restriction where legal conditions are met;
- learn the recipients to whom data has been transferred;
- object to certain processing or automated outcomes where applicable;
- request data portability where applicable;
- withdraw consent for future processing where processing is based on consent;
- make a complaint to the competent data protection authority.
To make a request, email info@casamillertravel.com with enough information for us to understand and verify the request. We may ask for reasonable identity verification before disclosing or changing personal data.
11. Marketing communications
Where you have opted in or another lawful basis applies, we may send information about Casa Miller Travel services. You can unsubscribe through the message instructions or contact us. Service messages concerning an enquiry or booking are not marketing and may still be sent where necessary.
12. Children’s data
Bookings for children must be made by a parent, guardian or authorised adult. We may process limited child traveller information where required to arrange a family booking, ticket, accommodation, safety measure or legal record. The booking adult should provide only information necessary for the service.
13. Third-party websites and services
Our website may link to payment providers, maps, social networks, suppliers or other third-party services. Their privacy practices are controlled by them, and you should review their notices before providing personal data directly to those services.
14. Updates to this policy
We may update this notice when our services, suppliers, technology or legal obligations change. The updated date at the top of the page identifies the current version.
15. Privacy contact
Privacy questions and data subject requests can be sent to: info@casamillertravel.com.
You may also write to Casa Miller Travel at Hacımimi Mahallesi, Kemeraltı Caddesi No: 37/A, Beyoğlu, İstanbul, Türkiye.