Privacy Policy and Data Notice

Data we process

• Your selected cruise, full name, email address, phone number, and message.
• Your commercial electronic communication choice.
• For form security and request records: date/time, IP address, browser user agent, page, and referrer details.
• UTM campaign parameters when they are present in the link you followed.
• The consent schema, category choices, and time saved.
• Measurement data collected by Google tags configured in GTM for categories you enable.

Purposes and legal basis

Form data is processed to respond to your request, contact you about reservation or travel options, secure the service, and understand the source of the request. Commercial communications and optional analytics, advertising, or social media processing are enabled according to your explicit choice or consent. Records may also be processed where necessary to meet legal obligations or establish, exercise, or defend legal rights.

Recipients and international transfers

Information-request form data is sent to the configured Google Sheets webhook. If the SendPulse integration is enabled in production, it is also sent to SendPulse for communication and campaign management. Hosting, security, and technical support providers may have limited access where needed to operate the service. Enabling Google Analytics, Google Ads, or YouTube may transfer information to those providers’ systems outside Türkiye. Only tags actually configured in the external GTM container run; the container configuration is not part of this code repository.

Cookies and consent preferences

Google Consent Mode v2 signals are denied on first load. Analytics controls only analytics_storage; advertising controls ad_storage, ad_user_data, and ad_personalization together. Social media consent controls YouTube previews and frames. Your choice is stored under aroya_cookie_consent_v2 for no more than 180 days. See the Cookie Policy for details.

Retention

The cookie preference expires after 180 days. Form and communication records are kept only as long as needed to respond, manage a commercial relationship or dispute, and meet applicable statutory retention obligations. External-provider retention varies according to the production configuration of the integrations that are actually enabled.

Your rights and withdrawing choices

To ask about access, correction, deletion, recipients, objection, or other rights under applicable data-protection law, contact [email protected]. You can withdraw commercial communication consent through İYS or company contact channels and change cookie preferences using the button below at any time.