Updated: October 19, 2026 ·
1. Booking and travel information
Where necessary for booking and travel services, we may process names, date of birth, nationality, identity and passport details; contact information; sailing, date, cabin, passenger, flight, transfer and accommodation preferences; and payment, invoice, refund and enquiry records. Only necessary information should be shared when booking for other passengers.
Booking and information requests may be received through the website, sales office, telephone, email, WhatsApp, authorised agents and relevant travel service providers. Necessary information for booking, payment, changes, cancellation and refunds is used to provide the relevant service and meet applicable obligations.
2. Marketing and operational communications
Consent to commercial messages is not a condition of booking or using our services. You may withdraw it at any time and manage preferences through the Message Management System (İYS) where applicable. Withdrawal of marketing permission does not prevent operational messages needed to fulfil your booking.
The homepage booking search component loads from booking.aroya.com.tr. Loading it connects to that service and may transmit technical information such as your IP address, device and browser details to its provider. Also review the booking service’s own notices for its data processing and payment steps.
3. Controller and scope
SUNORAMA CRUISES GEMİCİLİK HİZMETLERİ A.Ş. is the controller for the AROYA Türkiye website and sales, enquiry and travel services it operates. AROYA is the brand; Sunorama remains the service company. The cruise operator may provide separate notices for its own processing.
This notice provides information under Article 10 of Turkish Law No. 6698 (KVKK). Reading it or visiting the site is not consent to processing or marketing.
4. Collection and data
We may receive information from you through the website, newsletter form, email, telephone, WhatsApp, sales offices and authorised agents, electronically or on paper. Necessary travel information may also come from your authorised representative and service partners.
The newsletter stores your email, language, registration/consent times and notice version. The planner helps you contact the sales team; the homepage search uses an external booking component. Hosting and security services may process IP addresses, request times and browser information.
5. Purposes and legal grounds
Contact details, cruise/cabin preferences, passenger numbers and correspondence are used to answer enquiries and arrange or perform a contract where necessary under Article 5(2)(c). Identity, passport and passenger details may be requested separately when needed for a confirmed booking.
Financial and transaction records are processed where required by law under Article 5(2)(a)/(ç), or for legal claims under Article 5(2)(e). Support and security records rely on applicable legal duties, the protection of rights or proportionate legitimate interests that do not override your fundamental rights (Article 5(2)(ç)/(e)/(f)).
Optional newsletter and marketing processing relies on purpose-specific consent. Commercial electronic messages also require compliance with Law No. 6563 and applicable consent and İYS rules. Newsletter registration is not a condition of purchasing a cruise; contact us to withdraw consent.
Health and accessibility information is handled only when necessary and a condition under the revised Article 6(3) applies, with the required safeguards; consent is needed if no other condition applies. Do not put sensitive details in the newsletter field. Information about children is obtained through their legal representatives where needed for travel. This website does not create marketing profiles based on occupation, marriage dates or children.
6. Recipients and international transfers
Necessary data may be shared with the cruise operator, agents, port/border authorities and, depending on your package, accommodation, transport and insurance providers. Financial institutions, authorised hosting/support providers, legal advisers and competent authorities may receive information for the corresponding service or legal requirement.
Cloudflare hosts the website and its D1 database stores newsletter registrations. Starting a YouTube video connects to Google/YouTube; following a WhatsApp link connects to the messaging provider. These services and international travel recipients can involve processing abroad.
The revised Article 9 requires an adequacy decision or appropriate safeguards, such as the Board’s standard contract; limited exceptions without these safeguards apply only to incidental transfers. A blanket consent is not by itself sufficient for continuous cloud transfers. Contact Sunorama for details of recipients and applicable safeguards.
7. Retention and security
Records are kept only for their purpose and applicable legal retention requirements. You may request removal of your newsletter registration. When all processing and retention grounds cease, data must be erased, destroyed or anonymised. Necessary legal-claim records may be kept only for that limited purpose.
Article 12 requires appropriate technical and organisational measures against unlawful processing and unauthorised access, proportionate to the data and risks.
8. Your rights and requests
Article 11 gives you rights to learn whether and why data is processed, request information, learn domestic/foreign recipients, correct inaccurate or incomplete data, and request erasure/destruction where conditions are met. You can request notification of corrections/erasure to recipients, object to adverse results based solely on automated analysis and claim compensation for unlawful processing.
Send a signed written request to the postal address below or use the registered electronic mail (KEP) address. You can also use an email address previously notified to and recorded by Sunorama, or other methods allowed by the relevant Communiqué, including secure electronic or mobile signature. Include your name, signature for written requests, Turkish identity number (nationality and passport/identity number for foreign nationals), service address, optional email/phone and request. Avoid unnecessary sensitive documents.
Requests are normally free and answered within 30 days; the Board’s tariff may apply to additional costs. After first applying to Sunorama, you may complain to the Board if refused, inadequately answered or not answered in time: within 30 days of learning the response and in any case within 60 days of your application.
9. Microsoft Clarity
Microsoft Clarity loads only after you allow analytics. Microsoft may process page views, clicks, scrolling, device/browser information and IP addresses to provide heatmaps and session recordings. Clarity may use cookies such as _clck and _clsk to connect visits. Advertising storage consent is not granted. Withdraw permission by choosing Necessary only in Cookie preferences in the footer; Clarity is stopped. Microsoft services may process data abroad; the international-transfer information also applies.
10. Google Tag Manager / Google Analytics
Google Tag Manager loads Google Analytics visit measurement after your analytics permission. Google may process page URLs, interactions and device/browser information; cookies such as _ga may connect visits. The existing container also includes Google Ads tags; advertising storage, advertising user data and personalization consent are sent as denied. Google services may process data abroad. You can withdraw permission in Cookie preferences.
Contact Sunorama
SUNORAMA CRUISES GEMİCİLİK HİZMETLERİ A.Ş.
Caddebostan Mah. Bağdat Cad. No:311 Mengüç Apt. K.1 D:1-2, Kadıköy / İstanbul
KEP: sunoramacruises@hs01.kep.tr
Email: rezervasyon@aroya.com.tr
Related notices: