Privacy Policy

Last updated: 23 July 2026 -- yournext.tours

This Privacy Policy has been prepared in order to explain and inform you how your personal data is processed under Personal Data Protection Law No. 6698 ("KVKK") when you use the Your Next Tours service.

The data controller is First Point Yazılım Limited Şirketi (providing services under the Your Next Tours brand). Address: Balgat Mah. Ceyhun Atuf Kansu Cad. No: 36 İç Kapı No: 6, Çankaya, 06520, Ankara, Türkiye. MERSIS No: 0386104970700001. Trade Registry No: 513972 (Ankara Trade Registry Directorate). Tax Office/No: Hitit / 3861049707. Registered electronic mail (KEP): [email protected]. Contact: [email protected], +90 505 794 47 75.

We collect your data electronically, while you use the service, through our website and panel, the guide (tour leader) mobile application and the participant web client. Each data category below is stated together with the legal ground on which it relies.

Account data: e-mail address, display name, organisation (company) name if any, language preference and profile image (avatar). This data is processed on the legal ground of the establishment and performance of a contract (KVKK Art. 5/2(c)).

Usage data: tour sessions and their durations, participant counts, rating scores and comments, and the name entered by the participant, if any. This data is processed on the legal grounds of the performance of the contract and our legitimate interest in measuring and improving service quality (KVKK Art. 5/2(c), Art. 5/2(f)).

Configuration data: wallet addresses (network and address), WiFi profile information (SSID and password) and tour templates. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)).

Support data: the content of and correspondence relating to the support requests you open. This data is processed on the legal grounds of the performance of the contract and our legitimate interest (KVKK Art. 5/2(c), Art. 5/2(f)).

Pre-tour check-in data: the name entered by the participant, phone model, headphone/power bank status and free-form notes. This data is processed on the legal ground of the performance of the contract (KVKK Art. 5/2(c)). We kindly ask that you do not enter special categories of personal data, such as health data or biometric data, into free-text fields such as support requests and check-in notes; these fields are not designed for the collection of special categories of personal data.

Payment data: If you purchase a paid plan or credits, your billing information such as invoice title, address and tax identification number is processed in order to fulfil our statutory invoicing obligation; this processing relies on the legal ground of compliance with a legal obligation (KVKK Art. 5/2(ç)). Payment transactions are carried out through payment institutions such as iyzico, PayTR or Polar; card data such as the card number, expiry date and security code is not stored by us. Such data is held by the relevant payment institution and is transferred to that institution solely for the purpose of executing the transaction (KVKK Art. 5/2(c), performance of the contract).

We process data in order to provide and maintain the service, manage your account, provide support, measure and improve service quality, and fulfil our legal obligations.

Processing relies on the establishment and performance of a contract (KVKK Art. 5/2(c)), compliance with our legal obligation (KVKK Art. 5/2(ç)), our legitimate interest (KVKK Art. 5/2(f)) and, where necessary, your explicit consent (KVKK Art. 5/1).

For example, your account and subscription data is processed on the basis of the performance of the contract, your billing data on the basis of a legal obligation, and the campaign attribution data described in Section 8 on the basis of your explicit consent.

For the purpose of providing the service, your data may be shared with hosting and infrastructure providers, our e-mail delivery service provider and, where used, payment institutions. These providers act in the capacity of data processors, solely in accordance with our instructions and under contractual security obligations.

Some recipients, such as our hosting/infrastructure provider and our e-mail delivery service provider, are established abroad. Pursuant to Article 9 of the KVKK, such transfers are carried out on the basis of one of the appropriate safeguard mechanisms provided for in Article 9 of the KVKK, such as the execution of the standard contract published by the Personal Data Protection Board, transfer to a country affording an adequate level of protection, or, where necessary, your explicit consent. Where a payment institution is used, the transfer to that payment institution is likewise made solely for the purpose of executing the transaction and in accordance with one of the safeguard mechanisms set out above.

In order to ensure the security of your data, we apply appropriate technical and administrative measures, in particular encryption, access control and the principle of least privilege.

We retain personal data only for as long as necessary for the purposes of processing and for the periods prescribed by the applicable legislation. The retention period may vary according to the data category (for example, billing data is retained for the period prescribed by the applicable tax legislation). Once the period expires, the data is deleted or anonymised.

Pursuant to Article 11 of the KVKK, as a data subject you have the following rights: (a) to learn whether your personal data is processed, (b) to request information if it has been processed, (c) to learn the purpose of processing and whether the data is used in accordance with that purpose, (ç) to know the third parties to whom the data is transferred domestically or abroad, (d) to request rectification if the data has been processed incompletely or inaccurately, (e) to request erasure or destruction of the data within the conditions set out in Article 7 of the KVKK, (f) to request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred, (g) to object to a result to your detriment arising from the analysis of the data exclusively by automated systems, (ğ) to claim compensation if you suffer damage due to unlawful processing. Your applications are concluded free of charge within 30 days at the latest, depending on their nature.

You can delete your account from the panel. You may submit requests relating to the rights set out above to [email protected].

The site does not use third-party tracking (analytics, advertising). We store strictly necessary data in your browser in order to keep you signed in and to remember your cookie consent preference (dw_refresh, dw_remember, dw_consent); this storage does not require consent.

If you arrive via a campaign or referral link, we additionally store first-party campaign attribution data (dw_attr_first, dw_attr_last) in order to measure which campaign led to the registration. This attribution data relies on your explicit consent; you can manage your preference through our cookie consent mechanism -- see our Cookie Policy for the full list.

If third-party analytics is added in the future, a separate consent mechanism will be introduced.

You can reach us at [email protected] with any questions regarding this policy.