ROMA

Privacy Policy

Last Updated: November 20, 2025

This Privacy Policy outlines how Nova Roma Travel ("we", "our", "us") collects, uses, and protects the personal information of users who visit or make bookings through our website novaromatravel.com.

1. Information We Collect

When you use our website or book a service, we may collect the following types of information:

• Personal identification information (Name, Email, Phone Number, etc.)
• Booking details (Selected tours, dates, number of guests)
• Payment information (processed securely via iyzico)
• Device and usage data (browser type, IP address, time zone, etc.)

2. How We Use Your Information

Your personal data is used to:

• Process bookings and payments securely
• Provide customer support and respond to inquiries
• Improve our website and services
• Send confirmation emails, service updates, and important information related to your booking
• Comply with legal obligations

3. Payment Processing

All online payments are securely handled by iyzico. We do not store your full credit card details on our servers. For more information, please refer to iyzico's own privacy policy.

4. Data Sharing

We do not sell, rent, or trade your personal data. Your data may be shared only with:

• Trusted service providers assisting us in operations (e.g. tour partners, payment processors)
• Legal authorities if required to comply with Turkish or international law

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with applicable laws and regulations. Our data retention periods are:

• Cookie Consents: Retained for 12 months, after which they are anonymized using SHA-256 hashing and archived for compliance purposes
• Booking & Transaction Data: Retained for 10 years to comply with Turkish tax and accounting regulations
• User Account Data: Retained for 10 years for legal compliance, or until account deletion is requested
• Audit Logs & Consent Records: Retained for 10 years to meet GDPR, KVKK, and ISO 27001 compliance requirements
• Anonymized Data: After the retention period, personal identifiers are irreversibly anonymized using cryptographic hashing while preserving statistical data for compliance reporting

6. Your Rights

You have the right to:

• Access, update, or delete your personal information
• Withdraw consent at any time (where applicable)
• Lodge a complaint with a data protection authority

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience, analyze website performance, and provide personalized content. We are committed to transparency and compliance with GDPR, KVKK, and ISO 27001 standards.

When you first visit our website, you will see a cookie consent banner allowing you to accept or reject non-essential cookies. Your preferences are stored for 12 months and can be changed at any time through the cookie settings.

We use the following types of cookies:

• Necessary Cookies (Always Active): Essential for website functionality including authentication, security, and session management. These cannot be disabled as the website would not function properly without them.
• Functional Cookies (Optional): Remember your preferences such as language selection, currency, and customization settings to provide a more personalized experience.
• Analytics Cookies (Optional): Help us understand how visitors interact with our website by collecting anonymized usage statistics, allowing us to improve our services.
• Marketing Cookies (Optional): Used to deliver relevant advertisements and track campaign effectiveness. These cookies may track your browsing across different websites.

Your cookie consent data is protected using industry-standard SHA-256 encryption for IP addresses and user agent information. We maintain detailed audit logs of all consent actions for compliance purposes.

You can manage your cookie preferences at any time by clicking the cookie settings button in the footer of our website, or by adjusting your browser settings to block or delete cookies.

8. International Users

If you are accessing our website from outside Turkey, please note that your information may be transferred to and processed in Turkey, where our servers and service providers are located.

9. Security

We take appropriate security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

10. Updates to This Policy

We may update this Privacy Policy periodically. The latest version will always be available on this page, and significant changes will be communicated via email or on the website.

11. Contact Us

If you have any questions about this Privacy Policy or your personal data, please contact us at [email protected].