Privacy Policy

As Tolerance Seyahat Turizm ve Organizasyon Anonim Şirketi (“Lufer Tour”), we are committed to processing the information you share while using the tour reservation services we offer through lufer.com.tr in a confidential manner. This policy complements our KVKK Information Notice and explains our privacy practices specific to our services.

Data Controller / Seller: Tolerance Seyahat Turizm ve Organizasyon Anonim Şirketi (operating under the “Lufer Tour” brand)

Address: Orhan Veli Kanık Street No: 53/1 Kavacık / Beykoz / Istanbul

Tax Office/No: Beykoz Tax Office / 8490698779

MERSİS No: 0849069877900001

E-mail: bilgi@lufer.com.tr

Phone: +908504206464

Web: lufer.com.tr

1. Information We Collect

Account information: name, surname, e-mail, phone, password (encrypted).
Reservation information: selected tour, date/time, number of people, communication preference, billing information.
Payment information: All card transactions are processed on the PCI-DSS certified Iyzico infrastructure. Lufer Tour does not store, see, or receive card number, CVV, or expiration date on its servers.
Usage information: IP, browser, session log, page views.
Cookies/analytics: GA4 and Meta Pixel only with consent.

2. How We Use the Information

To establish the reservation, collect payment, confirm the tour, and send change notifications.
Customer support, request, and complaint management.
Security of your account and prevention of fraud.
Fulfilling legal obligations (tax, manifest, commercial law).
Subject to your consent; e-mail/SMS marketing, campaign notifications, site analysis via GA4/Meta Pixel.

3. Sharing with Third Parties

We share your data only with the following parties, and only to the extent necessary:

Iyzico (payment & refund)
Resend / Gmail SMTP (e-mail delivery)
Google Ireland Ltd. (only with consent, GA4)
Meta Platforms Ireland Ltd. (only with consent, Meta Pixel)
Legal authorities (where required by law)

We do not sell or rent your data to advertising partners.

4. Security Measures

All connections are encrypted with HTTPS / TLS.
Passwords are stored hashed using modern algorithms such as bcrypt.
Payment data is processed in the PCI-DSS compliant Iyzico infrastructure; card information is not stored on our servers.
Role-based authorization is implemented against unauthorized access; admin panel logs are kept.

5. Children's Privacy

Our services are not intended for users under 18 to make reservations on their own. Information relating to children is provided only by the parent/guardian making the reservation and is used for manifest / age category determination.

6. Retention and Deletion

Your data is retained for the periods specified in Article 6 of the KVKK Information Notice. At the end of the period, it is deleted, destroyed, or anonymized.

7. Your Rights and Contact

To exercise your rights under Article 11 of the KVKK and for any privacy-related requests, you may contact bilgi@lufer.com.tr.

Cookie Policy

Tolerance Travel Tourism and Organization Inc. (“Lufer Tour”) uses cookies and similar tracking technologies on the website lufer.com.tr. This Cookie Policy explains which cookies we use, why we use them, and how you can manage them. Our policy complies with Article 5 of the Personal Data Protection Law (KVKK) and the Guide on Cookie Practices (KVKK Board, June 2022).

1. What is a Cookie?

A cookie is a small text file placed on your device by the website you visit via your browser and can be read on subsequent visits. Cookies are used to remember your session information, measure site performance, and personalize content.

2. Categories of Cookies We Use

2.1 Mandatory Cookies (always active)

These are absolutely necessary for the basic functions of the site (login, cart, language preference, cookie preference, etc.); consent is not required.

session_token — session authentication (1st party, session duration)

cookie_consent_v2 — your cookie consent preferences (1st party, 12 months)

i18n_locale — language preference (1st party, 12 months)

2.2 Analytical Cookies (active with consent)

Measures site usage anonymously; analyzes how often each page is visited.

Google Analytics 4 (Google Ireland Ltd.): _ga, _ga_* (3rd party, 13 months) — only installed when you consent.

2.3 Marketing / Targeting Cookies (active with consent)

Used to show ads based on your interests and measure conversions.

Meta Pixel (Meta Platforms Ireland Ltd.): _fbp, fr (3rd party, 90 days)

Affiliate / UTM: utm_source, utm_campaign etc. (1st party, 30 days) — solely to transmit anonymous conversion information to the business partner who referred you to our site.

3. Consent Management

You can use the “Accept All”, “Reject All” or “Manage Preferences” options via the Cookie Consent Banner presented to you upon your first visit to our site. Your preferences are stored in the cookie_consent_v2 cookie for 12 months. You can change your preference at any time via the Cookie Preferences link at the bottom of the page.

Analytical and marketing cookies are not loaded until you give your explicit consent; rejecting them does not affect the basic functions of the site.

4. Management via Browser

Chrome: Settings > Privacy and Security > Cookies

Safari: Preferences > Privacy

Firefox: Settings > Privacy and Security

Edge: Settings > Cookies and site permissions

If you reject all cookies, some functions of the site may not work.

5. Contact

For questions about cookies, you can contact us at bilgi@lufer.com.tr.