Privacy Policy

Last updated: 21 October 2026

This notice explains how Private Tour Ephesus, operated by Romos Travel Agency, handles personal information when you use this website, contact our team or submit a guest review.

Who is responsible for your information?

The operator and data controller is Romos Turizm Bilişim Dış Ticaret Ltd. Şti., trading as Romos Travel Agency, TURSAB licence A-13114. Our head office is at Sinanpaşa Mah. Alaybeyi Sok. No:2 İç Kapı:3, Beşiktaş, İstanbul, Türkiye. For privacy enquiries, email [email protected] or call +90 212 327 26 87.

Information you provide

Contact and tour enquiry forms collect your name, email address, preferred travel date, party size and message, together with the page or tour you enquire about. Tour enquiries also record the group price displayed when you submit your request. These forms request an enquiry; they do not collect payment-card details or confirm a booking.

When you submit a review, we collect the name, email address, rating, review text and travel or review date you provide, and your permission to publish it. Approved reviews may display your submitted name, rating, text and date. Your review email address is not displayed publicly. Only include personal information in a review that you are comfortable making public.

Please do not send passport details, payment-card information, medical records or other sensitive information through the general website forms. If particular information is needed to arrange a service, our team will explain the request separately.

Technical and enquiry context

When you submit an enquiry, we record its reference and time, the relevant page, your IP address, browser and device information, browser language, first landing page and referring website where available. The visitor-context feature removes URL query strings and fragments from the landing, current and referrer addresses it records. The hosting and network services may separately maintain technical access and security logs.

We use this context to understand and respond to enquiries, investigate delivery problems, protect the forms from abuse and maintain reliable website operation. Enquiry details and this technical context are available to authorised staff in the private enquiry inbox and company notification email. Customer acknowledgement emails do not include the private technical context.

Purposes and grounds for processing

We process enquiry information to answer your request, prepare a quotation and take steps at your request towards a possible travel-service contract. Where relevant, we also process records to fulfil legal obligations, establish or protect legal rights, and pursue legitimate interests in website security, preventing misuse and maintaining service records, subject to the safeguards required by applicable law. Where consent is the appropriate basis for an optional activity, including permission to publish your submitted review, that activity is handled separately from responding to an enquiry. Sending an enquiry does not itself subscribe you to a marketing mailing list.

Service providers and sharing

Authorised Romos personnel use your information to handle your request. Website and database hosting, media delivery, DNS/network operation, backups and business email involve service providers. The current website uses DigitalOcean for application hosting, Amazon Web Services S3 for media delivery and Google Workspace/Gmail for enquiry correspondence. Requests for website resources can disclose technical information such as an IP address to the relevant provider.

If you ask us to arrange a travel service, relevant details may also need to be shared with the guide, transport operator, hotel or other supplier needed for that service. This notice does not replace any additional information provided during a booking. Information may also be disclosed where required by law or necessary to address misuse or legal claims.

Some providers or recipients may process information outside Türkiye or your country of residence. The applicable data-protection requirements and any required transfer mechanism must be considered for the relevant transfer. Contact us for information about recipients and the safeguards applicable to your request.

Cookies, browser storage and external services

The website stores the first landing page and referring website in your browser's session storage under ephesus-visit-v1. This supplies context if you send an enquiry. It is session-based browser storage, not a persistent advertising identifier; its lifetime follows your browser's session behaviour.

The private staff administration area uses a session cookie, ephesus_admin_v1, with a maximum lifetime of 12 hours. Connecting the business Gmail account uses a separate short-lived authorisation cookie, ephesus_gmail_oauth_v1, with a maximum lifetime of 10 minutes. These support staff access and email authorisation rather than visitor advertising.

The footer map loads a Google Maps embed when you choose to load it. The homepage film loads a YouTube privacy-enhanced embed when you choose to play it. Those services may then process your IP address and other technical information under their own privacy practices. WhatsApp, social-media and other external links take you to services whose privacy practices also apply. You can manage cookies and browser storage through your browser settings.

Retention and security

Retention depends on the purpose of the record, whether an enquiry becomes a booking, relevant legal obligations, and the need to deal with disputes or security issues. Website enquiries, email correspondence, published reviews and backups may have different retention periods. This website does not apply one automatic deletion deadline to every record. Contact us to ask about the records relating to you or to request deletion where applicable.

Access to the private enquiry and administration areas is restricted. HTTPS protects information in transit to this website. No online service can guarantee absolute security.

Your rights and requests

Subject to applicable law, you may ask whether we process your personal data, request information about its use and recipients, request correction of incomplete or inaccurate information, and request deletion or destruction when the relevant conditions are met. Under Article 11 of Türkiye's Personal Data Protection Law, relevant rights also include requesting notification of corrections or deletion to recipients, objecting to an adverse result based solely on automated analysis, and seeking compensation for unlawful processing.

Email [email protected] with the subject “Privacy request”, or write to the head-office address above. Include enough information to locate the relevant enquiry or review; avoid sending unnecessary sensitive documents. We may need to verify your identity and explain the appropriate request procedure. You may also use the complaint procedures available under applicable data-protection law, including those of Türkiye's Personal Data Protection Authority where relevant.

Changes to this notice

We may update this notice when the website or our data-handling arrangements change. The date above identifies the current version. Additional information may be provided when a particular service requires it.