Privacy Policy and Privacy Notice

Last updated: 14 October 2026

1Data Controller and Scope of This Notice

This notice applies to the Sapanca.org City and Tourism Portal website, mobile application, services connected to the administration panel and communication channels provided through those services. Sapanca.org is the contact point for personal data matters. You can reach us at info@sapanca.org or through the form on the Contact page. Our contact region is Sapanca, Sakarya.

Sapanca.org provides local news, events, obituaries, a business and travel directory, galleries, transport information, maps and live city data. You do not need to open an account or create a membership to browse the website and mobile application.

2Categories of Personal Data Processed

Depending on the feature used, data may include:

• Contact and newsletter data: name, email, optional contact-form telephone number, subject, message, subscription status, permission and unsubscribe records.
• Membership data: name, surname, email, telephone, password hash, verification, password-reset and document acceptance records, addresses and notification preferences.
• Business data: representative and contact details, applications, ownership claims, edit requests and submitted photographs or gallery content.
• Transaction data: cart, order, delivery, invoice, payment reference and status, Premium subscriptions and renewals, cancellations, returns, refunds and support records.
• Security and sessions: IP address, request time, browser/device information, user agent, error/security logs, web sessions and mobile token hashes, device names, validity and last-use times.
• Preferences and notifications: theme, favourites, dismissed notices, notification categories, cache, analytics preference and Firebase Cloud Messaging tokens.
• Consented web analytics: when Google Analytics is configured and accepted, page views, technical browser/device information, cookie identifiers and phone/WhatsApp link-click events.

Sapanca.org does not store card numbers or card security codes. Identity/tax information may be requested when required for a payment or invoicing transaction. Do not submit sensitive or unnecessary third-party personal data through contact forms.

3Collection Methods

Data is collected electronically through web/mobile registration, login, contact, newsletter, business, ownership claim, address, cart, order, payment and return forms; payment-provider transaction notifications; and session/security logs. Cookies, browser local storage and mobile device storage retain preferences. Consented web analytics and map, video, font or notification services may also involve technical processing by the relevant provider.

4Purposes of Processing

• Responding to contact, news-tip, advertising, business, event and support requests.
• Creating accounts, verifying email, managing login/password resets and account security.
• Reviewing business authority and submitted content, publishing approved directory information and processing changes.
• Managing carts, orders, payments, delivery, invoices, cancellations, returns, refunds and Premium renewals.
• Delivering selected newsletters and notifications, and marketing messages with separate permission.
• Remembering preferences and caching content; measuring visits and basic interactions when analytics is accepted.
• Preventing spam and unauthorised access, investigating errors, protecting rights and meeting legal obligations.

5Legal Bases and Separate Preferences

Membership, business and order processing relies on necessity directly related to establishing or performing a contract; invoices and mandatory records on legal obligations; dispute records on establishing, exercising or protecting a right; and security on legitimate interests that do not prejudice fundamental rights and freedoms, under the relevant conditions of Article 5 of Law No. 6698.

Analytics and marketing requiring explicit consent depend on separate choices. Acceptance of the Terms or reading this notice is not blanket consent to all processing, marketing or analytics. Rejecting analytics does not prevent access to basic content. Withdrawal does not affect previously lawful processing.

6Cookies, Local Storage and Google Analytics

Required sessions support login, form security and guest carts. Session-cookie duration depends on browser/session settings; server session files inactive for over 24 hours are periodically cleared.

The website may store theme under “sapanca-theme”, favourites and dismissed notices in browser local storage. The general cookie-notice choice is stored under “sapanca.cookies.preference”; analytics acceptance/rejection is stored under “sapanca.google.metrics.preference”. Preferences may remain until changed or browser data is cleared. Mobile favourites, theme, notifications and cache are stored on the device; membership access tokens use secure device storage. Signing out removes the access token. Device data can also be managed through device settings.

Google Analytics 4 loads on web pages only when the site has a valid measurement ID and you accept analytics. This integration does not load Google's measurement script before acceptance or following rejection. When accepted, analytics cookies such as _ga and _ga_* may be used; their standard duration may be up to two years, depending on provider and configuration. Cookies can be deleted through your browser.

Advertising storage and advertising personalisation permissions are disabled; Google Signals is not enabled. Query parameters and URL fragments are removed from page addresses sent by this integration. Custom phone/WhatsApp click events do not include telephone numbers or message text. Google may process IP and technical request information under its service terms; we do not describe this measurement as fully anonymous.

A cookie notice appears on the first visit with “Preferences”, “Reject” and “Accept all”. Essential cookies remain active. When analytics is used, it can be enabled separately. A general acceptance while analytics is unavailable does not authorise future analytics. Use “Cookie preferences” to change your choice. Rejection stops subsequent measurement through this integration; existing cookies can separately be deleted in the browser. Google Analytics retention depends on the property's settings. The former local analytics system's 90-day retention statement does not apply to current Google measurement.

7Maps, Video, Fonts and Other External Services

Some portal pages use external services to provide technical or visual functions:

• Font and Leaflet interface files may be loaded through Google Fonts and unpkg.
• OpenStreetMap tile servers may be used on maps, and Google Maps links or embedded maps may be used in some areas.
• When a user opens a video in the gallery, YouTube's privacy-enhanced domain or the Vimeo player may be activated.
• Mobile notifications may be delivered through Google Firebase Cloud Messaging infrastructure.
• Consented web measurement may use Google Analytics 4; payments may use iyzico and relevant technical providers.
• When a user presses a sharing button, they may be redirected to the platform they select, such as WhatsApp or Facebook.

When these services are called, the IP address, device/browser information, request time and the address of the displayed resource may be transmitted to the relevant provider. These providers' own privacy terms apply. If service infrastructure is located abroad, technical data may be processed abroad; applicable cross-border-transfer provisions of Law No. 6698 are observed in such processing.

8Live City Data and Precise Location

Information such as weather, air quality, traffic, pharmacies on duty and water level may be obtained through the portal server from sources such as OpenWeatherMap, Open-Meteo, TomTom, eczaneapi and Sakarya SASKI. General or predefined locations belonging to Sapanca are used for these requests; the user's GPS location is not requested or sent to those providers. Apart from internet, network-status and optional notification permissions, the current version of the mobile application does not request camera, microphone, contacts, files or precise-location permission.

9Transfer of Data

Personal data is not sold, rented or shared for the purpose of creating an independent advertising profile. Data may be transferred, limited to the purpose, to technical suppliers that provide services such as hosting, security, email or notifications and are expected to act only in accordance with our instructions; to authorised public institutions where legally necessary; and to legal advisers. The role and terms of the relevant provider separately apply to technical data collected directly by external services.

10Retention, Deletion and Account Requests

Data is retained for the processing purpose and applicable legal periods. Membership and addresses support account management; contact/business requests support review and assistance; orders, invoices, sales-document acceptance, payments and refunds support transactions, accounting and legal obligations; security records support abuse and error investigation. Google Analytics retention is explained in section 6.

Request account/data correction or deletion at info@sapanca.org or through Contact. Closing an account does not immediately erase legally required order, invoice or dispute records. When the purpose and legal retention need end, data is deleted, destroyed or anonymised. Backups are subject to the relevant retention and security processes.

11Information Security

To reduce the risk of unauthorised access and data loss, access authorisation, secure administrator sessions, password hashing, CSRF protection, input validation, rate limiting, secure session cookies and appropriate server-security measures are used. Since no method of data transfer over the internet can guarantee absolute security, you may notify info@sapanca.org if you notice a suspicious situation.

12Rights of the Data Subject

Under Article 11 of Law No. 6698, you have the right to learn whether your personal data is processed; request information if it has been processed; learn the processing purpose and whether it is used in accordance with that purpose; know third parties to whom data has been transferred; request correction of incomplete or incorrect data; request deletion or destruction where the conditions are met; request that correction and deletion be notified to persons to whom the data was transferred; object to a result against you arising solely from analysis by automated systems; and request compensation for damage caused by unlawful processing.

You may submit your request to info@sapanca.org or through the Contact page, stating your name, surname, contact information that helps verify the request and a clear description of the request. Only the additional information necessary to verify your identity may be requested. Applications are answered within the legal period and, as a rule, free of charge; if the process requires an additional cost, the tariff in legislation may apply.

13Newsletter, Marketing and Notification Preferences

Newsletter/marketing selection during registration is optional and separate from accepting the Terms. Unsubscribe using the newsletter's unsubscribe link or by contacting info@sapanca.org. Membership notification preferences can be managed in My Account. Mobile categories can be disabled in the app and all notifications through device settings. Commercial opt-out requests are fulfilled within applicable legal periods.

Verification, password-reset, security, order, payment, refund and business-review emails may be sent to operate the service independently of marketing preferences.

14Children's Privacy

The portal is intended for a general audience and does not aim to knowingly collect personal data from children. Users under eighteen are advised to obtain support from a parent or legal representative before writing personal information in the contact form.

15Changes and Contact

This text may be updated when portal features or legislation change. The current version and update date are always published on this page. For privacy, correction, deletion or other data-protection requests, you can use info@sapanca.org or the Contact page.

16Membership, Business, Premium and Store Processes

Membership is not required to read general content. Member profiles, addresses and preferences are processed on the server. Mobile login uses a securely stored device token and a server-side token hash/session record, subject to expiry and account security checks.

Business applications and ownership claims are reviewed for authority and content. Approved business names, addresses, telephone numbers, descriptions, images and directory details may be publicly published. Do not include private personal information in material submitted for publication.

Premium records may include plan, annual period, amount, currency, provider references, payment/renewal/cancellation status and related business. Required billing and identity/tax information may be sent to the payment provider; card number, security code and expiry date are not stored in the Sapanca.org database.

Member or guest store orders may record buyer name, email, telephone, shipping/billing addresses, products, amounts, customer note and transaction status. Guest order access uses an expiring secure link; do not share it. Orders, invoices, delivery, returns and refunds support service and legal obligations. Accepted sales documents and transaction snapshots may be retained for subsequent dispute review.

17Transaction Notifications and Marketing Preferences

Emails relating to account verification, password reset, security, orders, payments, Premium, business applications, claims, photo and edit requests may be sent to operate the service. Campaign or marketing emails are sent when a separate preference or permission exists; you can change this preference through the My Account area or the opt-out method in the message.

18Document Versions and Acceptance Records

New memberships record the Terms/Privacy acceptance date and document version. This is not marketing or analytics permission. Store and Premium pre-contract information and agreements are presented separately; their accepted version and transaction snapshot may be retained. Updating this notice does not retroactively change existing members' historical acceptance versions.