Privacy policy: what we collect and how we use it

Last updated: 14 November 2026

Who we are

Ontripo is operated by LEBBEYK TURİZM LİMİTED ŞİRKETİ, a travel agency licensed in Türkiye (TÜRSAB licence 17384), Akşemsettin Mah. Albay Cemil Sakarya Sk. Uğur Apt. No:22/2, Fatih, Istanbul. We are the controller of the personal data described here. Contact: info@ontripo.com or WhatsApp +90 501 073 07 30.

What we collect

Account data: your email address, the name you give us, and your password, which is stored only in hashed form that we cannot read.
Saved items: the places and tours you save to your account.
Consent record: the date and time you accepted this policy.
Booking messages: if you book a tour we run, the details you send us on WhatsApp, such as your name, date, hotel and number of guests.
Hotel and flight bookings: the guest names, email address and phone number you enter, so that the reservation can be made and your confirmation sent.
Technical data: our hosting provider keeps standard server logs, including IP addresses, for security.

We never see or store your payment card number, and we do not buy data about you from anyone.

Why we use it

To run your account and show your saved items and member prices. Legal basis: our agreement with you.
To arrange the tours you book with us. Legal basis: our agreement with you.
To make the hotel and flight bookings you request. Legal basis: our agreement with you.
To keep the site secure and prevent abuse. Legal basis: our legitimate interest.

We do not send marketing emails unless you ask for them.

Cookies

We set a cookie when you sign in, so that the site remembers you. If you accept cookies in the banner shown on your first visit, Google Analytics also sets cookies to measure how the site is used. We do not use advertising cookies.

Other companies involved

Hosting: the site and its database are stored with our hosting provider.
Tour listings: some pages show tours and photos from GetYourGuide and Viator, loaded from their servers. Your browser contacts them when these blocks appear, and they may set their own cookies.
Fonts: the typefaces are served from our own site, so your browser does not contact a font provider.
Visit and click counting: a small script from Travelpayouts counts page visits and link clicks. Your browser contacts Travelpayouts when a page loads. The script sets no cookies on this site.
Visit statistics: Google Analytics, a service of Google, measures how the site is used. It sets cookies only if you accept them; if you decline, it receives only basic signals without cookies.
Google sign-in: if you choose to sign in with Google, Google tells us your email address and name.
WhatsApp: messages you send us are handled by WhatsApp under its own terms.
Booking processor: hotel and flight bookings, and their card payments, are handled by our booking processor. It receives the guest details needed to make the reservation or issue the ticket. Your card details go directly to its secure payment form, and we never see or store them.
Other booking websites: when you follow a link to another company’s website and book there, that company’s privacy policy applies. We do not receive your payment details.

Because we are based in Türkiye, your data is processed outside the European Economic Area.

How long we keep it

Account data is kept until you delete your account. Booking records are kept for as long as Turkish law requires for tax and consumer purposes.

Your rights

You can ask for a copy of your data, ask us to correct it, object to how we use it, or have it deleted. If you live in the EU or the UK you also have the right to complain to your local data protection authority.

Deleting your account

Sign in, open My account and press “Delete my account”. Your account, name, email and saved items are removed immediately and permanently. You do not need to contact us or give a reason.

Changes

If we change this policy in a way that matters, we will tell account holders before the change takes effect.