Privacy Policy

Effective: October 14, 2026 · Last updated: October 14, 2026

This policy explains what data is processed when the Haydi tour and group management app is used, why it is used, and the choices available to users.

1. Haydi and data-processing roles

Haydi is a platform that tour companies use to coordinate with their guides, operations teams and participants during tours. The Haydi operator is the data controller for data processed for its own purposes, such as operating the platform, security and support. Because tour companies decide the participant list and tour details, the tour company may be the controller and Haydi a processor for data related to running a tour. This allocation is set by the contracts with tour companies. You may also send requests about records a tour company is responsible for to that tour company.

2. Data we process

• Account and profile: staff name, e-mail, optional phone number, company and role; participant display name and preferences.
• Tour and participant: name, phone and room details supplied by the tour company; tour membership, itinerary, meeting and check-in records.
• Location: precise location when permission is granted; location shared in a chat or captured at check-in.
• Communications and content: messages, announcements, shared photos, videos and voice recordings; content-report and block records.
• Device and notifications: notification token, device platform and app version.
• Security records: session, access and activity records, including IP address.

Haydi does not process data for advertising, analytics or cross-app tracking.

3. How data is collected and legal bases

Data is obtained when a user or tour company provides it, when the app and the company web panel are used, and automatically while the service is operated. For processing where Haydi is the controller, the legal bases are:

• Account, tour participation, communication and notifications: entering into or performing a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• Security, abuse prevention and content reports: legitimate interests and, where required, legal obligation (KVKK Art. 5/2-f and 5/2-ç; GDPR Art. 6(1)(f) and 6(1)(c)).
• Legal claims: establishment, exercise or protection of a right (KVKK Art. 5/2-e).
• Live location: legitimate interests in tour safety and meeting coordination, or explicit consent; which basis applies will be finalized after legal review. The device location permission is not by itself a legal basis.

Where a tour company is the controller, the tour company determines the legal basis. Where processing relies on explicit consent, consent is obtained separately and can be withdrawn at any time.

4. Purposes

Data is used to match users with the correct tour and role, run itineraries and participant workflows, provide communication and location features, send notifications, keep the service secure, prevent abuse, provide support and operate the service.

5. Location sharing

• Location permission is optional; if refused, the participant can still join the tour, but location features will not work.
• Live location is shared only during an active tour and stops when the tour ends. Before sharing starts, the app explains who will see the location.
• A participant's location is visible to guides and the tour company's operations team; other participants cannot see it. The lead guide's location is visible to the tour's participants and the operations team.
• During a tour, location may update while the app is not in use; the device shows this with a system indicator.
• A location sent to a chat is a one-time share. Permission can be changed in device settings, and sharing can be paused in the app.

6. Messages and media

Content is visible only to the members of the relevant conversation. Media is not public; location information is removed from photos before upload. Reported content may be reviewed by the tour company's authorized staff and by Haydi. Notifications may include a short preview of a message and may appear on the lock screen depending on device settings.

7. Transfers and sharing

Data is shared only as far as the service requires, with the following groups:

• Cloud infrastructure, authentication and data-storage service providers
• Mobile notification delivery services
• Map and location service providers
• Tour companies and their authorized staff
• Authorities legally entitled to request it

Service providers must process data only on Haydi's behalf and for providing the service, and must provide protection equivalent to this policy. Haydi does not sell personal data. Some providers may process data outside Türkiye; transfers abroad must rely on the mechanisms in KVKK Art. 9 and, where applicable, GDPR. The transfer mechanism will be stated in this section once finalized.

8. Retention

• Location history is kept for the 1–90 days set by the tour company; the default is 7 days.
• The current location is deleted when the tour ends or the person leaves the tour.
• Invitation records kept for security are deleted after 30 days.
• In closed content reports, information about the reporting person is removed after 180 days.
• No automatic deletion period is yet applied to tour, participant, message, media and audit records; these are kept until deleted or anonymized through account deletion or a valid deletion request. This section will be updated once a retention schedule is set.
• Deleted data may remain in backups until the backup cycle completes.

9. Account and data deletion

Participants and staff can permanently delete their accounts from Profile/Settings in the app. Deletion ends access, deletes or anonymizes personal data and removes location history; some steps complete in the background within 30 days at the latest. Users who cannot access the app can send a deletion request to support@hayditur.com; identity verification may be required.

The tour company's own participant record, check-in records without location, anonymized company content and records that must legally be kept may remain. See Account Deletion for details.

10. Security

Data is encrypted in transit, and access is limited by role and authorization. No method provides absolute security. Report a suspected security issue to support@hayditur.com.

11. Your rights

Under Article 11 of KVKK, you have the right to learn whether your data is processed, request information, learn the purpose of processing and whether data is used accordingly, know the recipients, request correction, deletion or destruction, request that recipients be notified of these actions, object to an adverse result based solely on automated analysis, and claim compensation for damage. Where GDPR applies, you also have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a supervisory authority.

Send requests to support@hayditur.com; identity verification may be required. Requests are concluded free of charge within 30 days at the latest. If you are not satisfied with the response, you may complain to the Turkish Personal Data Protection Board.

12. Children

Haydi is not a service directed to children. If minors take part in tours, notice and parental consent must be arranged separately together with the tour company.

13. Changes and contact

This policy may be updated; material changes will be announced in the app or through a suitable channel. Use support@hayditur.com for privacy requests and general support.