BULBILET INFORMATION
Privacy and personal data
English edition:
This page explains how the current version of Bulbilet works, information that may be shared during communication, and the contact channel for personal data requests.
Site operator and data controller
The site operator and data controller for Bulbilet’s own activities is Halis Zeybek, an individual.
For contact and personal data requests: bulbilet@gmail.com.
Category and route selections
Provider searches, subtypes and origin/destination selections are processed in the open page’s memory and reset when refreshed. No account or route database is created. If analytics is accepted, category choices, recognised search types and outbound link clicks are measured as described below.
The directory does not submit searches or route selections to a Bulbilet server. No search text or origin/destination fields are added to our custom analytics events. An external link may lead to a route page whose address contains route names. Destination websites may apply their own data processing and cookie practices.
Page delivery and security
Delivering a web page to your device requires a network connection. Hosting and network security infrastructure may process connection data such as IP address, browser technical details, requested URL, access time and request outcome to deliver the service and prevent abuse.
Operating without user accounts does not mean no personal data is processed during a visit. Optional Google Analytics is loaded only after accepting analytics. Advertising personalisation and Google Signals are disabled in the site tag configuration.
Collection methods, legal basis and recipients
Technical connection data is obtained automatically when a page is requested. Communication data is obtained electronically through the emails and attachments you send. Necessary page delivery and abuse-prevention processing is assessed under the legitimate interest condition in Article 5(2)(f) of the KVKK, provided your fundamental rights and freedoms are not harmed. Legal bases for communication requests are described separately below.
Hosting and network security providers process technical data to deliver and protect the service. Emails are transmitted and stored through Google’s Gmail service. Disclosure to competent public authorities and judicial bodies is limited to applicable legal obligations or the establishment, exercise or protection of rights.
Cookies
The application’s own category and route functions do not use cookies. The network security layer may use Cloudflare’s __cf_bm bot protection cookie. It helps distinguish automated and abusive traffic; according to the provider, it expires after 30 minutes of continuous inactivity.
Optional analytics cookies are used only after accepting analytics; advertising cookies are not enabled by the site tag. Your analytics choice is saved on this device in browser storage under bulbilet.analytics-consent.v1 for 180 days. This record contains the choice, scope, version and time, without a visitor ID. It is used to remember and respect your preference. Optional test mode separately stores only its enabled/disabled state and time under bulbilet.analytics-test.v1 for 180 days. This browser-specific preference prevents Analytics from measuring test visits. Visiting the page or reading this notice does not constitute consent. Use Analytics preferences in the footer to change your choice.
Technical source: Cloudflare cookie documentation ↗
Optional Google Analytics
Visitors who accept the current analytics notice may also be measured for result-view counts, filter types, favourite add/remove actions and comparison starts. These events do not include query text, cities, route fields or contact messages. Older consent is not automatically extended to these additional measurements; you can accept the current notice under Analytics preferences.
If you separately accept analytics, Google Analytics 4 is used to measure visits, page views, device/browser details, referring websites, category selections and outbound link clicks. Its purpose is to understand and improve the directory. This optional processing relies on explicit consent under Article 5(1) of the KVKK. Measurement data is processed through Google’s analytics service. Declining analytics does not prevent using the directory.
The Google tag does not load before acceptance. Advertising personalisation and Google Signals are disabled in the site tag configuration. Only a category code is added to our custom category event; no name, email, search text or origin/destination fields are added. Outbound measurement may include the destination link address. If enabled in the Google Analytics account’s enhanced measurement settings, technical events for scrolling, site search, file downloads, videos or form interactions may also be measured. These events do not establish that a ticket was purchased.
After acceptance, Google may use the _ga and _ga_JDS0PR3RYH cookies. The site tag sets a 180-day cookie lifetime without renewing it on every visit. Event-data retention in the Google account is a separate administrative setting and is not the same as cookie expiry. Device and network information may be personal data; measurement is not promised to be completely anonymous.
Withdraw your choice through Analytics preferences in the footer. Withdrawal stops subsequent measurement by this site tag and deletes accessible Google Analytics cookies; it does not affect the lawfulness of earlier processing or automatically erase historical Google records. Use the request channel below for requests about those records. Google’s overseas services require separate assessment of transfer conditions; analytics consent alone does not establish compliance with Article 9 of the KVKK.
With permission, category selections, route searches, searches with no results and provider-link clicks are measured as separate events. Fields may include the category code, guide/evidence mode, result count and the provider’s catalogue ID. Search text, origin/destination cities, country selections and travel dates are not added to these custom events. An empty name search is measured when the search is committed or the field loses focus.
Smart search measurement uses only predefined search types, matching methods, result counts and catalogue provider IDs when applicable. Free-text queries, city pairs, contact messages and email draft contents are not included in custom analytics events. Google Analytics may process cookies and technical data as part of its service.
With analytics permission, bounded issue types such as application or resource failures, invalid selections, unsafe links and link reports may also be measured. Up to 20 distinct issue codes are kept in the open page’s memory; no error messages, stack traces, full addresses, search text or message content are recorded. No backlog is created before consent; memory is cleared on withdrawal. This mechanism cannot verify whether an external destination page works.
Email communication
If you email us, your sender address, name and other information in the message, and any attachments are processed to assess and respond to your request. Messages are delivered through Google’s Gmail service. This address is not used to subscribe you to advertising newsletters.
In your initial message, share only the provider’s name, the affected page address and the information necessary for your correction request. Identity photos, payment card details and ticket documents are not requested in the directory’s ordinary communication process.
Following up communication requests is assessed under the legitimate interest condition in Article 5(2)(f) of Türkiye’s Personal Data Protection Law (KVKK), provided the data subject’s fundamental rights are not harmed; requests necessary for establishing, exercising or protecting a right are assessed under Article 5(2)(e). Where disclosure is required by a legal obligation, the relevant statutory processing conditions apply.
Communication data should be limited to resolving the request and any applicable statutory retention or protection of rights needs. When the processing reason ends, deletion, destruction or anonymisation obligations apply. This page does not promise that all data in email and infrastructure services is stored only in Türkiye.
Optional device storage
Your last five searches, favourite providers, theme and list preferences and the filters/list position of your last search are saved in this browser’s local storage only if you enable “Save on this device”. The preference and data last up to 180 days and may be renewed during use. When disabled, information stays only in the open page’s memory. Optional theme and list preferences use the bulbilet.appearance.v1 key and are cleared when device storage is disabled or records are erased. This preference is independent of analytics consent. You can erase the records or disable device storage to clear them. A warning appears if storage is unavailable. Avoid enabling this on shared devices.
Search and route records are not sent to a Bulbilet server or added to custom analytics events. When you copy a route link, selected cities and countries appear in the fragment after #; people receiving the link can see them. The recipient page consumes the route fragment and clears it from the address bar. Feedback entered in an email draft reaches us only when you send it from your own email app. Do not enter payment or identity details.
Retention and overseas services
Retention of communication records is assessed according to the request, its resolution, and applicable legal retention or protection-of-rights needs. Deletion, destruction or anonymisation obligations continue when the processing reason ends. Infrastructure providers’ technical log and backup retention depends on their service configurations.
Overseas infrastructure or access used by hosting, network security, Google Analytics and Gmail services may involve international transfers of personal data. Such transfers require the conditions in Article 9 of the KVKK to be met separately. This notice does not state that a particular transfer safeguard has been established. Visiting the website or sending an email alone is not explicit consent to an international transfer.
Rights under the KVKK
Subject to the law’s applicability, you have rights to learn whether your personal data is processed, request information if it is, learn the purpose of processing and whether data is used accordingly, learn the third parties receiving data domestically or abroad, request correction of inaccurate data, and request deletion or destruction when the statutory conditions are met.
Article 11 also provides rights to request notification of corrections and deletions to third parties receiving the data, object to an adverse outcome resulting exclusively from automated analysis, and seek compensation for damage caused by unlawful processing.
Send data questions and requests to bulbilet@gmail.com. The procedures in Article 13 and the applicable application communiqué remain reserved. Requests submitted in accordance with the legislation must be resolved as soon as possible according to their nature, and within 30 days at the latest. When emailing a data request, using an address previously supplied and held in communication records helps verification. Other statutory application channels remain available; any necessary identity verification must be relevant and proportionate.