1. Controller and scope
This policy describes the processing of personal data on istanbul-id.com (Istanbul-ID and Lunatolia). The controller is Amra Avdić, Schwarzer Weg 82D, 8054 Graz, Austria. Email: mindsetbullamra@gmail.com.
2. Hosting and server log data
The website is hosted by Vercel Inc. (USA). When you visit it, technically necessary data is processed, in particular IP address, time, requested address, browser and device information and error data. This is done for delivery, security and troubleshooting of the website on the basis of Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
3. Partner (affiliate) links
This website contains links to partners from whom I receive a commission if you book or buy through the link. Currently these are in particular GetYourGuide, Booking.com (via the partner network Commission Junction), Airalo (via impact.com) and Saily.
You only leave my website once you click such a link. When you click, data is transmitted to the respective partner or network company (for example IP address, time and the identifier of the referring website), and cookies or similar technologies may be set so that a booking can be attributed to the recommendation. The respective partner is responsible for this; its privacy information applies. I myself only receive commission statements without knowing who you are.
My recommendations and the order of the content are not changed by commissions; partner links are marked as affiliate links or advertisements. The legal basis for setting cookies on the partner's side is, where required, your consent there (Art. 6(1)(a) GDPR) or Art. 6(1)(f) GDPR.
4. Embedded and external content
In some blog articles, posts from Instagram (Meta Platforms) are embedded. When such a post loads, data such as your IP address is transmitted to Instagram and cookies may be set. Links to YouTube (Google), Fourthwall (shop) and other external sites take you to their websites; their privacy information applies there. Please note that a click on an external link alone does not yet transmit data to me.
5. The interactive Istanbul Guide
The Guide runs in the browser and loads map and place data from third parties: map tiles from OpenStreetMap, address search via Nominatim (OpenStreetMap), route calculation via router.project-osrm.org and photos of the places from Wikimedia Commons. The map library and the fonts are delivered by this website itself. When these services are called, your IP address is transmitted to them. The legal basis is Art. 6(1)(f) GDPR (provision of the requested map function).
If you use the “Use location” function, your browser asks for your permission. The location is only used for the route function in your browser; it is not stored on my servers. You can revoke the permission in your browser at any time.
6. Local storage and cookies
The website uses your browser's local storage for technically necessary purposes, for example to remember the selected language or the last view you chose. The Guide can be installed as a web app and cache content for offline use (service worker). You can delete this data at any time via your browser's website data.
For audience measurement (section 7) and advertising (section 8), the rules described there apply. According to the provider, audience measurement with Umami works without cookies. Advertising-related cookies and similar technologies from Google are used, where they require consent, only after you have consented.
7. Audience measurement with Umami and clicks on partner links
I use Umami Cloud (Umami Software, Inc.) to understand which pages are read. When a page is loaded, technical information is transmitted to Umami for this purpose, in particular the page visited, the referring page (referrer), browser, operating system, device type, language and country. According to the provider, Umami does not set cookies and does not track you across different websites.
In addition, I count clicks on partner links (Booking.com, GetYourGuide, Airalo, Saily) as an anonymous event “affiliate_click”. The provider, the page visited, the label and type of the link, the link destination and the language are recorded. No names, email addresses or account data are recorded. If your browser blocks the Umami script, this entry can alternatively be forwarded to Umami via a server endpoint of this website (hosted at Vercel); the browser identifier (user agent) is passed along.
The legal basis is my legitimate interest in statistical evaluation and in improving the website (Art. 6(1)(f) GDPR). Umami is a service of a US company; processing outside the European Economic Area therefore cannot be ruled out. Further details, for example on the server location, can be found in Umami's privacy information (umami.is).
8. Advertising with Google AdSense and consent
Google AdSense is integrated on this website, an advertising service of Google Ireland Limited (Ireland) or Google LLC (USA). The AdSense script is loaded from Google servers when a page is opened; for technical reasons your IP address is transmitted to Google. Ads are only displayed after Google has approved the website and the consent message has been published.
When ads are displayed, Google may use cookies and similar technologies as well as information such as IP address, device and browser data and the page visited to deliver ads, measure their effect and prevent abuse. Depending on your choice, ads may be personalised or non-personalised. Google may also act as an independent controller. More: policies.google.com/technologies/ads.
For visitors from the European Economic Area, the United Kingdom and Switzerland, a consent message from Google is shown before advertising cookies are used. Consent is voluntary; the basis is Art. 6(1)(a) GDPR and the respective rules on storing and reading information on end devices. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of the website; withdrawal applies for the future.
Google may also process data outside the European Economic Area, in particular in the USA. Further information is in Google's privacy information (policies.google.com/privacy).
9. Contact
If you write to me by email, I process your message and contact details to answer your request (Art. 6(1)(b) or (f) GDPR). The data is deleted as soon as it is no longer required and no statutory retention obligations apply.
10. Recipients and third-country transfers
Recipients are the service providers named above, in particular Vercel, the linked partners, Instagram/Meta and the providers of the map services. These services may also process data outside the European Economic Area, in particular in the USA. Art. 44 et seq. GDPR apply to such transfers, for example an adequacy decision or EU standard contractual clauses. You can ask for further information at the contact address given above.
In addition, Umami (audience measurement, section 7) and Google (AdSense, section 8) are recipients of data.
11. Storage period
Server log data is stored by the host only for a short time. Emails are deleted as soon as the request has been dealt with and no retention obligation applies. Data in local storage remains until you delete it in your browser.
For cookies and data from Google (AdSense) and for the data at Umami, the storage periods follow the information given by the respective providers.
12. Your rights
Under the statutory conditions you have rights of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consents at any time with effect for the future. To exercise your rights, contact me at the email address given above. You can also lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority (dsb.gv.at).
13. Changes
This policy is updated when the data processing changes, for example when new partners or services are integrated.