KVKK Privacy Notice

Turla360 Turizm A.Ş.

Contact: [email protected]

This notice has been prepared pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

• Identity: first name, surname, Turkish ID or passport number, date of birth
• Contact: e-mail, telephone, address
• Financial: payment transaction record, invoice details (card numbers are not stored)
• Transaction: booking details, service history, complaint records
• Technical: IP, cookie, device and session records
• Marketing: newsletter preferences (only with explicit consent)

• Booking and payment: performance of a contract (KVKK 5/2-c)
• Legal obligations: legal requirement (KVKK 5/2-ç)
• Customer services: performance of a contract and legitimate interest (5/2-c and 5/2-f)
• Security: legitimate interest (5/2-f)
• Marketing: explicit consent (5/1)
• Analytics (anonymous): legitimate interest (5/2-f)

• Domestic: PayTR, tour operators, authorised public institutions
• Abroad: e-mail infrastructure and analytics tools — subject to an adequacy decision of the Board or to explicit consent

• SSL/TLS encryption, access control, firewall and regular penetration testing are applied.
• Payment security is provided by the PCI-DSS certified PayTR infrastructure; card details are not stored by Turla360.

• a) To learn whether your personal data is being processed
• b) To request information if it has been processed
• c) To learn the purpose of processing and whether the data is used in accordance with that purpose
• d) To know the parties to whom the data is transferred domestically or abroad
• e) To request rectification of incomplete or incorrectly processed data and notification of the party to whom it was transferred
• f) To request erasure or destruction of the data where the conditions for processing no longer exist
• g) To object to adverse outcomes resulting from analysis by automated systems
• h) To claim compensation for damage suffered due to unlawful processing

• E-mail: [email protected]
• Post: a wet-signed petition sent by registered mail with return receipt
• Your requests are answered free of charge within 30 days.
• If the response is inadequate, you may lodge a complaint with the Turkish Data Protection Board.