PERSONAL DATA PROTECTION POLICY

TURAXUS TRAVEL Personal Data and Privacy Policy

Personal Data Processing and Protection Policy

Protection of personal data is an important issue for TURAXUS TRAVEL. TURAXUS TRAVEL adopts the principles stipulated by the KVK Law in order to comply with the Personal Data Protection Law No. 6698, and fulfills its obligations regarding the processing, deletion, destruction, anonymization, transfer of personal data, informing the relevant person and ensuring data security. The Privacy and Personal Data Protection Policy prepared in this context is made available to real persons whose personal data is processed.

1) Scope and Purpose of the Privacy and Personal Data Protection Policy

This Privacy and Personal Data Protection Policy, TURAXUS TRAVEL;

Methods and legal reasons for collecting personal data,
Which person groups' personal data are processed (Data Owner Categorization),
Which categories of personal data are processed regarding these groups of people (Data Categories) and sample data types,
In which business processes and for what purposes this personal data is used,
Technical and administrative measures taken to ensure the security of personal data,
To whom and for what purpose personal data may be transferred,
Personal data retention periods,
What are the rights of Relevant Persons regarding their personal data and how they can exercise these rights,
How Relevant Persons can change their positive or negative preferences regarding receiving electronic commercial messages,
It explains the sharing of personal data with official authorities.

a) Personal Data Collection Methods and Legal Reasons

TURAXUS TRAVEL personal data in audio, electronic or written form through websites, mobile applications of websites, social media accounts, cookies, call center, notifications from administrative and judicial authorities and other communication channels, in accordance with the personal data processing conditions specified in the KVK Law and collects it in accordance with the legal reasons specified in this Privacy/Personal Data Protection Policy.

b) Data Subject Person Group Categorization

TURAXUS TRAVEL categorizes the groups of data subjects whose personal data are processed in personal data processing processes and activities related to these processes as follows. In addition, personal data of other groups of individuals (such as bloggers) may also be processed in accordance with the personal data processing conditions specified in Articles 5 and 6 of the KVK Law and in line with the legal reasons specified in this Privacy/Personal Data Protection Policy.

Customer/Member, Potential Customer/Member
Online Visitor
Person who will perform the purchased activity
Service Provider/Service Provider Candidate or Service Provider Employee or Official

c) Data Categories and Sample Data Types

Customer/Member, Potential Customer/Member

Identity Information: Name, surname.
Contact Information: Mobile phone, e-mail address.
Customer/Member Information: Membership information, membership ID number
Customer/Member Transaction Information: Purchased activities, call center call records, commercial communication permission, campaigns used, reservation-related information
Risk Management Information: IP address
Transaction Security Information: Password, password information
Marketing Information: Cookie records, targeting information, evaluations showing habits and tastes. Marketing SMS and e-mail messages sent based on the commercial electronic message permission given by the relevant person.
Audio Data: Interview Recordings
Legal Transaction and Compliance Information: Start and end time of the service provided, type of service used, amount of data transferred, commercial electronic message permission given by the member electronically, membership agreement approved, distance sales contract.
Request/Complaint Management/Reputation Management Information: Records regarding the complaints and/or requests submitted by the member through the website, mobile application, social media accounts regarding the service purchased, and the transactions carried out during the evaluation or management of these requests.

Online Visitor

Legal Action Information/Risk Management Information: IP address
Legal Transaction and Compliance Information: Start and end time of the service provided, type of service used, amount of data transferred.

Person who will perform the purchased activity

Identity Information: Name, surname
Contact Information: mobile phone, e-mail address.

Service Provider/Service Provider Candidate or Service Provider Employee or Official

Identity Information: TR ID Number, Name and Surname
Contact Information: e-mail address, telephone, KEP address, address, mobile phone
Financial Information: Account Number, Tax office, Tax Identification Number, tax plate, IBAN
Legal Transaction and Compliance Information: Signature circular, activity certificate,
Special Personal Data/Legal Process Information: Signature

d) In Which Business Processes and For What Purposes are Personal Data Used?
Personal data;

Processing of online visitor data in accordance with the relevant legislation,
You can make reservations as a "guest" on these platforms,
Carrying out membership transactions,
Improving the services offered on the platform, developing new services and providing information about them,
For customers with existing commercial electronic message approval, for the purpose of fulfilling the Membership Agreement established with the Customer; Analyzing Customer/Member preferences, tastes and needs and providing special promotions, opportunities and benefits to Customer/Member,
Within the scope of the contractual relationship, commercial electronic message approval for existing customers/members; Promoting and marketing activities, events and services in line with the preferences and tastes of the Customer/Member by performing direct marketing, digital marketing, remarketing and analysis,
Resolving customer/member problems and complaints,
Communicating with the Customer/Member based on commercial electronic message permission and improving the Customer/Member experience on both the platform and the mobile application,
Creating customer/member satisfaction, loyalty and commitment,
Conducting statistical evaluations and market research,
Corporate reputation management, media communication,
Determination and implementation of TURAXUS TRAVEL's commercial and business strategies,
Follow-up of accounting and purchasing transactions,
Legal processes and compliance with legislation,
Answering information requests from administrative and judicial authorities,
Planning internal reporting and business development activities,
Ensuring information and transaction security and preventing malicious use,
Planning and execution of operational activities necessary to ensure that TURAXUS TRAVEL's activities are carried out in accordance with TURAXUS TRAVEL procedures and policies prepared within the scope of the KVK Law,
It is used to make the necessary arrangements to ensure that the processed data is up-to-date and accurate and to carry out activities related to all these processes.

e) Technical and Administrative Measures Taken to Ensure the Security of Personal Data
TURAXUS TRAVEL undertakes to take all necessary technical and administrative measures and to show due care to ensure the confidentiality, integrity and security of your personal data.

TURAXUS TRAVEL takes the necessary precautions to prevent unauthorized access to personal data, misuse, unlawful processing, disclosure, alteration or destruction of personal data. TURAXUS TRAVEL uses generally accepted security technology standards such as firewalls and Secure Socket Layer (SSL) encryption when processing personal data. In addition, when sending your personal data to TURAXUS TRAVEL through the website, mobile application and mobile site, this data is transferred using SSL.

TURAXUS TRAVEL regarding preventing unlawful access to the personal data it processes, preventing unlawful processing of these data and ensuring the preservation of personal data:

All areas on the website or mobile application where personal data is collected are protected by SSL.
Creates and implements access authorization and control matrices for its employees to prevent personal data collected from the website or mobile application from being processed unlawfully,
To ensure that personal data is not accessed unlawfully; performs periodic penetration tests, tests the system's resistance to unauthorized access,
It uses the Pseudonymization method for all secondary data processing other than the primary processing purpose. In order to ensure that pseudonymous data makes it impossible to identify the relevant person, it uses encryption methods in the systems where this data is located and applies a stricter access authorization and control policy to this data,
It ensures that personal data in paper form is kept in locked cabinets and can only be accessed by authorized persons.

f) To whom and for what purpose personal data can be transferred
TURAXUS TRAVEL transfers personal data to third parties only for the purposes specified in this Privacy and Personal Data Protection Policy and in accordance with Articles 8 and 9 of the KVK Law. In this context, the Customer/Member data processed and the information of the booked activity or the person who will perform the activity are shared with the supplier and these data can be accessed by the call center when necessary.

Customer/Member data also; In line with the commercial electronic message approval of the customer/member, it is shared with the commercial electronic message service provider in order to be able to promote, advertise, and offer benefits and opportunities in line with their shopping preferences, tastes and habits.

Website or mobile application usage preferences and navigation history are shared with third parties who receive cookie services for the purpose of segmentation and communicating with the Customer/Member in line with their likes and preferences. Personal data transfers carried out in this context are carried out through the secure environment and channels provided by the relevant third party. Depending on the content and scope of the service received from third parties; In all cases where there is no need to transfer the Customer/Member's personal data, the transfer is made using pseudonymous data.

In order to increase customer/member satisfaction and loyalty, anonymous data of Customer/Member is shared with companies that will conduct market research.

Personal data subject to domestic and international transfer as mentioned above, in addition to technical measures to ensure their security; Considering that the other party to the legal relationship is the data controller or data processor, it is also legally protected thanks to the provisions compatible with the KVK Law included in our contracts.

g) Personal Data Storage Periods
TURAXUS TRAVEL preserves the personal data it processes in accordance with the KVK Law for the periods stipulated in the relevant legislation or required by the purpose of processing. In our Personal Data Storage and Destruction Policy, these periods are approximately as follows:

You can review our Cookie Policy regarding the retention periods of personal data we obtain through cookies.

h) What are the rights of the relevant persons on their personal data and how can they exercise these rights?
The rights that the Relevant Person has on the personal data processed by TURAXUS TRAVEL in accordance with Article 11 of the KVK Law are listed below:

Learning whether personal data is processed or not,
Requesting information if personal data has been processed,
Learning the purpose of processing personal data and whether they are used for their intended purpose,
Knowing the third parties to whom personal data is transferred at home or abroad,
Requesting correction of personal data if it is incomplete or incorrectly processed,
Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVK Law,
To request that the transactions carried out in accordance with paragraphs (d) and (e) be notified to third parties to whom personal data has been transferred,
Objecting to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,
In order to exercise your rights over your personal data; You can access your account from the "Profile" section of the TURAXUS TRAVEL website, mobile application and mobile site and make necessary changes, updates and/or deletions. In addition, you can make your application and exercise your rights through the methods specified in the "APPLICATION FORM" issued in accordance with Article 13 of the KVK Law on the website or mobile application operated by TURAXUS TRAVEL.

i) How Relevant Persons Can Change Their Positive or Negative Preferences About Receiving Electronic Commercial Messages
You can change or update your positive or negative preferences regarding receiving commercial electronic messages, which you have given while subscribing to the website or mobile application operated by TURAXUS TRAVEL or at a later time, at any time by accessing the "Profile" section.
Termination of membership does not mean withdrawing your consent to receive commercial electronic messages. For this reason, please also make sure that you have completed all the procedures regarding withdrawing your consent.
Regarding cookie management, you can follow the steps specified in our Cookie Policy.

j) Personal Data Sharing with Official Authorities
Your personal data and navigation information regarding your visit or membership to the website and mobile application operated by TURAXUS TRAVEL; TURAXUS TRAVEL is legally authorized to request this information in order to fulfill its obligations under the law (in cases where TURAXUS TRAVEL has a legal or administrative obligation to notify or provide information, including but not limited to the fight against crime, threat to state and public security, etc.). can be shared with public institutions and organizations.

k) Cookie Use and Management
You can review our Cookie Policy for detailed information about the cookies used by TURAXUS TRAVEL, cookie types, purposes, storage periods and cookie management.

2) Conditions for Deletion, Destruction and Anonymization of Personal Data

TURAXUS TRAVEL stores the personal data it processes through its website, mobile application or mobile site for the periods stipulated by the relevant laws and/or the periods required by the purpose of processing, in accordance with Articles 7, 17 of the KVK Law and Article 138 of the Turkish Penal Code. If these periods expire, it will delete, destroy or anonymize it in accordance with the provisions of the Regulation on Deletion, Destruction or Anonymization of Personal Data.
TURAXUS TRAVEL explains in detail the methods for deletion, destruction and anonymization and the technical and administrative measures taken within the scope of the Personal Data Storage and Destruction Policy prepared in accordance with the Regulation on Deletion, Destruction or Anonymization of Personal Data. In this Policy, the time interval for the periodic destruction stipulated by the Regulation is determined as 6 months. Accordingly, TURAXUS TRAVEL uses anonymization as a destruction method.

3) Changes to the Privacy/Personal Data Protection Policy

TURAXUS TRAVEL may make changes to this Privacy/Personal Data Protection Policy at any time. These changes become effective immediately upon the publication of the new amended Privacy/Personal Data Protection Policy. Necessary information will be provided to our members so that you can be informed about the changes in this Privacy/Personal Data Protection Policy.

Date: 04/10/2022