Data Protection Disclosure Notice

This disclosure notice has been prepared by TourOperation.com in its capacity as data controller, in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Our aim is to inform you about the processing of your personal data. Where applicable, our data processing practices also align with the EU General Data Protection Regulation ("GDPR").

1. Data Controller

Your personal data is processed by the following data controller:

• Company: TourOperation Yazılım Teknolojileri
• Email: [email protected]
• WhatsApp: +90 507 156 86 89

2. Personal Data Processed

The following categories of personal data are processed in connection with the use of our platform:

• Identity Data: First name, last name, national identification number (where legally required)
• Contact Data: Email address, telephone number, business address
• Professional Data: Company name, job title, tax identification number
• Financial Data: Billing information, payment history
• Transaction Security Data: IP address, session data, access logs
• Marketing Data: Communication preferences, service usage data

3. Purpose of Processing Personal Data

Your personal data is processed for the following purposes:

• Provision, execution, and improvement of platform services
• Creation and management of your membership account
• Fulfilment of contractual obligations
• Execution of billing and payment transactions
• Provision of customer support services
• Compliance with legal obligations (tax legislation, commercial law, etc.)
• Execution of information security processes
• Sending communications regarding our services (with your consent)
• Conducting statistical analyses (using anonymised data)

4. Transfer of Personal Data

Your personal data may be transferred to the following parties in accordance with the conditions set forth in Articles 8 and 9 of the KVKK, as well as applicable GDPR provisions where relevant:

• Business Partners: Payment service providers, server hosting companies, email service providers — only data necessary for the performance of services is shared.
• Public Institutions: Data may be shared with authorised public authorities where legally required (UETDS notifications, tax authority, etc.).
• International Transfers: Server services are provided in data centres located within European Union member states. International data transfers are carried out in compliance with Article 9 of the KVKK, to countries with adequate protection or based on binding undertakings.

5. Collection Methods and Legal Basis

Your personal data is collected through the following channels:

• Registration and login processes via the platform
• Contact forms and email correspondence
• Telephone communications
• Cookies and automated data collection tools

Legal bases for processing:

• Your explicit consent
• Performance or establishment of a contract
• Compliance with a legal obligation
• Legitimate interests of the data controller (improvement of service quality)

6. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights regarding your personal data:

• To learn whether your personal data is being processed
• To request information about the processing, if your personal data has been processed
• To learn the purpose of processing and whether your data is used in accordance with its intended purpose
• To know the third parties to whom your personal data is transferred, whether domestically or internationally
• To request correction of your personal data if it has been processed incompletely or inaccurately
• To request the deletion or destruction of your personal data under the conditions set forth in Article 7 of the KVKK
• To request that the correction, deletion, or destruction operations are notified to the third parties to whom the data has been transferred
• To object to any outcome arising against you as a result of the analysis of your processed data exclusively through automated systems
• To claim compensation for any damages incurred due to the unlawful processing of your personal data

Application Method

To exercise your rights stated above, you may use one of the following methods:

• Email: You may send an email to [email protected] containing your identity verification details.
• Written Application: You may submit a signed petition to our company address.

Your applications will be concluded free of charge within 30 days at the latest, regardless of the nature of the request. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may apply.