Personal Data Protection

Airport Transfer Istanbul (İST AND TRAVEL TURİZM LİMİTED ŞİRKETİ) takes the protection of your personal data seriously. This notice explains which personal data we process when you use our website and when you purchase a transfer service from us. Your privacy is as important to Airport Transfer Istanbul as it is to you.

1. Data Controller

As the Data Controller (GDPR Art. 4(7), KVKK Art. 3(1)(ı)), İST AND TRAVEL TURİZM LİMİTED ŞİRKETİ — Airport Transfer Istanbul (Merkez Mah. Hasat Sk. Kamara No: 52, İç Kapı No: 1, Ofis No: 240, Şişli / İstanbul) informs you about the processing of your personal data in connection with the use of our website (airport-transfer.istanbul) and the sale of our services. For any questions, you can reach us at info@istandtravel.com.

2. Scope, Purpose and Legal Basis of Processing

Your personal data is processed in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR — Reg. EU 2016/679). In the cases below, we collect and use personal data directly from you or from the stated sources.

2.1.1. Viewing the website and log files. Each time you access our website, our system automatically records technical information such as browser type and version, operating system, internet service provider, IP address, date and time of access, and the pages you came from and accessed. This data is kept in log files and is not stored together with your other personal data. We use it for network security, the operability of the website and its continuous improvement. The legal basis is GDPR Art. 6(1)(f).

2.1.2. Cookies. Our website uses cookies. Cookies are text files stored in your browser that allow your browser to be recognised when you access the site again. You can disable, limit or delete cookies in your browser settings; in that case, not all functions of the website may be usable.

2.1.3. Services offered on the website. Processing your personal data may be necessary to provide the services we offer. Airport Transfer Istanbul may use your personal data to provide support via live chat, to send newsletters and commercial messages through the channels you choose, for market research and customer-satisfaction work, to send campaigns and offers, to provide our services in line with our contractual obligations or legitimate interests, and for the personalised use of the website and personalised offers.

On the basis of your explicit consent under GDPR Art. 6(1)(a) and KVKK Art. 5(1): providing the offers and services you request, and managing any campaign or loyalty programme that may be run from time to time.

Within the scope of a contractual obligation under GDPR Art. 6(1)(b) and KVKK Art. 5(2)(c): providing special service offers, building and reporting on databases, analysing how you use our website, and developing and promoting our services.

Within the scope of our legitimate interest under GDPR Art. 6(1)(f) and KVKK Art. 5(2)(f): ensuring the security of the service, protecting the life and property of Airport Transfer Istanbul, its employees, service providers and guests, preventing fraud, and managing internal audits and legal claims.

Within the scope of compliance with a legal obligation under GDPR Art. 6(1)(c) and KVKK Art. 5(2)(a) and (ç): complying with the rules to which we are subject.

For these purposes we may collect the following types of data from you: contact details such as name, surname, address, phone and email; identity and passport information; transfer reservation details; invoice and payment-instrument information; order information; areas of interest; information you send us within your requests and complaints; information about your use of our website and communication channels; and your preferences regarding the services.

2.1.4. Newsletter. You can subscribe to our free newsletter via our website; for this we process your email address and, at subscription, your IP address and the date and time. Your consent is obtained at subscription. Newsletter data is not transmitted to third parties and is used only to send the newsletter. The legal basis is GDPR Art. 6(1)(a) and KVKK Art. 5(1).

2.2. Data processing for service sales. When you purchase a transfer service from us (via the website or one of our agency partners), we process the types of data listed in 2.1.3 in order to better meet your travel needs — within the scope of a contractual obligation under GDPR Art. 6(1)(b) and KVKK Art. 5(2)(c) and of our legitimate interest under GDPR Art. 6(1)(f) and KVKK Art. 5(2)(f).

2.3. Our legitimate interest in processing. Where GDPR Art. 6(1)(f) is the legal basis, our legitimate interests include protecting the company against material and non-material damage, developing our services, and cost optimisation.

2.4. Other bases for processing. We may process your personal data due to legal obligations, for example to comply with retention obligations arising from commercial or tax law.

2.5. Obligation to provide data. The mandatory fields on our website are determined by legal or contractual requirements, so that the relevant contract or the requested service can be fulfilled.

3. Retention Period

Your personal data will be deleted when it is no longer needed for the stated purposes. Data is retained to the extent and for as long as necessary within the framework of possible legal proceedings and legal retention obligations arising from commercial, tax and anti-money-laundering legislation. These retention periods may be long depending on the applicable legislation.

4. Transfer to Third Parties

In order to provide our services and fulfil our legal obligations, we may need to transfer your personal data to third parties in Türkiye or abroad. These recipients may fall into the following categories: our affiliates; service providers; transport; marketing; information technology; payment services; credit institutions; customer-feedback services; and official authorities.

5. Your Rights as a Data Subject

Under the Turkish Personal Data Protection Law No. 6698, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used for that purpose; know the third parties to whom it is transferred; request correction if it is incomplete or incorrect; request its deletion or anonymisation where the conditions are met; request that these actions be notified to the third parties to whom the data was transferred; object to a result against you arising from analysis solely by automated systems; and request compensation for damage suffered due to unlawful processing.

You can submit your requests in writing to the postal address in Section 1, or by email to info@istandtravel.com from the email address registered in our system. The application must contain your name and surname (and signature, if in writing), your Turkish ID number (for foreigners, nationality and passport number), your address, your email/phone if any, and the subject of your request.

Your requests are concluded as soon as possible and within 30 days at the latest. A processing fee may be charged for each page over 10 pages for a written response, and the cost of the medium may be charged if the response is provided on a medium such as a CD or flash drive. If your application is not answered or is found insufficient, you may file a complaint with the Personal Data Protection Authority (KVKK Articles 14 and 15).

Personal Data Protection Authority — Address: Nasuh Akar Mah. Ziyabey Cad. 1407 Sok. No: 4, 06520 Balgat-Çankaya / Ankara · Phone: +90 312 216 5050 · Web: kvkk.gov.tr

6. Consent

If you have given us consent to process your personal data, you can withdraw it at any time. You can withdraw the consent given on the website from the relevant page or your account settings; and your newsletter consent via the 'Unsubscribe' link in the newsletter. In other cases, you can contact info@istandtravel.com. Withdrawal of consent applies only to the future and does not affect the lawfulness of prior processing.

7. Commercial Electronic Messages

Pursuant to the Turkish Law No. 6563 on the Regulation of Electronic Commerce, within the framework of the communication permissions you have given, you accept receiving commercial electronic messages from Airport Transfer Istanbul and its affiliates and partners about the promotion of services, new services, special offers and other information you may find interesting. You can change your communication preferences at any time by following the links in the messages, or stop their delivery.

8. Disclaimer

This Personal Data Protection Notice applies only to the airport-transfer.istanbul website. Other websites that are linked are not within its scope and have their own privacy policies.

9. Additional Notice for Users in the European Union

This section applies where our services are used by persons located in European Union member states.

9.1. International transfer. Personal data may be transferred to third countries or international organisations. Such a transfer is subject to appropriate safeguards being taken in accordance with legal requirements (in particular the EU standard contractual clauses) or to an adequacy decision issued by the EU Commission (GDPR Art. 45). You can request a copy of the safeguards applied from info@istandtravel.com.

9.2. Right to object (GDPR Art. 21). On grounds relating to your particular situation, you have the right to object at any time to the processing — including profiling — under GDPR Art. 6(1)(e) or (f). Where your data is processed for direct-marketing purposes, you may object at any time; following your objection, your data will no longer be processed for that purpose.

9.3. Your rights as a data subject (GDPR). Under the GDPR you have the rights of access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability and objection. To exercise your rights, you can email info@istandtravel.com.