Privacy Notice on Personal Data Protection Regarding Identity/Passport/Visa Information

Within the scope of the Fulfilment of the Obligation to Inform of the Data Controller in accordance with the Personal Data Protection Law No. 6698 (“KVKK”) and the European Union 2016/679 General Data Protection Regulation (“GDPR”), we aim to inform you about your personal data processed by Hürkuş Aviation and Trade Inc. (“Company”, “we”) in the capacity of data controller with this Privacy Notice.

1. WHAT ARE YOUR PROCESSED PERSONAL DATA?

Identity Information:Name-Surname, Date of Birth, Country of Domicile, Identity Number, Identity, Passport and Visa Information
Advanced Passenger Information (“API”)**:Name-Surname, Naitonality, Date of Birth, Gender, the Type and Number of Travel Documents, the Start and End Dates of their Validity and the Country of Issuance Information
Contact Information: E-mail address, Phone Number, Address Information
Customer Transaction Information: Website usage information, preferences, likes, interests and usage habits, advertising ID (identity identifiers), billing information, request / complaint information, comments, points and evaluation information
Other Information:Within the scope of the circulars issued by the Ministry of Interior of the Republic of Turkiye, personal data requested according to special permission certificate, and national and international civil aviation rules.

**API: In case you book your ticket through a travel agency or other airlines, they may send us your name, nationality, date of birth, gender, as well as the type, number, country of issuance and validity date of your travel documents.

2. WHAT ARE THE METHOD, PROCESSING PURPOSES AND LEGAL BASIS OF THE COLLECTION OF YOUR PERSONAL DATA?

Your personal data mentioned above are collected by automatic and/or partially automatic methods during the establishment of your relationship with us and during the continuation of the relationship in question, for the purposes and based on the reasons for compliance with the law set out below.

PERSONAL DATA CATEGORY

PURPOSES

LEGAL BASIS

Identity Information
Advanced Passenger Information (“API”)
Contact Information
Customer Transaction Information
Other Information

Fulfillment of our legal obligations
Execution of Communication Activities
Follow-up of Requests / Complaints
Ensuring customer satisfaction
Providing Information to Authorized Persons, Institutions and Organizations
Preparation of the necessary records and documents for the execution of flight operations in accordance with national and international legislation and aviation rules
Compliance with the rules set by the civil aviation authorities
Fulfilling the verbal/written instructions given by the local authorities/authorities of the destination country, making some examinations and confirmations on the travel documents of our passengers (such as passport duration, validity, visa dates, residence permit), keeping records of these examinations
Compliance with information retention, reporting, recording, disclosure, tax, international sanctions, and other obligations stipulated by law
Ensuring security, identification/tracking/delivery of your baggage/found items
Ability to make payment/compensation/transfer/membership transactions

Processing of your personal data is explicitly stipulated by legislation (KVKK m. 5/2-a)
Processing is necessary for the performance of a contract (KVKK m. 5/2-c) (GDPR m. 6/1-b)
Processing of your personal data is necessary for fulfilling our legal obligations (KVKK m. 5/2-ç) (GDPR m. 6/1-c)
Processing is necessary in order to protect the vital interests of the data subject or of another natural person (KVKK m. 5/2-e) (GDPR m. 6/1-d)
Legitimate interest of the data controller (KVKK m. 5/2-f) (GDPR m. 6/1-f)

3. TO WHOM YOUR PERSONAL DATA ARE TRANSFERRED AND WHAT ARE THE PURPOSES OF TRANSFER?

Your personal data can only be transferred to third parties in the following cases, being limited, associated and restrained with the purposes of the processing, in accordance with the provisions of the KVKK and GDPR regarding the transfer of personal data.

RECIPIENTS

PURPOSES

Authorized Persons, Institutions or Organizations
Gözen Holding A.Ş. Group Companies

To fulfill our legal obligations, to inform authorized persons, institutions, or organizations within the scope of our legal obligations, to carry out legal processes, and to conduct our business operations in accordance with the legislation.
Some of the services offered by our company are carried out through our affiliates, your personal data may be shared with our relevant group companies in this context. Gözen Holding A.Ş. Group Companies may share your information with Holding Group Companies only when exceptionally necessary for the purpose of execution of administrative affairs, technical and technological activities. You may access the information of our Holding Companies at https://gozenholding.com/.

4. IN CASE YOUR PERSONAL DATA IS TRANSFERRED ABROAD, WHAT ARE THE PURPOSES OF THE TRANSFER?

In the case of flights performed abroad/to abroad, your personal data may be transferred to foreign states where the transportation takes place, authorized private institutions and organizations authorized by national and international legislation, and public institutions in accordance with the provisions of KVKK and GDPR regarding the transfer of personal data, limited, relevant, adequate (proportionate) to the purposes of the processing. (For example: Relevant authorities of the country where your travel takes place or whose airspace is used in accordance with national and/or international civil aviation legislation and regulations, and authorized third parties, law enforcement agencies within the scope of investigations, etc.).

5. FOR HOW LONG YOUR PERSONAL DATA IS STORED?

Your personal data is not stored for longer than the required period. In accordance with our company procedure, the storage period of your personal data processed during your relationship with our Company is 10 years. At the end of this period, the data is destroyed.

In addition, our company is committed to ensuring the protection of your personal data. Therefore, technical and organisational measures are taken within the scope of KVKK and GDPR to protect your personal data from unauthorised access, use or disclosure.

6. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?

In accordance with the Article 11 of the KVKK, you have the following rights regarding your personal data;

Right to be Informed:To learn whether personal data is processed, To request information if personal data is processed, To learn the purpose of processing personal data and whether they are used in accordance with their purpose
Right of Access:To know the third parties to whom personal data are transferred domestically or abroad
Right to Rectification:To request correction of personal data in case of incomplete or incorrect processing
Right to Erasure:Request deletion or destruction of personal data
Right to Notification:In case of correction, deletion or destruction of personal data, to request notification of these transactions to third parties to whom personal data are transferred
Right of Objection:To object to the occurrence of a result to the detriment of the person himself/herself by analysing the processed data exclusively through automated systems
Right to Compensation:To demand compensation for damages in case of loss due to unlawful processing of personal data

In accordance with the Article 3 of the GDPR, you have the following rights regarding your personal data;

Right to be Informed:Organisations must tell individuals what data is collected, how it is used, how long it will be stored and whether it will be shared with third parties.
Right of Access:Individuals have the right to request a copy of the information an organisation holds on them.
Right to Rectification:Individuals have the right to correct inaccurate or incomplete data.
Right to Erasure and to be Forgotten:In certain circumstances, individuals can ask organisations to erase personal data stored on them, including on the Internet.
Right to Data Portability:Individuals can request organisations to transfer all data held on them to another company.
Right to Restriction of Data Processing:Individuals can request that an organisation limit the way it uses their personal data.
Right to Object:Individuals have the right to object to certain types of processing, such as direct marketing.
Rights relating to automated individual decision-making tools, including profiling:Individuals can ask organisations to provide a copy of their automated processing activities if they believe that data is being processed unlawfully. Organisations should also remind individuals that they are free to exercise their rights and explain how they can do so.

7. HOW TO USE YOUR RIGHTS?

In order to exercise these rights granted to the data subjects under Article 11 of KVKK and Article 3 of the GDPR, certain procedures are set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. To exercise your rights and to get information about your rights;

- You can send your requests to the following address of our company by hand upon identification in person or through a notary public,

Hürkuş Hava Yolu Taşımacılık ve Ticaret A.Ş. (“Hürkuş Aviation and Trade Inc”), Simetri Ofis - Çobançeşme Mah. Sanayi Cad. No:60 Kat:4-5 34197 Bahçelievler - İstanbul/Türkiye,

- You can apply to our company's [email protected] / [email protected] e-mail address or our company's registered electronic mail (KEP) [email protected] address with your secure electronic signature and mobile signature or your e-mail address previously notified to us by you and confirmed by us in our systems.