PERSONAL DATA PROTECTION AND PRIVACY POLICY

WEBSITE PRIVACY AGREEMENT

During your visit to this website and your use of the services we offer through this site, the use and protection of the information obtained about you and the services you request are subject to the terms set forth in this Personal Data Protection and Privacy Policy.

By visiting this website and requesting to benefit from the services offered through this site, you accept the terms specified in this policy.

I. Purpose of the Personal Data Protection and Processing Policy

As Küheylan Turizm, due to the nature of our activities, we attach importance to the confidentiality and security of the personal data obtained from our customers, prospective customers, business partners, and website visitors.

The protection of personal data is one of our company’s fundamental policies. In this regard, it is intended to take the necessary administrative and technical measures for the lawful processing, storage, transfer, and protection of personal data within the framework of Law No. 6698 on the Protection of Personal Data and relevant legislation.

II. Scope and Amendment of the Policy

This policy covers the principles regarding the protection of the personal data of our customers, prospective customers, website visitors, business partners, suppliers, employees, and other persons who contact us.

Küheylan Turizm reserves the right to amend, update, or renew this policy in order to comply with legislation and to ensure better protection of personal data. The updated policy shall enter into force as of the date it is published at www.kuheylan.com.tr.

III. Basic Principles Regarding the Processing of Personal Data

Küheylan Turizm acts in accordance with the following principles when processing personal data:

a) Lawfulness and fairness

Personal data is obtained and processed in accordance with the law and fairness principles.

b) Accuracy and, where necessary, being up to date

Due care is taken to ensure that personal data is accurate and up to date. Requests from data subjects for updates to their information are taken into account.

c) Processing for specified, explicit, and legitimate purposes

Personal data is processed for specified, explicit, and legitimate purposes.

d) Being relevant, limited, and proportionate to the purpose for which they are processed

Personal data is used in a manner that is relevant, limited, and proportionate to the processing purpose. Data that is not necessary is not collected.

e) Retention for the period prescribed by law or required for the purpose of processing

Personal data is stored for the period prescribed by relevant legislation or for the period necessary for the purpose for which it is processed. Upon expiry of such periods, the data is deleted, destroyed, or anonymized.

IV. Purposes of Data Processing

Your personal data may be processed for the following purposes:

Providing reservation, sales, offer, tour, transfer, accommodation, airline ticket, DMC, and travel services,

Managing requests, suggestions, complaints, and communication processes,

Improving customer satisfaction and service quality,

Conducting campaign, promotion, publicity, and informational activities,

Fulfilling legal obligations,

Managing invoicing, payment, accounting, and finance processes,

Establishing and performing contractual processes,

Conducting operational processes with business partners, suppliers, hotels, airlines, transfer companies, insurance companies, and related service providers,

Improving the website user experience,

Conducting security, audit, and information systems processes.

V. Data of Customers, Prospective Customers, and Business Partners

Processing of data within the scope of contractual relationships

If a contractual relationship is established with our customers or prospective customers, personal data may be processed for the purpose of establishing and performing the contract and providing the service.

In this context, name, surname, phone number, e-mail, Turkish ID number or passport information, travel information, accommodation preferences, payment information, and other information necessary according to the nature of the service may be processed.

Data of business and solution partners

Küheylan Turizm acts in compliance with the law when sharing data with business partners and solution partners. Sharing is carried out only to the extent required by the service, and the relevant parties are expected to take the necessary measures regarding data security.

Data processing for advertising and commercial communication purposes

Sending electronic commercial communications is carried out in accordance with the relevant legislation and, where necessary, with the consent of the relevant person.

Users may opt out of e-newsletters, campaigns, or promotional mailings by using the unsubscribe link included in the commercial electronic messages sent to them.

VI. Processing of Sensitive Personal Data

Under the Law; health data, biometric and genetic data, criminal convictions and security measures data, as well as data concerning a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect, or membership in an association, foundation, or trade union are considered sensitive personal data.

Küheylan Turizm processes sensitive personal data only where required for the service, in accordance with the relevant legislation, and by taking the necessary security measures.

For example, information such as health status, special dietary preferences, disability status, pregnancy, allergies, or special service needs may be processed only for the purpose of properly providing the relevant travel, accommodation, or service, and where necessary, may be shared with the relevant hotel, airline, transfer company, insurance company, or healthcare institution.

VII. Transfer of Personal Data

Your personal data may be shared with the following persons and institutions for the purpose of providing the service:

Hotels in Turkey and abroad,

Airline companies,

Transfer and transportation companies,

Tour operators,

DMC companies,

Insurance companies,

Payment institutions and banks,

Software, infrastructure, call center, CRM, accounting, and technical service providers,

Authorized public institutions and organizations,

Legally authorized private legal entities,

Business partners and suppliers.

For overseas hotel, tour, transfer, airline ticket, or similar services, depending on the destination of the travel, your personal data may be shared with service providers located abroad.

VIII. Transfer of Personal Data Abroad

In order to provide overseas accommodation, airline tickets, tours, transfers, visas, insurance, or similar travel services, your personal data may be transferred to hotels, airlines, transfer companies, tour operators, DMCs, agencies, insurance companies, or technology providers located abroad, depending on the nature of the service.

In addition, if the servers of analytical, advertising, communication, payment, reservation, artificial intelligence, live support, or similar digital service providers used on the website are located abroad, your personal data may be transferred abroad in accordance with the relevant legislation.

IX. Data Processed Through Automated Systems

Some data may be processed through automated systems such as the website, reservation infrastructure, CRM, call center, payment systems, e-mail sending systems, and analytics and advertising technologies.

This data may be used to improve user experience, ensure security, enhance services, measure campaign performance, and facilitate reservation processes.

Without the explicit consent of individuals, no processing is carried out via exclusively automated systems that would produce legal consequences or similarly significant effects to the detriment of the relevant person.

X. Use of Artificial Intelligence and Live Support

Küheylan Turizm may use artificial intelligence-supported assistants, live support, messaging, or automated response systems on its website or digital channels.

The information you provide through these systems may be processed for the purposes of receiving and responding to your request, carrying out reservation or offer processes, and improving customer experience.

Users are advised not to share sensitive personal data, credit card information, passwords, or excessive personal information through these systems.

XI. Cookie Policy

Küheylan Turizm, like many websites, may use cookies and similar technologies in order to improve the user experience of website visitors, enhance service quality, ensure security, analyze site performance, and conduct marketing activities.

If you do not approve the use of cookies, you may block or delete cookies by changing your browser settings. If cookies are not allowed, some features of the website may not function properly.

What Are Cookies?

Cookies are small text files stored on your computer, tablet, or mobile device when you visit a website.

Through cookies, your IP address, session information, preferred language, pages accessed, visit duration, search preferences, and similar data may be processed.

Types of Cookies Used

Strictly Necessary Cookies

These are technical cookies necessary for the website to function securely and properly. No separate consent is required for the use of these cookies.

Analytical Cookies

Used to understand how the website is used, measure visitor numbers, analyze page performance, and improve user experience.

Functionality Cookies

Enable preferences such as language, region, search preference, session information, and similar settings to be remembered.

Marketing and Advertising Cookies

May be used to provide campaigns, offers, and advertisements tailored to users’ interests. These cookies are activated only with the user’s consent in cases where explicit consent is required.

How Can You Change Your Cookie Preferences?

You can change your cookie preferences, delete cookies, or block them through the settings of the internet browser you use.

For different browsers, cookie management is generally carried out through the “Settings,” “Privacy and Security,” or “Help” menu of the relevant browser.

XII. Protection of Credit Card and Payment Information

Where payment is collected through the website, your credit card and payment information is processed through secure payment infrastructures.

Küheylan Turizm does not store credit card information in its own systems in plain form. Payment transactions are carried out through the secure infrastructures of the relevant bank or authorized payment institution.

Users are advised not to share their credit card information, passwords, or payment details in insecure environments and to use caution when storing such information in browsers, third-party applications, or devices.

XIII. Storage, Deletion, and Anonymization of Personal Data

Personal data is stored for the periods prescribed by relevant legislation and for the period necessary for the processing purpose.

Upon the expiration of legally required retention periods, the disappearance of the processing purpose, or upon a request by the relevant person in accordance with the legislation, personal data is deleted, destroyed, or anonymized.

Anonymized data may be used for statistical analysis, reporting, and service improvement purposes.

XIV. Confidentiality and Data Security

Personal data is confidential. Küheylan Turizm takes the necessary administrative and technical measures to ensure that only authorized persons can access personal data.

In this context, secure use of software, restriction of access rights, training of employees, careful selection of suppliers, and regular review of data security processes are ensured.

Due to the nature of the internet, even if necessary security measures are taken, the risk of unauthorized access cannot be completely eliminated. Therefore, it is important that users also pay attention to the security of their own devices, passwords, and connections.

XV. Rights of the Data Subject

Under Article 11 of Law No. 6698 on the Protection of Personal Data, persons whose personal data is processed have the following rights:

To learn whether personal data is being processed,

If personal data has been processed, to request information regarding it,

To learn the purpose of processing personal data and whether they are used in accordance with that purpose,

To know the third parties to whom personal data is transferred domestically or abroad,

To request the correction of personal data if it is incomplete or incorrectly processed,

To request the deletion or destruction of personal data within the framework of the conditions stipulated by law,

To request that correction, deletion, or destruction operations be notified to third parties to whom personal data has been transferred,

To object to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,

To claim compensation for damages in the event of damage suffered due to the unlawful processing of personal data.

XVI. Application Method

You may submit your requests regarding your personal data to Küheylan Turizm in accordance with the provisions of the Communiqué on the Principles and Procedures for Application to the Data Controller.

Applications are finalized as soon as possible and in any event within 30 days depending on the nature of the request. If the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

You can use the following contact channels for your application:

Küheylan Turizm

Address: [Mustafa Kemal Mh. 2108 Sk. No:2 Çankaya Ankara]

Phone: [+90 312 230 3161]

E-mail: [info@kuheylan.com.tr]

Website: www.kuheylan.com.tr

XVII. Reporting Violations

In the event of any breach involving personal data, Küheylan Turizm takes the necessary steps to remedy the breach, reduce possible damages, and make the required notifications under the relevant legislation.

If personal data is accessed by unauthorized persons, the situation is notified to the Personal Data Protection Board and, where necessary, to the relevant persons within the procedures and time limits prescribed by the relevant legislation.

XVIII. Links to Third-Party Sites

Links to websites belonging to third parties may be provided through www.kuheylan.com.tr.

Küheylan Turizm is not responsible for the privacy policies, content, security practices, or data processing activities of third-party websites linked from this site. Therefore, it is recommended to review the privacy policies of the relevant sites before sharing any personal data on third-party websites.

XIX. Contact

For questions regarding the privacy policy and personal data protection, you may contact us using the information below:

Küheylan Turizm

Address: [Mustafa Kemal Mh. 2108 Sk. No:2 Çankaya Ankara]

Phone: [+90 312 230 3161]

E-mail: [info@kuheylan.com.tr]

Website: www.kuheylan.com.tr

Last Updated: 07 July 2026

Version: 1.0