LPPD Clarification Text

Effective date: [DATE]
Last update: [DATE]

In accordance with the Law on the Protection of Personal Data No. 6698 ("LPPD"), as TRIPORA GROUP TURİZM GAYRİMENKUL VE DANIŞMANLIK LİMİTED ŞİRKETİ ("Tripora" or "Company"), in our capacity as the data controller, we would like to inform you about the processing of your personal data as follows.

1. Identity of the Data Controller

2. Categories of Processed Personal Data

Tripora may process your personal data in the following categories within the scope of the travel agency and package tour organization services it provides:

• Identity Data: Name, surname, date of birth, T.R. identity number, passport details, nationality, gender

• Contact Data: Phone, email, postal address, WhatsApp number

• Customer Transaction Data: Reservation records, request and complaint records, customer correspondence

• Financial Data: Invoice details, payment information (card numbers are not stored, processed through virtual POS), bank account information (in case of refund)

• Visual and Auditory Data: Call center voice recordings, images taken via IP cameras (during office visits)

• Marketing Data: Campaign preferences, survey answers, communication consents

• Legal Action Data: Contracts, power of attorneys, legal correspondence

• Special Categories of Personal Data: (only with your explicit consent) health declaration, diet/allergen details, physical limitations, food preferences related to religious beliefs (halal, kosher, etc.)

• Passport/Visa Data: Copy of passport, visa application documents, biometric photograph

• Cookie and Traffic Data: IP address, device information, browser information, pages visited (see Cookie Policy for details)

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

1. Execution of contract processes: Providing tours, transfers, accommodation, visa intermediation, and other travel services

2. Reservation and operation management: Creating reservations with airlines, hotels, transfer companies, and other suppliers

3. Fulfillment of legal obligations: Notification obligations to TÜRSAB, Ministry of Culture and Tourism, Ministry of Finance, Security, and other public institutions

4. Visa and travel document procedures: Following up on consulate applications, visa consultancy

5. Customer relationship management: Evaluating requests, complaints, and opinions

6. Execution of financial processes: Issuing invoices/receipts, collection, refund transactions

7. Intervention in medical emergencies: Providing support in health-related events that may occur during the tour

8. Marketing activities: (with your explicit consent) notifications for campaigns, discounts, new tours

9. Execution of legal processes: Defense of rights in case of possible disputes

10. Development of service quality: Statistical analysis, surveys

4. Legal Grounds for Processing

Your personal data is processed based on the following legal grounds pursuant to Articles 5 and 6 of the LPPD:

• Establishment or performance of a contract: Tour reservation, package tour contract

• Explicitly provided for in the laws: Law No. 1618, Regulation on Package Tour Contracts, Tax Procedure Law, Turkish Commercial Code

• Fulfillment of a legal obligation: Reporting obligations to official institutions

• Establishment, exercise, or protection of a right: Defense in legal disputes

• Legitimate interest: Increasing service quality, prevention of fraud

• Explicit consent: Marketing communications, special categories of health data, transfer of data abroad

5. Parties to Whom Personal Data is Transferred and Transfer Purposes

Your personal data may be transferred to the following parties in order to provide the service:

• Supplier agencies and operators

• Airline companies and GDS providers: Amadeus, Sabre, Travelport, etc.

• Accommodation facilities

• Transfer and transportation providers

• Visa service providers and consulates

• Insurance companies: Mandatory package tour guarantee insurance and travel health insurance

• Payment institutions and banks

• Legal and financial advisors, audit firms

• TÜRSAB and Public Institutions: Ministry of Culture and Tourism, Ministry of Finance, Directorate General of Security, BTK, Courts

• Authorized public institutions (upon request)

6. Transfer of Data Abroad

Within the scope of international tours, your data may be transferred to suppliers such as hotels, airlines, transfer companies, and consulates in EU member states and other countries. These transfers are carried out as a requirement for the performance of the contract under the exception in Article 9/2 of the LPPD or based on your explicit consent.

7. Retention Periods of Personal Data

At the end of the duration, data is deleted, destroyed, or anonymized.

8. Methods of Collecting Personal Data

Your data is collected through our website, mobile platforms, WhatsApp, email, telephone, call center, face-to-face meetings, social media, online forms, and physical documents by written, oral, electronic, or automated means.

9. Your Rights Under Article 11 of the LPPD

As a data subject, you can use the following rights by applying to Tripora:

1. To learn whether your personal data is processed or not

2. To request information if it has been processed

3. To learn the purpose of processing and whether it is used in accordance with its purpose

4. To know the third parties to whom it is transferred domestically or abroad

5. To request correction if it is incomplete or incorrectly processed

6. To request deletion or destruction under Article 7 of the LPPD

7. To request notification of correction/deletion processes to third parties to whom data is transferred

8. To object to any result against you arising from analysis exclusively through automated systems

9. To demand compensation for damages suffered due to unlawful processing

10. Method of Application

Pursuant to Article 13 of the LPPD and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests:

• In writing with a physically signed petition to the address of 19 Mayıs Mah. Halaskargazi Cad. No: 216 İç Kapı No: 3, Şişli / İstanbul,

• To our Registered Electronic Mail (KEP) address: [kep address]

• With a secure electronic signature to the address of [info@tripora.com],

• Using the Data Subject Application Form on our website.

You may apply by transmitting through these means.

Your applications will be finalized within 30 days at the latest. The transaction is free of charge; however, for transactions that require an additional cost, the tariff determined by the Personal Data Protection Board may be applied.

Your right to complain to the Board is reserved: kvkk.gov.tr

This clarification text can be revised in accordance with legislative modifications and updates in our scope of services. The current version is published on our website.