Privacy Policy – Data Protection Notice
This notice explains how we process your personal data when you book an airport transfer for GBS Istanbul 2026. It is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to you, Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR").
1. Who is responsible for your data
The data controller is TERRATURKEY TURİZM ANONİM ŞİRKETİ, Fulya Mah. Sakız Ağacı Sk. Perk Apartmanı No: 16 İç Kapı No: 3 Şişli, İstanbul, Türkiye, MERSİS no. 0840083518600001 ("Terra Turkey", "we"). Our contact person for data protection matters is Fethi Aydın, at +90 540 002 5903.
2. What data we process
| Category | Data |
|---|---|
| Identity | First name, last name; names of other passengers in your party |
| Contact | Email address, mobile telephone number |
| Travel | Airport, hotel, date, flight number, landing or pick-up time, vehicle class, number of passengers, IGA Pass selection, remarks you provide |
| Financial | Amount, currency, payment reference, invoice and billing details. We do not receive or store your card number |
| Special category (only if you provide it) | Health, disability or accessibility information you give us so that we can arrange a suitable vehicle or assistance; ages of children travelling with you |
| Technical | IP address, device and browser information, server log records, and the date and time on which you accepted the Terms & Conditions and this notice |
3. Why we process it and on what legal basis
| Purpose | Legal basis – KVKK | Legal basis – GDPR |
|---|---|---|
| Taking and confirming your booking; performing the transfer; passing your name, flight and hotel details to the driver and transport supplier | Art. 5/2(c) – necessary for the performance of a contract | Art. 6(1)(b) |
| Monitoring your flight and arranging the meet and greet, including sharing data with the airport operator if you select IGA Pass | Art. 5/2(c) | Art. 6(1)(b) |
| Taking payment, issuing invoices and keeping accounting records | Art. 5/2(ç) – legal obligation | Art. 6(1)(c) |
| Responding to your questions and complaints | Art. 5/2(f) – legitimate interest | Art. 6(1)(f) |
| Security of the website, prevention of fraud and misuse | Art. 5/2(f) | Art. 6(1)(f) |
| Establishing, exercising or defending legal claims, and insurance claims | Art. 5/2(e) | Art. 6(1)(f) |
| Arranging a suitable vehicle or assistance where you tell us about a health or accessibility need | Explicit consent | Art. 9(2)(a) |
| Sending you marketing messages, if you ask us to | Explicit consent, with İYS registration | Art. 6(1)(a) |
You are not obliged to give us health or marketing consent, and you can withdraw either at any time without affecting your booking. Withdrawing consent does not affect processing carried out before the withdrawal.
4. Where the data comes from
We collect your data directly from you through the booking form, by email and by WhatsApp, and from the person who makes a booking that includes you. We also generate technical data automatically when you use the Booking Page. We do not buy personal data and we do not obtain it from marketing partners or public databases.
5. Who we share it with
| Recipient | What and why |
|---|---|
| Drivers and transport suppliers | Name, flight or pick-up details, hotel, mobile number, vehicle and child seat requirements – so that the transfer can be carried out |
| Airport operator (IGA) | Data needed for IGA Pass, only if you select it |
| Hotel | Only where needed to arrange pick-up or drop-off |
| Payment provider (Yapı Kredi) | Payment data. Your card details are given directly to the provider and are not seen by us |
| Hosting, email and IT providers | Data stored or transmitted on our systems, under a data processing agreement |
| Accountants, auditors and tax authorities | Invoice and payment records, as required by law |
| Insurers and legal advisers | Only where needed for a claim or a dispute |
| Courts and public authorities | Where we are legally required to disclose |
We do not sell your personal data and we do not share it with third parties for their own marketing.
6. Transfers outside Türkiye
Some of the recipients above are located outside Türkiye, and some of our IT services are hosted outside Türkiye. Where we transfer your data abroad we rely on the standard contract issued by the Turkish Personal Data Protection Authority under Article 9 of the KVKK, which we notify to the Authority within five working days of signature, or on another lawful transfer mechanism. For transfers from the European Economic Area we use the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards we have put in place using the contact details in clause 11.
7. How long we keep it
| Data | Retention period |
|---|---|
| Booking and travel data | For the period during which a claim may be brought, and in any event no longer than 10 years from the transfer |
| Invoices, payment and accounting records | 10 years, under Article 82 of the Turkish Commercial Code; 5 years under Article 253 of the Tax Procedure Law |
| Correspondence, including WhatsApp messages | 10 years from the end of the correspondence |
| Records of consent and acceptance of terms | For as long as the related processing continues, and 5 years afterwards |
| Server log records | 6 months |
| Marketing consent | Until you withdraw it, and 5 years afterwards as evidence |
When a retention period ends, we delete, destroy or anonymise the data in accordance with our retention and destruction policy.
8. Your rights
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is being processed;
- request information about it if it has been processed;
- learn the purpose of the processing and whether the data is used in line with that purpose;
- know the third parties in Türkiye or abroad to whom the data has been transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for the data to be erased or destroyed where the conditions in Article 7 are met;
- ask us to notify the third parties to whom the data was transferred of any correction, erasure or destruction;
- object to a result reached solely by automated analysis of your data that operates to your detriment; and
- claim compensation for damage caused by unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, objection and data portability, and the right not to be subject to a decision based solely on automated processing. We do not carry out automated decision-making or profiling.
9. How to use your rights
You can make a request in writing to info@terraturkeydmc.com, or by registered electronic mail (terraturkeydmc@hs09.kep.tr), secure electronic signature, mobile signature, or from an email address you have previously notified to us and which is registered in our system, in accordance with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller. Please describe your request clearly and include enough information for us to identify you.
We will respond as soon as possible and in any event within thirty days. Our response is free of charge unless it requires additional cost, in which case we may charge the fee set by the Authority.
10. Complaints
If you are not satisfied with our response, you may complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within thirty days of our response and in any event within sixty days of your application. If you are in the European Economic Area or the United Kingdom, you may also complain to your local supervisory authority.
11. Children
We do not collect personal data directly from children. Where a booking includes children, we process only the information the booking adult gives us, and only what is needed to carry out the transfer safely, such as the number and age of children so that we can provide the correct child seats.
12. Security
We take appropriate technical and organisational measures to keep your data secure, including encryption of data in transit, access controls, and written data processing agreements with our suppliers. If a personal data breach occurs, we will notify the Turkish Personal Data Protection Authority as soon as possible and in any event within seventy-two hours of becoming aware of it, and we will inform affected individuals as soon as possible where the breach is likely to result in a risk to them.
13. Cookies
The Booking Page uses only strictly necessary cookies. These are the session cookie that keeps your booking form together while you fill it in, and the cookie that protects the form against cross-site request forgery. They are deleted when you close your browser and are not used to identify you, to build a profile or to show you advertising.
We do not use analytics, advertising or social media cookies on the Booking Page. Because no non-essential cookies are set, no consent banner is shown. If we introduce non-essential cookies in the future, we will ask for your consent before setting them, and you will be able to withdraw that consent at any time.
14. Changes to this notice
We may update this notice. The current version is always published on the Booking Page, with the date on which it took effect. If we make a material change we will tell you directly before it takes effect.
© 2026 Terra Turkey DMC. All rights reserved. · Terms & Conditions