Introduction

As Karavan Turizm Seyahat ve Nakliyat A.Ş. ("Karavan Cruises," "Company," or "We"), we are committed to ensuring the confidentiality of your personal data and processing it in compliance with applicable legislation while providing services to our guests. In accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data ("Law"), we would like to provide you with information on the following topics:

• How can we obtain your personal data?
• Which personal data do we process?
• For what purposes and on what legal grounds do we process your personal data?
• For what purposes and with whom can we share your personal data?
• What are your rights regarding your personal data, and how can you use these rights?

How Can We Obtain Your Personal Data?

Karavan Cruises can establish contact with you through many channels. For instance:

• During visits to our agencies or branches,
• When you call our customer service center and leave your information,
• When you visit our website or register and make a reservation;
• When you communicate with our customer service or other Karavan Cruises employees via email, you may share your personal data with us. Additionally, if your relationship with our company is through an intermediary, we may obtain your personal data through these intermediaries.

Which Personal Data Do We Process?

As Karavan Cruises, we may process your personal data in various categories in the context of the services we provide to you:

• Identity and Contact Information: Your name, surname, TCKN, passport, email address, phone number, mobile number, identity details, and address information.
• Visual and Audio Records: Your photo, call center records.
• Financial Information: Financial records or payment details related to services you have received from our company.
• Current and Past Transaction Information: Hotel, hotel reservations along with activities purchased, your package tour preferences, or travel details related to your current or past reservations.
• Request and Complaint Information: Written or verbal records of your requests and complaints about the services provided by Karavan Cruises, or special requests related to your existing reservation.
• Insurance Information: Details about your travel insurance policy.
• Professional Information: Details regarding your profession.
• Other Information: Your marriage date and children’s details.
• Sensitive Personal Data: Health information, if you have special needs during your trip or if you request a change or cancellation of your reservation due to a health condition.

For What Purposes Do We Process Your Personal Data?

Karavan Cruises processes your personal data for the following purposes and legal grounds:

• To Provide the Products and Services You Requested:
  Based on the legal ground of "necessary for the performance of a contract" stated in Article 5, Paragraph 2(c) of the Law, we process your personal data to deliver requested products and services. For example, we process personal data like identity, contact, request, or financial information to make reservations, follow up on operations, and manage membership processes.
• To Improve the Quality of Our Products and Services:
  Based on the legal grounds of "legitimate interests of the data controller" stated in Article 5, Paragraph 2(f) and occasionally on the ground of "data made public by the data subject" stated in Paragraph 2(d), we process personal data to improve our products and services and measure customer satisfaction.
• To Address Your Requests and Complaints:
  We process personal data based on "legitimate interests" and "fulfilling legal obligations" as stated in Article 5, Paragraph 2(f) and (ç) of the Law to address your requests and complaints regarding our services.
• To Create Financial Records:
  Based on the legal ground of "necessary for the performance of a contract" stated in Article 5, Paragraph 2(c), we process personal data for financial processes such as issuing invoices, creating financial records, or conducting financial audits.
• To Conduct Internal Company Activities:
  Based on the legal grounds of "legitimate interests of the data controller" as stated in Article 5, Paragraph 2(f), we process personal data for internal operations like managing IT infrastructure, evaluating employee performance, or conducting internal audits.
• To Fulfill Legal Obligations:
  Based on the legal grounds of "fulfilling legal obligations" and "explicitly provided by laws" as stated in Article 5, Paragraph 2(ç) and (a), we process your personal data to comply with various legal obligations, such as tourism, tax, and insurance regulations.

For What Purposes and with Whom Do We Share Your Personal Data?

We may share your personal data with third parties in certain situations. Here are the parties we may share your data with and the reasons for doing so:

• With Our Business Partners:
  We may share your data with suppliers such as accommodation providers (hotels), transportation companies (airlines, bus companies), insurance companies, and event organizers to provide the services you request.
• With Our Suppliers:
  We may share your data with third-party service providers for website management, IT infrastructure, legal and financial services, etc.
• With Financial Institutions:
  We may share your personal data with banks or payment service providers to process payments for the services you’ve requested.
• With Authorized Public Institutions or Private Entities:
  We may share your personal data with public institutions or other organizations to fulfill our legal obligations, for example, with authorities during criminal investigations or tax audits.

What Are Your Rights Regarding Your Personal Data and How Can You Use These Rights?

Under Article 11 of the Law, as the data subject, you have several rights concerning your personal data. These rights include:

• Learning whether your personal data is processed.
• Requesting information about the processing of your personal data.
• Learning the purposes for which your data is being processed and whether it is being used accordingly.
• Learning the third parties to whom your data is transferred.
• Requesting correction of incorrect or incomplete personal data.
• Requesting the deletion or destruction of your personal data if the reasons for processing no longer exist.
• Objecting to the processing of your data that results in unfavorable outcomes through automated systems.
• Requesting compensation for damages caused by unlawful processing of your personal data.

To exercise these rights, you can contact us through the Karavan Cruises Data Subject Application Form, available on our website at www.aroyacruise.com.tr After filling out the form, you can send it using one of the specified methods. We will respond to your request as soon as possible and within 30 days at the latest.