KVKK Disclosure Text

Effective date: 1 May 2026 · Last updated: 15 May 2026

1. Data Controller

In accordance with Personal Data Protection Law No. 6698 ("KVKK"), in our capacity as data controller Trip and Tick Tourism and Travel Agency Limited Company we declare that we act in accordance with the principles of the Personal Data Protection Board.

Address: Göreme Merkez, Nevşehir 50180, Türkiye
Email: [email protected]
Phone: +90 537 464 78 61

2. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Conclusion and performance of the distance sales contract.
• Booking processing, payment collection, invoicing.
• Booking notification to the operator and service delivery.
• Customer support, complaint and request management.
• Fulfilment of legal obligations (tax, TÜRSAB).
• Marketing communications (only with explicit consent).
• Improving service quality, anonymous analytics.
• Data security, fraud prevention.

3. Legal Grounds for Processing (KVKK art. 5)

• Where it is mandatory for the conclusion or performance of a contract (art. 5/2-c).
• Where it is mandatory for the fulfilment of a legal obligation (art. 5/2-ç).
• Legitimate interest of the data controller (art. 5/2-f) — analytics, security.
• Explicit consent (art. 5/1) — processing for marketing purposes.

4. Transfer of Personal Data

Your data may be transferred to the following recipient groups under KVKK art. 8 and art. 9:

• Partner operators (booking information).
• Payment provider (Stripe — PCI-DSS).
• Email service (Brevo) — domestic.
• Authorised public institutions (upon legal request).
• Legal advisers and financial consultants.

5. Retention Periods

• For the duration of the contractual relationship and 10 years thereafter.
• Documents under tax legislation: 5 years.
• Marketing-purpose records: until consent is withdrawn.
• Cookie data: up to 12 months.
• At the end of the statutory retention period, the data is destroyed by a secure method.

6. Rights of the Data Subject (KVKK art. 11)

As a data subject, you have the following rights:

1. Learn whether your personal data is being processed.
2. Request information regarding your personal data if it has been processed.
3. Learn the purpose of processing and whether the data is used in accordance with that purpose.
4. Know the third parties, domestic or abroad, to whom the data is transferred.
5. Request correction if processed incompletely or incorrectly.
6. Request deletion/destruction within the conditions set out in KVKK art. 7.
7. request notification to third parties to whom the data has been transferred regarding the operations carried out under paragraphs (5) and (6).
8. Object to an adverse outcome arising from analysis solely by automated systems.
9. Claim compensation for damages incurred due to unlawful processing.

7. Application Methods

To exercise your rights under KVKK art. 13, you may apply using one of the following methods:

• Online (recommended): Data Rights Request Form — 24-hour approved magic-link for data access (KVKK m.11/b) or deletion (m.11/e).
• Email: [email protected]
• Post: Göreme Merkez, Nevşehir 50180 — with a copy of your ID.
• Notarised notice: official registered method.

Your application within 30 days at the latest is answered free of charge.

8. Right to Complain

If your application is rejected, the response provided is found insufficient, or no response is given within 30 days, you have the right to file a complaint with the Personal Data Protection Board:

Personal Data Protection Authority: www.kvkk.gov.tr