GDPR Privacy Notice

1Purpose and Scope

Within the framework of the relevant provisions of the Constitution of the Republic of Turkey and the Law No. 6698 on the Protection of Personal Data (“KVKK”), this clarification text has been prepared by WayOfTurkey, as the Data Controller, due to the obligation to inform individuals about their rights regarding the processing, purpose, and possible transfer of their personal data based on their explicit consent, and the retention of such data in accordance with legal regulations, particularly Articles 10 and 11 of the Law.

Accordingly, all personal data processed by WayOfTurkey, including data of our customers, employees, suppliers, and third parties, fall within the scope of this policy.

2Data Controller

Your personal data is processed by our company, whose details are given below, in its capacity as data controller under Law No. 6698.

3Categories of Personal Data Processed

Depending on the service, the following personal data may be processed:

• Identity: name, surname, Turkish ID or passport number, nationality, date of birth (for bookings and legal notifications)
• Contact: phone number, e-mail address, address
• Customer transactions: tour and accommodation requests, booking records, requests and complaints
• Travel: flight, accommodation, transfer and participant details
• Finance: payment and invoice details
• Transaction security: IP address, website usage logs and strictly necessary cookies
• Marketing: your consent and e-mail address for campaign and newsletter messages

4Collection Method and Legal Basis

Your personal data is collected through the contact and newsletter forms on our website, WhatsApp, e-mail, telephone and our office, by automated or partly automated means.

Your data is processed on the legal grounds set out in Article 5(2) of the Law: it is necessary for the establishment or performance of a contract (c), for compliance with a legal obligation of the data controller (ç), for the establishment, exercise or protection of a right (e), and for our legitimate interests provided that your fundamental rights and freedoms are not harmed (f). Commercial electronic messages (campaigns and newsletters) are sent only with your explicit consent, which you may withdraw at any time.

5Transfer of Personal Data

For the purposes above and in accordance with Articles 8 and 9 of the Law, your personal data may be transferred to accommodation providers, airlines and transfer companies, car rental companies, guides, insurance companies, banks, our accounting and legal advisers, TÜRSAB, the Republic of Türkiye Ministry of Culture and Tourism and legally authorised public institutions.

If you request a service that takes place abroad, the data necessary to provide it may be transferred to the relevant service providers abroad under the conditions of Article 9 of the Law. If you contact us via WhatsApp, your messages are also processed by the provider of that application.

6Retention Period

Your personal data is kept for as long as the purpose of processing requires and for the statutory retention periods set out in the applicable legislation; at the end of these periods it is deleted, destroyed or anonymised.

7How Are Your Personal Data Protected?

In order to protect personal data, administrative and technical measures appropriate to the nature of the data are taken in line with applicable legislation and current technological conditions. In addition, data security is continuously monitored and maintained.

8Your Rights Under Law No. 6698

You may exercise the following rights by submitting a written application to the address below or via methods determined by the Personal Data Protection Authority, provided that your identity is verified.

Application addressDuayeri Mahallesi, Karağandere Sokak No: 30/1, Ürgüp / Nevşehir, Turkey

Pursuant to Article 11 of KVKK, data subjects have the following rights:

1. aTo learn whether personal data is being processed,
2. bTo request information if personal data has been processed,
3. cTo learn the purpose of the processing of personal data and whether they are used in accordance with the intended purpose,
4. çTo know the third parties to whom personal data is transferred, whether domestically or abroad,
5. dTo request correction of personal data if it is incomplete or incorrectly processed,
6. eTo request deletion or destruction of personal data under the conditions set out in Article 7 of the Law,
7. fTo request notification of the operations carried out under subparagraphs (d) and (e) to third parties to whom personal data has been transferred,
8. gTo object to any result that is to the detriment of the data subject, arising from the analysis of personal data exclusively through automated systems,
9. ğTo request compensation in case of damage due to the unlawful processing of personal data.

You may send your application in writing to our address above, via registered electronic mail (KEP), secure electronic signature or mobile signature, or from an e-mail address previously notified to us and registered in our system to info@wayofturkey.com. Applications are concluded free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

9Purposes of Personal Data Processing

Your personal data may be processed for the following purposes:

• Execution of Access Authorization Processes
• Conducting Activities in Compliance with Legislation
• Execution of Finance and Accounting Processes
• Execution of Management Activities
• Providing Information to Authorized Persons, Institutions, and Organizations
• Execution of Communication Activities
• Execution / Supervision of Business Activities
• Execution of Goods / Services Procurement Processes
• Execution of After-Sales Support Services for Goods / Services
• Execution of Sales Processes for Goods / Services
• Execution of Goods / Services Production and Operation Processes
• Execution of Customer Relationship Management Processes
• Recording and Tracking Visitor Information
• Execution of Performance Evaluation Processes
• Execution of Risk Management Processes
• Execution of Storage and Archiving Activities
• Execution of Contractual Processes
• Tracking Requests / Complaints
• Ensuring the Security of Data Controller Operations

Applications in this context will be accepted following identity verification, and a response will be provided to the relevant persons in writing or electronically within the legal timeframe.

10Cookies

Our website uses only cookies that are strictly necessary for it to work; no analytics or advertising cookies are used. See our Cookie Policy for details.

Cookie Policy