Data Protection

1- Data Controlle

Below, as the Data Controller (GDPR Article 4(7), KVKK Article 3(1) (ı)),

White Deck (Sancak Mah. Trabzon Cad. No: 233/A, Yomra, Trabzon 61250)

(hereinafter referred to as “White Deck,” “we”), will inform you about the processing of your personal data in connection with the use of our website at https://www.yomratour.com (the “website”), as well as the sale of our products and services (GDPR Article 4(2), KVKK Article 3(1) (e)).

If you need further information about the processing of your personal data in connection with the use of our website and the sale of our products and services, please feel free to contact us.

Your privacy is as important to us as it is to you. Therefore, we aim to inform you about "White Deck's purposes for processing your data, the manner in which we process it, and the entities to whom we may transfer it." Your personal data shared with us via our website and other electronic communication and sales channels will be processed in accordance with this notice.

2- Scope, Purpose, and Legal Basis of Personal Data Processing

Your personal data is processed in accordance with the Personal Data Protection Law No. 6698 ("KVKK"), the General Data Protection Regulation (Reg. EU 2016/679) ("GDPR"), and, where applicable, German laws (particularly BDSG 2018) ("Data Protection Legislation").

We collect and use personal data directly from our users or from other sources (as specified below) in the following circumstances:

2.1. Our Website

2.1.1. Viewing the Website and Creation of Log Files

Each time you access our website as a user, our system automatically requests and records data and information from the computer system. In this context, the following data ("technical information") is collected:

(1) Information about the browser type and version,
(2) The user's operating system,
(3) The user's internet service provider,
(4) The user's IP address,
(5) Date and time of access,
(6) Websites accessed by the user's system before reaching our website,
(7) Websites accessed by the user through our website.

The data is also recorded in our system's log files. These data are not stored together with other personal data of the user.

In this context, we collect and use this technical information for network security purposes (e.g., to combat cyberattacks), marketing, understanding the needs of our users, continuously improving our website, and ensuring that the website is displayed on the user's computer.

The purpose of storing the data in the log files is to ensure the operability of the website. Additionally, we use the data to optimize the website and ensure the security of our information technology systems. In this context, the data is not analyzed for marketing purposes.

The legal basis for the temporary storage of the data and log files is GDPR Article 6(1)(f).

2.1.2. Use of Cookies

Cookies are used on our website. Cookies are text files that are stored in the web browser or on the user's computer system. When a user accesses a website, a cookie may be saved to the user's operating system. This cookie contains a specific string of characters that allows the browser to be recognized when the website is accessed again.

Cookies are stored on the user's computer, at the location where they are transmitted to us. As a user, you have full control over the use of cookies. You can disable or limit the transmission of cookies by changing the settings of your web browser. You can also delete previously stored cookies at any time. This process can be done automatically. If cookies are disabled for our website, it may no longer be possible to fully utilize all functions of the website.

For more information on the cookies we use, their purposes, and legal bases, please refer to our Cookie Policy.

2.1.3. Use of Services Provided on Our Websites

We offer various services and applications on our website. The collection and processing of personal data of our users or customers is necessary to provide the aforementioned services.

White Deck may use your personal data for the following purposes:

• Providing support during your transactions on our website via Live Chat,
• Sending newsletters (see Section 2.1.4) and commercial communications via the communication channels you have chosen,
• Contacting you through your selected communication channels regarding market research and customer satisfaction surveys, analyzing the results of these surveys and studies, and using the data for statistical purposes,
• Sending mail, newsletters, and personalized offers related to a Loyalty Program that may be carried out from time to time,
• Providing our products and services in accordance with our contractual obligations or legitimate interests, and transferring your personal data abroad in accordance with KVKK for compliance with public safety regulations in the countries where travel occurs, or airline regulations,
• Offering personalized offers, including personalized use of the website and profiling,
• Providing support regarding the use of the website, including reminder features,

Based on your explicit consent pursuant to GDPR Article 6(1)(a), KVKK Article 5(1):

• Providing the requested offers and services,
• Managing a Loyalty Program that may be carried out from time to time,
• Enabling the management of Loyalty Program members’ accounts effectively,
• Rewarding Loyalty Program members with free flights, BonusPoints, and White Deck services paid with BonusPoints from time to time,

Pursuant to GDPR Article 6(1)(b), KVKK Article 5(2)(c) under contractual obligations:

• Providing special flight and service offers,
• Creating, listing, reporting, verifying, analyzing, and evaluating databases, generating statistical information,
• Analyzing how you use our website and other communication and sales channels, customizing communication channels to provide better service, contacting you through the communication channels you shared directly with us or through service providers,
• Researching and developing our products and services and your personal preferences related to them, promoting our services or related products, engaging in commercial communication to promote new products, providing special flight offers, advantageous flight change offers, and other information you may find interesting,
• Ensuring flight safety and security, protecting the lives or property of White Deck, White Deck employees, White Deck service providers and their employees, or White Deck guests,
• Preventing fraud, conducting internal audits, managing legal and other claims, and ensuring security,

Pursuant to GDPR Article 6(1)(f), KVKK Article 5(2)(f) under our legitimate interest:

• Complying with legal obligations, including adhering to the rules that White Deck is subject to, performing a task in the public interest or in the exercise of official authority, or complying with a legal order,

Pursuant to GDPR Article 6(1)(c), KVKK Article 5(2)(a), Article 5(2)(ç) under the fulfillment of legal obligations.

For the purposes mentioned, we may collect the following types of data from you:

• Your name, surname, occupation, address, phone and fax numbers, email address, and other contact information,
• Identification and passport details,
• Ticket and flight reservation details,
• Invoice and payment information,
• Product order details,
• Personal interests,
• Information you have provided to us regarding requests and complaints related to our products and services,
• Information related to your usage of our website and other communication channels,
• Preferences or past selections regarding products or services.

2.1.4. Newsletter

You can subscribe to our free newsletter via our website. To do so, we collect and process the email address you provide on the web page. Additionally, the following data is collected during the subscription process:

(1) The IP address of the computer from which the newsletter is requested,
(2) The date and time of the membership.

During the subscription registration process, your consent for data processing will be obtained, and reference will be made to this informational notice.

If you enter your email address to receive the newsletter from our website, the email address may later be used for sending newsletters. In such cases, our newsletter will include direct advertisements for products and services from White Deck Travel and its affiliates and business partners.

Regarding data processing associated with sending the newsletter, no data will be transferred to third parties. The data will only be used for the purpose of sending the newsletter.

The legal basis for processing the data after the user subscribes to the newsletter with consent is GDPR Article 6(1)(a) and KVKK Article 5(1).

2.2. Data Processing for Ticket Sales

If you purchase a flight ticket from us (via our website or through one of our agency partners), we process your personal data for the following purposes:

• To better meet your travel needs,

Under GDPR Article 6(1)(b), KVKK Article 5(2)(c) in accordance with contractual obligations;

• Additionally, for the purposes specified in Section 2.1.3 above,

Under GDPR Article 6(1)(f), KVKK Article 5(2)(f) in accordance with our legitimate interests.

For these purposes, we may collect the following types of data from you:

2.3. Our Legitimate Interest in Data Processing

If GDPR Article 6(1)(f) serves as the legal basis for data processing, our legitimate interests, in addition to the purposes mentioned above, include the following:

• Protection of the company from material and immaterial damages,
• Professionalization and development (of our products and services),
• Cost optimization (control and minimization).

2.4. Other Grounds for Processing

We may process your personal data due to legal obligations, for example, to comply with retention requirements under trade or tax laws, or to fulfill requirements under security laws. For more information on retention periods, please refer to the "Personal Data Processing Duration" section.

2.5. Obligation to Provide Personal Data

The mandatory fields on our website are determined based on mandatory legal or contractual requirements. This ensures that the relevant contract or requested service can be fulfilled.

3. Personal Data Processing Duration

Your personal data will be deleted when it is no longer needed for the aforementioned purposes. However, your personal data may need to be stored by White Deck for the duration during which legal proceedings can be initiated (statutory period). Additionally, personal data will be stored as long as White Deck is legally required to do so. Documentation and storage obligations arise from local laws related to trade, tax, and anti-money laundering. These storage periods can extend up to 30 years.

4. Transfer of Personal Data to Third Parties

In order to provide our products and services in accordance with our contractual obligations or legitimate interests, or to fulfill obligations arising from public and flight safety regulations or airline rules in the countries where the travel takes place, we may need to transfer your personal data to third parties, either within or outside White Deck. These recipients may be categorized as follows:

White Deck affiliates

Service providers

Transportation

Marketing

Information Technology

Payment Services

Credit Institutions

Customer Feedback Services

Official authorities

5. Your Rights as the Data Subject

Under the Law on the Protection of Personal Data No. 6698, you have the following rights:

(a) To learn whether your personal data is being processed,
(b) If your personal data has been processed, to request information about it,
(c) To learn the purpose of processing your personal data and whether they are being used in accordance with their purpose,
(d) To know the third parties to whom your personal data is transferred, whether domestically or internationally,
(e) To request the correction of your personal data if it is incomplete or incorrect,
(f) To request the deletion or anonymization of your personal data if the reasons for processing no longer exist,
(g) To request the notification of the correction or deletion of your personal data to third parties to whom it has been transferred,
(h) To object to any result that may arise against you through the solely automated processing of your personal data,
(i) To request compensation for damages arising from the unlawful processing of your personal data.

You can submit your requests regarding the above rights by sending them in writing to the address listed in Section 1 or by sending an email to [info@yomratour.com] using the email address registered in the White Deck system.

In your application, you must include:
(a) Full name and signature (if the application is written),
(b) For Turkish citizens, the Turkish identity number; for foreigners, nationality, passport number, or foreign identity number if applicable,
(c) The address for notifications or workplace address,
(d) If applicable, the email address, telephone, and fax number for notifications,
(e) The subject of your request must be specified.

Your requests will be concluded as soon as possible and no later than 30 days. If a written response is provided, a fee of 1 Turkish Lira per page will be charged for any pages exceeding 10. If the response is provided on a CD, flash drive, or other recording media, a fee equal to the cost of the recording medium will be charged.

If you do not receive a response or the response is insufficient, you can file a complaint with the Personal Data Protection Authority (KVKK Article 14 and 15).

Personal Data Protection Authority
Address: Nasuh Akar Mah. Ziyabey Cad. 1407 Sok. No: 4 06520 Balgat-Çankaya/Ankara, Turkey
Phone: +90 312 216 5050
Website: http://www.kvkk.gov.tr

6. Consent

If you provide your consent for the processing of your personal data, we inform you that you can withdraw your consent at any time.

If you have given your consent on this website, please visit the page where you gave consent or log in to your registered account to withdraw your consent in the settings.

If you have given consent for the newsletter, you can withdraw your consent by clicking the "Unsubscribe" link in the newsletter.

In all other cases, or if you face difficulty in withdrawing your consent on this website, please do not hesitate to contact [info@yomratour.com].

The withdrawal of your consent will only apply to future processing and will not affect the lawfulness of the data processing conducted prior to your withdrawal. In some cases, despite the withdrawal, we may have the right to continue processing your personal data based on another legal ground, such as the performance of a contract.

7. Information about Sending Commercial Electronic Messages

Under the Law No. 6563 on the Regulation of Electronic Commerce, with regard to commercial electronic messages, you agree to receive promotional messages about products and services offered by White Deck and its affiliates and business partners, including new products and services, special flight offers, and other information related to your travel or anything else that may be of interest to you, through the contact details you provided during ticketing and through any White Deck platform, within the scope of the communication permissions you have granted.

You can always change your communication preferences by following the links in the messages sent to you, and you can stop the transmission of such messages through some or all communication channels.

8. Disclaimer and Personal Data Protection Information

This Personal Data Protection Information is only valid for the “https://www.yomratour.com” website. Other websites are not covered by this Personal Data Protection Information and have their own privacy policies.

9. Additional Information for Users within the European Union

This section applies only when the services provided by White Deck are used by individuals located in EU member states.

9.1. International Transfer of Personal Data

Personal data may be transferred to third countries or international organizations. To ensure the protection of your and your personal data, such data transfers are subject to legal requirements and must be made with appropriate safeguards in place (especially through the application of EU Standard Contractual Clauses) or based on an adequacy decision issued by the EU Commission (GDPR Article 45).

For information on EU Standard Contractual Clauses, see [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF]. The EU Commission provides information on existing adequacy decisions at [https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en#dataprotectionincountriesoutsidetheeu].

A copy of the applied security measures can be requested at [info@yomratour.com].

Furthermore, we are obliged to provide personal data to German and international authorities (as per local and international regulations and agreements, in accordance with GDPR Article 6(1)(c)).

9.2. Right to Object under GDPR Article 21

You have the right to object to the processing of your personal data, including profiling, under Article 6(1)(e) or (f) of the GDPR, at any time, on grounds relating to your particular situation.

If the data controller cannot show a compelling legitimate reason for processing your personal data, which overrides the interests, rights, and freedoms of the data subject, or if the data is being processed for the establishment, exercise, or defense of legal claims, they will not be able to process your personal data.

If your personal data is processed for direct marketing purposes, including profiling related to such marketing, you have the right to object at any time to the processing of your personal data for such purposes.

If you object to the processing of your data for direct marketing purposes, your personal data will no longer be processed for such purposes.

With regard to the use of information society services, you may exercise your right to object using automated tools without considering Directive 2002/58/EC.

9.3. Your Rights as a Data Subject

The rights you have under the European Union General Data Protection Regulation (Reg. EU 2016/679) and applicable German laws (particularly BDSG 2018) are as follows:

• Right of access

• Right to rectification

• Right to erasure (“Right to be forgotten”)

• Right to restriction of processing

• Right to data portability

• Right to object (see Section 9.2 above)