DISCLOSURE TEXT

IN ACCORDANCE WITH THE LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

 

Data Controller:

 

TAV İşletme Hizmetleri A.Ş.


Address: Vadistanbul Bulvarı, Azerbaycan Caddesi No:3L/4, 2C Blok, 34485 Sarıyer / Istanbul

 

This Disclosure Text has been prepared by TAV İşletme Hizmetleri A.Ş. (“TAV İşletme Hizmetleri” or the “Company”), acting as the data controller, in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”) and the relevant secondary legislation. It aims to inform you about the purposes of processing your personal data, the legal bases, the methods of data collection, data transfer processes, and your rights under the KVKK, in connection with the services provided through www.tavoperationservices.com.

  1. METHODS OF COLLECTING YOUR PERSONAL DATA, LEGAL BASES, AND PURPOSES OF PROCESSING:

Your personal data may be collected and processed by our Company through automated means when you browse on the website www.tavoperationservices.com or contact us through our call/communication centers, and corporate social media channels, in electronic and/or physical environments.

The table below sets out the categories of personal data processed by TAV İşletme Hizmetleri A.Ş., along with the purposes of processing and corresponding legal bases:

Data Category

Legal Basis

Purpose of Processing

Identity Information (Full name, gender)

Explicit consent (In case you give your consent during registration on our website, promotional messages and campaign notifications may be sent to you via SMS or e-mail.) (KVKK Art. 5/1)

 

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))
  • Managing processes required for the establishment and performance of the membership agreement
  • Creating a user profile/account on the Platform
  • Managing account closure processes when necessary
  • Tracking purchase transactions and orders
  • Establishing and performing the distance sales agreement
  • Managing cancellation and refund processes
  • Ensuring the provision of products and/or services offered by our Company or on behalf of our Company
  • Conducting payment transactions, issuing invoices, and performing related financial and accounting operations
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Ensuring compliance with ground handling security policies and procedures
  • Fulfilling legal, contractual, or internal/external procedural obligations
  • Taking steps necessary for the provision of travel-related services
  • Providing post-sale support services
  • Carrying out data retention and archiving activities
  • Conducting statistical and similar studies to evaluate, measure, and analyze the performance of offered products and services
  • Carrying out advertising, promotion, and marketing activities
  • Performing marketing-oriented data analytics
  • Conducting direct and personalized marketing activities based on individual behavior, past preferences, and shopping habits
  • Sending marketing communications through SMS, e-mail, phone, and similar channels
  • Facilitating your participation in activities such as surveys, competitions, and prize draws

Contact Information (E-mail, Address, phone number, address, country information)

Explicit consent (If you provide consent during registration on our website, promotional messages and campaign notifications may be sent to you via SMS or e-mail.) (KVKK Art. 5/1)

 

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))
  • Managing processes necessary for the establishment and performance of the membership agreement
  • Creating a user profile/account on the Platform
  • Managing account closure processes when necessary
  • Tracking purchases and orders
  • Establishing and performing distance sales contracts
  • Managing cancellation and refund processes
  • Carrying out the necessary activities to ensure users benefit from products and/or services offered by our Company or on behalf of our Company
  • Conducting payment transactions, issuing invoices, and other related financial and accounting operations
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Ensuring compliance with ground handling security policies and procedures
  • Fulfilling our legal, contractual, and internal/external procedural obligations
  • Performing necessary operations for the provision of travel-related services
  • Providing after-sales support services
  • Carrying out data retention and archiving activities
  • Conducting statistical and similar studies for evaluating, measuring, and analyzing the performance of products and services offered
  • Carrying out advertising, promotional, and marketing activities
  • Conducting marketing-focused data analytics
  • Performing direct and personalized marketing activities based on individual behavior, past preferences, and shopping habits
  • Sending marketing communications via channels such as SMS, e-mail, or phone
  • Enabling your participation in activities such as surveys, contests, and prize draws

Customer Transaction Information (Purchase history, cart contents, order number, campaign/discount codes used, return transactions)

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))
  • Tracking purchases, order placement, and order fulfillment
  • Establishing and performing distance sales contracts
  • Managing cancellation and return processes
    - Carrying out necessary activities to ensure that individuals benefit from the products and/or services offered by our Company or on behalf of our Company
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Fulfilling our obligations under legal, contractual, and internal/external procedures
  • Performing necessary actions to ensure the provision of travel-related services

Financial Information (Last 4 digits of the card number, card type, tokenized card data – full card details are not collected, payment amount, payment method, payment date, billing information)

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))
  • Tracking purchases, placing orders, and order processing
  • Establishing and performing distance sales contracts
  • Managing cancellation and return processes
  • Executing payment transactions, issuing invoices, and conducting other finance and accounting operations
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Fulfilling obligations arising from legal, contractual, or internal and external procedures
  • Performing necessary actions for the provision of travel-related services
  • Managing financial and accounting affairs
  • Handling legal claims and litigation processes, responding to legal requests, and ensuring the establishment, exercise, and protection of our legal rights and interests

Transaction Security Information (IP address, session details, log records, username, login/logout timestamps, device information, error logs)

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))
  • Carrying out information security processes
  • Managing access authorizations
  • Ensuring compliance of activities with applicable legislation
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Fulfilling obligations arising from legal, contractual, or internal and external procedures
  • Managing legal claims and litigation processes, responding to legal requests, and ensuring the establishment, exercise, and protection of our legal rights and interests

Audio Recording Information (Call recordings made during interactions with our Company's call centers)

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for compliance with a legal obligation to which the data controller is subject (KVKK Art. 5/2(ç))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))
  • Carrying out information security processes
  • Managing access authorizations
  • Ensuring compliance of activities with applicable legislation
  • Detecting unlawful activities such as fraud, theft, or misuse
  • Fulfilling obligations arising from legal, contractual, or internal and external procedures
  • Managing legal claims and litigation processes, responding to legal requests, and ensuring the establishment, exercise, and protection of our legal rights and interests

Location Information (Your location data, obtained automatically by the Website through browser settings if permitted by you, or manually provided by you)

Necessary for the establishment or performance of a contract (KVKK Art. 5/2(b))

 

Necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2(e))

 

Explicit consent (If you provide consent during registration on our website, promotional messages and campaign notifications may be sent to you via SMS or e-mail) (KVKK Art. 5/1)
  • Processing your orders, managing payment procedures, confirming the order, and delivering transfer services purchased via the Platform to your location
  • Presenting product options based on your location and in coordination with member businesses operating on the Platform
  • Offering products and campaigns tailored to your preferences, interests, usage habits, and location, and conducting promotional activities within this framework

 

  1. PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND PURPOSES OF TRANSFER

Your personal data may be transferred to the following parties and for the purposes listed below, in accordance with the conditions and purposes for processing personal data set out under Articles 8 and 9 of the Law on the Protection of Personal Data No. 6698 ("KVKK"):

 

Recipient

Data Categories

Purpose of Transfer

Legal Basis for International Transfer

Supplier

(Cloud service provider)

Identity, Contact, Customer Transaction, Financial, Transaction Security

Personal data obtained through our website is stored on servers of a cloud service provider located abroad, based on the legal ground of legitimate interest, in order to receive data storage and hosting services.

Transfer is carried out based on the standard contractual clauses signed in accordance with KVKK Art. 9/4(c).

Business Partners (Companies selling products and services on our website)

Identity, Contact, Customer Transaction

When you purchase a product from a third-party seller listed on our website, your name and delivery address are shared with the seller to enable them to process and fulfill your order.

No international data transfer.

Authorized Public Authorities (Judicial authorities or relevant law enforcement agencies)

Identity, Contact, Customer Transaction, Financial, Audio Recordings, Location

Shared upon request for the resolution of legal disputes or as required by applicable legislation.

No international data transfer.

Shareholders (https://ir.tav.aero/en-EN/tav-airports#shareholderStructure)

 

Identity, Contact, Customer Transaction, Financial, Transaction Security, Audio Recordings, Location

 

Shared on a limited basis with our shareholders for the purposes of designing strategies and conducting audits related to our Company’s commercial activities.

 
 

Transfer is carried out based on the standard contractual clauses signed in accordance with KVKK Art. 9/4(c).

 

  1. RIGHTS OF THE DATA SUBJECT UNDER ARTICLE 11 OF LAW NO. 6698

 

You may submit your requests and applications regarding your personal data, if you wish, by using the Data Subject Application Form, through one of the following methods:

 

  • By sending a wet-signed copy of the form along with a photocopy of your ID to the following address:
    TAV İşletme Hizmetleri A.Ş. - Vadistanbul Bulvarı, Azerbaycan Caddesi No:3L/4, 2C Blok, 34485 Sarıyer / Istanbul
  • By applying in person with a valid ID document to the above address,
  • By signing the form with a mobile signature or secure electronic signature and sending it via e-mail to:
    kvkkiletisim_isletmehizmetleri@tav.aero,
  • By sending it to the registered e-mail address tavisletme@hs01.kep.tr using a secure electronic signature or mobile signature via your registered e-mail (KEP),
  • Or, by sending a signed copy via your e-mail address that is registered in the TAV İşletme Hizmetleri A.Ş. system to kvkkiletisim_isletmehizmetleri@tav.aero

 

Once your request is received, it will be evaluated and concluded by us, in our capacity as data controller, as soon as possible and in any case within thirty (30) days, depending on the nature of the request. Please find Data Subject Application Form here

To ensure data security, we may request additional information from the applicant in order to verify that the person submitting the application is the actual owner of the personal data subject to the request. In addition, questions may be directed to the applicant to clarify the scope of the request and ensure accurate processing.

 

In cases where fulfilling the data subject's request may (i) prevent the rights and freedoms of others, (ii) require disproportionate effort, or (iii) relate to information that is already publicly available, the request may be rejected, with a justified explanation provided by us.

 

 

 

TAV İşletme Hizmetleri A.Ş.