Clarification Text on the Protection of Personal Data

1. Purpose and Scope of the Policy

Within the scope of Law No. 6698 on the Protection of Personal Data ("KVKK"), Personal data refers to any information relating to an identified or identifiable natural person. In accordance with the provisions of the KVKK, the natural or legal person responsible for determining the purposes and means of processing personal data and responsible for the establishment and management of the data recording system is referred to as the data controller. Within the scope of KVKK, your personal data regarding your transactions made through the website www.obilet.com ("Website") and Obilet's mobile application ("Mobile Application") will be processed by Obilet Bilişim Sistemleri A.Ş. ("Obilet") as the data controller within the scope, purposes, and legal reasons described below. The Website and the Mobile Application will be collectively referred to as the "Platform" herein this Clarification Text.

Obilet is the data controller in terms of ticket listing, trip display, ticket sales, car rental, car listing, hotel listing, hotel booking, and similar services provided through the Platform. In terms of personal data processed as part of the ticket, car rental, and/or hotel reservation programs provided by Obilet other than the services stated above, Obilet has the title of "data processor" within the scope of KVKK.

This Clarification Text has been prepared to inform the real persons whose personal data are processed by Obilet as the data controller within the framework of Article 10 of the KVKK and the Communique on Principles and Procedures to Be Followed in Fulfillment of The Obligation to Inform. Obilet is committed to transparency and accountability. In this regard, we have prepared this Clarification Text to fulfill our obligations arising from the legislation as well as to provide our users with a good customer experience. In this context, the Clarification Text includes information on the identity of the data controller and its representative, if any, the purpose for which personal data will be processed, to whom and for what purpose personal data may be transferred, the method and legal reason for collecting personal data and other rights of the data subject listed in Article 11 of the KVKK.

Obilet may update the Clarification Text in case of changes in the applicable legislation, decisions of the Personal Data Protection Board, judicial decisions, changes in personal data processing and/or transfer methods, purposes, reasons, or similar developments. Any update of the Clarification Text will be published on the Platform. Obilet may publish other clarification texts, rules, conditions, or other explanations on the Platform within the framework of its activities regarding the processing and/or transfer of personal data. If you have any questions regarding the matters set forth in this Clarification Text, we kindly ask you to contact us via the following e-mail address : gdpr@obilet.com.

2. Methods of Collecting Personal Data and Legal Basis

The security of personal data is one of our primary objectives. Your personal data is processed by Obilet in accordance with the provisions of the Constitution of the Republic of Turkey, the KVKK, Law No. 6563 on the Regulation of Electronic Commerce, the Turkish Penal Code No. 5237, and the relevant legislation.

In accordance with the personal data processing conditions specified in the KVKK and in line with the legal reasons specified in this Clarification Text, Obilet processes personal data visually, audibly, physically, electronically, orally, or in writing through the Platform, authorized agencies, service providers, intermediary service providers, social media accounts, cookies call center, messaging programs on the Platform, notifications from administrative and judicial authorities, and other communication channels for the purposes of establishing commercial relations, receiving job applications, making offers, establishing a contractual relationship, fulfilling its obligations arising from the law and/or within the framework of its legitimate interests.

When interacting with Obilet through Facebook, Twitter, Instagram, and YouTube channels used by Obilet as social media platforms, the provided personal data to the relevant social media platform may also be processed by Obilet. However, the use of social media platforms and the content and features provided are subject to the respective platform's own privacy and usage policies.

We use "cookies" to help personalize your online experience and to enable you to log in to our services. Obilet collects personal data for different purposes through cookies on the Platform. Cookies are text files placed on visitors' computers by visited websites. Cookies are widely used on almost all websites for websites to work effectively and in line with visitors' preferences, as well as to provide information to website administrators. Cookies are used to determine the preferences of our visitors, to determine the requests for a specific page, to improve the Platform usage experience, to keep our services secure, and to perform online behavioral advertising activities for our users. Many internet browsers are set to automatically accept cookies by default. If you do not want these tools to be used, you can disable them by setting in your browser. However, please note that in this case, you may not be able to use the full functionality of the Platform.

For detailed information on personal data processed through cookies, please review the Cookie Policy.

3. Personal Data Processed

Your processed personal data may vary depending on the nature of the legal relationship with Obilet. Nevertheless, in general terms, the processed personal data are as follows:

Identity Information

Your personal data such as name, surname, identity information, date of birth, driver's license information, passport number, nationality, etc. that you have provided while becoming a member of the Platform, buying tickets, renting a car, booking a hotel and similar services through the Platform, during live support or call center calls and in all kinds of applications.

Contact Information

Your personal data such as email address, telephone number, mobile phone number, social media contact information, address, etc. that you have provided while becoming a member of the Platform, buying tickets, renting a car, booking a hotel, and similar services through the Platform, during live support or call center calls and in all kinds of applications.

Customer (Including titles such as Passenger / Driver / Consumer / Guest / Visitor etc.) Information

Your personal data such as name, surname, nationality, date of birth, Turkish ID number, passport number, driver's license, gender, reservation information, purchase information, billing information, delivery information, travel information, travel dates, accommodation information, location information, reservation information, customer transaction information, type and number of travel documents, start and end dates of validity and your personal data regarding the country of issue; API/PNR numbers; call center records, credit card statements, box office receipts, customer instructions, records recorded in channels for this, etc., and information and records collected within the scope of requests and complaints and the results thereof, as well as the website password and password information created when benefiting from our services offered in digital environments.

Financial Information

Credit/debit card information, bank account information, IBAN information, balance information, credit balance, and other financial information.

Sensitive Data

Necessary information about your health condition and disability information that may affect the service received, which is explicitly stipulated in the legislation and where it is necessary for our operations and processed upon your explicit consent.

Marketing Information

Reports showing the likes of the person to be used for marketing purposes, targeting information, cookie records, information derived from data enrichment activities, information and evaluations obtained as a result of surveys, campaigns, and direct marketing activities.

Transaction Security Information

Other Information

Information on family members and relatives (identity and contact information on children and spouses of the relevant persons), security information on physical space (entry/exit records, visit information, photographs, camera and audio recordings), legal proceedings, and compliance information (information requests from judicial and administrative authorities, etc.).

4. Purposes of Processing Personal Data

In accordance with the KVKK, personal data cannot be processed without the explicit consent of the data subject as a rule. Obilet processes your personal information when and to the extent permitted by the legislation.

In this respect, the purposes of processing your personal data are as follows:

To confirm the identity information of the person who buys a ticket on the platform and on whose behalf the ticket is purchased, who rents a car and on whose behalf the car is rented, who makes a hotel reservation and on whose behalf the hotel reservation is made,
To save the address and other necessary information for contact,
To manage the procedures for the establishment and execution of contracts,
To communicate with our customers regarding the conditions, current status, and updates of the concluded contracts under the relevant articles of the Distance Sales Agreement and the Law on the Protection of Consumers, to provide the necessary information, and to fulfill the obligations undertaken in accordance with the concluded contracts,
To organize all records and documents that will be the basis of the transaction in electronic or hardcopy format,
To be able to provide information to public officials on matters related to public security upon request and in accordance with the legislation,
To provide a better service to our customers, to inform our customers about our products that our customers may be interested in, taking into account the interests of our customers, and to share campaigns,
To provide information to our customers via email or text message within the framework of the Law on the Regulation of Electronic Commerce and the relevant legislation,
To increase customer satisfaction, to recognize our customers from the Platform, to use it in customer network analysis, to use it in various marketing and advertising activities, and to organize surveys in electronic and/or physical environments through contracted organizations in this context,
To be able to offer suggestions to our customers by our contracted institutions and solution partners and to inform our customers about our services,
To evaluate customer complaints and suggestions regarding our services,
To carry out goods and services production, operation and sales processes, finance and accounting activities, and archive activities,
To ensure information security,
To fulfill our legal obligations and to exercise our rights arising from the legislation in force.

In addition, the personal data of our employees may be processed without consent to the extent necessary for business relations. The terms and conditions specified in the Policy on the Protection and Processing of Personal Data of Employees shall apply to the processing of personal data of our employees.

5. Rights and Obligations of our Company Arising from the Law

Personal data are processed and transferred by our Company in accordance with Article 20 of the Constitution and Article 4 of the KVKK, by keeping them for the period stipulated by law or required by the purpose of processing personal data, based on the conditions specified in Articles 5 and 6 of the KVKK under the following conditions;

Consistent with the law and good faith,
Accurate and up to date,
For specific, explicit and legitimate purposes,
Linked to processing purposes,
In a limited and measured way
All data received through the platform is transferred from your computer or mobile device to our application servers with a 256-bit RSA SSL certificate compatible with TLS 1.2 standard. Your sensitive payment information is not stored on the servers of our application in any way and is encrypted in the standards required by the relevant payment system and transmitted to the relevant bank and/or payment system infrastructure.
Leak tests are performed periodically and the resistance of the system to unauthorized access is tested.
Access authorization and control matrices have been established for employees to prevent unlawful processing of personal data collected from the Platform.
Personal data on paper media are kept in locked cabinets accessible only by authorized persons.

Since Obilet has the obligation to keep the personal data of the relevant persons accurate and up-to-date in accordance with Article 4 of the KVKK, our customers are required to share their accurate and up-to-date data with Obilet to fulfill these obligations. In case your personal data changes in any way, we would like you to update your information by visiting your profile page.

Obilet stores the processed personal data for the periods specified in the legislation. In case no specific period is set in the legislation, the personal data is stored for the period required to be processed in accordance with Obilet's practices and the customs of Obilet's commercial life, depending on the services provided by Obilet while processing the relevant personal data. After this period, the personal data is stored only for the periods required in practice to constitute evidence in possible legal disputes. After the expiration of the specified periods, the personal data in question are deleted, destroyed, or anonymized.

6. Transfer of Personal Data

The sharing of personal data with third parties is realized within the framework of the legislation in force and/or the explicit consent given by the relevant persons. In addition, personal data is transferred to third parties within the framework of a contractual relationship to provide the committed services and to perform quality control of the services provided.

Necessary technical and administrative measures are taken to prevent data breaches during data transfer to third parties. For example, during data transfer; SSL and transport layers are used.

Your personal data may be shared with program partner institutions and organizations that we cooperate with to carry out our activities, with third parties who have the title of service provider and/or intermediary service provider, with our business partners who provide special integrator services, with third parties who provide independent auditing, with domestic/foreign persons and institutions that we receive data storage services in the cloud environment, with domestic/foreign organizations that we have contracted to send commercial electronic messages to our customers, with our financial advisors, with the Interbank Card Center, with our contracted banks, payment service providers and various agencies, advertising companies and survey companies in Turkey and abroad and other third parties in Turkey and abroad, and our related business partners, shareholders and affiliates and third parties, lawyers, consultants and legally authorized public institutions and private law legal entities from which we receive services within the scope of a contractual relationship to provide you with better service and customer satisfaction within the scope of various marketing activities.

7. Rights of the Data Subject

In accordance with Article 11 of the KVKK, the data subject has the following rights:

To learn whether personal data about him/her is being processed,
To request information if personal data about him/her has been processed,
To learn the purpose of processing personal data and whether they are used for their intended purpose,
To know the third parties to whom personal data are transferred domestically or abroad,
To request correction of personal data in case of incomplete or incorrect processing,
To request the deletion or destruction of personal data in case the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the Law and other relevant laws,
To request notification of the transactions made as a result of correction, deletion, and destruction requests to third parties to whom personal data are transferred,
To object to the emergence of a result to the disadvantage of the person himself/herself by analyzing the processed data exclusively through automated systems,
To demand compensation for damages in case of any damage due to unlawful processing of personal data.

To exercise these rights, you may submit your request in this direction in accordance with Article 13 of the KVKK and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to Obilet's "Sultan Selim Mah. Yunus Emre Cad. Topçu İş Merk. No:1/11 Kat:3 Kağıthane/İstanbul" address, by including your name, surname, signature, and Turkish identity number if you are a citizen of the Republic of Turkey, If not, by including your nationality, your passport number, or identification number, if any, your residential or workplace address for notification, your e-mail address and telephone number for notification, and the necessary information and documents to determine the subject of the request and your identity, and/or in writing by using the Application Form, via your e-mail address where your membership is confirmed, or if you do not have any membership, you can apply via e-mail to receive general information about KVKK. Your application will be evaluated by Obilet and finalized free of charge within thirty days. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be requested.

Click here to access the Application Form that you can use to submit your requests.

Data Controller	:	Obilet Bilişim Sistemleri A.Ş.
TIN / Tax Office	:	6320481434 / Maslak
Address	:	Sultan Selim Mah. Yunus Emre Cad. Topçu İş Merk. No:1/11 Kat:3 Kağıthane/İstanbul 34415
E-mail	:	gdpr@obilet.com
Contact Number	:	(0212) 963 03 53
Trade Registry Number	:	14285-5
MERSİS	:	0632048143400049