PRIVACY AND PERSONAL DATA PROTECTION POLICY

1. Data Controller

This Privacy and Personal Data Protection Policy has been prepared to explain the principles regarding the processing of personal data of persons who visit the website operated by Seyahat Rehberi Turizm Taşımacılık A.Ş. (“NİLTUR”) or benefit from the services offered through the website.

Within the scope of the Personal Data Protection Law No. 6698 (“PDPL”), your personal data may be processed by NİLTUR, acting as the data controller, within the scope explained below.

2. Processed Personal Data

Your following personal data may be processed when you visit our website, fill out communication forms, create a pre-registration or reservation, and benefit from our services:

• First name, surname, date of birth, Turkish ID or passport details,
• Telephone number, e-mail address and address details,
• Reservation, tour, flight, accommodation and travel details,
• Invoice and payment transaction details,
• Website usage, transaction security, IP address and cookie information,
• Customer requests, suggestions, complaints and communication records,
• Information contained in documents required for visa and travel procedures,
• Health, disability, special dietary or similar special-category personal data, where required by the relevant service and provided that the legal conditions exist.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Receiving requests regarding tour, umrah, hajj, flight ticket, hotel, visa and other travel services,
• Conducting pre-registration, reservation, sales and payment transactions,
• Planning travel programs and carrying out operational processes,
• Arranging flight, accommodation, transfer, insurance and visa procedures,
• Managing customer services, requests, suggestions and complaint processes,
• Conducting invoicing and accounting transactions,
• Fulfilling legal and financial obligations,
• Ensuring the security and functionality of the website,
• Responding to requests from authorized public institutions and organizations,
• Sending campaign, promotional, advertising, e-newsletter and marketing communications where explicit consent has been given.

4. Method and Legal Basis for Collecting Personal Data

Your personal data may be collected verbally, in writing or electronically through the website, communication and reservation forms, telephone, e-mail, WhatsApp, social media accounts, call center, physical offices, cookies and authorized business partners from whom we receive services.

Your personal data are processed on the basis of the following legal grounds specified in Articles 5 and, where necessary, 6 of the PDPL:

• Being directly related to the establishment or performance of a contract,
• Being necessary for the data controller to fulfill its legal obligation,
• Being necessary for data processing to establish, exercise or protect a right,
• Being necessary for data processing for NİLTUR’s legitimate interests, provided that this does not harm the fundamental rights and freedoms of the data subject,
• Being expressly prescribed by law,
• Obtaining explicit consent where necessary

5. Transfer of Personal Data

Your personal data may be shared with the following parties to the extent required by the service provided and in accordance with the conditions specified in the PDPL:

• Airline companies and other transportation service providers,
• Hotels, restaurants, transfer companies and local service providers,
• Guides, agencies and business partners in Türkiye or abroad,
• Consulates, visa application centers and insurance companies,
• Banks, payment institutions and financial service providers,
• Information technology, hosting, communication and software service providers,
• Financial advisors, legal consultants and independent auditors,
• Public institutions and organizations authorized by law.

For the performance of international travel services, your personal data required for this purpose may be transferred to hotels, airline companies, local agencies, consulates or other service providers in the country where the travel will take place, in accordance with the provisions of the PDPL regarding the transfer of data abroad.

6. Retention of Personal Data

Your personal data are retained for the period necessary for the purpose for which they are processed and in accordance with the statutory retention periods prescribed by the relevant legislation.

When the reasons requiring processing cease to exist and the statutory retention period expires, your personal data are deleted, destroyed or anonymized in accordance with the legislation.

The termination of membership or the customer relationship does not mean that invoices, reservations, payment and travel records that are legally required to be retained will be deleted immediately.

7. Electronic Commercial Communications

Commercial electronic communications regarding campaigns, opportunities, promotions and announcements are sent only when the consents required under the relevant legislation have been obtained.

You may refuse to receive commercial electronic communications at any time by using the unsubscribe link contained in the communication or by contacting NİLTUR. Withdrawal of consent for commercial communications does not affect mandatory notifications sent within the scope of tour and reservation processes.

8. Cookies

Cookies may be used on our website to ensure that the site operates securely and properly, improve the user experience, analyze visits, and conduct advertising and marketing activities where explicit consent has been given.

Non-essential analytics, advertising and marketing cookies are not activated without obtaining the visitor’s preferences. Detailed information regarding the cookies used and the management of preferences is explained in the Cookie Policy.

9. Data Security

NİLTUR takes appropriate technical and administrative measures to prevent personal data from being;

• Processed unlawfully,
• Accessed unlawfully,
• Lost, altered or disclosed by unauthorized persons

and to ensure that the data are securely retained.

Secure connection technologies are used for data transfers carried out through the website. However, it should be taken into consideration that no data transfer method carried out over the internet can provide absolute security.

10. Credit Card and Payment Security

Payments made through the website may be carried out through the secure payment infrastructures of authorized banks or payment institutions.

In transactions where credit card information is processed directly by the bank or payment institution, NİLTUR does not access the full card number or card security code and does not store this information in its own systems.

Records relating to payment transactions may be processed in accordance with the relevant legislation for the purposes of preventing fraud, verifying the transaction and fulfilling financial obligations.

11. Your Rights Under the PDPL

Within the scope of Article 11 of the PDPL, you may apply to NİLTUR to:

• Learn whether your personal data are being processed,
• Request information about them if they have been processed,
• Learn the purpose of processing and whether they are being used in accordance with that purpose,
• Learn the third parties in Türkiye or abroad to whom your data have been transferred,
• Request the correction of your incomplete or inaccurately processed data,
• Request the deletion or destruction of your data where the legal conditions are met,
• Request that correction, deletion or destruction procedures be notified to third parties to whom the data have been transferred,
• Object to the occurrence of a result against you as a result of analysis conducted exclusively through automated systems,
• Request compensation for damages if you suffer damage due to the unlawful processing of your data.

12. Application and Contact

You may submit your requests under the PDPL to NİLTUR through the following channels, together with information to verify your identity and explanations regarding your request:

Data controller: Seyahat Rehberi Turizm Taşımacılık A.Ş.

Address: Nalbantoğlu Mah. Akbıyık Cad. No:13 Osmangazi/BURSA

E-mail: info@niltur.com

Telephone: +90 444 0 658 (NLT)

Applications are concluded as soon as possible and at the latest within the statutory period, depending on the nature of the request.

13. Updating the Policy

This policy may be updated in line with changes in legislation, NİLTUR’s services or personal data processing processes. The current version of the policy is published on the website.

Last update date: 01 / 09 / 2026