Personal Data Protection Notice (KVKK)

1. Data Controller

Under the KVKK, your personal data is processed by Seyra Seyahat ve Turizm as data controller, within the framework described in this notice. You can contact us at Levent, Beşiktaş / Istanbul, Türkiye or by e-mail at merhaba@seyra.travel.

2. Categories of Personal Data Processed

The following categories of personal data may be processed through the forms on our website and our contact channels. We do not ask for special categories of personal data, such as health information, through our forms; please do not include such information, or your ID number, passport or card details, in the message field.

If you are making a request on behalf of other travellers, please make them aware of this notice before sharing their details with us.

• Identity data: first name and surname.
• Contact data: phone number and e-mail address.
• Request data: the tour you are interested in, the number of travellers, anything you write in the message field, and records of related correspondence and calls.
• Legal transaction data: the record of the notice acknowledgement box on the form and, where applicable, correspondence about requests to exercise your rights.
• Transaction security data: log records such as IP address, date and time of access and browser type, kept at the level of our hosting provider.

3. Purposes of Processing

Your personal data is processed in line with the general principles in Article 4 of the Law: lawfully and fairly, for specified, explicit and legitimate purposes, and in a way that is relevant, limited and proportionate. We process it for the following purposes:

• To receive and respond to your information and callback requests and to contact you by phone or e-mail.
• To provide programme, price and availability information for the tour you are interested in and to prepare a suitable offer.
• To carry out pre-contractual steps if your request turns into a booking.
• To follow up on your requests and complaints and to improve the quality of our service.
• To keep our website and information systems secure and to prevent misuse and unauthorised access.
• To meet our legal obligations and respond to requests for information from competent authorities.

4. Method of Collection and Legal Grounds

Your personal data is collected electronically or verbally through the information and callback forms on our website, by e-mail and by phone. Transaction security data is recorded automatically by our hosting infrastructure when you visit the site.

The acknowledgement box on our forms confirms that you have read this notice. Responding to your request does not rely on explicit consent but on the following legal grounds under Article 5(2) of the Law:

• Article 5(2)(c) – processing is directly related to the formation or performance of a contract: pre-contractual steps such as assessing your tour request and making you an offer.
• Article 5(2)(ç) – processing is necessary for the data controller to comply with a legal obligation: record-keeping duties and providing information to competent authorities as required by law.
• Article 5(2)(f) – processing is necessary for the legitimate interests of the data controller, provided it does not harm your fundamental rights and freedoms: following up requests, improving our service and maintaining information security.
• Article 5(1) – explicit consent: where none of the grounds above applies, for example to send commercial electronic messages about offers and announcements, we ask for your separate consent. You may withdraw it at any time.

5. Transfers of Personal Data

Your personal data may be transferred only for the purposes above and in accordance with Articles 8 and 9 of the Law. As the cloud services used for our website and e-mail may have servers outside Türkiye, any such transfers are made in line with the conditions of Article 9 of the Law: an adequacy decision, appropriate safeguards such as the standard contracts published by the Personal Data Protection Board, or one of the incidental transfer cases listed in the Law.

Your data may be shared with the following groups of recipients:

• Hosting and infrastructure providers for our website.
• E-mail and form service providers through which form submissions are delivered.
• If your request becomes a booking, and subject to separate information being provided to you, business partners that deliver tour services such as airlines, hotels, transfer companies and local agencies.
• Competent public authorities and judicial bodies, on request and to the extent required by law.

6. Retention and Deletion

Your personal data is kept for as long as the purpose of processing requires and for the retention periods set by the relevant legislation. Information and callback requests that do not lead to a contract are kept for no more than one year after the request is closed, so that we can answer any follow-up questions.

Records relating to requests that become bookings are kept for the periods required by legislation such as the Turkish Commercial Code and the Tax Procedure Law. Log records held by our hosting provider are likewise kept for the periods set out in the applicable legislation.

Once the retention period ends or the reason for processing no longer exists, personal data is erased, destroyed or anonymised in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

7. Your Rights as a Data Subject

Under Article 11 of the Law, you may apply to the data controller to:

• Find out whether your personal data is being processed.
• Request information about the processing if it has taken place.
• Find out the purpose of the processing and whether your data is used in line with that purpose.
• Know the third parties in Türkiye or abroad to whom your personal data has been transferred.
• Ask for your personal data to be corrected if it is incomplete or inaccurate.
• Ask for your personal data to be erased or destroyed under the conditions set out in Article 7 of the Law.
• Ask for any correction, erasure or destruction to be notified to third parties to whom your data has been transferred.
• Object to an outcome that is to your detriment and results solely from the analysis of your data by automated systems.
• Claim compensation for damage suffered as a result of the unlawful processing of your personal data.

8. How to Apply

You can submit requests about your rights in writing and in Turkish, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application should include your name and surname, your signature if the application is on paper, your Turkish ID number (or, for foreign nationals, your nationality and passport number or ID number if you have one), your residential or business address for notices, your e-mail address and phone number if available, and the subject of your request, together with any supporting documents.

We will conclude your application free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request; if the process involves an additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board. If your application is rejected, you find our response inadequate or we do not respond in time, you may complain to the Board within 30 days of learning of our response and in any case within 60 days of your application.

You can send your application in any of the following ways:

• Deliver a signed written application in person or via a notary public to Levent, Beşiktaş / Istanbul, Türkiye.
• E-mail an application signed with a secure electronic signature or mobile signature to merhaba@seyra.travel.
• E-mail merhaba@seyra.travel from the e-mail address you have previously given us and that is held in our records.