Personal Data Protection Law

PERSONAL DATA PROTECTION INFORMATION NOTICE

Under Personal Data Protection Law No. 6698

1. Data Controller

Under Personal Data Protection Law No. 6698 (KVKK), the data controller is Nivora Turizm Ve Taşımacılık Tic. Ltd. Şti.

Address: Cumhuriyet Mah. D100 Karayolu Caddesi, ADM Konaklama Outlet Park AVM No: 374, Inner Door No: 83, Floor: 3, Büyükçekmece / İstanbul

TÜRSAB Certificate No: 18911

Telephone: 0505 398 89 98 / 0545 275 51 80

Web: www.nivortravel.com

2. Categories of Personal Data Processed

Depending on the nature of the service provided, the following personal data may be processed:

• Identity Information: First name, last name, Turkish identification number, passport number and, where necessary, passport image, date of birth, gender, and nationality.

• Contact Information: Telephone number, email address, residential/billing address.

• Reservation and Customer Transaction Information: Details of the tour, hotel, transfer, or other services purchased; PNR/reservation code, flight and accommodation information, reservation history, voucher, and records of requests and complaints.

• Financial Information: Bank/IBAN details required for payment, invoicing, receipts, and refund transactions. Rather than storing credit card details, secure infrastructures of authorized payment institutions are used wherever possible.

• Transaction Security and Technical Data: When using the website, IP address, device/browser information, log records, and cookie preferences.

• Marketing Information: Campaign and commercial communication preferences, and permission/consent records.

• Visual and Audio Recordings: Photographs and video footage where explicit consent or another appropriate legal basis exists.

• Special Categories of Personal Data: Data such as health information, biometric data, or criminal record information are processed only where required for a visa or special service request and where the applicable conditions under Article 6 of the KVKK are met.

3. Purposes of Processing Personal Data

Your personal data may be processed for the purposes of conducting reservation and sales transactions; planning and providing package tours and travel services; arranging airline/transport tickets and accommodation; handling visa and insurance procedures upon request; organizing transfers and tour guides; providing operational information; processing payments/accounting and refunds; issuing invoices; managing customer requests and complaints; preventing fraud and misuse; ensuring information and transaction security; fulfilling legal obligations; and pursuing disputes.

4. Legal Bases for Processing Personal Data

Your personal data is processed, depending on the processing activity, on the legal bases set out in Articles 5 and 6 of the KVKK. These include, in particular, processing that is directly related to the establishment or performance of a contract; compliance with a legal obligation; the establishment, exercise, or protection of a right; legitimate interests, provided that fundamental rights and freedoms are not harmed; and explicit consent for processing activities where it is legally required.

5. Method of Collecting Personal Data

Personal data may be collected through the website, reservation and contact forms, telephone, email, WhatsApp and similar communication channels, in-person meetings, contracts/vouchers, payment channels, travel agency and supplier sales systems, and information and documents provided by the data subject or persons authorized by them during the provision of the service. Collection may be carried out by automated, partially automated, or non-automated means, provided that the latter form part of a data filing system.

6. Transfer of Personal Data

Your personal data may be transferred, to the extent necessary to provide the service, to package tour organizers and principal product providers, airlines and other transport companies, hotels, local tour operators, transfer and tour guide service providers, insurance/visa service providers, payment institutions and banks, accounting/legal/IT service providers, and legally authorized public institutions and organizations, in accordance with the transfer conditions set out in the KVKK.

For international travel, it may be necessary to transfer data to service providers in foreign countries. Transfers abroad are carried out in accordance with the applicable provisions of the KVKK governing international transfers and appropriate safeguards; separate explicit consent is obtained where legally required.

7. Website, Cookies, and Transaction Security

If you submit a form, make a reservation, or request information through the website, the information you provide may be processed to respond to your request and carry out the service process. Technical logs may be kept to ensure website security, detect errors, and prevent misuse/fraud. If non-essential analytics or advertising/marketing cookies are used, a separate Cookie Information Notice and the necessary preference/consent mechanism will be provided.

8. Special Categories of Personal Data

Special categories of personal data required due to health status, disability/accessibility needs, a special diet, or visa procedures are processed only to the extent genuinely necessary for the service and in accordance with the processing conditions set out in Article 6 of the KVKK. It is important not to share such data unnecessarily.

9. Retention and Disposal

Personal data is retained for the period required by the relevant processing purpose and for the statutory retention and limitation periods. If the conditions for processing cease to apply, personal data is deleted, destroyed, or anonymized in accordance with the KVKK and relevant legislation.

10. Rights of the Data Subject

Under Article 11 of the KVKK, you have the right to learn whether your personal data is being processed; to request information if it has been processed; to learn the purpose of processing and whether the data is being used in accordance with that purpose; to know the third parties to whom it has been transferred; to request the correction of incomplete or inaccurate data; to request its deletion or destruction where the relevant conditions are met; to request that these actions be notified to third parties to whom the data was transferred; to object to any adverse outcome resulting from analysis conducted exclusively by automated systems; and to claim compensation for damages resulting from unlawful processing.

11. Applications

You may submit your requests under the KVKK to Nivora Turizm Ve Taşımacılık Tic. Ltd. Şti., together with sufficient information to identify you and your request.

Address: Cumhuriyet Mah. D100 Karayolu Caddesi, ADM Konaklama Outlet Park AVM No: 374, Inner Door No: 83, Floor: 3, Büyükçekmece / İstanbul

Telephone: 0505 398 89 98 / 0545 275 51 80

Web: www.nivortravel.com

Applications are assessed in accordance with the procedures and time limits set out in the KVKK and relevant secondary legislation. It is recommended that an up-to-date KVKK Data Subject Application Form and the email/registered electronic mail (KEP) address to be used for applications also be published on the website.

12. About This Information Notice

This notice has been prepared to fulfill the information obligation and is not subject to approval. A separate “Explicit Consent Text Regarding the Processing of Personal Data” is provided for processing activities requiring explicit consent.