Distance Sales Agreement

PERSONAL DATA PROTECTION NOTICE

Pursuant to Personal Data Protection Law No. 6698

1. Data Controller

Under the Personal Data Protection Law No. 6698 (KVKK), the data controller is Nivora Turizm Ve Taşımacılık Tic. Ltd. Şti.

Address: Cumhuriyet Mah. D100 Karayolu Caddesi, ADM Konaklama Outlet Park AVM No: 374, İç Kapı No: 83, Kat: 3, Büyükçekmece / İstanbul

TÜRSAB Certificate No.: 18911

Telephone: 0505 398 89 98 / 0545 275 51 80

Web: www.nivortravel.com

2. Categories of Personal Data Processed

Depending on the nature of the service provided, the following personal data may be processed:

• Identity Information: First name, last name, Turkish ID number, passport number and, where necessary, passport image, date of birth, gender, and nationality.

• Contact Information: Telephone number, email address, residential/billing address.

• Reservation and Customer Transaction Information: Details of the tour, hotel, transfer, or other services purchased; PNR/reservation code, flight and accommodation information, reservation history, voucher, request and complaint records.

• Financial Information: Bank/IBAN details required for payment, invoicing, payment receipts, and refunds. Rather than storing credit card information, secure infrastructures of authorized payment institutions are used wherever possible.

• Transaction Security and Technical Data: When using the website, IP address, device/browser information, log records, and cookie preferences.

• Marketing Information: Campaign and commercial communication preferences, and permission/consent records.

• Visual and Audio Recordings: Photographs and video recordings, where explicit consent or another appropriate legal basis exists.

• Special Categories of Personal Data: Data such as health information, biometric data, or criminal record information required for visa or special service requests are processed only where the appropriate conditions under Article 6 of the KVKK are met.

3. Purposes of Processing Personal Data

Your personal data may be processed for the purposes of carrying out reservation and sales transactions, planning and providing package tours and travel services, arranging airline/transport tickets and accommodation, handling visa and insurance procedures if requested, organizing transfers and guide services, providing operational information, processing payments/accounting and refunds, issuing invoices, managing customer requests and complaints, preventing fraud and misuse, ensuring information and transaction security, fulfilling legal obligations, and pursuing disputes.

4. Legal Grounds for Processing Personal Data

Your personal data is processed, depending on the processing activity, on the legal grounds set out in Articles 5 and 6 of the KVKK. These include, in particular, the processing being directly related to the establishment or performance of a contract, compliance with a legal obligation, the establishment/exercise/protection of a right, legitimate interests provided that fundamental rights and freedoms are not infringed, and explicit consent for processing activities where explicit consent is legally required.

5. Method of Collecting Personal Data

Personal data may be collected through the website, reservation and contact forms, telephone, email, WhatsApp and similar communication channels, in-person meetings, contracts/vouchers, payment channels, travel agency and supplier sales systems, and information and documents provided by the data subject or their authorized representatives during the provision of the service. Collection may be carried out by automated, partially automated, or non-automated means, provided that the latter form part of a data recording system.

6. Transfer of Personal Data

Your personal data may be transferred, to the extent necessary to provide the service, to package tour organizers and principal product providers, airlines and other transportation companies, hotels, local tour operators, transfer and guide service providers, insurance/visa service providers, payment institutions and banks, accounting/legal/IT service providers, and legally authorized public institutions and organizations, in accordance with the transfer conditions set out in the KVKK.

For international travel, it may be necessary to transfer data to service providers in foreign countries. Transfers abroad are carried out in accordance with the KVKK’s applicable provisions governing transfers abroad and appropriate safeguards; explicit consent is also obtained where it is legally required.

7. Website, Cookies, and Transaction Security

If you submit a form, make a reservation, or request information through the website, the information provided may be processed to respond to your request and carry out the service process. Technical logs may be kept to ensure site security, detect errors, and prevent misuse/fraud. If non-essential analytics or advertising/marketing cookies are used, a separate Cookie Notice and the necessary preference/consent mechanism will be provided for them.

8. Special Categories of Personal Data

Special categories of personal data, such as health status, disability/accessibility needs, special dietary requirements, or information required for the visa process, are processed only to the extent genuinely necessary for the service and in accordance with the processing conditions set out in Article 6 of the KVKK. It is important not to share such data unnecessarily.

9. Retention and Destruction

Personal data is retained for the period required by the relevant processing purpose and for statutory retention and limitation periods. If the conditions for processing cease to exist, personal data is deleted, destroyed, or anonymized in accordance with the KVKK and applicable legislation.

10. Rights of the Data Subject

Under Article 11 of the KVKK, you have the right to learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom it has been transferred; request correction of incomplete or inaccurate data; where the conditions are met, request its deletion or destruction; request notification of these actions to third parties to whom the data has been transferred; object to an adverse outcome resulting from analysis exclusively by automated systems; and claim compensation for damage caused by unlawful processing.

11. Applications

You may submit your requests under the KVKK to Nivora Turizm Ve Taşımacılık Tic. Ltd. Şti., together with sufficient information to identify you and your request.

Address: Cumhuriyet Mah. D100 Karayolu Caddesi, ADM Konaklama Outlet Park AVM No: 374, İç Kapı No: 83, Kat: 3, Büyükçekmece / İstanbul

Telephone: 0505 398 89 98 / 0545 275 51 80

Web: www.nivortravel.com

Applications are assessed in accordance with the procedures and time limits prescribed by the KVKK and related secondary legislation. It is also recommended that a current KVKK Data Subject Application Form and the email/registered electronic mail address to be used for applications be published on the website.

12. About This Notice

This notice has been prepared to fulfill the obligation to inform and is not subject to any approval. A separate “Explicit Consent Text Regarding the Processing of Personal Data” is provided for processing activities that require explicit consent.