Personal Data Protection Notice (KVKK)

PERSONAL DATA PROTECTION NOTICE (KVKK)

Last updated: 28 October 2026

1. Data controller

This notice is prepared by ARMİ TURİZM TİCARET İTHALAT İHRACAT LİMİTED ŞİRKETİ, operating as Arbat Travel, to inform tour, activity and transfer customers under Turkish Personal Data Protection Law No. 6698.

Agency: Arbat Travel — Class A travel agency, licence no. 11309.

Address: Saray Mahallesi, Şirinevler Sokak, Best Home 20 Sitesi, No:16/B, Alanya/Antalya, Türkiye.

Contact: [email protected]

2. Data processed and collection methods

Depending on the service, we process names, telephone numbers, email addresses, participant numbers, children’s ages, booking details, accommodation or pickup/drop-off locations, flight and transfer details, billing and payment transaction details, and correspondence about requests or complaints. Identity, passport, birth date or nationality details are requested only where required for the service, ticketing or by law. IP addresses, transaction and security logs and cookie preferences may be processed when using the website.

Data is collected through the website and booking forms, email, telephone, messaging and face-to-face communication, wholly or partly by automated means or by non-automated means forming part of a filing system. Those booking for others should inform participants of this notice.

3. Purposes and legal grounds

Data necessary for bookings, service planning, participant lists, ticketing, transfer coordination and service communications is processed on the basis of entering into or performing a contract under Article 5(2)(c).

Data necessary for invoicing, accounting and statutory notifications is processed, as relevant, on the grounds of express provision by law and compliance with legal obligations under Articles 5(2)(a) and 5(2)(ç).

Cancellation, refund, request, complaint and dispute records may be processed to establish, exercise or protect a right under Article 5(2)(e).

Transaction and communication records needed for information security, prevention of misuse and management of service processes are processed on the legitimate-interest ground in Article 5(2)(f), provided fundamental rights and freedoms are not harmed.

Marketing, analytics or other processing requiring explicit consent needs a separate choice or explicit consent. This notice is not consent. Special categories of personal data may be processed only when necessary for the service and an applicable condition under Article 6 exists.

4. Recipients and reasons for sharing

Information necessary to fulfil a booking may be shared with relevant tour and activity operators, local agencies, guides, transport and transfer companies, accommodation establishments and ticket providers. Providers may be in Türkiye or other countries where the service is supplied. Information is not sent collectively to all suppliers, but only to recipients required for the booking and within the necessary scope.

Necessary information may also be sent to banks, payment and accounting providers for payment and accounting; technical providers needed for website and communications; authorised advisers for legal claims; and legally authorised public bodies. Domestic transfers comply with Article 8.

5. International transfers

Necessary customer information may be sent to the relevant foreign supplier for booking, organising or communicating about a service abroad. Use of overseas technical or communication providers may also involve transfers. International transfers are subject to Article 9. An applicable adequacy decision or appropriate safeguard must exist; exceptions for occasional transfers may be used only in non-regular, non-continuous cases meeting the legal conditions.

A commercial supplier agreement or reading this notice alone is not a legal ground for an international transfer. You may request information about the recipient and legal transfer mechanism at [email protected].

6. Retention and security

Data is retained only for the periods required by law and the processing purpose. Booking and service relationships, accounting and tax obligations, disputes and applicable limitation periods are considered. Once the processing ground and retention obligation end, data is deleted, destroyed or anonymised. Access restrictions and appropriate technical and organisational safeguards are required.

7. Your rights and requests

Under Article 11, you may learn whether your data is processed; request information if it is; learn its purpose and whether use accords with that purpose; know third-party recipients in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under the legal conditions; request that corrections and erasure be notified to recipients; object to an adverse result arising exclusively from automated analysis; and seek compensation for damage caused by unlawful processing.

Submit requests in writing to the company address above or by the methods in the Communiqué on the Procedures and Principles for Requests to Data Controllers. You may email [email protected] from an address previously provided to us and registered in our system. Information necessary to verify your identity may be requested. Requests are resolved as soon as possible and within 30 days at the latest; where a fee is required, the Board’s tariff applies.

This notice informs customers; it is neither a supplier agreement nor a declaration of explicit consent.