1. Data Controller and Scope of this Notice
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), personal data are processed by Eykas Turizm Tic. Ltd. Şti. ("Eykas Travel", "Eykas" or the "Company") as explained below. This notice covers our customers and prospective customers, travellers whose travel is arranged by corporate customers, parents or guardians of child travellers, and visitors to our website.
2. Collection Methods and Sources
Personal data may be obtained directly from you or, when arranging travel, from corporate customers, employers, persons authorised to organise travel or act for travellers, business partners and service providers. Collection channels include our offices, website and quotation/contact forms, email, telephone, WhatsApp and similar channels, booking and ticketing systems, and electronic or physical documents. Data may be collected by automated or partially automated means or by non-automated methods forming part of a data recording system.
Where a third person requests a booking, ticket, visa or other travel service on another person's behalf, the passenger information necessary for the service may be obtained from that person.
3. Categories of Personal Data
- Identity: name, surname, Turkish ID number, date of birth, gender and other identity details required for the service.
- Contact: telephone number, email, address and communication preferences.
- Passport and visa: passport number and validity, nationality/citizenship, visa information and the documents required for a visa application.
- Customer transactions and travel: PNR, flight, ticket, booking, hotel, tour, transfer, rental car, dates and destinations, service requests, changes, cancellations, refunds and transaction history.
- Finance and accounting: invoices, payments/collections, banking details necessary for refunds and accounting records.
- Requests, complaints and correspondence: requests, feedback, complaints and service correspondence sent by email, telephone, WhatsApp, website or other channels.
- Transaction security: IP addresses, connection/log records and technical information needed for system security.
- Insurance: information required for policies and travel insurance transactions if arranged through Eykas.
- Special-category data: where necessary for a service, health, disability/reduced mobility, allergy or similar special-needs information and special-category information submitted by applicants for visa/insurance processes.
4. Processing Purposes and Legal Bases
Data are processed for the activities below, under the applicable conditions in Articles 5 and, for special categories, 6 of the KVKK. Processing is relevant, limited and proportionate to each concrete purpose.
5. Special Categories of Personal Data
Most Eykas travel services do not require special-category personal data. Information about disability assistance, reduced mobility, health-related travel needs or cancellation, travel insurance or visas may nevertheless be submitted. Such data are processed only as necessary, under a valid Article 6 condition and with appropriate technical and organisational safeguards. Please do not send special-category data unless necessary for the service.
6. Recipients of Personal Data
As necessary for the service and the purposes above, data may be shared under Article 8 and applicable law with airlines, hotels, tour operators, guides and event organisers, transfer and vehicle-rental providers, global distribution systems and reservation/technology providers, relevant diplomatic missions and authorised visa centres, insurers/intermediaries, banks and payment providers, e-invoice/e-archive and accounting providers, IT/communications suppliers, legal and financial advisers, and legally authorised public bodies and private-law entities.
7. International Transfers
International flights, accommodation, tours, transfers, visas and similar services may require transfers to foreign airlines, hotels, tour operators, reservation systems, diplomatic missions, visa providers and other providers. Overseas transfers arising from email, cloud, communications and IT services are assessed separately.
International transfers are carried out in accordance with the current Article 9 framework, where an appropriate processing condition exists and, depending on the transfer, an adequacy decision, a legally recognised appropriate safeguard (including standard contracts) or an applicable, strictly limited occasional-transfer exception is available. Any required notifications concerning standard contracts are made.
8. Child Travellers
Identity, passport, visa and travel data concerning children may be processed to the extent needed for booking, accommodation, visa, transfer or other travel services. A parent, guardian or authorised person acting for the child must be entitled to share these details.
9. Commercial Electronic Messages and Cookies
Operational messages about bookings, flights, visas, payments, changes and cancellations are distinct from advertising, promotions and marketing communications. Marketing and commercial electronic messages are governed by applicable consent and legal requirements. This Privacy Notice does not constitute explicit consent or permission to receive marketing messages.
If optional analytics, performance or marketing cookies are used, the purposes and choices are explained separately in the Cookie Policy and the cookie preference controls, as applicable.
10. Retention, Disposal and Security
Personal data are retained for periods prescribed by law or required for their processing purpose. When applicable grounds and obligations cease, data are erased, destroyed or anonymised in accordance with the law. Eykas takes technical and organisational measures suitable to the nature of its operations to protect personal data against unlawful access, processing and loss.
11. Your Rights and How to Apply
You may submit requests concerning your rights under Article 11 of the KVKK in accordance with Article 13 and the Communiqué on Application Procedures and Principles to the Data Controller. Applications may be made in writing to the Company's address, via your own registered electronic mail (KEP) address to [email protected], with a secure electronic or mobile signature, or through an email address that you previously notified to Eykas and which is registered in our systems. Provide your full name, signature for written applications, Turkish ID number (or nationality and passport/identity number for foreign applicants), correspondence address, available email/telephone information and the subject of the request.
Requests are resolved as soon as possible and no later than 30 days, normally free of charge. Where additional costs arise, the fee prescribed by the Personal Data Protection Board may apply.
12. Data Controller Contact Information
Publication / last update: 30 September 2026