Dear customers,

In this clarification text, you will find information about the third parties to whom your personal data will be disclosed, your rights and how to contact MAVİ GÖK HAVACILIK ANONİM ŞİRKETİ (hereinafter referred to as "MGA") and, in particular, which of your personal data will be processed and for what purpose. The clarification text has been prepared in accordance with Article 10 of Act No. 6698 on the Protection of Personal Data ("KVK Act") in order to transparently process the personal data of customers who submit complaints and enquiries, who wish to book flights and purchase travel tickets via MGA's website.

IDENTITY OF THE DATA CONTROLLER

MAVİ GÖK HAVACILIK ANONİM ŞİRKETİ is the "data controller" for the personal data contained in this clarification text pursuant to Article 3(1) subparagraph (ı) of the Personal Data Protection Act.

MGA, in its capacity as data controller, takes all necessary measures to prevent unlawful use of the data, to ensure its retention and to ensure an adequate level of security in accordance with the law when processing and transmitting personal data. Your personal data will be processed primarily in accordance with the provisions of the KVK Law, the Turkish Civil Aviation Law, the Consumer Protection Law, the Turkish Code of Obligations, the Turkish Commercial Code and other relevant legislation.

Although your personal data may vary depending on the service, product or commercial activity that MGA offers, it will be processed in accordance with the principles described below, pursuant to Article 4 of the CPC Law:

In accordance with the law and in good faith.
Accurate and, where necessary, up to date
For specific, explicit and legitimate purposes
Relevant, limited and proportionate to the purpose for which they are processed
To be kept for the period laid down in the relevant legislation or necessary for the purpose of the processing

PURPOSE AND LEGAL REASON FOR THE PROCESSING OF YOUR PERSONAL DATA

Personal data		Purpose of the data processing	Legal ground for data processing
Data category	Data type
Identity data	First name, surname, gender, date of birth, Turkish identity card number, passport number, nationality of the person.	Carrying out the contract establishment and fulfilment processes and, in this context, carrying out the enquiry, offer, booking, ticket production, sale, payment, invoicing and accounting processes. Carrying out the activities in accordance with the legislation Allocating MGA's products and services to you Conducting goods/services contact, customer satisfaction, demand, complaints procedures Fulfilment of contractual obligations in case of possible damage during the use of MGA's services, elimination of victimisation of our clients, realisation of compensation payments Implementation of procedures for cancellation and delay of flights and provision of the necessary assistance Providing the necessary assistance and coordination in case of problems with lost items and baggage Carrying out communication activities Carrying out storage and archiving operations Ensuring the security of operations Ensuring flight security and taking the necessary measures by identifying passengers who breach flight security Conducting and supervising commercial operations and carrying out activities in accordance with legislation Informing the authorised persons, institutions and organisations	If expressly provided for by law If they are directly related to the conclusion or performance of a contract and the processing of personal data of the contracting parties is necessary If it is absolutely necessary for the data controller to comply with its legal obligations If the data processing is absolutely necessary for the establishment, exercise or protection of a right If the data processing is strictly necessary for the legitimate interests of the controller, provided that it does not adversely affect the fundamental rights and freedoms of the data subject
Contact details	Address, phone number, e-mail
Customer procedure	Tax identification number, tax office information, business title, billing information, enquiry/complaint information, reservation information, travel information, flight information, ticket information, PNR/ticket number.
Finance	Bank account information, credit card information, payment information, compensation information, current records, financial data	Collecting payments, incoming payments Executing contractual processes and realising financial, accounting and invoicing transactions within this framework Making compensation payments and refunds in the event of losses incurred by our clients Carrying out the necessary controls and checks in the context of your enquiries and complaints Carrying out storage and archiving activities Carrying out activities in accordance with the law Informing the authorised persons, institutions and organisations
Private Personal Data	Health data necessary for the provision of services to you at your request, Subject of the request, Private Personal Data	Allocating MGA's services to you according to your wishes and fulfilling contractual obligations, providing services to passengers with health disabilities and taking necessary precautions. Ensuring customer satisfaction Providing after-sales service for goods/services Fulfilling requests made by you to the MGA, investigating complaints and providing the necessary support	(Your personal data will be retained for as long as your express consent and permission for commercial communication is valid for the purposes listed and for the periods set out in the legislation or for reasonable periods after consent is withdrawn).
Audiovisual recording	Photo, video recording	Photographing and videotaping our customers in organisations and at events that take place in the course of carrying out advertising, promotional, campaigning, promotional and sales processes for our company's products and services, as well as carrying out advertising and promotional activities during the performance of flights
Marketing	Personal habits, preferences, targeting information, information obtained as part of marketing analysis activities, Commercial electronic message authorisation information	Carrying out analyses, profiling and targeting activities for marketing purposes Carrying out advertising, marketing, campaign and promotion processes and informing our customers in this context Providing the most suitable offers for our customers' previous preferences and tastes Creating a register of potential customers Increasing engagement with MGA products and services Conducting customer satisfaction activities Conducting celebration and welcome activities on special days Sending commercial electronic messages (SMS, email, phone calls, etc.) with the content of promotion, communication, advertisements, marketing, sales, surveys, campaigns related to the products and services within MGA's commercial activities; content of birthdays, national and religious holidays, New Year celebrations, etc.
ID card	Name, surname, date of birth

NATURE OF THE COLLECTION OF PERSONAL DATA

MGA collects and processes your personal data by informing you in accordance with the purpose and legal grounds stated in the field "Purpose and legal ground for processing your personal data", in accordance with the provisions of the KVK Act and other relevant legislation primarily through the enquiry, complaint and feedback screens on our website, as well as through the booking, ticket sales and travel information screens that you complete during booking transactions and online payment channels.

However, your personal data may also be collected and processed through the following channels in order to make bookings and ticket sales, organise travel, carry out accounting activities, fulfil your requests, provide our services to you and carry out advertising and promotional activities:

Personal data collected through call centres, ticket outlets, email, web sites, oral communication, written or electronic media, automated or non-automated methods.
Electronic storage areas, software and programs, accounting programs where your personal data is collected and stored.
Printed documents, identity and passport documents required for the provision of the service.
Photographs, recordings.
Personal data collected in oral, written and electronic form through travel agents authorised to sell MGA's products and services, internet sales channels, social media, passenger and customer surveys, SMS channels, business partner companies, group/joint venture companies.

We would like to inform you that in the context of the requests you make to MGA, we ask you to disclose your personal data only in the context of your request. If the subject of your request requires the processing of your private personal data, you consent to the processing of your private personal data by providing such data to MGA. However, private personal data may be processed in the cases referred to in Article 6 of the KVK Law. The processing of private personal data without applying the exceptions is only possible with explicit consent.

DISCLOSURE OF YOUR PERSONAL DATA

Your collected personal data may be transferred under the conditions for the processing of personal data regulated in Articles 8 and 9 of the KVK Law.

On the basis of the legal basis of "expressly provided for by laws" regulated in Article 5/2 (a) of the KVK Act; Your personal data may be disclosed to law enforcement authorities, the tax administration, the General Directorate of the State Airport Authority, as well as to authorised persons, public institutions and organisations requesting information, in order to provide the necessary notifications within the framework of the fulfilment of obligations arising from legislation, in particular the provisions of the Turkish Civil Aviation Law, the Tax Procedure Law and the Turkish Commercial Code. In addition, in the course of fulfilling legal obligations and sending commercial electronic messages to you, as well as carrying out our advertising and marketing activities, the permits, telephone numbers or e-mail addresses and commercial electronic message information received from you must be stored in the message management system. For this reason, we may share your personal data with our service providers and business partners for the purpose of carrying out registration procedures. Detailed information about the message management system can be found at https://iys.org.tr.
On the legal basis of "establishment and performance of the contract" regulated in Article 5/2 (c) of the KVK Act; Your personal data may be transferred to relevant banks, payment and credit institutions for necessary payment and collection transactions; handling companies, catering companies, marketing, information technology suppliers, business partners and authorised public institutions and organisations, group and community companies, which are the service providers of MGA for the purposes of establishing the contract you are a party to and allocating our services to you in accordance with the contract.
On the basis of the legal basis of "the processing of data is strictly necessary for the data controller (MGA) to comply with its legal obligations" regulated in Article 5/2 (ç) of the KVK Act that; Your personal data may be disclosed to courts and public bodies and organisations requesting information to make legal notifications, financial advisory/accountancy firms and independent auditors to comply with obligations arising from legislation.
On the basis of the legal basis of "the data processing is necessary for the establishment, exercise or protection of a right" regulated in Article 5/2 (e) of the KVK Act; Your personal data may be disclosed to law firms and other advisers to serve as evidence in the event of any disputes, to obtain legal advice and technical assistance, to implement the contract and to check that the parties are complying with their obligations.
On the basis of the legal basis of "legitimate interest of the data controller" regulated in Article 5/2 (f) of the KVK Act; Your personal data may be transferred to accounting programs to ensure commercial security, store your personal data securely, use accounting programs and archiving services; transferred to domestic providers and/or archiving companies to perform electronic storage, infrastructure server services, backup services or systems; transferred to group/group companies to perform accounting operations, perform necessary checks, receive support services and provide information in this context.
On the basis of the legal basis of "express consent" regulated in Article 8/1 of the KVK Act;
- Your visual recordings may be shared with third parties in public media such as our Company's corporate website, social media accounts and transferred to social media platforms for the purposes of informing the public, carrying out advertising activities, announcing events and organisations, increasing the visibility of our Company in online media.
- Your sensitive personal data may be transferred to MGA's domestic suppliers, handling companies, catering companies, marketing, information technology suppliers, business partners and authorised public institutions and organisations, group and community companies in order to execute contract processes, meet and follow up requests and complaints and ensure customer satisfaction.
On the basis of the legal basis of "explicit consent" regulated in Article 9/1 of the KVK Law; Your personal data and private personal data may be transferred to our service providers located abroad for the purpose of using corporate e-mail services and carrying out communication activities, and to business partners located abroad, suppliers, airlines, law enforcement agencies, public institutions and organisations with which information should be exchanged, for the purpose of carrying out international flight organisations, carrying out clearance procedures, providing travel services and fulfilling contracts.

STORAGE OF YOUR PERSONAL DATA

Ihre personenbezogenen Daten werden auf der Grundlage einer der in Artikel 5 des KVK-Gesetzes genannten Bedingungen für die Datenverarbeitung und in Übereinstimmung mit den in Artikel 4 des KVK-Gesetzes genannten allgemeinen Grundsätzen gespeichert, insbesondere für den Zeitraum, der in den einschlägigen Rechtsvorschriften festgelegt oder für den Zweck erforderlich ist, wobei die in der gemäß Artikel 7 des KVK-Gesetzes ausgestellten Aufbewahrungs- und Vernichtungsrichtlinie festgelegten Fristen berücksichtigt werden und werden innerhalb der Vernichtungsfrist vernichtet.

YOUR RIGHTS AS DATA SUBJECT

As a data subject, you have the following rights;

You may find out whether your personal data have been processed or not.
You may request information on whether or not your personal data have been processed.
You may find out about the purpose of the processing of your personal data and whether it has been used in accordance with its purpose.
You may find out about the third parties in Türkiye or abroad to whom your personal data have been transferred.
If your personal data has been processed incompletely or inaccurately, you may request the rectification of your personal data and the communication of the transaction carried out in this context to third parties to whom your personal data has been transferred.
Even if the processing has been carried out in accordance with the provisions of the KVK Act and other relevant laws, you may request the erasure or destruction of your personal data if the reasons for its processing cease to exist and you may request that the transaction carried out in this context be communicated to third parties to whom your personal data have been communicated.
You may object to the occurrence of a result against you by having the processed data analysed exclusively by automated systems.
You have the right, in the event of damage caused by the unlawful processing of personal data, to request compensation for the damage.

REQUEST TO THE DATA CONTROLLER

As a personal data subject, you may address your requests regarding your rights under Article 13(1) of the KVK Act to MGA in writing or by the means regulated in the Communiqué on the Procedures and Principles of Application to the Data Subject (https://www.resmigazete.gov.tr/eskiler/2018/03/20180310-6.htm); MGA will process the request as soon as possible and at the latest within thirty days, depending on the nature of the request, free of charge. However, if the transaction requires additional costs, the fee set by the data protection authority will be charged by MGA.

Our contact details

MAVİ GÖK HAVACILIK ANONİM ŞİRKETİ

BARBAROS MAH. SERİK (E) CAD. E BLOK NO: 419E İÇ KAPI NO: 2 AKSU / ANTALYA

KEP address: mavigokhavacilikas@hs01.kep.tr