1. Scope and governing text
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to inform everyone who uses the nivotravel.com website, contacts us by e-mail, telephone or WhatsApp, submits a booking request or uses our services.
This notice is published in Turkish, English, Arabic and Persian. In case of any difference or conflict between the language versions, the Turkish text prevails.
2. Data controller
Your personal data is processed by Karakaya Group Turizm Seyahat Taşımacılık Limited Şirketi (the “Company”) as data controller. The Company operates under the travel agency title Kenan Karakaya Turizm Seyahat Acentası, holding Group A Travel Agency Operating Licence No. 8719 issued by the Ministry of Culture and Tourism of the Republic of Türkiye under the Travel Agencies and Association of Travel Agencies Law No. 1618, and runs the Nivo Travel Türkiye brand and the nivotravel.com website.
- Address: Alemdar Mah. Biçkiyurdu Sok. No:1 İç Kapı No:301 Fatih/İstanbul, Türkiye
- Tax office and number: Hocapaşa, 5141337179
- Telephone / WhatsApp: +90 534 919 48 91
- E-mail: info@nivotravel.com
3. Personal data we process
Depending on the service, and only to the extent necessary, we process the following personal data:
- Identity: first name and surname; age of child travellers.
- Contact: e-mail address, telephone / WhatsApp number, country.
- Booking and travel details: arrival and departure dates, number of adults and children, preferred tour, hotel, transfer and programme, interests, budget, pick-up time, booking reference number and your request message.
- Passport details: only when needed for a hotel or transport booking; name as shown in the passport, nationality, date of birth, passport number and expiry date.
- Financial: payment amount, date and method, and bank transfer / payment records.
- Communication records: e-mail and WhatsApp correspondence, contact form messages, your requests and complaints.
- Reviews: the name, country, rating, title, review text and travel date you submit for publication.
- Transaction security: IP address and session cookie record.
We do not ask for special categories of personal data (e.g. health condition, dietary or accessibility needs). If you choose to share such information, it is processed only to provide the service you have requested and in line with the conditions of Article 6 of the KVKK.
4. Purposes of processing
We process your personal data for the following purposes:
- To receive your booking request, provide availability and price information and give written confirmation.
- To plan and deliver package tour, accommodation, transfer, day tour and guiding services.
- To receive payments and carry out invoicing and accounting.
- To communicate with you before and during your trip and to answer your questions, requests and complaints.
- To comply with obligations under Consumer Protection Law No. 6502, the Package Tour Contracts Regulation, the Distance Contracts Regulation, Law No. 1618 and tax legislation, and to respond to requests from competent authorities.
- To keep the website secure and prevent misuse.
- To establish and protect rights in the event of a dispute.
- If you submit one, to publish your review on the website after approval.
We do not send you commercial electronic messages such as campaigns or newsletters without your prior consent; any such message may only be sent after obtaining your consent under Law No. 6563 on the Regulation of Electronic Commerce.
5. Legal grounds
Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK:
- Processing is directly related to the conclusion or performance of a contract (Art. 5/2-c): assessing and confirming your booking request and delivering the service; using passport details for a hotel or transport booking.
- Processing is expressly provided for by law and necessary for us to comply with a legal obligation (Art. 5/2-a and ç): retention and information obligations under invoicing, accounting and consumer legislation.
- Processing is necessary to establish, exercise or protect a right (Art. 5/2-e): possible disputes.
- Processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms (Art. 5/2-f): website security, prevention of misuse and keeping correspondence records.
- Your explicit consent (Art. 5/1): publication of reviews and cases where no other legal ground applies.
Special categories of personal data are processed only where one of the conditions listed in Article 6 of the KVKK is met, relying on your explicit consent where required. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of earlier processing.
6. Transfers of personal data
Your personal data may be transferred to the following recipients, only to the extent necessary for the relevant purpose and in accordance with Article 8 of the KVKK:
- Hotels, transfer and transport companies, airlines and guides providing the services in your booking.
- Banks and payment institutions through which payments are made.
- Competent public authorities and judicial bodies, where they request it under the law.
- Service providers hosting our website and e-mail servers, solely for providing the technical service.
Transfers abroad take place only when necessary for the service (e.g. bookings made through an airline or service provider established outside Türkiye) and within the conditions of Article 9 of the KVKK: an adequacy decision or appropriate safeguards, or, on an occasional basis, where the transfer is necessary for the performance of the contract or you have given explicit consent after being informed of the possible risks.
If you choose to correspond with us via WhatsApp, your messages are transmitted through the infrastructure of the WhatsApp service provider and under its own terms and privacy policy.
7. How we collect personal data
We collect your personal data partly by automated means (web forms, the session cookie and server security logs) and partly by non-automated means, through the booking request, travel planner, contact and review forms on the website, e-mail, telephone and WhatsApp correspondence, and banking channels at the time of payment. Details on cookies are set out in our Cookie Policy.
If you make a request on behalf of other travellers (e.g. family members or group participants), you must inform them of this notice before sharing their details with us.
8. Retention periods
Personal data is kept for as long as necessary for the purpose for which it is processed and for the periods required by the applicable legislation:
- Requests that do not become bookings and contact form messages: 1 year from the last correspondence.
- Contract, payment, invoice and correspondence records of completed bookings: for the retention periods under Turkish Commercial Code No. 6102 and Tax Procedure Law No. 213 and the applicable limitation periods, up to a maximum of 10 years.
- Passport details: no later than 6 months after the service is completed, unless retention is required by a legal obligation or a dispute.
- Published reviews: for as long as they remain published; deleted when you ask for removal.
- IP-based security records: kept for a short period and deleted automatically.
When these periods expire, personal data is deleted, destroyed or anonymised.
9. Your rights
Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:
- To learn whether your personal data is processed.
- To request information if it has been processed.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties in Türkiye or abroad to whom it has been transferred.
- To request correction if it is incomplete or inaccurate.
- To request deletion or destruction within the conditions of Article 7 of the KVKK.
- To request that correction, deletion or destruction be notified to the third parties to whom the data has been transferred.
- To object to a result against you arising from analysis of the data exclusively by automated systems.
- To claim compensation for damage suffered as a result of unlawful processing.
10. How to apply
You may submit your requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by the following means:
- E-mail: to info@nivotravel.com from the e-mail address you have previously given us and that is registered in our records.
- Written application: a petition bearing your wet signature, delivered by hand, by post or through a notary public to Alemdar Mah. Biçkiyurdu Sok. No:1 İç Kapı No:301 Fatih/İstanbul, Türkiye.
Your application should include your name and surname, your signature for written applications, your Turkish identity number if you are a Turkish citizen or, if you are a foreign national, your nationality and passport number or identity number if any, your address for notifications, your e-mail address and telephone number if any, and the subject of your request.
Your application will be concluded free of charge within 30 days at the latest, depending on the nature of the request; if the action involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the KVKK.
