Personal Data Protection

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA FOR CUSTOMERS

1. DATA CONTROLLER

Your personal data is processed by:

Coral Seyahat A.Ş.

Address: Merkez Mahallesi Ayazma Caddesi Papirus Plaza No: 37/87 Kağıthane/Istanbul

E-mail: kvkk@coraltatil.com

within the scope of the Law No. 6698 on the Protection of Personal Data and its secondary legislation (“KVKK”), in its capacity as the data controller.

Coral Seyahat A.Ş. processes your personal data in compliance with KVKK and the applicable data protection legislation.

2. PROCESSED PERSONAL DATA

Depending on the nature of the services provided, the following personal data may be processed:

Identity Information

Name, surname, date of birth, ID or passport details.

Contact Information

Phone number, email address, address details.

Financial Information

Purchase, payment, and invoicing details.

Note: Payment data may be processed by payment infrastructure providers.

Customer Transaction Information

Hotel reservation details, accommodation dates, room details, payment records, feedback, requests and complaints, membership information (username, password, and other login credentials).

Website Log Information

IP address, device information, browser information, website usage data, cookie data.

Note: You may access the cookie notice here.

Special Categories of Personal Data

Health information shared with your explicit consent where necessary for the provision of accommodation services (e.g. special needs such as allergies or disability status).

3. METHODS OF COLLECTION OF PERSONAL DATA

Your personal data is collected through:

• reservation processes carried out in digital or physical environments,
• email or telephone communications,
• electronic or printed forms,
• information provided by the customer in digital or physical environments,

·       reservation and accounting systems,

by automated or non-automated means.

4. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed within the scope of the COP31 event for the following purposes:

·       execution of hotel reservations,

·       organization of accommodation services,

·       execution of payment and accounting processes,

·       fulfillment of cooperation requirements with suppliers and relevant Ministries involved in the organization and coordination of operational processes,

·       execution of membership, customer relationship management, and operational processes,

·       provision of after-sales support services,

·       collection and evaluation of feedback, suggestions, satisfaction levels (surveys), requests and complaints, and provision of necessary information and support services,

·       fulfillment of legal obligations,

·       protection of rights in potential disputes.

5. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data is processed in accordance with Articles 5 and 6 of KVKK based on the following legal grounds:

·       necessity for the establishment or performance of a contract,

·       compliance with the legal obligations of the data controller,

·       necessity for the establishment, exercise, or protection of a right,

·       legitimate interests of the data controller.

6. TRANSFER OF PERSONAL DATA

Your personal data may be shared with the following parties, where necessary for the fulfillment of the above purposes:

·       the relevant organization company, Ministries, and/or other suppliers involved in the tender and organization processes of the COP31 event, to whom Coral Seyahat A.Ş. is contractually obliged to transfer data,

·       hotel establishments for the proper execution of accommodation services,

·       business partners and suppliers supporting service delivery,

·       Coral Travel Group companies involved in different operational functions within the COP31 event (such as transfer and travel services, customer services, software support, survey processes, etc.),

·       authorized public institutions and organizations.

Your personal data may also be transferred abroad within the scope of such transfers. In such cases, data transfers are carried out in compliance with Article 9 of KVKK regarding international data transfers, particularly through the use of “standard contractual clauses”, and by implementing all necessary technical and administrative safeguards.

Your personal data is transferred only to the extent necessary and in compliance with applicable legislation.

7. RETENTION PERIOD OF PERSONAL DATA

Your personal data is retained:

·       for the periods stipulated under the relevant legislation,

·       for the duration necessary to fulfill accounting and contractual obligations,

·       for the duration necessary to serve as evidence in potential legal disputes,

and is deleted, destroyed, or anonymized once the relevant retention period expires.

8. YOUR RIGHTS AS A DATA SUBJECT

Pursuant to Article 11 of KVKK, you have the right to:

·       learn whether your personal data is processed,

·       request information if processed,

·       learn the purpose and whether it is used appropriately,

·       know third parties to whom data is transferred,

·       request correction,

·       request deletion or destruction,

·       request compensation for damages.

9. APPLICATION PROCEDURE

You may submit your requests regarding your personal data by using the Data Subject Application Form available on our website, or through the following methods:

·       by sending a signed written application along with documents verifying your identity to: Merkez Mahallesi Ayazma Caddesi Papirus Plaza No: 37/87 Kağıthane/Istanbul

·       by applying in person with a valid ID,

·       via registered electronic mail (KEP) to: coralseyahat@hs01.kep.tr,

·       via email signed with secure electronic signature or mobile signature to: kvkk@coraltatil.com,

·       via email from your previously registered email address in our system.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your name, surname, signature (if written), Turkish ID number (or nationality and passport number for foreigners), address for notification, email address, phone number, and details of your request.

Requests must be clear and supported by relevant documents. Applications made on behalf of another person must include proof of authorization (power of attorney).

Unauthorized third-party applications will not be considered.

Your requests will be concluded free of charge as soon as possible and within 30 days at the latest; however, if the process requires additional costs, a fee may be charged in accordance with the Communiqué.