Subject: Information for data owners in accordance with the Law on the Protection of Personal Data No. 6698 regarding the acquisition of personal data of customers/visitors

With this privacy policy; as TAYA Yolcu Hizmetleri A.Ş. and İGA Havalimanı İşletmesi A.Ş. (“Companies”), we would like to inform you regarding the services we provide on IGA Mobile and the personal data we process within the scope of our activities in connection with them, within the scope of the Law on the Protection of Personal Data No. 6698 (“LPPD”) and other relevant data protection legislation.

1.Principles of Processing Personal Data

Pursuant to Article 4 of LPPD, personal data of the data owner is processed by the data controller Companies within the scope of the purposes stated below, in accordance with the law and the rules of honesty, accurately and, when necessary, for current, specific, clear and legitimate purposes; connected, limited and restrained for the purpose for which they are processed in accordance with the rules of storage for the period required for the purpose for which they are processed or stipulated in the relevant legislation.

Processed Personal Data

When You Become a Member of IGA Mobile, We Process the Following Basic Membership Information:
Name and surname
Date of birth
Gender
Country
Nationality
Password and Password Information
E-Mail Adress
Mobile number
Location data
IGA Mobile Wants to Access the Following Data On Your Device:
Device Location
Data on Other Application
Bluetooth
Camera
When you give us permission for commercial electronic messages to be aware of advertisements and campaigns regarding IGA Mobile, we process the following information:
Name - Surname
E-Mail Address
Mobile Number (call and SMS)

Collection Channel

IGA Mobile Membership Form
Permissions appearing with in the application
Electronic Forms

Purpose of processing

Execution of information security processes,
Carrying out the activities in compliance with the legislation,
Evaluation of complaints, requests and wishes on behalf of customer/visitor satisfaction;
To improve the customer/visitor service experience
Developing special services and campaigns for customers/visitors;
Determining the type of communication work to be done with customers/visitors;
Resolution of disputes that may arise between the Companies and the customer/visitor in the future;
Companies' use and protection of their legal rights;
Fulfilling the legal obligations of the Companies;
Evaluation of customer/visitor satisfaction
Device location data is required to use maps and navigation services. Thus, it is easy for customers to use navigation services in terms of planning their time during the time spent at the airport. It is possible to edit the preferences for device location information from the settings tab on the device. The location data can be accessed when the app is closed if the user gives explicit consent. IGA Mobile App collects location data when the app is closed or not in use, for the user to benefit from navigation services such as the map provided by the application and to calculate time for transportation from home to the airport. The use of location services in the background can be turned off in the settings.
Providing Bluetooth Access makes it easier to find the vehicle when parking service is available. Access to Bluetooth can be turned off in device settings.
Providing Access to the camera enables customers to benefit from informative services about their flights after scanning their tickets read the parking ticket, take a profile photo, scan the credit card, and use the augmented reality function. Access to the camera can be turned off in the device settings.
Access to other companies’ apps and websites is used to provide customers with a better personalized experience. This application can be turned off in the device settings.
Carrying out the activities in compliance with the legislation,
Execution of company/ product/ services loyalty processes,
Execution of marketing analysis studies,
Execution of advertising / campaign / promotion processes
Execution of marketing processes of products / services
Providing information to authorized persons, institutions and organizations

Legal Cause

Fulfilment of the obligations arising from the contractual relationship between the Companies and the customer/visitor, provided that it is directly related to the establishment or performance of a contract.
Fulfilment of other legal, administrative or contractual obligations;
Explicit Consent (with the aim of improving the customer/visitor service experience)
Explicit consent (Within the scope of sending messages with marketing content to the contact addresses of relevant persons)

2.Transfer of Personal Data

Our Companies operate in accordance with the regulations set out in the LPPD for the transfer of personal data. Without prejudice to the exceptions stated in the LPPD, personal data and special categories of personal data are not transferred to other real or legal persons without the explicit consent of the data subject. In exceptional cases, as stipulated by LPPD and other legislation, maximum attention is paid to complying with the methods and limitations stipulated in the legislation during the transfer of personal data to authorized administrative or judicial institutions or private institutions.

In line with the procedures and principles stated in the relevant legislation and in compliance with the purposes and general principles stipulated in the Article 8 and 9 of LPPD, your personal data will be transferred to:

The authorized official institutions and organizations and private persons authorized by law, for the purpose of fulfilling the statutory obligation,
Our corporate or individual customers / visitors, we have agreed to provide transportation companies for the airport transfers in accordance with the demands,
The judicial authorities to carry out or follow judicial proceedings,
Our foreign stakeholders, partners and data management platforms with which we have contractual relations,
The data management platforms which we have contractual relations, anonymously.
With the airline companies arising from the result of mergers, divisions, acquisitions and our business partners operating in the same sector.
Companies operating in the sectors such as; information technology, education, electric and electronics, finance, food, construction, culture, art and design, media communication and publishing, automotive, health and social services; textile, garment and leather, sales and marketing, retail, tourism, aviation, accommodation, food and beverage; transport, logistics, communication, telecommunications, and online service providers.

3.The Method and Legal Reason for the Collection of Personal Data

Your personal data is collected based on the service our companies presents or can be collected depending on our commercial activity directly through the call centers or web pages, mobile applications, social media channels either verbal, written or electronic through automatic methods or other methods. Contracts signed with our companies and the personal data shared during this course with our behalf can be updated and processed as long as you continue to benefit from the products and services of our companies and during the time our companies hold the legitimate interest of keeping the information according to the related legislation from the termination of the contracts in question.

Legal reasons for your personal data being processed by the Companies are as follows:

The consent given by the data subject on the section of Explicit Consent in compliance with the first paragraph of Article 5 of LPPD and the exceptions of explicit consent stated in Article 5/2-a, c, ç, e and f and Article 6/3 of LPPD. Your personal data is collected based on the legal reasons above mentioned reasons by our Companies in accordance with all applicable laws and regulations and for the purposes set forth in Articles 1 and 2 of this Information Form.

4.Explicit Consent

I have read and understood the particulars specified in this Privacy Policy prepared in accordance with the LPPD. I give explicit consent with my free will for the processing and transfer, including international transfer of my personal data collected by the methods stipulated in this Privacy Policy and will be processed and transferred for the purposes and principles stipulated in this Privacy Policy , the storage and processing of my said data after the termination of the contractual relationship for the periods stipulated in the relevant legislation or for the periods when the Companies have a legally legitimate interest in keeping the data.

5.Storage Period of Your Personal Data

Your personal data is primarily stored for the periods determined in the legislation. If a storage period has not been determined in the legislation; we keep your personal data for as long as required by the purpose of processing. Considering the possibility that a possible court request or a request by an administrative authority authorized by law regarding the relevant data arrives late to us or a dispute that we may be a party to occurs, your data will be stored for the period determined by legislation, if there is any period determined in the legislation. If the period is not determined in the legislation a period of 6 months to 1 year is added to the storage period determined based on the purpose of storage. At the end of the specified period, the data in question is deleted.

6.Your Rights Regarding Your Personal Data

You are entitled to exercise the rights regarding your personal data listed below,

To learn whether your personal data is processed,
If your personal data has been processed, requesting information regarding your personal data which has been processed.
To learn the purpose of processing your personal data and whether they are used in accordance with the purpose,
To learn the third parties to whom your personal data is transferred, in the country or abroad,
To request the correction of your personal data if it is incomplete or incorrectly processed,
To request the deletion or destruction of your personal data within the scope of the conditions stipulated in the LPPD legislation,
When you request the deletion or destruction of your personal data with the correction of incomplete or inaccurate data, requesting that this situation be notified to the third parties to whom we have transferred your personal data,
If you suffer damage due to the illegal processing of personal data, you have the right to demand that this damage be remedied.

7.Application to Exercise Your Rights Regarding Personal Data

In order for your application to be evaluated, it must meet the conditions in the Communiqué on Application Procedures and Principles to the Data Controller. You can reach the relevant Communiqué at www.resmigazete.gov.tr.

If your applications and requests regarding your personal data meet the conditions in the relevant Communiqué you can apply:

By sending it to our ist@igairport.aero address with wet-ink signature and information sufficient to verify your identity,
By sending it to the address Tayakadın Mahallesi, Terminal Cadde, No: 1/1 Arnavutköy/Istanbul, with a wet-ink signature and information sufficient to verify your identity
By personally applying to TAYA Yolcu Hizmetleri A.Ş. with a valid identity document,

By sending it to our registered electronic notification address tayayolcuhizmetleri@hs03.kep.tr using a registered electronic notification address and a secure electronic signature or mobile signature.

DISCLOSURE TEXT AND PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA (“PRIVACY POLICY”)