Personal Data Protection Notice

PERSONAL DATA PROTECTION NOTICE

1. Data Controller

Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by YKS Yazılım Teknoloji A.Ş. (“Pointransfer” or the “Company”) as the data controller.

This Notice explains how the personal data of individuals using the Pointransfer website, reservation system, customer services and transfer services is collected and processed, the purposes and legal grounds for processing, the parties to whom data may be transferred, and your rights under KVKK.

2. Personal Data We Process

Depending on the nature of the service provided, we may process the following personal data:

• Identity information, including name and surname,
• Contact information, including telephone number and email address,
• Reservation and transfer details,
• Pick-up and drop-off locations,
• Flight number, flight date and time,
• Number of passengers and passenger information provided as part of the reservation,
• Billing and payment transaction information,
• Correspondence, requests and communications with customer service,
• IP address, device, session and cookie information relating to website use,
• Other information voluntarily provided by the user where necessary for the provision of the service.

Where payments are processed through third-party payment service providers or banks, payment card information may be processed through the secure infrastructure of the relevant payment service provider.

3. Purposes of Processing Personal Data

Your personal data may be processed for the purposes of:

• Creating, confirming and fulfilling transfer reservations,
• Coordinating passengers, drivers, meet & greet personnel and service providers,
• Monitoring flight information and planning transfers,
• Providing customer support,
• Managing reservation amendments, cancellations, refunds and requests,
• Processing payments and invoices,
• Measuring and improving service quality and customer satisfaction,
• Ensuring information and system security,
• Preventing fraud and misuse,
• Complying with legal obligations,
• Responding to lawful requests from competent public authorities,
• Conducting promotional, campaign and commercial communication activities where permitted and subject to the individual's preferences and required consents.

4. Legal Grounds for Processing

Your personal data is processed in accordance with the legal grounds set out in Article 5 of KVKK, particularly where processing is necessary for the establishment or performance of a contract, compliance with legal obligations, establishment, exercise or protection of a right, or the legitimate interests of the Company provided that such processing does not prejudice your fundamental rights and freedoms.

Where explicit consent is required under applicable law, personal data will be processed on the basis of your explicit consent.

5. Transfer of Personal Data

Where necessary for the provision of our services, personal data may be transferred to:

• Drivers and transportation suppliers providing transfer services,
• Meet & greet and operational service providers,
• Payment service providers and banks,
• IT, hosting, communications and software service providers,
• Accounting, financial advisory and legal service providers,
• Competent public institutions and authorities.

Where personal data is transferred outside Türkiye, such transfers are carried out in accordance with the applicable provisions of KVKK governing international data transfers.

6. Methods of Collecting Personal Data

Personal data may be collected through:

• The Pointransfer website and reservation system,
• Telephone,
• Email,
• Messaging and customer support channels,
• Business partners and reservation platforms,
• Payment service providers,
• Cookies and similar technologies,

through automated, partially automated or other methods permitted by applicable law.

7. Commercial Electronic Communications

Promotional, campaign, discount, announcement and marketing communications are sent only in accordance with applicable legislation and, where required, after obtaining the necessary consent.

Users may change their communication preferences or unsubscribe from commercial communications through the methods provided in the relevant communication channel.

8. Retention and Security of Personal Data

Personal data is retained for the period necessary for the purposes for which it is processed and in accordance with applicable statutory retention periods.

Pointransfer implements appropriate technical and administrative measures to prevent unlawful processing of and access to personal data and to ensure its secure storage.

When the applicable retention period expires and there is no longer a legal basis for processing, personal data is deleted, destroyed or anonymised in accordance with applicable legislation.

9. Your Rights Under KVKK

Under Article 11 of KVKK, you have the right to:

• Learn whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether your data is used in accordance with that purpose,
• Know the third parties to whom your data has been transferred in Türkiye or abroad,
• Request correction of incomplete or inaccurate personal data,
• Request deletion or destruction of personal data where the conditions provided by law are met,
• Request notification of correction, deletion or destruction to third parties to whom the data has been transferred,
• Object, under the conditions provided by law, to results arising from analysis performed exclusively through automated systems,
• Claim compensation if you suffer damage as a result of unlawful processing of your personal data.

10. Applications

You may submit requests concerning your rights under KVKK to info@pointransfer.com or through other application methods permitted by applicable legislation.

Applications will be evaluated and concluded within the periods and procedures prescribed by KVKK and applicable legislation.