Privacy and Personal Data Protection Policy

PRIVACY AND PERSONAL DATA PROTECTION POLICY

1. Data Controller

This Privacy and Personal Data Protection Policy explains the principles regarding the processing of personal data collected through the pointransfer.com website operated by YKS Yazılım Teknoloji A.Ş. (“Pointransfer” or the “Company”) and in connection with the transfer services provided by Pointransfer.

Data Controller: YKS Yazılım Teknoloji A.Ş.
Address: Mandırlar Mah. Altınoluk Cad. No:107/1, 07112 Aksu/Antalya, Türkiye

Pointransfer processes and protects personal data in accordance with applicable legislation, particularly the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

2. Personal Data We May Process

Depending on the nature of the services provided, PointTransfer may process the following personal data:

• First and last name,
• Telephone number and email address,
• Transfer pick-up and drop-off locations,
• Hotel and accommodation information,
• Flight number, flight date and time,
• Reservation date and transfer details,
• Number of passengers and passenger information provided as part of the reservation,
• Billing and payment-related information,
• Customer requests, complaints and communication records,
• IP address, device, browser, session and website usage information,
• Other information voluntarily provided by the user and required to provide the transfer service.

Where payment card information is required, PointTransfer aims to ensure that such information is processed through the secure payment infrastructure of the relevant payment service providers and banks.

3. Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

• Creating and managing transfer reservations,
• Meeting passengers and providing transfer services,
• Tracking flights and planning operations,
• Managing reservation changes and cancellations,
• Providing customer support,
• Processing payments, invoicing and accounting,
• Improving service quality and customer experience,
• Ensuring information security and preventing misuse,
• Complying with legal obligations,
• Responding to lawful requests from authorized public authorities.

Advertising, campaigns, promotions and commercial electronic communications are carried out in accordance with users' preferences and consent where required by applicable legislation.

4. Transfer of Personal Data

PointTransfer may share personal data, only to the extent necessary for providing the service or fulfilling legal obligations, with:

• Authorized suppliers and operational partners providing transfer services,
• Meet & greet and transportation service providers,
• Payment service providers and banks,
• IT, hosting, email, messaging and technical service providers,
• Accounting and legal advisers,
• Legally authorized public authorities and institutions.

Only personal data necessary for the relevant service should be shared.

Where personal data is transferred outside Türkiye, such transfers are carried out in accordance with the provisions of the KVKK governing international transfers of personal data.

5. Retention of Personal Data

Personal data is retained for the period necessary for the purposes for which it is processed, taking into account applicable statutory retention periods.

When the reasons requiring processing cease to exist and there is no other legal obligation requiring retention, personal data is deleted, destroyed or anonymized in accordance with applicable legislation.

6. Security of Personal Data

PointTransfer takes appropriate technical and administrative measures to prevent unlawful processing of and unauthorized access to personal data and to ensure the secure storage of personal data.

However, no method of data transmission over the internet can guarantee absolute security.

In the event of a personal data breach, necessary actions will be taken in accordance with applicable legislation.

7. Cookies and Similar Technologies

PointTransfer may use cookies and similar technologies to ensure the proper functioning of the website, improve the user experience, remember preferences, measure website performance and, where applicable, conduct analytics or marketing activities.

Cookies may generally include the following categories:

Strictly Necessary Cookies:
Cookies required for the basic operation of the website and reservation system.

Functional Cookies:
Cookies that may remember preferences such as language, currency and route selections.

Performance and Analytics Cookies:
Cookies that help us understand how the website is used and improve its performance.

Advertising and Marketing Cookies:
Cookies that may be used to measure or personalize advertising and marketing activities in accordance with user preferences.

Where required by applicable legislation, the use of non-essential cookies is subject to the user's preferences and/or consent.

Further information about cookies may be provided separately in PointTransfer's Cookie Policy.

8. Third-Party Services and Links

The PointTransfer website may contain links to payment systems, mapping services, analytics tools, social media platforms or other third-party services.

These third parties may have their own privacy and data-processing policies. PointTransfer is not responsible for independent data-processing activities carried out by such third parties.

9. Commercial Electronic Communications

Campaign, discount, promotional and similar marketing communications may be sent in accordance with the user's consent where required by applicable legislation.

Users may change their commercial communication preferences through the available communication channels or unsubscribe options provided in such messages.

Reservation confirmations, vouchers, flight and transfer information, operational notifications and customer service communications necessary for providing the service are treated separately from marketing communications.

10. Rights Regarding Personal Data

Subject to the conditions set out in Article 11 of the KVKK, data subjects have the right to:

• Learn whether their personal data is being processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing and whether the data is being used in accordance with that purpose,
• Learn the third parties to whom personal data has been transferred,
• Request correction of incomplete or inaccurate personal data,
• Request deletion or destruction of personal data under the conditions specified by law,
• Request notification of correction, deletion or destruction to third parties to whom the data has been transferred,
• Object, under the conditions specified by law, to results arising from analyses performed exclusively through automated systems,
• Claim compensation for damages resulting from unlawful processing of personal data.

Requests regarding these rights may be submitted to YKS Yazılım Teknoloji A.Ş. through the contact channels specified on the Pointransfer website.

11. Updates to This Policy

Pointransfer may update this Privacy and Personal Data Protection Policy due to changes in legislation, technologies used or services provided.

The updated policy becomes effective on the date it is published on the website.

12. Applicable Law

This Policy and the processing of personal data are governed by the laws of the Republic of Türkiye and applicable personal data protection legislation.