Privacy Policy

PRIVACY POLICY

Last updated: 01.01.2016

1. What this policy covers

Sanalogi Bilişim Sanayi ve Ticaret A.Ş. ("Sanalogi", "we" or "us") is a software company that develops software for the travel industry under the Turasistan brand. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit www.turasistan.com and when you use Turasistan App, Turasistan Reader, Trobot and Turizm Web. For visitors to agency websites built with Turizm Web and for travelers who scan their passports with Turasistan Reader, the privacy notice of the agency concerned applies; Sanalogi processes these people's data only as a data processor (see section 2).

Some topics are covered in more detail on separate pages:

The legal notice under Turkish Personal Data Protection Law No. 6698 ("KVKK"): Privacy Notice
Cookies used on the website: Cookie Policy
The mobile passport reader app: Turasistan Reader Privacy Policy
Our relationship with our customers: Membership and SaaS Service Agreement

2. Who is the data controller?

Who personal data is processed for depends on the type of data:

Data we process for our own activities: Sanalogi is the data controller for data about website visitors, people who fill in our demo and contact forms, our customers' representatives and the users of their Turasistan accounts (agency staff), and for subscription, billing, support, log and security records.
Data our customers enter into Turasistan: For data that an agency enters into Turasistan about its own customers, travelers, Turizm Web visitors and staff, or collects from those people or receives from third-party systems through Turasistan Reader, Turizm Web or Trobot, that agency is the data controller. Sanalogi is the data processor and processes this data only on the agency's instructions and to provide the service.

If you are a traveler or customer of an agency, please contact that agency first about your data. We forward any such requests we receive to the agency concerned.

3. What data do we collect?

Information you give us

Name, company or agency name, job title, email address and phone number
Your demo, contact, registration and support requests and our correspondence
Billing details: company name, tax office and number, billing address
The CV and information you send with a job application (details in the Job Applicant Privacy Notice)

Information collected automatically

IP address, browser and device information, pages visited, date and time of visit
Login and activity records (logs) in Turasistan
Information collected through cookies (details in the Cookie Policy)

Information we process on behalf of our customers

Travelers' identity and passport details, including data read from the passport chip
Passport photo and the facial image stored on the passport chip
Contact details, visa and travel information
Payment, collection and accounting records
For Hajj and Umrah, indirect information about a person's religious beliefs. This information is protected as special category personal data.
Where uploaded by the agency, health data such as vaccination cards or health reports. This information is also protected as special category personal data.

Subscription payments by card are collected through a payment institution, which processes the card details.

4. How do we use your data?

To open accounts, manage free trials and subscriptions, and provide the service
To answer your questions and provide demos and support
For invoicing, collections and our legal obligations
To protect accounts and systems against unauthorized access
To analyze, in aggregate, how the website and products are used and improve the service (the content of traveler data we process on behalf of our customers is not used for this purpose)
To send product updates, maintenance and service notices
To send campaign, newsletter and promotional messages if you have agreed to receive them
To respond to requests from public authorities and protect our legal rights

5. Legal grounds

We process personal data for which we are the data controller on the following grounds under Article 5 of KVKK: entering into or performing a contract, our legal obligations, establishing, exercising or defending a right, and our legitimate interests. We ask for your explicit consent for promotional messages and non-essential cookies. You can withdraw your consent at any time. For data we process on behalf of our customers, the agency concerned determines the legal ground as data controller.

6. Who do we share data with?

We do not sell or rent your personal data. We share data only in the following cases and only as far as necessary:

Our service providers: Suppliers of server, email, SMS and similar services. They use the data only to provide services to us and are bound by confidentiality obligations.
Banks and payment institutions: To collect subscription payments made to Sanalogi. Payments our customers receive from their own travelers through Turizm Web, payment links or virtual POS are processed by the customer's bank or payment institution; Sanalogi does not receive these payments.
Transfers our customers start: Our customers may use Turasistan to send data to third-party systems such as Diyanet, Nusuk, Saudi visa systems, airlines, hotels and e-invoicing systems. These systems are not owned by Sanalogi; such transfers are made on the customer's instructions and under the customer's responsibility.
Public authorities: When a court, prosecutor or other competent authority requests it under the law.
Our advisers: Our legal and financial advisers and auditors, under confidentiality obligations.
Corporate changes: In the event of a merger, acquisition or restructuring, with the protections in this policy maintained.

7. Transfers abroad

Some of our service providers, such as server and email providers, are located outside Türkiye. Transfers to these providers rely on one of the transfer mechanisms under Article 9 of KVKK (for example, a standard contract notified to the Personal Data Protection Authority). Transfers our customers make through Turasistan to systems abroad (for example, Nusuk and Saudi visa systems) are the customer's responsibility.

8. How do we protect data?

We take technical and administrative measures to protect data. These include permission-based access, encrypted connections, access logs, regular backups and confidentiality obligations for staff who have access to the data. Details are set out in our Information Security Policy.

No system is completely free of risk. If a breach affects data for which we are the data controller, we notify the Personal Data Protection Board and the people affected in line with KVKK. For data we process on behalf of our customers, we notify the customer concerned within 24 hours of becoming aware of the breach; notifying the Board and the people affected is the customer's obligation as data controller, and we support the customer in doing so.

9. How long do we keep data?

Data we process for our own activities: Kept for as long as the purpose of processing requires and for the periods set by law. For example, invoices and accounting records are kept for the period required by tax and commercial law.
Data our customers enter into Turasistan: Kept for no more than 1 year after the agreement ends (for a free trial that does not move to a paid subscription, after the trial ends) and deleted earlier on the customer's written request. Customers should export their data before the agreement ends.

When the retention period ends, the data is deleted, destroyed or anonymized.

10. Children's data

Our services are intended for businesses, not for people under 18. Agencies may enter family or group bookings that include children into Turasistan or scan these children's passports with Turasistan Reader. As data controller, the agency concerned is responsible for processing this data lawfully and, where needed, for informing parents or guardians.

11. Links to other websites

Our website may contain links to our social media accounts and other websites. Sanalogi is not responsible for the privacy practices of those websites; we recommend that you read their own privacy policies.

12. Your rights

Under Article 11 of KVKK, you have the right to:

Find out whether your personal data is processed and, if so, request information about it
Find out why it is processed and whether it is used for that purpose
Know the third parties in Türkiye or abroad to whom it is transferred
Ask for it to be corrected if it is incomplete or inaccurate
Ask for it to be deleted or destroyed under the conditions in Article 7 of KVKK
Ask for corrections and deletions to be notified to the third parties to whom it was transferred
Object to a result against you that arises solely from analysis by automated systems
Claim compensation if you suffer loss because your data was processed unlawfully

You can send your request using the Data Subject Application Form, from an email address you have previously given us and that is registered in our system, to [email protected] or in writing to our company address. We will respond free of charge within 30 days at the latest. If the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

13. Changes

When we update this policy, we publish the new text on this page and change the "Last updated" date. We also announce material changes to our customers by email or in-app notice. In case of conflict between the Turkish and English versions of this policy, the Turkish version prevails.

14. Contact

Sanalogi Bilişim Sanayi ve Ticaret A.Ş.

Address: YTÜ İkitelli Teknopark No:1 Kat:2 Ofis No:16, 34220 Başakşehir / Istanbul / Türkiye

Phone: +90 850 557 76 54

Email: [email protected]

Website: www.turasistan.com