IGA PASS PRIVACY NOTICE

Version: 2.0

Date of Update: 27/07/2024

TAYA Yolcu Hizmetleri A.Ş., IGA Havalimanı İşletmesi A.Ş. and group companies under the IGA

Tayakadın Mah., Terminal Cad. Havalimanı Terminal Binası Apt., No: 1/760494-770402 Arnavutköy/İstanbul

We would like to inform you regarding the services we provide through TAYA Yolcu Hizmetleri A.Ş., IGA Havalimanı İşletmesi A.Ş. and group companies under the IGA (“TAYA, IGA or IGA Pass”) IGA Pass and the personal data we process within the framework of our activities in connection with those services, within the scope of the Personal Data Protection Law No. 6698 (“KVKK”) and other relevant data protection legislation.

Processed Personal Data	Collection	Our Processing Purposes	Legal Reason
We Process the Basic Membership Information Below While You Become a Member of IGA Pass: Name and Surname Date of Birth Gender Country Nationality Password and Code Information E-Mail Address Date and Time for Submission of Application Form Mobile Phone Number	IGA Pass Application Form	Execution of Information Assurance Processes, Execution of Activities in Compliance with the Legislation, Execution of Company / Product / Services Loyalty Processes Follow-up and Execution of Legal Affairs, Execution / Supervision of Business Activities, Execution of Business Continuity Activities, Conducting Production and Operation Processes of Goods / Services Execution of Customer Relationship Management Processes, Conducting Customer Satisfaction Relevant Activities, Conducting Marketing Analysis Studies Conducting Advertising / Campaign / Promotion Processes Execution of Storage and Archive Activities, Execution of Contract Processes, Execution of Marketing Processes of Products / Services, Informing Authorized Persons, Institutions and Organizations,	Processing of personal data of the parties of a contract is necessary provided that it is directly related to the establishment or performance of the contract. (Under the Membership Contract) It is necessary for compliance with a legal obligation to which the data controller is subject. (Responding to Requests from Authorized Public Institutions such as Courts such as ICTA, Prosecution, Court)
We process the information below while purchasing good or service from IGA Pass: IGA Pass Membership Information(before mentioned) Bank Account Information Invoice Information: R.T. Identity Number Name, Surname E- Mail Address Posta Kodu Mobile Phone Number Country City Type of Invoice Name of Invoice	IGA Pass Membership	Execution of Activities in Compliance with the Legislation, Follow-up and Execution of Legal Affairs, Execution of Finance and Accounting Affairs, Execution of Communication Activities, Execution / Supervision of Business Activities, Conducting After Sales Support Services Execution of Service Sales Processes, Execution of Storage and Archive Activities, Execution of Contract Processes, Informing Authorized Persons, Institutions and Organizations	Processing of personal data of the parties of a contract is necessary provided that it is directly related to the establishment or performance of the contract. (Under the Sales/Service Contract) It is necessary for compliance with a legal obligation to which the data controller is subject. (Such as Arrangement of invoice, Keeping Commercial Books)
We process the information below while contacting us via the Contact Form on our website or our Call Center: Name-Surname Mobile Phone Number E-Mail Address Request Information Personal Data which is declared in the Subject Section Personal Data which is Declared in the Message Section Audio and Visual Data Call Center Records	Contact Form Call Center	Execution of Information Assurance Processes, Execution of Activities in Compliance with the Legislation, Execution of Company / Product / Services Loyalty Processes Follow-up and Execution of Legal Affairs, Execution of Communication Activities Execution / Supervision of Business Activities, Receiving and Evaluation of Suggestions for the Improvement of Business Processes, Execution of Service Sales Processes, Execution of Customer Relationship Management Processes, Conducting Customer Satisfaction Relevant Activities, Conducting Advertising / Campaign / Promotion Processes, Execution of Storage and Archive Activities, Follow-up of Requests / Complaints, Execution of Marketing Processes of Products / Services, Informing Authorized Persons, Institutions and Organizations	It is necessary for compliance with a legal obligation to which the data controller is subject. (Such as Fulfilling Responsibilities Arising from Consumer Law) Processing of personal data of the parties of a contract is necessary provided that it is directly related to the establishment or performance of the contract. (Such as After-Sales Service Support)
When Operating the IGA Pass Website and System, We Need to Use Cookies to Provide Necessary Performance and Functionality. However, We Use Advertising and Marketing Cookies With Your Consent. For Detailed Information Please Check Our Cookie Policy.	Web site	Execution of Activities in Compliance with the Legislation, Execution / Supervision of Business Activities, Execution of Business Continuity Activities, Conducting Production and Operation Processes of Goods / Services Conducting Customer Satisfaction Relevant Activities, Conducting Marketing Analysis Studies Conducting Advertising / Campaign / Promotion Processes, Execution of Marketing Processes of Products / Services, Informing Authorized Persons, Institutions and Organizations	Explicit Consent (Within the Scope of Using Cookies of the Related Person in Marketing and Advertising Activities) Processing of data is necessary for the legitimate interests pursued by the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject (Within the Scope of Ensuring that the Website Offered to Relevant Persons Works with the Required Performance and Functionality)
While You Give Us Permission for Commercial Electronic Messages to Be Aware of Advertising and Campaigns About IGA Pass, We Process the Information Below: Name-Surname Mobile Phone Number E-Mail Address	Electronic Forms	Execution of Activities in Compliance with the Legislation, Execution of Company / Product / Services Loyalty Processes, Execution / Supervision of Business Activities, Conducting Customer Satisfaction Relevant Activities, Conducting Marketing Analysis Studies Conducting Advertising / Campaign / Promotion Processes, Execution of Marketing Processes of Products / Services, Informing Authorized Persons, Institutions and Organizations	Explicit Consent (Within the Scope of Sending Messages with Marketing Content to the Contact Addresses of Relevant Persons)
If You are an IGA Pass Supplier, We Process the Information Below Within the Scope of the Our Purchasing Processes: Name, Surname Tax Identification Number TR Identity Number Signature Specimen of Signature Power of Attorney Information E-Mail Address Mobile Phone Number Office Address Office Name/Title Invoice/Draft/Note Information Order Information Request Information Bank Account Information	Documents Declared by the Supplier Contracts Printed and Electronic Forms	Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Execution / Supervision of Business Activities, Conducting Logistics Activities, Conducting Precesses of Goods/Services Sales Execution of Storage and Archive Activities Execution of Contract Processes, Conducting Supply Chain Management Processes, Informing Authorized Persons, Institutions and Organizations	Processing of personal data of the parties of a contract is necessary provided that it is directly related to the establishment or performance of the contract. (Under the Purchase Agreement) It is necessary for compliance with a legal obligation to which the data controller is subject. (Such as Keeping Commercial Books)
As IGA Pass, We Process Information Regarding Technical, Commercial and Administrative Risks within the Scope of Risk Management	Risk Management Process	Execution of Information Assurance Processes, Execution of Activities in Compliance with the Legislation, Follow-up and Execution of Legal Affairs, Execution / Supervision of Business Activities, Execution of Business Continuity Activities, Execution of Risk Management Process, Ensuring Security of Data Controller Operations, Informing Authorized Persons, Institutions and Organizations	It is necessary for compliance with a legal obligation to which the data controller is subject. (Such as Fulfilling Obligations Originated from ICTA Legislation)
As IGA Pass, We Process the Information Below When Necessary Within the Scope of Legal Processes. Information in Correspondence with Judicial Authorities, Information in Correspondence with Administrative Authorities, Information in the Case File, Information Within the Scope of Warning/Notification	Court Records Legal Correspondence Official Documents	Execution of Activities in Compliance with the Legislation, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities Informing Authorized Persons, Institutions and Organizations	It is necessary for compliance with a legal obligation to which the data controller is subject. (Responding to Requests from Authorized Public Institutions such as ICTA Prosecution, Court) Data processing is necessary for the establishment, exercise or protection of any right. (Within the Scope of Execution of Possible Litigation Processes)
We Process the Transaction Logs to Ensure the Security of the Transactions which are Performed on the Istbuy.com Site.	Web Site	Execution of Activities in Compliance with the Legislation, Execution / Supervision of Business Activities, Execution of Business Continuity Activities, Conducting Production and Operation Processes of Goods / Services Ensuring Security of Data Controller Operations, Informing Authorized Persons, Institutions and Organizations	It is necessary for compliance with a legal obligation to which the data controller is subject. (Such as Fulfilling Obligations Originated from ICTA Legislation)

Transfer of Your Personal Data to Third Persons in Turkey

Your personal data may be transferred toAuthorized Public Institutions and Organizations, Business Partners, Group Companies and our Suppliers within the scope of the above-mentioned purposes and legal reasons.

Transfer of Your Personal Data to Third Persons Abroad

Your personal data is not transferred abroad.

Retention Period of Your Personal Data

Your personal data is primarily stored for the periods determined in the legal legislation. If a storage period has not been determined in the legal legislation; we keep your personal data for as long as required by the purpose of processing. A period of 6 months to 1 year for the storage of your data, if any, depending on the purpose of processing, if any, for the storage of your data, by taking into account the possibility that a request from a court or an administrative authority authorized by law regarding the relevant data reaches us late, or that a dispute that we may be a party to occurs. The storage period of the data is determined by adding the data, and at the end of the specified period, the said data is deleted.

Rights with Respect to Your Personal Data

Regarding your personal data you have the rights;

Learning whether your personal data is processed or not,
If your personal data has been processed, requesting information about it,
To learn the purpose of processing your personal data and whether they are used in accordance with the purpose,
Knowing the third parties to whom your personal data is transferred, in the country or abroad,
Requesting correction of your personal data if it is incomplete or incorrectly processed,
Requesting the deletion or destruction of your personal data within the scope of the conditions stipulated in the KVKK legislation,
When you request the deletion or destruction of your personal data with the correction of incomplete or inaccurate data, requesting that this situation be notified to the third parties to whom we have transferred your personal data,
If you suffer damage due to the illegal processing of personal data, you have the right to demand that this damage be remedied.

Exercise of Your Rights Regarding Personal Data

In order for your application to be evaluated, it must meet the conditions in the Communiqué on Application Procedures and Principles to the Data Controller. You can reach the relevant Communiqué athttps://www.resmigazete.gov.tr If your applications and requests regarding your personal data meet the conditions in the relevant Communiqué,

By sending it to our address ist@igairport.aero with wet signature and information sufficient to verify your identity,
By sending it to the address of Tayakadın Mah., Terminal Cad., Havalimanı Terminal Binası Apt., No: 760494-770402 Arnavutköy/İstanbul with wet signature and information sufficient to verify your identity,
With a valid identity document, you can apply to TAYA Yolcu Hizmetleri A.Ş. or İGA Havalimanı İşletmesi A.Ş. in person and send it to TAYA Yolcu Hizmetleri A.Ş. or İGA Havalimanı İşletmesi A.Ş.
By sending via a registered electronic mail (REM) address and secure electronic signature or mobile signature to our registered electronic mail address tayayolcuhizmetleri@hs03.kep.tr or igahavalimaniisletmesi@hs03.kep.tr

You can deliver to TAYA Yolcu Hizmetleri A.Ş. or İGA Havalimanı İşletmesi A.Ş.

Response Time of Your Requests Regarding Your Personal Data

Your requests regarding your personal data will be answered by the method you applied, within 30 days at the latest from the date they reach us.