TURKISH AIRLINES
TURKISH AIRLINES OFFICIAL STORE
DATA PROTECTION NOTICE

1. Introduction

Türk Hava Yolları (referred to as “THY”, the “Company” or “We”) attaches the utmost importance, in its capacity as data controller, to the lawful processing of your personal data. This Data Protection Notice (the “Notice”) has been prepared in accordance with the relevant legislation, and in particular with Article 10 of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu) (the “Law”), for the purpose of ensuring the transparent processing of your personal data during the transactions carried out at the address store.turkishairlines.com (the “website”) prepared by Turkish Airlines.

In this context, the Notice provides information on the personal data of yours that we process, in our capacity as data controller, within the scope of the website and the purposes for which such data is processed, as well as on the third parties with whom your data is shared, on your rights and on the means by which you may contact us.

2. How Do We Obtain Your Personal Data? What Is the Legal Basis for Processing Your Personal Data?

Your personal data is obtained by wholly or partly automated means, such as the forms completed when you register on the store.turkishairlines.com website or shop without becoming a member, the requests you submit through our communication channels, the query of your Miles&Smiles balance at the payment step where you choose to pay with miles, the requests you submit through our call centre, interactive voice response system and chatbot channels, and the cookies and log records running in the background during your visit to the website. Whatever the purpose for which we process your personal data, we at THY process such data in all cases in compliance with national and international legislation, and in particular with the fundamental principles set out in Article 4 of the Law, relying on the following conditions:

- Article 5(2)(c) of the Law – “being directly related to the conclusion or performance of a contract”;

- Article 5(2)(a) of the Law – “being expressly provided for by law”;

- Article 5(2)(ç) of the Law – “being mandatory for the data controller to fulfil its legal obligation”;

- Article 5(2)(f) of the Law – “processing being mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed”;

- “Explicit consent” under Article 5(1) of the Law, as regards the presentation of personalised content, recommendations and offers by means of profiling and the sending of commercial electronic messages.

3. Which of Your Personal Data Do We Process?

The general categories of your personal data processed by THY are as follows:

- Identity Data: Name, surname, identity number, date of birth, gender.

- Contact Data: Telephone number, address and e-mail address information.

- Other Data: Miles&Smiles membership number, current mile balance (where payment is made using Miles&Smiles membership details).

- Transaction Security Data: IP address information obtained in online applications, log records, web page visited, date and duration of the visit.

- Customer Transaction Data: Order number and content, order and delivery records, invoice details, refund, withdrawal and exchange requests, and gift voucher and discount code records.

- Financial and Payment Data: Payment method, payment and refund transaction references, amount paid with miles and the number of miles used.

- Request and Complaint Management Data: The content of the requests, suggestions and complaints you submit through the call centre, interactive voice response system, chatbot, e-mail and website forms, together with the name, surname and contact details you share in that context.

- Marketing Data: Where your explicit consent is available; the segmentation and profiling results generated on the basis of your shopping and browsing history, your preferences and your demographic data, together with your campaign and message preferences.

4. For Which Purposes Do We Process Your Personal Data?

We process your personal data within the scope of the website for the following purposes:

- Conducting order processes; the conclusion, performance and proof of the distance sales contract and of the preliminary information obligation,

- Carrying out payment transactions; querying the mile balance and completing the payment where payment with miles is chosen,

- Conducting the delivery processes of the products and managing logistics and shipping activities,

- Conducting the right of withdrawal, cancellation, refund and exchange processes and issuing gift vouchers in that context,

- Issuing invoices and fulfilling tax, accounting and other legal obligations,

- Receiving, recording and resolving your requests, suggestions and complaints through the call centre, interactive voice response system, chatbot and written channels,

- Ensuring information and transaction security, preventing fraud and misuse, and creating and retaining the records required to be kept under the legislation,

- Following up legal claims and providing information to authorised persons, institutions and organisations,

- Where your explicit consent is available; presenting personalised content, recommendations and offers by means of profiling and conducting marketing and customer experience activities,

- Where your approval is available; sending commercial electronic messages regarding campaigns, announcements and special offers.

5. To Whom and for Which Purposes Do We Transfer Your Personal Data?

In certain cases we may transfer the personal data we process to third parties located in Türkiye and abroad, within the framework of national legislation and in particular Articles 8 and 9 of the Law.

The categories of third parties to whom we may transfer your data for the purpose of conducting the website's activities are as follows:

- Our group companies, e.g. part of the services offered by THY is performed through our affiliates, and your personal data may be shared with the relevant group companies in that context. More detailed information on our group companies is available in the Türk Hava Yolları Anonim Ortaklığı Personal Data Protection and Processing Policy or at https://www.turkishairlines.com/tr-tr/basin-odasi/hakkimizda/ .

- Our suppliers; e.g. the website content providers from which we at THY receive technical support, website infrastructure providers, third parties from which we receive data retention and storage services, software companies, etc.

- Our business partners located in Türkiye and abroad; e.g. the intermediary logistics company conducting our logistics processes and the shipping companies designated by that company which carry out delivery and return operations, etc. Pursuant to Article 9 of the Law, transfers abroad may be made to countries determined by the Personal Data Protection Board (the “Board”) as providing adequate protection or, where adequate protection is not available, by providing Standard Contracts and the other appropriate safeguards prescribed by the Board.

- Service providers from which we receive call centre, interactive voice response system and chatbot services; for the purpose of receiving and resolving your requests and complaints.

- Legally authorised public institutions and organisations and judicial authorities; for the purpose of fulfilling our obligations arising from the legislation.

6. Profiling and Personalised Content

Where you give your explicit consent, personalised content, recommendations and offers are created for you using your shopping history, product preferences, browsing activity and your date of birth and gender information. Within the scope of this activity, no decision producing legal consequences concerning you, or similarly significantly affecting you, is taken solely by automated means. Withholding your explicit consent does not prevent you from using the Electronic Commerce Environment or from purchasing products. You may withdraw your explicit consent at any time, as easily as you gave it; withdrawal does not affect the lawfulness of the processing carried out up to that moment.

7. Call Centre, Interactive Voice Response System and Chatbot

You may submit your requests, suggestions and complaints through our call centre, our interactive voice response system or the chatbot in the Electronic Commerce Environment. In these channels, your name, surname and contact details required in order for your request to be met, together with the content of your request, are processed. This Notice also covers these channels, and access to the text is separately provided before use of the relevant channel begins. We kindly ask you not to share, in these channels, any information that is not necessary for your request to be met.

8. For How Long Do We Retain Your Personal Data?

Your personal data is retained for the period necessary for the purpose for which it is processed, taking into account the limitation and retention periods prescribed in the relevant legislation. The periods are set out in detail in the Türk Hava Yolları A.O. Personal Data Retention and Destruction Policy. Upon expiry of the periods, your personal data is deleted, destroyed or anonymised.

9. Cookies

The cookies and similar technologies used in the Electronic Commerce Environment and the methods for managing your preferences in relation to them are explained in the separately provided Cookie Notice. Cookies other than mandatory cookies are used only with your explicit consent.

10. What Rights Do You Have as a Data Subject?

Pursuant to Article 11 of the Law, you have a number of rights in relation to your personal data in your capacity as data subject. In this section we would like to inform you of the rights you have and of the methods for exercising them. Your rights under Article 11 of the Law are as follows:

- You may learn whether your personal data is processed by us,

- If your personal data has been processed by us, you may request information from us in this regard,

- You may learn the purposes for which we process your personal data and whether your personal data is used in accordance with those purposes,

- You may learn the third parties to whom we transfer your personal data in Türkiye or abroad,

- If we have processed your personal data incompletely or inaccurately, you may request that it be corrected and that such corrections be notified to the third parties to whom we have transferred your personal data.

- Even though we have processed your personal data in accordance with the Law and other relevant national and international legislation, you may request the erasure or destruction of your personal data where the reasons requiring its processing cease to exist, and you may request that the corrections made in this context be notified to the third parties to whom we have transferred your personal data.

- Where an outcome to your detriment arises as a result of the analysis of the data we process solely by automated means, you may object to that outcome,

- Where you suffer damage due to the unlawful processing of your personal data, you may request compensation for the damage arising from such unlawful processing.

- If you are a customer subject to the GDPR, we kindly ask you to visit https://www.turkishairlines.com/en-pl/legal-notice/gdpr-privacy-notice/ for detailed information on the rights you have.

11. Our Contact Details as Data Controller:

So that you may easily exercise the rights listed above and easily submit the relevant requests to us, you may reach us through the contact details set out below. We will respond to you as soon as possible and in any event within thirty days, depending on the nature of your application. As a rule, data subject applications are answered free of charge; however, should an additional cost arise, we reserve the right to charge you a fee in accordance with the tariff to be determined by the Personal Data Protection Board. Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your name and surname, your signature if the application is in writing, your identity number if you are a citizen of the Republic of Türkiye, your residential or business address for service of notice, your e-mail address for notification (if any), your telephone or fax number, and the subject matter of your request.

Turkish Airlines Head Office:

https://www.turkishairlines.com/tr-tr/bilgi-edin/musteri-iliskileri/geribildirim/

+90 212 444 0 849; +90 212 463 63 63

Türk Hava Yolları A.O. Genel Yönetim Binası, Yeşilköy Mah. Havaalanı Cad. No:3/1 34149 Istanbul, Türkiye