Turkish Airlines Gdpr Privacy Notice

1. Introduction of the Data Controller and this Privacy Notice

As a data controller, Türk Hava Yolları Anonim Ortaklığı (hereinafter referred to as “THY”, “Company”, "Turkish Airlines" or “We”), pays the utmost attention to the lawfulness of the processing of personal data of its customers. We have prepared this Turkish Airlines GDPR Privacy Notice (“Privacy Notice”) on the protection and the processing of personal data, in order to ensure compliance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).

The security of our customers’ personal data is at the forefront of our work. Therefore, in order to prevent any unlawful access to personal data or leak and to ensure the secure retention of personal data relating to our customers, such data are only transferred to trusted business partners and on a minimum level, by taking necessary security measures in accordance with the legislation in force.

Transparency is one of the most important subjects of our personal data protection program. In this respect, We have prepared this Privacy Notice in order to provide our customers with all necessary information while We are processing personal data, e.g. for the purposes of compliance with our legal obligations and to ensure a better customer experience. Detailed information regarding the types of personal data and the purposes for processing personal data are detailed under section 5 of this Privacy Notice.

Another subject that We also pay close attention to is customers’ right to have control over their personal data. We implement measures to ensure that our customers manage their preferences regarding their own personal data and highly respect our customers preferences. This Privacy Notice also describes your data protection rights, including a right to object to specific processing activities which THY carries out. More information about your rights, and how to exercise them, is set out in the “What are Your Rights as Data Subjects?” section.

In summary, data security, transparency and individuals’ right to have control over their personal data are fundamentals for us in ensuring compliance with the GDPR.

This Privacy Notice contains our declarations and explanations concerning the processing of personal data relating to our customers and other natural persons establishing contact with us, excluding our employees, in compliance with the provisions of the GDPR.

This Privacy Notice is prepared in order to provide information concerning which personal data Turkish Airlines processes within the scope of its commercial activities, the purposes for processing, the parties to whom personal data are transferred and the purposes for such transfers.

2. Contact Information

If you have any concerns about how we process your data, or if you would like to opt-out of direct marketing, based on the laws applicable to you can reach out to:

THY HQ Entity:

https://www.turkishairlines.com/en-tr/any-questions/customer-relations/feedback/index.html

Please select (1) Continue with Miles&Smiles/Continue without logging in, (2) New feedback/Previous feedback and (3) Other: Personal Data Protection

+90 212 444 0 849

Türk Hava Yolları A.O. Genel Yönetim Binası, Yeşilköy Mah. Havaalanı Cad. No:3/1 34149 Istanbul, Türkiye

If you live in Germany and have an unresolved concern you can also contact our German DPO:

https://www.turkishairlines.com/tr-tr/bilgi-edin/musteri-iliskileri/geribildirim/

+49 069 955171 22/53

Turkish Airlines Inc. Hamburger Allee 4 (Westendgate) 60486 FRANKFURT/M

If you contact us by e-mail, communication is unencrypted.

3. How Do We Collect Your Personal Data?

This section covers the source of information and the channels through which personal data are collected:

  • Call center, booking offices, check-in counters, kiosks, inflight entertainment system, requests and complaints, boarding checkpoints, surveys, fairs and events; in verbal, written or electronic form, wholly or partly by automated and non-automated means.
  • Turkish Airlines and Miles&Smiles Special Passenger Program website and mobile applications.
  • Agencies authorized to sell Turkish Airlines products and services and sales channels on the web, social media, passenger and customer conversations, SMS channels, business intelligence, contracted merchants, business/program partners and other airlines; in verbal, written or electronic form, wholly and partly by automated and non-automated means.
  • If you request to receive service from these channels: The website located at turkishairlines.com (“Website”); software and applications provided through computers or other smart devices (“Application”); social media accounts administered by persons authorized to provide services on behalf of Turkish Airlines, instant messaging applications that mediate the service provided by Turkish Airlines such as WhatsApp Business, Telegram, Facebook Messenger, WeChat, BiP and all other digital channels, which shall be referred to together as “Digital Environments”.

4. Which Personal Data Do We Collect and Process?

Personal data processed by our Company differ in accordance with the nature of the legal relationship established with our Company. In this respect, categories of personal data collected by our Company through all channels, including Digital Environments, are as follows:

  • Identity and Contact Information : Personal data such as name, surname, government identification number, passport information and contact information (such as e-mail address), phone and mobile phone number or social media contact information that you have provided to us while creating accounts, making plane ticket reservations or applying for exclusive services offered by THY and its partners. For more detailed information about processing of Identity/Passport Information please read the “Turkish Airlines Protection of Personal Data Announcement for the Processing of Identity/Passport Information” published on https://www.turkishairlines.com/en-tr/legal-notice/privacy-policy/processing-of-identity-passport-information/ .
  • Flight Information : Reservation or ticket information or other information related to your flights such as your medical condition or your meal preferences if needed.
  • Advance Passenger Information (“API”) : Personal data relating to your name, nationality, birth date, gender, type and number of your travel documents including its date of validity, and its issuing country.
  • Location Data (location data collected by way of location-based tools such as airport directions, map view, Turkish Airlines Lounge, nearest car parking space.)
  • Information Relating to Family and Relatives (identification information, contact information, information relating to data subject’s children spouse etc.)
  • Customer Process Information (personal data recorded in channels such as call centers, credit card statements, box office receipts, customer instructions including reservation, purchase, cancellation, postponement and other changes relating to an instruction or request attributable to a person.)
  • Process Security Information (information relating to website password etc. provided in the course of benefiting from products and services offered in Digital Environments.)
  • Risk Management Information (such as results and records of various queries provided by public institutions relating to the data subject, records of security checks concerning whether you prohibited from boarding on a plane, records of address recording system, IP tracking records.)
  • Request/Complaint Management Information (such as information and records collected in relation with requests and complaints concerning our products or services and information contained within reports regarding the conclusion of such requests by our business units).
  • Financial Information (credit/debit card information, bank account information, IBAN information, balance information, credit balance information and other financial information.)
  • Physical Environment Security Information (entry/exit logs in Company’s physical environments, visit information, camera records.)
  • Legal Procedure and Compliance Information (information provided within information requests and decisions of judicial and administrative authorities.)
  • Audit and Inspection Information (information relating to all kinds of records and processes concerning the exercise of our legal claims and rights associated with the data subject.)
  • Special Categories of Personal Data (special categories of personal data processed limited to the circumstances expressly envisaged under the laws and where required for the Company’s operations for example to provide you with assistance or facilities appropriate to your medical needs during your trip, to accommodate your requests, to ensure safety on board to comply with legal requirements. Where your religion or health status could be inferred from meal preferences, We will not use it in any other way other than to fulfil your meal request.)
  • Marketing Information (such as reports and evaluations containing information indicating preferences, taste, usage and travel habits attributable to the data subject and used for the purposes of marketing, targeting information, cookie records, data generated within data enrichment operations, records of surveys, satisfaction surveys, information and evaluations obtained as a result of campaigns and direct marketing activities.)
  • Visual Information (photographs, camera.)
  • Audio Information Call center voice records via your explicit consent.
  • Membership Program Information : If you are a member, information regarding Miles&Smiles and Turkish Airlines Corporate Club membership programs.

We may also receive information about you from third parties. In particular:

  • API : When you make a booking through a travel agency or another airline company they may send us your name, nationality, date of birth, gender as well as the type, number, issuing country and date of validity of your travel documents.
  • Flight information : When you make a booking through a travel agency or another airline company, they will send us your reservation or ticket information, or other information related to your flights such as your medical condition or your meal preferences.

5. Why Do We Process Your Personal Data and What Is the Legal Basis for This Use (purpose of the processing)?

We process your personal data for the following purposes:

  • To fulfil a contract, or take steps linked to a contract We have with you. (According to Art. 6/(1), Subparagraph 1(b) GDPR) This includes:

  • Management of flight reservations and other related services:

When you book a flight, including booking processes concluded through third parties and other websites, an account through which you may finalize your booking and manage your preferences regarding your flight is created. In this respect, information concerning your identity is processed for the verification of your identity at check-in, baggage delivery and security check points.

Additionally, personal data relating to you may also be processed in the course of benefiting from airport services provided through kiosks such as check-in, seat selection, luggage and cargo.

  • Managing flight operations and establishing communications concerning services provided within your flight program

Within the scope of your flight, We process personal data relating to you within the scope of services concerning your flight for the purposes of conclusion of your flight ticket, check-in processes, preparation of your boarding pass and boarding on the plane.

Personal data relating to you may only be processed for the purposes of providing information regarding the verification of your travel organization, changes to your flight program, opening date and time of check-in and conveying communication concerning reminders of your incomplete reservations.

  • Establishing communication with our customer and customer relationship management

In certain circumstances, We are required to deliver certain information to our customers regarding our flights. For instance, We may be required to establish communication with you via SMS, e-mail or telephone for the purposes of conveying booking information, confirmation regarding the purchase of your ticket or to provide payment and flight details. Additionally, customers benefiting from services provided through the Application, may also be communicated by way of in app notifications.

  • Membership Programs : In case you are a member, in particular Miles&Smiles, Turkish Airlines Corporate Club, carrying out the necessary work to take advantage of related loyalty program services and carrying out the relevant business processes.

  • As required to conduct our business and pursue our legitimate interests (According to Art. 6/(1), Subparagraph 1(f) GDPR), in particular:

  • Requests and Evaluations : Personal data relating to you may be processed for the purposes of taking necessary actions in order to provide responses to questions, requests or complaints conveyed by our customers through Digital Environments or by other written and verbal channels. Opinions of our customers are of great importance for us. Therefore, We may process personal data while evaluating the responses provided by our customers to questions within customer satisfaction surveys, in order to evaluate the quality of our services.
  • Fraud prevention : We monitor customers' actions to prevent, investigate and/or report things such as fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable laws.
  • Establishing information technologies infrastructure and executing and auditing information security processes and operations : Personal data relating to you may be processed for the purposes of ensuring compliance with internal policies and procedures related to information security, management of information technologies systems as well as improving and optimizing such systems, ensuring the accessibility and reliability of such infrastructure and systems by way of back-ups and tests, improving products and services provided including statistical analysis and research on systems and programs regarding ticketing and travel operations.
  • Conducting financial and accounting operations : Personal data relating to you may be processed for the purposes of complying with obligations to inform including identification and verification of identity and the prevention of fraudulent transactions, receiving payments and where deemed necessary, reimbursement.
  • Service Customization : Offering, proposing and introducing the programs, services and products to the related persons and performing the activities for the customization of them according to the usage habits and needs of the related persons.
  • Usage Information : In order to provide better service to our customers and to customize our services for you, your usage habits on our web site and applications may be followed. In addition, in order to provide service only, the information such as IP address, device model etc., regarding to the devices which you display on our website or use our applications may be processed. Where required by law, the marketing and advertising activities carried out through targeting and profiling are carried out only if you have given your consent.

  • For purposes which are required by law (According to Art. 6/(1), Subparagraph 1(c) GDPR) (legal obligations):

  • Ensuring compliance with the national and international legislation to which THY is subjected and fulfilling the obligations arising from the relevant legislation. In response to requests by government or law enforcement authorities conducting an investigation.
  • In such cases, it may be required to comply with commercial or tax-related retention requirements or to fulfill safety-related requirements. For more information about retention periods, see "How long will you retain my data?"
  • Transfers to immigration authorities or Federal Police Offices (Advanced Passenger Information or Passenger Data regulations)

  • Where you give us consent (According to Art. 6/(1), Subparagraph 1(a) GDPR):

  • Marketing activities : Where required by law, We will send you with your consent direct marketing in relation to our relevant products and services, or other products and services provided by us, our affiliates and carefully selected partners
  • Cookies : We place cookies and use similar technologies in accordance with our Cookies Notice and the information provided to you when those technologies are used. For more information, see “Use of Cookies”
  • Other occasions : On other occasions where We ask you for consent, We will use the data for the purpose which We explain at that time such as when collecting information in relation to your medical condition..

In some cases (e.g. for booking a flight) the provision of information is mandatory: if relevant data is not provided, then We will not be able to process your request. When the provision of information is not marked as mandatory (e.g. for direct marketing purposes) it is optional.

Withdrawing consent or otherwise objecting to direct marketing:

Wherever We rely on your consent, you will always be able to withdraw that consent, although We may have other legal grounds for processing your data for other purposes, such as those set out above. You have an absolute right to opt-out of direct marketing or profiling We carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic message, or by contacting us using the details set out below.

6. To Whom, Why and Where We Transfer Your Personal Data?

Due to the global nature of our business, We may transfer your personal data to recipients residing in Türkiye or abroad, in accordance with applicable laws.

Recipients that We may transfer your data to can be listed categorically as follows:

  • Our business partners or suppliers residing within Türkiye or abroad : Security firms, ground operation service providers at airports, transportation service providers for ground handling services and other additional related services, global distribution systems, partner airlines including but not limited to member airlines of the Star Alliance that will provide you services during connecting flights.
  • Loyalty Program related services : Please see full list below: https://www.turkishairlines.com/en-tr/miles-and-smiles/program-partners/index.html .
  • Group companies : Certain services offered by THY are carried out by our affiliates, within this context, your personal data may be shared with our relevant affiliates.
  • Suppliers : Your personal data will also be shared with service providers, in particular, providers of website hosting, software, maintenance, call centers, security firms, and transportation service providers.
  • Government authorities such as civil aviation or custom authorities and/or law enforcement officials authorized by national or international legislations ; e.g. to enforcement agencies, executive or judicial bodies in relation to ongoing investigations or when travelling to United States of America, to United States National Security Council etc.
  • In the event that the business is sold or integrated with another business, certain pieces of your details may be disclosed to our advisers and any prospective purchaser’s adviser and may be passed to the new owners of the business.

We will only transfer your personal data outside the EEA if suitable safeguards ensure that an appropriate level of protection is in place. Typically, We rely on the following safeguards:

Further information on such transfers or copies of these measures can be obtained via the contact details above.

Third Party Web Sites : Our website may include links to third-party websites, microsites, plug-ins and applications (i.e. booking.com) Please note that clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. Therefore, whenever you make use of these links or microsites or when you leave our website, please read the privacy notice of the third party.

7. How long will you retain my data?

THY is subject to legal obligations on data retention periods under Turkish law, European Law and depending on the country in which you live or which law applies, national laws of a country (for example, USA, Germany, Italy, Spain, Switzerland, etc.). As THY, as a global company, has locations in different countries and the applicable laws change thereafter, the retention periods may therefore vary from country to country.

Your personal data are deleted as soon as they are no longer needed for the specified purposes. However, We must sometimes continue to store your data until the retention periods and deadlines set by the legislator or supervisory authorities, up to 30 years which may arise from the Turkish Commercial Code, Tax Code, Turkish Code of Obligations and depending on other applicable European Laws and national laws of a EU-Country. We may also retain your data until the statutory limitation periods have expired (but up to 30 years in some cases), provided that this is necessary for the establishment, exercise or defence of legal claims. After that, the relevant data are routinely deleted or anonymized.

Where We process personal data for marketing purposes or with your consent, We process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data so that We can respect your request in future.

8. Principles relating to personal data privacy

Our company acts in accordance with the principles stated below in all data processing activities. “lawfulness, fairness and transparency”, “purpose limitation”, “data minimisation”, “accuracy”, “storage limitation”, “integrity and confidentiality” and “accountability”.

9. Use of cookies

As Turkish Airlines, We utilize technologies such as cookies, pixels, GIFs (“Cookies”) to improve your user experience during your use of our websites and applications. The use of these technologies is in accordance with the Law and other related regulations that We are subjected to.

For further information regarding cookies, please refer to the Türk Hava Yolları Anonim Ortaklığı Cookie Privacy Notice located at https://www.turkishairlines.com/en-tr/legal-notice/privacy-policy/cookies

10. Use of Digital Platforms

Your personal data may be processed while your use of Digital Platforms to manage and operate the Website, to perform activities for optimizing and improving the user experience related to the Website and Application, to detect in what ways the Website is being used, to support and enhance the use of location based tools, to manage your online accounts and to inform you about the services offered near you.

In case you desire to benefit from the offered product and services, your personal data will be processed only to make you get such product and services.

11. Use of CCTV (Closed Circuit Television)

When you visit our company premises, your visual data may be obtained via CCTV and may be preserved only for a period necessary to fulfill the following purposes. With the use of CCTV, prevention and detection of any criminal act incompatible with the law and company policies, maintaining the security of company premises and equipment located within the premises, protection of visitors’ and workers’ well-being is pursued. All necessary technical and administrative measures will be taken by us regarding the security of your personal data obtained via CCTV.

12. What are Your Rights as Data Subjects?

Under the GDPR you are entitled to the following rights (further information is available under https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights_en):

  • Right to withdraw consent (Art. 7 GDPR)
  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

Under the GDPR or national laws, these rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which We are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in the GDPR or in applicable national laws. We will inform you of relevant exemptions We rely upon when responding to any request you make.

In order to exercise these rights please contact the above mentioned contact addresses. Please specify which individual rights according to Art. 15 et seq. you want to exercise. For this purpose, We may have to confirm your identity before responding to your request. Please provide the following details so that We can identify you:

  • Name
  • Postal address
  • E-mail address and optionally: customer number or booking code or ticket number

If you send us a copy of your ID, please black out all other information apart from your first and last name and address. When sending copies of the ID card, it must be clear that this is a copy. Therefore, please make a note on the copy of the ID as following: “This is a copy”.

In order to be able to process your request, as well as for identification purposes, please note that We will use your personal data in accordance with Art. 6 para. 1 (f) of the GDPR as legal obligation.

If you believe that We have failed to comply with data protection regulations when processing your personal data, you can lodge a complaint with the competent supervisory authority in accordance with Art. 77 GDPR. The competent supervisory authority can be identified according to the list provided under: https://edpb.europa.eu/about-edpb/board/members_en.

In Germany, the competent supervisory authority is „Der Hessische Beauftragte für Datenschutz und Informationsfreiheit“, which can be found under: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html).

13. The right to object to processing of personal data (Article 21 of the GDPR)

As indicated above, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6 (1) (e) or (f) of the GDPR, including profiling based on those provisions.

We shall no longer process the personal data unless We demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

14. Data security

We take all appropriate technical and organizational measures to safeguard your personal data and to mitigate risks arising in connection with unauthorized access, accidental data loss, deliberate erasure of or damage to personal data.

In this respect our Company;

  • Ensures data security by utilizing protection systems, firewalls and other software and hardware containing intrusion prevention systems against virus and other malicious software,
  • Access to personal data within our Company is carried out in a controlled process in accordance with the nature of the data and on a strict need-to-know basis,
  • Ensures the conduct of necessary audits to implement the provisions of the GDPR, in accordance with Article 32 of the GDPR,
  • Ensures the lawfulness of the data processing activities by way of internal policies and procedures,
  • Applies stricter measures for access to special categories of personal data,
  • In case of external access to personal data due to procurement of outsourced services, our Company obliges the relevant third party to undertake to comply with the provisions of the GDPR,
  • It takes necessary actions to inform all employees, especially those who have access to personal data, about their duties and responsibilities within the scope of the GDPR.

15. Changes to this Privacy Notice

We reserve the right to make changes to this Privacy Notice in order to provide accurate and up-to-date information concerning practices and regulations relating to the protection of personal data. Data subjects will be informed by appropriate means in the event of a substantial change to the Privacy Notice.

OTHER LANGUAGES

You can use the documents below to examine the translations of this page in other languages.

Bulgarian | Croatian | Czech | Danish | Dutch | Estonian | Finnish | Greek | Hungarian | Latvian | Lithuanian | Polish | Romanian | Slovak | Slovenian | Swedish