Turkish Airlines privacy notice for Miles&Smiles
1. Introduction
As a data controller Türk Hava Yolları Anonim Ortaklığı (hereinafter referred to as “THY”, “Company” or “We”), pays the utmost attention to the lawfulness of the processing of personal data relating to its customers. The Turkish Airlines Privacy Notice (“Privacy Notice”) herein have been prepared in accordance with the Article 10 of Law No. 6698 on Protection of Personal Data ("Law") to ensure that the personal data of our customers are processed in a transparent manner during processes within the scope of the Miles&Smiles Program (“Miles&Smiles”).
Specifically, We would like to inform you with respect to processing of your personal data collected. In this respect, We provide you with information on which personal data We process, for what purposes and how long, the third parties your data are shared with, your rights and ways to contact us.
Data processing is conducted in accordance with the principles of “lawfulness, fairness and transparency”, “purpose limitation”, “data minimisation”, “accuracy”, “storage limitation”, “integrity and confidentiality”, “data subject’s control over personal data” and “accountability”.
We reserve the right to update this Privacy Notice at any time and will provide you with a new Privacy Notice if any substantial updates are made thereto. From time to time We may also notify you in other ways about processing of your personal data.
If you are a passenger subject to GDPR, please find more detailed information on https://www.turkishairlines.com/en-int/miles-and-smiles/terms-and-conditions/GDPR-privacy-notice-for-miles-and-smiles/
2. Which personal data we process and how do we collect your personal data?
General information on your personal data processed by THY are as follows:
- Identity and contact information : Personal data such as name, surname, government identification number, passport information and contact information such as e-mail address, address, phone and mobile phone number or social media contact information that you have provided to us while creating accounts, changing membership status, making plane ticket reservations or applying for exclusive services offered by THY and its partners.
- Flight information : Reservation or ticket information or other information related to your flights,
- Advanced passenger information (“API”) : Personal data relating to your name, nationality, birth date, gender, type and number of your travel documents and its date of validity, and its issuing country.
- Evaluations and requests : Information regarding your assessments, complaints and requests relating to our services.
- Payment information : Credit/Debit card information, bank account information, IBAN information, balance and receivable information and other financial data,
- Membership program information : Information about being member of Miles&Smiles, information regarding Turkish Airlines Corporate Club (If you are a member) and Miles&Smiles membership programs, Miles&Smiles Card Status information;
- Special service requests : Provided that you have your request and approval, information about the disease, disability, allergy and special dietary requirements and the information contained in the documents related to them, to provide the service you need during your travel.
- Profession information : Information about your profession in order to benefit from certain advantages, campaigns and accruals (eg: teacher, doctor)
- Special discount offers : Information processed in order to benefit from special discounts offered for students, teachers (if the conditions are met), disabled persons, martyr/veteran relatives and veterans.
- Households and relatives information ; Households information obtained in case of creating family membership and required identity, contact information of your relatives in case creating Companion application that allows quick ticketing transactions.
- Fraud prevention : Device ID Information, device name- os, installation ID, IP address, location data, login date, browser type.
Your personal data can be collected within services we provide with Miles&Smiles program via Turkish Airlines’ online channels, documented forms, sales offices, check-in counters, kiosks, call center, internet service provided inside the plane and in-flight entertainment (“IFE”) portals, member feedback, admission points to the plane, authorized travel agencies for the sale of Turkish Airlines products and services, GDSs, online sales channels, evaluation activities, program partners and other airlines verbally, in written form or digitally.
As per the Law, your personal data may only be processed where one or more conditions that are stipulated under Law are present. As THY, regardless of the purpose for which we process your personal data, we process it in accordance with the provisions of national and international law, primarily the general principles stated under Article 4 of the Law and by relying on conditions for lawful data processing listed under Article 5 of the Law.
3. For which purposes do we process your personal data?
We process personal data of customers who accepts Miles&Smiles Program Rules and Conditions and becomes a member for the following purposes:
- to provide Miles (“Miles”) from flights with Turkish Airlines and with program partner airlines,
- to introduce a personal security code (“PIN Code”) and a card for each member,
- to design and provide special services to program members via our more than a hundred program partners (https://www.turkishairlines.com/en-nl/miles-and-smiles/program-partners/index.html ) operating in a wide range of sectors such as airlines companies, car-rental companies, banks which provide credit cards used to accumulate Miles, hotels, insurance companies, health service providers, tourism companies, organizations providing shopping and entertainment services, telecommunication companies, educational institutions and energy companies,
- National and international airport authorities and/or Star Alliance may process your biometric data based on your explicit consent for the purpose of providing to the members easy and fast track services at the airports via digital applications. (THY does not process your biometric data);
- to spend Miles at https://www.shopandmiles.com website,
- to benefit our Miles&Smiles credit card holder members with Miles in different rates according to the sector,
- to allow our members and their preferred relatives and friends benefit from various advantages (such as award tickets, cabin upgrades, Cash&Miles) with earned Miles&Smiles Miles according to the membership status,
- to perform transactions such as accrual of Miles, transferring Miles, activating Miles that are outdated, paying ticket taxes with Miles and redeeming Miles,
- to enable booking a ticket from the website and mobile applications, to design special campaigns for Miles&Smiles members through various surveys, to offer special opportunities for our members' birthdays, to cut celebration cakes, to organize special surprises and services for our members such as valet parking and private driver service,
- to carry out THY My-Pass operations,
- in case you request a Family Membership, to take necessary actions within the Miles collected by family members. If you create a family membership account, all members within the family can view the account movements of other family members)
- in case you have a RFID baggage card, to inform you by SMS about the status of your baggage at the airport,
- to reward loyal members as a general feature of loyalty programs and to follow member behaviors to customize the program according to the member’s expectations.
- to carry out the operations and after-sales support services via https://www.shopandmiles.com,
- to carry out the customer relationship management operations,
- to prevent, investigate and/or report things such as fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable laws;
- to carry out activities in accordance with the legislation.
4. What is our legal basis for processing your personal data?
Under the Law personal data can only be processed if at least one of the conditions set forth under Art. 5 and Art 6 of the Law. Personal data are processed on the following basis of the Law:
- if you give us consent as provided by Art. 5(1) Law. If this is the case, personal data will be processed limited to the scope of your freely given explicit consent. You may at any time withdraw your explicit consent e.g. We would like to point out that if you decide to withdraw your consent, your Miles&Smiles membership will be terminated,
- It is explicitly permitted by any Law provided by 5 (2) (a) Law,
- compliance with legal obligations provided by Article 5(2) (ç) Law;
- as required to conduct our business and pursue our legitimate interests if such interests do not have a negative impact on your fundamental rights and freedoms as provided by 5 (2) (f) Law.
- if it is necessary to establish a contractual relationship and/or to perform our obligations under a contract (airline transport services and other related services etc.) as provided by Art. 5(2)(c) Law.
5. To whom we transfer your personal data and for what purposes?
Under certain circumstances, we may transfer your personal data that we process to third parties residing within borders or abroad, in accordance with the provisions of national and international law, particularly Article 8 and 9 of the Law.
The categories of third parties that we may transfer your data to can be listed categorically as follows:
- Our business partners residing within borders or abroad ; e.g. car rental companies, hotels, ground operation service providers at airports, agencies, transportation service providers, global distribution systems, partner airlines that will provide you services during connecting flights, within the scope of mileage accrual, product differentiations, personalized offers and dynamic pricing; mileage redemption (award tickets, cabin upgrades)
- Group companies, e.g. certain services offered by THY are carried out by our affiliates, within this context, your personal data may be shared with our relevant affiliates. You may find more detained information regarding our group companies on Türk Hava Yolları Anonim Ortaklığı Policy on Protection and Processing of Personal Data or from the following link: https://www.turkishairlines.com/en-tr/press-room/about-us/index.html
- Suppliers ; e.g. software companies that we procure technical services, research companies, agencies that perform special campaign service for members, supply companies, security firms, transportation service providers,
- Countries that the transportation is carried out to and private and public institutions authorized by national or international legislations ; In accordance with national and/or international legislation or civil aviation regulations, the relevant authorities and authorized bodies of the country where your travel takes place from or over its airspace, national and international public institutions that may take decisions that affect THY and/or THY's operations, national and international civil aviation authorities such as Directorate General of Civil Aviation, International Air Transport Association, The Office of Foreign Assets Control, Bureau of Industry and Security, Transportation Security Administration etc. and to United States National Security Council etc. when travelling to or using the airspace of United States of America;
- Government authorities and/or law enforcement officials : Your personal data can be shared with government authorities law enforcement officials and/or executive or judicial bodies (e.g. authorized public and private bodies) if required by law or if required for the protection of our legitimate interests in compliance with applicable laws and/or in relation to ongoing investigations.
6. Notification regarding commercial electronic communications
According to the Law on Electronic Commerce no. 6563 and the Regulation on Commercial Communication and Commercial Electronic Communications, in accordance with the consent given, your personal data may be processed in order to provide information about our services, to promote our goods and services and to keep you informed about our campaigns. In accordance with the relevant legislation, your permissions regarding commercial electronic communication must be recorded in the Communication Management System (CMS), and within this scope, the contact address (phone number or e-mail address), permission date, communication channel, recipient type and data of permission source will be shared with CMS. You can visit https://iys.org.tr for detail information.
7. What are your rights as data subjects?
8. Data controller and contact information
