ODEON TURİZM İŞLETMECİLİĞİ A.Ş.
CUSTOMER PRIVACY NOTICE
ON PROCESSING OF PERSONAL DATA
4. WHAT PERSONAL DATA DO WE PROCESS? 3
5. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA? 4
6. COUNTRY-BASED REGULATIONS 5
7. TRANSFER OF YOUR PERSONAL DATA 6
8. HOW LONG DO WE KEEP YOUR PERSONAL DATA? 6
ANNEX-1: PERSONAL DATA PROCESSING TABLE 9
ANNEX-2: COUNTRY-SPECIFIC PROCESSING ACTIVITIES 13
ANNEX-3: TRANSFER OF YOUR PERSONAL DATA 19
ANNEX-4: COUNTRY-SPECIFIC RIGHTS 20
ANNEX-5: CORAL TRAVEL GROUP COMPANIES LIST 27
1.1. As Coral Travel Group consisting of Coral Holding Anonim Şirketi and its affiliate companies (Coral Holding A.Ş. and all its affiliate companies will hereinafter be referred to collectively as "Coral Travel Group" or "Company" and each affiliate company individually as "Coral Travel Group Company"), we give utmost importance to the security of your personal data that we process and we would like to inform you, our customers, about the processing of your personal data.
1.2. This Customer Privacy Notice on the Processing of Personal Data ("Privacy Notice") has been prepared in order to inform our real person customer and the guests of our corporate customers receiving services from the relevant Coral Travel Group Company operating as a travel agency and destination management company within the Coral Travel Group (All groups of relevant data subjects listed herein or that may be listed in the future will be referred to hereinafter as "Customer") about the processing of their personal data.
2.1. The relevant Coral Travel Group Company from which you receive services is the data controller for the processing of your personal data in terms of the relevant legislation in force in the country where you are located or receive services in relation to the protection of personal data ("Personal Data Protection Legislation"). In other words, which and why and how your personal data will be processed and how long it will be stored is determined by the relevant Coral Travel Group Company from which you receive services or with which you have established a contractual relationship. All companies within the Coral Travel Group that establish a relationship with Customers are listed in Annex-5: Coral Travel Group Companies List. You can also review the Contact Us section of this Privacy Notice.
We process your personal data within the framework of the following general principles in accordance with the law within the scope of the relevant Personal Data Protection Legislation.
3.1. Lawfulness, Fairness and Transparency : Personal data must be processed in a lawful and fair manner and data subjects must clearly know how their data is collected and for what purpose it is processed. This process must be explained in an understandable and plain language. This Privacy Notice has been prepared to inform the data subjects in the Customer data group within this framework.
3.2. Being Purpose-Related, Limited and Proportionate: Personal data should be collected for specific, explicit and legitimate purposes and should not be processed for purposes other than the purpose of collection. Your personal data is processed for the purposes described in this Privacy Notice.
3.3. Data Minimization: Personal data should be collected, processed and retained for as long as required by the relevant legislation or only to the extent necessary for the specified purpose and sufficient for that purpose. Coral Travel Group processes your personal data only to the extent necessary to fulfill the data processing purposes described below and retains it only for as long as necessary.
3.4. Accuracy and Timeliness: Personal data processed must be kept accurate and up-to-date, and inaccurate or incomplete data must be corrected immediately. It is important for our customers to inform the relevant data controller, Coral Travel Group Company, about their personal data in an accurate and up-to-date manner and to notify the relevant data controller immediately in case of any change in their personal data.
3.5. Integrity and Confidentiality: Your personal data is protected against unauthorized access, loss or damage by appropriate technical and administrative measures. Within Coral Travel Group, necessary measures are taken depending on the nature of the personal data processed and the processing activity. For example, more specific technical and administrative measures are applied to protect the confidentiality of your health data, which is special category of personal data.
4.1. As Coral Travel Group, we process your personal data in accordance with the general principles set out above as part of our contractual relationship with you and as part of the relevant legislation governing tourism or consumer relations in force in the country where you are located or where you are traveling within the scope of the services we provide (“Relevant Legislation”).
4.2. Your personal data processed is listed and grouped below as an example. In addition, your personal data processed in accordance with the Relevant Legislation and the scope of our service relationship with you may differ from country to country or specific to the service you have purchased. In this regard, you can request detailed information about your personal data processed from the relevant data controller by using the application methods specified in this Privacy Notice.
4.3. You can access the Annex-1: Personal Data Processing Table regarding how the categories of personal data grouped as examples below are obtained and for what purposes and legal grounds they are processed.
● Financial Data: Bank account information, credit card information, billing information, payment history, payment amounts, etc.
● Audio and Visual Data: Conversation and voice recordings when the call center is called, audio and video recordings during vehicle tracking processes, etc.
● Contact Data: Phone number, e-mail address, etc.
● Activity Security Data: Website and application usage (IP address, browser information, cookie data), communication history with customer services, username and password information in membership processes, etc.
● Identity Data: Name-surname, ID number and identification information, passport information where necessary, date of birth, gender, citizenship information, signature, reservation number, etc.
● Location Data: Location data of vehicles used during tours, vehicle tracking system data, etc.
● Customer Transaction Data: Flight information, reservation number, accommodation information, satisfaction information, transfer details, request and complaint information, voucher and reservation number, user code, travel date, information on special requests such as marriage and wedding, etc.
4.4. In addition to your personal data listed above, your data below, which is qualified as special categories of data within the framework of the relevant Personal Data Protection Legislation, is also processed:
● Health Data: Health information in line with special requests and needs (for example, services needed for disabled guests), disability status and related information, health report, allergy information, death report, etc.
4.5. We obtain the above-mentioned personal data through call center and phone calls, e-mail, disclosure by you, digital media such as social media platforms and our websites, printed or electronic forms you fill out, software we use, our agents, printed documents, CCTV devices and the use of existing data and process them by automatic or non-automatic methods.
5.1. We process your personal data in the processes of ticket sales, reservations, visitor entries and exits, meeting requests and complaints, measuring customer satisfaction, performing transfers at the location you arrive, providing flights and transportation, meeting your special requests, communication, daily tours, payment and collection, meeting requests, suggestions and complaints, reporting and assignments within the Coral Travel Group Company, vehicle tracking, emergency processes, notifications to the competent authorities.
5.2. The legal grounds we rely on when processing your personal data are as follows:
● Explicitly Stipulated by Law: We process your personal data in accordance with the laws in force in the country where you are located or where you wish to travel within the framework of the services we provide. For example, in accordance with the law in force in Turkey, we are obliged to obtain the identity information of our Customers in the invoices we issue and, if necessary, to provide the identity information of our Customers to authorized public institutions and therefore we process your identity and financial data.
● Performance of a Contract: We process your personal data when it is necessary for the performance of a contract to which you are a party. For example, within the scope of our service relationship with you regarding the sale of our services, we process your tour, hotel and flight information, customer transaction data, identity data such as ID and passport, and contact data such as telephone and e-mail.
● Legal Obligation: We process your personal data when necessary to comply with a legal obligation to which we are subject. For example, in accordance with the Personal Data Protection Legislation in force in Turkey, we are obliged to keep the contracts we have made with you in the sales we make over the internet and the information we provide within the scope of the relevant Personal Data Protection Legislation for the periods specified in the said legislation.
● Legitimate Interest: We process your personal data where it is necessary for our or a third party's legitimate interest, provided that it does not prejudice your rights and freedoms. Examples of what may be our or a third party's legitimate interest are as follows:
o Improving our systems and operations
o Security verification of our systems
o Ensuring security during operations
o Detection and prevention of fraud or illegal activities
Where we rely on legitimate interest to process your personal data, we assess the necessity and proportionality of the processing and the impact of the processing on your fundamental rights and freedoms.
● Establishment, Exercise or Protection of a Right: We may process your personal data when it is necessary for the establishment, exercise or protection of a right. In this context, the use of your customer transaction data or identity data in a possible dispute can be given as an example.
● Your Explicit Consent: In some cases, we process your personal data based on your explicit consent, which we obtain from you and which you give of your own free will after being informed about a specific matter. For example, health data you provide for your specific needs. You can withdraw your explicit consent regarding your personal data processed in this context at any time by using the application methods in the sections titled Your Rights and Annex-4: Country Specific Rights.
5.3. To learn which category of personal data is processed, for what purpose and for what reasons, please see Annex-1: Personal Data Processing Table and Annex-2: Country Specific Processing Activities.
6.1. This Privacy Notice has been prepared to cover all Customers of the relevant Coral Travel Group Company operating as travel agency and in destination management activities within the Coral Travel Group. However, in certain cases, there may be differences within the scope of the relevant Personal Data Protection Legislation in force in the country where you are located or traveling.
6.2. Annex-2: Country Specific Processing Activities has been prepared in this context in order to fulfill the requirements of the different legislation to which we are subject. In addition to the explanations in this Privacy Notice, you can learn whether there are additional or different issues specific to the country you are in or traveling to by examining the Annex-2: Country Specific Processing Activities table.
6.3. In the event of a conflict between the general explanations included herein or the issues in Annex-1: Personal Data Processing Table and Annex-2: Country Specific Processing Activities, Annex-2: Country Specific Processing Activities shall take precedence.
7.1. Coral Travel Group operates globally and works with many third party companies in order to fulfill these global activities. In order to fulfill its legal obligations and to continue its activities, Coral Travel Group shares your personal data with third parties within or outside the country where you are located or traveling.
7.2. In certain cases, your personal data may be transferred to the specified recipient groups for the purposes described in Annex-3: Transfer of Your Personal Data.
7.3. When your personal data is transferred from Turkey to a third country outside Turkey, it is transferred through standard contracts, which is one of the appropriate safeguards stipulated in the Personal Data Protection Law No. 6698 ("KVKK"). The standard contracts we sign with third-party recipients to whom we transfer your personal data aims to ensure that your personal data can be processed in other countries under the terms and conditions provided by the KVKK.
7.4. In case your personal data is transferred to another third country from countries that are within the scope of the European Union General Data Protection Regulation ("GDPR"), we use the standard contractual clauses stipulated in the GDPR and prepared by the European Data Protection Authority ("EDPB") and conclude contracts containing standard contractual clauses with third parties to whom we transfer your personal data.
7.5. You can request a copy of the contracts we have signed within the framework of KVKK and GDPR from us by using the methods in the Privacy Notice within the framework of the relevant Personal Data Protection Legislation.
7.6. If you are located or traveling in a country other than Turkey or the European Union, you can see the methods by which your personal data is transferred to third countries in Annex-2: Country Specific Processing Activities.
Unless a longer retention period is mandatory or possible within the framework of the Relevant Legislation in force in the country where you are located or traveling, we store your personal data in accordance with the relevant Personal Data Protection Legislation for the period required to achieve the purposes specified in this Privacy Notice.
Some of the criteria we use when determining how long your personal data will be stored are as follows:
• Legal obligations requiring the storage of personal data
• Periods specified in the relevant legislation regarding contractual obligations, lawsuits and disputes
• The need for backups of your personal data
9.1. The rights you have as a data subject within the scope of KVKK are listed below. In case you wish to exercise your rights within the framework of KVKK, you can learn how to exercise your rights through the Data Subject Application Form in Data Subject Application Form Link. You can also review the Contact Us section of this Privacy Notice.
● Learn whether your personal data is being processed
● Request information if your personal data has been processed
● To learn the purpose of processing personal data and whether they are used in accordance with their purpose
● To know the third parties to whom your personal data are transferred domestically or abroad
● To request correction of your personal data in case of incomplete or incorrect processing
● To request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation
● When you request the correction of incomplete or incorrect data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data
● Object to the occurrence of a result to your detriment via analysis of the processed data exclusively through automated systems and
● In case you suffer damage due to unlawful processing of personal data, to demand the compensation of this damage
9.2. The rights you have as a data subject under the GDPR are listed below. In case you are subject to GDPR, you can learn how to exercise your rights through the Data Subject Application Form in Data Subject Application Form Link. You can also review the Contact Us section of this Privacy Notice.
● Right to withdraw consent (Article 7, GDPR)
● Right of access (Article 15, GDPR)
● Right to rectification (Article 16, GDPR)
● Right to erasure (Article 17, GDPR)
● Right to restriction of processing (Article 18, GDPR)
● Right to data portability (Art. 20 GDPR)
● Right to object (Article 21, GDPR)
● Right to lodge a complaint and take legal action with the relevant data protection authority (Articles 77-79, GDPR)
9.3. For other countries, the rights you have as a data subject and how to exercise them are explained in Annex-4: Country Specific Rights. You can also review the Contact Us section of this Privacy Notice.
For all your questions and requests within the framework of this Privacy Notice and the relevant Personal Data Protection Legislation, you can directly contact the relevant Coral Travel Group Company using the contact information in Annex-5: Coral Travel Group Companies List.
This Privacy Notice, together with its annexes below, is a whole and may be amended and updated from time to time by Coral Travel Group Companies. When an amendment is made to the Privacy Notice, this will be announced through public communication tools such as the Coral Travel Group website. However, we recommend that you review this Privacy Notice periodically to ensure that you have accurate and up-to-date information about how your personal data is processed.
|
Personal Data Category
|
Collection Method |
Processing Purpose |
Legal Ground |
|
Financial Data |
Printed
or digital documents/forms
|
Execution
of activities in accordance with the legislation |
Expressly provided for in the law |
|
Finance
and accounting processes |
Performance of the contract |
||
|
Execution
of activities in accordance with the legislation |
Legal obligation |
||
|
Conducting
legal affairs |
The establishment, exercise or protection of a right |
||
|
Audio and Visual Recordings |
Call
center call Audio and visual recording devices |
Conducting
communication activities |
Legitimate interest |
|
Conducting
communication activities |
Performance of the contract |
||
|
Execution
of activities in accordance with the legislation |
Expressly provided for in the law |
||
|
Execution
of activities in accordance with the legislation |
Legal obligation |
||
|
Contact Data |
Email Information and documents submitted by Coral Group Company
|
Execution
and supervision of work/operations |
Performance of the contract |
|
Execution
and supervision of work/operations |
Legal obligation |
||
|
Conducting
communication activities |
Legitimate interest |
||
|
Execution
and supervision of work/operations |
The establishment, exercise or protection of a right |
||
|
Identity Data |
Email Information and documents submitted by Coral Group Company
|
Execution
of activities in accordance with the legislation |
Expressly provided for in the law |
|
Execution
and supervision of work/operations |
Performance of the contract |
||
|
Execution
of activities in accordance with the legislation |
Legal obligation |
||
|
Conducting
communication activities |
Legitimate interest |
||
|
Execution
and supervision of work/operations |
The establishment, exercise or protection of a right |
||
|
Location Data |
Vehicle tracking device |
Ensuring
security |
Legitimate interest |
|
Customer Transaction Data |
Email Information and documents submitted by Coral Group Company
|
Execution
and supervision of work/operations |
Expressly provided for in the law |
|
Execution
and supervision of work/operations |
Legal obligation |
||
|
Execution
and supervision of work/operations |
Performance of the contract |
||
|
Execution
and supervision of work/operations |
Legitimate interest |
||
|
Conducting
legal affairs |
The establishment, exercise or protection of a right |
||
|
Health Data |
Use
of existing data disclosure by the customer Information and documents submitted by Coral Group Company |
Execution
and supervision of work/operations
Execution and supervision of work/operations
|
Establishment, exercise or protection of a right
Explicit consent
|
|
|
|
|
|
1. MEMBER STATES OF THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR is applied.
2. UNITED ARAB EMIRATES
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation is applied.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Reason |
|
Audio and Visual Recordings |
Conducting
communication activities |
Performance of the contract
|
|
Contact Data |
Conducting
communication activities
|
Performance of the contract
|
|
Process Security |
Information
security processes |
Implementation of safety measures Performance of the contract Establishment and exercise of legal rights
|
|
Identity Data |
Conducting
communication activities
|
Implementation of safety measures Performance of the contract
|
|
Location Data |
Ensuring
security |
Implementation of safety measures Legal Liability
|
|
Customer Transaction Data |
Execution
and supervision of work/operations
|
Performance of the contract
|
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law and with the appropriate safeguards deemed necessary and sufficient by the relevant Personal Data Protection Legislation for transfer abroad.
3. GEORGIA
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation is applied.
In certain cases, your personal data is transferred abroad in accordance with the law with the consent we obtain from you to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table.
4. SPAIN
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
5. EGYPT
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
Your Personal Data is processed in accordance with the law with the explicit consent we obtain from you in accordance with the relevant Personal Data Protection Legislation regarding the purpose and legal reason for processing in addition to all of the processing conditions in Annex-1 above.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law with your explicit consent and with the appropriate safeguards that the relevant Personal Data Protection Legislation deems necessary and sufficient for transfer abroad.
6. THAILAND
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
In certain cases, your personal data are transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, with the appropriate safeguards deemed necessary and sufficient by the relevant Personal Data Protection Legislation for transfer abroad.
7. TUNISIA
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
Except for the processes where the purpose and legal grounds for processing is based on “the legal obligation” under Annex-1 above, your Personal Data is processed in accordance with the law with the explicit consent we obtain from you in accordance with the relevant Data Protection Legislation on the purpose and legal reason for processing for all other processing conditions.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law with your explicit consent and with the appropriate safeguards that the relevant Personal Data Protection Legislation deems necessary and sufficient for transfer abroad.
8. TURKEY
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where KVKK finds an application area.
9. VIETNAM
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds |
|
Audio and Visual Recordings |
Conducting
communication activities |
Consent Performance of the contract
|
|
Contact Data |
Conducting
communication activities
|
Consent Performance of the contract
|
|
Process Security |
Information
security processes |
Consent Legal Liability
|
|
Identity Data |
Conducting
communication activities
|
Consent Performance of the contract
|
|
Location Data |
Ensuring
security |
Consent Legal Liability
|
|
Customer Transaction Data |
Execution
and supervision of work/operations
|
Consent Performance of the contract
|
10. GREECE
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
|
Recipient Groups
|
Transfer Purpose |
|
Coral Group Companies: Your personal data is transferred within Coral Group Companies since you receive services from Coral Group Companies in the services we provide to you.
|
Execution and supervision of
work/operations |
|
Suppliers: Your personal data is shared with our third party suppliers due to our needs such as the performance of the services we offer to you, especially hotels, flights and transfers, the software we use such as Microsoft 360 and SAP, and the consultancy we receive, especially in the fields of tax and law.
|
Execution and supervision of work/operations Finance and accounting processes Storage and archive Execution
of activities in accordance with the legislation Fulfillment of contractual obligations Reporting and management activities Conducting legal affairs Conducting communication activities Providing information to institutions and organizations Information security processes
|
|
Authorized Institutions and Organizations: Depending on the country where you are located or travel, your personal data is transferred to authorized public institutions and organizations, for example, administrative authorities, courts and regulatory and supervisory institutions related to tax and tourism processes. |
Execution of activities in accordance with the legislation Conducting
legal affairs |
1. MEMBER STATES OF THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA
The rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
2. UNITED ARAB EMIRATES
If you are located in the United Arab Emirates, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You may request information about the purposes for which we process your personal data and the appropriate protection measures used in the domestic or international transfer of your personal data by contacting the relevant Data Controller.
1.2. Right of access: Upon your request, you may receive detailed information about the types of personal data processed, the purposes of processing such data, decisions taken based on automated processing including profiling, the sectors or organizations with which your personal data may be shared domestically or internationally, the rules and criteria regarding the storage and retention periods. You also have the right to request additional information on procedures for rectification, erasure, restriction of processing or objection of your personal data, safeguards provided within the scope of cross-border data processing, measures to be taken in the event of a possible data breach and how you can lodge a complaint with the Relevant Data Protection Authority.
1.3. Right to rectification: You can request that we correct any inaccuracies relating to the personal data we hold about you.
1.4. Right to erasure: You have the right to request the erasure of your personal data if your personal data is no longer necessary for the purposes for which it was processed, if you withdraw your consent or object to the processing and the relevant Data Controller has no legitimate grounds for continuing the processing, or if your personal data has been processed in violation of the relevant Personal Data Protection Legislation and its erasure is necessary to bring it into compliance with legal regulations. However, you do not have the right to request the deletion of your personal data if your request affects the exercise of legal rights, conflicts with other legislation to which we are subject, or falls within other exceptional circumstances specified in the executive regulation of the Personal Data Protection Legislation.
1.5. Right to object/exit: In cases where your personal data is processed for direct marketing purposes, used for statistical research purposes or the processing activity is carried out in violation of the provisions of the Personal Data Protection Legislation, you have the right to object to the processing of your personal data and to stop the processing.
1.6. Right to data portability: You have the right to request the transfer of your personal data to another data controller where technically feasible.
1.7. Right not to be subject to automated decision-making: You have the right to object to decisions based on automated processing, including profiling, in particular decisions that have a legal effect on you or adversely affect you. However, when decisions based on automated processing are applied in certain circumstances, you may not have the right to object to these decisions.
1.8. Right to restrict processing: If you object to the accuracy of your personal data, if you object to the processing of your personal data contrary to the agreed purposes or if the processing is carried out in violation of the provisions of the Personal Data Protection Legislation, you have the right to request the restriction and cessation of the processing.
3. GEORGIA
If you are located in Georgia, you may exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you may contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You have the right to receive confirmation as to whether your personal data is being processed or not and to access detailed information upon your request. In this context, you may request information about the categories of data processed, the legal reasons and purposes of processing, the methods of obtaining the data, the retention period or determination criteria. Regarding the transfer of your personal data abroad, you have the right to receive information about the legal basis and purpose of the transfer and the protection measures provided. Furthermore, in the case of decisions based on automated processing, such as profiling, you may request detailed information about how these decisions are made and their impact on you. This information will be provided free of charge no later than ten (10) business days after your request, but in special cases the response period may be extended by a maximum of ten (10) business days and you will be notified.
1.2. Right of access: You have the right to access your personal data and may also request a copy of your data free of charge. The information you request will be provided within ten (10) working days, but in special circumstances and for good cause shown, this period may be extended by a maximum of ten (10) working days and you will be notified of this.
1.3. Right to rectification: You have the right to request that your personal data be corrected, updated or completed if it is incomplete or incorrectly processed. Upon receipt of your request, the necessary action will be taken within ten (10) business days at the latest or you will be notified of the reasons for the rejection of your request. In addition, if an error or deficiency is detected in your personal data without your request according to the relevant Personal Data Protection Legislation, we will inform you about these changes within ten (10) business days at the latest, as we are obliged to correct, update or complete these errors within a reasonable time.
1.4. Right to erasure: You have the right to request the termination of processing, erasure or disposal of your personal data in certain circumstances. We fulfill this request within ten (10) working days at the latest after receiving your request. However, your request for deletion may be rejected if there are appropriate reasons for the processing of your data according to the relevant legislation. If your data has been processed publicly, you also have the right to request that access to this data be restricted and internet links be removed.
1.5. Right to object/exit: In certain circumstances, you may object to the processing of your personal data or request to restrict its processing. You have the right to stop processing against direct marketing, automated decision-making or unlawful data processing activities. You may exercise your right to restrict processing, in particular if you dispute the accuracy of your data, if your data is no longer required for the purposes of processing but can be used in a legal dispute or if the deletion of your data is under consideration. Once a data blocking decision has been made, the data concerned may only be processed with your explicit consent, for the purpose of proving a legal claim or defense, or for reasons of public interest.
1.6. Right to data portability: You have the right to receive your automatically processed personal data in a structured, commonly used and machine-readable format. You may also, where technically feasible, request that your personal data be transmitted directly to another Data Controller.
1.7. Right not to be subject to automated decision-making: You have the right not to be subject to decisions made solely by automated systems that have legal or similar significant effects on you. However, such automated decision-making may be permitted in certain circumstances.
1.8. Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time and without giving any reason. When you withdraw your consent, the processing of your data will be stopped within ten (10) business days at the latest and your personal data will be deleted if there is no other legal basis. Furthermore, before withdrawing your consent, you may request information about the possible consequences of this processing.
4. SPAIN
If you are located in Spain, the rights you have within the framework of the GDPR regarding your personal data are included in the privacy notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority in application.
5. EGYPT
If you are in Egypt, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You may request information about your processed personal data and the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You may request to access or obtain your personal data.
1.3. Right to rectification: You may request rectification of your personal data.
1.4. Right to erasure: You can request the erasure of your personal data.
1.5. Right to object/withdraw: You have the right to object to the processing of your personal data or its consequences in any case where it conflicts with your fundamental rights and freedoms and to withdraw any consent you have given for the storage or processing of your personal data.
1.6. Right to restrict processing: You have the right to request that the purpose of processing your personal data be restricted to a specific scope.
6. THAILAND
If you are in Thailand, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You can request information about the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You have the right to access or request a copy of your personal data collected, used or transferred by the relevant Data Controller.
1.3. Right to rectification: You have the right to request correction of your personal data collected, used and transferred by the relevant Data Controller if they are incomplete, inaccurate, misleading or outdated.
1.4. Right to erasure: You have the right to request erasure or anonymization of your personal data that the Data Controller has collected, used and disclosed. However, you do not have the right to request erasure of your personal data where the Data Controller needs to retain such data to comply with a legal obligation or to establish, exercise or defend legal claims.
1.5. Right to object/ opt-out: You have the right to object to the collection, use and transfer of your personal data in a certain way, such as objecting to direct marketing.
1.6. Right to data portability: You have the right to obtain your personal data where the relevant Data Controller organizes the personal data in a readable or commonly usable format through automated means or equipment and where it can be used or transferred by automated means. You also have the right to request the transfer of your personal data to another Data Controller where technically feasible.
1.7. Right to restrict processing: You have the right to restrict the use of your personal data in certain circumstances (e.g. when the retention of such personal data is no longer necessary, but you request that it be retained for the establishment, exercise or defense of legal claims or for the establishment, exercise or defense of legal claims).
7. TUNISIA
If you are in Tunisia, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You can request information about the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You, your heirs or executors have the right of access to all personal data concerning you and the right to have it corrected, supplemented, updated, amended, disclosed or erased where it is proven to be inaccurate, ambiguous or prohibited by law. The right of access also includes the right to receive a copy of your personal data in clear language, in a form appropriate to the content of the records and understandable in the case of automated processing.
1.3. Right to rectification: You have the right to rectification, completion, amendment, clarification, updating and erasure of personal data relating to you, your heirs or executors, where such data is inaccurate, incomplete or ambiguous.
1.4. Right to erasure: In the event that you, your heirs or your guardian understand that your personal data are inaccurate and you, your heirs or your guardian are notified of this fact, you have the right to request that they be corrected, completed, corrected, updated, amended or deleted on lawful grounds.
8. TURKEY
If you are located in Turkey, the rights you have within the framework of KVKK regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the KVKK and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
9. VIETNAM
If you are in Vietnam, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You have the right to be informed about the method, scope, place and purposes of the collection, processing and use of your personal information.
1.2. Right of access: You have the right to access or view your personal data or to request its editing.
1.3. Right to rectification: You have the right to access or view your personal data or to request its rectification.
1.4. Right to erasure: You have the right to erase your personal data or to request the erasure of your personal data.
1.5. Right to object/exit: You have the right to object to or request the restriction of the processing of your personal data. In addition, you have the right to consent to the processing of your personal data or to withdraw your consent. Any processing of personal data that takes place before consent is withdrawn is lawful and valid.
1.6. Right to data portability: You have the right to request a copy of your personal data from the relevant Data Controller.
10. GREECE
If you are located in Greece, the rights you have within the framework of the GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the rights of the data subject in the GDPR will find priority application area
|
Company Title |
Country |
E-Mail Address |
|
Odeon Inbound Greece Touristic M.E.P.E. |
Greece |
|
|
Odeon Inbound Spain S.L. |
Spain |
|
|
Odeon Travel & Tourism Co. LLC |
United Arab Emirates |
|
|
Odeon Tours Egypt (S.A.E.) |
Egypt |
|
|
Odeon Turizm İşletmeciliği A.Ş. |
Turkey |
|
|
Odeon Travel and Tourism LLC |
Vietnam |
|
|
Asia In Hand Co. Ltd. |
Thailand |
|
|
Odeon Tours and Travel Services SARL |
Tunisia |
|
|
Coral Travel Ltd. |
Georgia |
|