ODEON TURİZM İŞLETMECİLİĞİ A.Ş.
GLOBAL SUPPLIER PRIVACY NOTICE
ON PROCESSING OF PERSONAL DATA
4. WHAT PERSONAL DATA DO WE PROCESS? 4
5. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA? 5
6. COUNTRY-BASED REGULATIONS 7
7. TRANSFER OF YOUR PERSONAL DATA 7
8. HOW LONG DO WE KEEP YOUR PERSONAL DATA? 8
ANNEX-1: PERSONAL DATA PROCESSING TABLE 10
ANNEX-2: COUNTRY-SPECIFIC PROCESSING ACTIVITIES 16
ANNEX-3: TRANSFER OF YOUR PERSONAL DATA 23
ANNEX-4: COUNTRY-SPECIFIC RIGHTS 24
ANNEX-5: CORAL TRAVEL GROUP COMPANIES LIST 33
1.1. As Coral Holding Anonim Şirketi and its affiliates (Coral Holding A.Ş. and all its affiliated companies will hereinafter be collectively referred to as "Coral Travel Group" or "Company" and each affiliate company will be referred to as "Coral Travel Group Company"), we give utmost importance to the security of your personal data that we process and we would like to inform you, our suppliers, about the processing of your personal data.
1.2. This Global Supplier Privacy Notice on the Processing of Personal Data ("Privacy Notice") has been prepared to inform suppliers, supplier employees, supplier officials, agencies, agency employees and agency officials, including potential suppliers who have provided services to Coral Travel Group in the past or currently provide services to Coral Travel Group or who may provide services to Coral Travel Group in the future (all relevant data subjects listed herein or who may be listed in the future are hereinafter referred to as "Suppliers") about the processing of their personal data.
2.1. The relevant Coral Travel Group Company that has entered into a contract with you or to which you provide services is the data controller for the processing of your personal data in terms of the relevant legislation in force in the country where you are located or in which you provide services in relation to the protection of personal data ("Personal Data Protection Legislation"). In other words, which and why and how your personal data will be processed and how long it will be stored is determined by the relevant Coral Travel Group Company that receives services from you or establishes a contractual relationship with you. All companies within the Coral Travel Group that establish a relationship with Suppliers are listed in Annex-5: Coral Travel Group Companies. You can also review the Contact Us section of this Privacy Notice.
We process your personal data within the framework of the following general principles in accordance with the law within the scope of the relevant Personal Data Protection Legislation.
3.1. Lawfulness, Fairness and Transparency: Personal data must be processed lawfully and fairly, and data subjects must clearly know how their data is collected and for what purpose it is processed. This process must be explained in an understandable and plain language. This Privacy Notice has been prepared to inform the data subjects in the Supplier data group within this framework.
3.2. Must be Purpose-Related, Limited and Proportionate: Personal data should be collected for specific, explicit and legitimate purposes and should not be processed for purposes other than the purpose of collection. Your personal data is processed for the purposes described in this Privacy Notice.
3.3. Data Minimization: Personal data must be collected, processed and retained for the period of time required by the relevant legislation or only to the extent necessary for the specified purpose. Coral Travel Group will only process your personal data to the extent necessary to fulfill the data processing purposes described below and will only retain it for as long as necessary.
3.4. Accuracy and Timeliness: Personal data processed must be kept accurate and up-to-date, and inaccurate or incomplete data must be corrected immediately. It is important for our suppliers to inform the relevant data controller, Coral Travel Group Company, about their personal data in an accurate and up-to-date manner and to notify the relevant data controller immediately in case of any change in their data.
3.5. Integrity and Confidentiality: Your personal data is protected against unauthorized access, loss or damage by appropriate technical and administrative measures. Necessary measures are taken depending on the nature of the personal data processed and the processing activity within Coral Travel Group. For example, more specific technical and administrative measures are applied to protect the confidentiality of your health data, which is special category of personal data.
4.1. As Coral Travel Group, we process your personal data in accordance with the general principles set out above as part of our contractual relationship with you and as part of the relevant legislation in force in the country in which you are located or where you provide services which regulates the sector in which you provide services or your relationship with us ("Relevant Legislation).
4.2. Your personal data is listed and grouped below as an example. In addition, your personal data processed in accordance with the supply relationship and the Relevant Legislation may differ from country to country or in the sector in which you provide services. In this regard, you can request detailed information about your personal data processed from the relevant data controller using the application methods specified in this Privacy Notice.
4.3. You can find detailed information on how the categories of personal data grouped as examples below are obtained and for what purposes and legal reasons they are processed via Annex-1: Personal Data Processing Table.
● Financial Data: Bank account information, invoice, receipt, collateral information, etc.
● Data on Work Place Security: CCTV camera records, information about the visit (office entry/exit times, date of visit), visitor card number, turnover time for Suppliers working as security, etc.
● Audio and Visual Data: Audio and video recordings, photos and videos, etc.
● Legal Information: Contracts, information on litigation, cease and desist letters, legal notices, etc.
● Contact Data: Address, phone number, personal and workplace e-mail addresses, company phone, residence information, etc.
● Transaction Security Data: IP address, username and password information for created user accounts, etc.
● Identity Date: Name-surname, gender, nationality, ID number, passport number, personnel registration number, tax number, tax office, date of birth, place of birth, driver's license, marital status, signature, maiden name in case it is included in the ID card, information on work and residence permit, signature circular, etc.
● Location Data: information on vehicle tracking system, etc.
● Professional Experience Data: Professional experience, diploma date and number, medical practice number, etc.
● Personnel Data: Position, department and title, certificate of employment, agency information, professional experience, diploma date and number, practice number, education information, reference information, experience information, curriculum vitae, etc.
4.4. In addition to your personal data listed above, your data below, which are qualified as special categories of personal data within the framework of the relevant Personal Data Protection Legislation, are also processed:
● Criminal Conviction and Offense Data: Information on criminal convictions and other measures imposed in the event of judicial proceedings.
● Health Data: Reports on periodic health examinations, examination forms at the time of employment, blood type information, etc., if required pursuant to the Relevant Legislation.
● Trade Union Membership: Information on trade union membership in the event of judicial proceedings and involvement of trade unions
4.5. We obtain and collect the above personal data through disclosure by the Supplier, electronic or printed forms, printed documents, software used within Coral Travel Group, audio and visual recording devices such as CCTV cameras, records before public institutions and organizations such as criminal records, official channels such as notary public or KEP system, e-mail or telephone, sharing by Coral Travel Group Companies or using existing personal data.
5.1. We process your personal data within the scope of the commercial relationship we have established with you in processes such as incentive processes, internal and external audits, service procurement, conducting business and operations, conducting periodic health examinations, training, communication, conducting finance and accounting transactions, ensuring security, judicial processes.
5.2. The legal grounds we rely on when processing your personal data are as follows:
● Explicitly Stipulated by Laws: We process your personal data in accordance with the laws in force in the country where you are located or in which you provide services. For example, pursuant to the law in force in Turkey, we are obliged to obtain the identity information of our Suppliers in the invoices we issue and, if necessary, to submit the identity information of our Suppliers to authorized public institutions and therefore we process your identity and financial data.
●
Performance of a Contract: We process your personal data when it is necessary for the
performance of a contract to which you are a party. For example, we
process your financial data in order to make payments
within the scope of our commercial relationship
with you, and your identity and contact data in order to contact you.
● Legal Obligation: We process your personal data when it is necessary to comply with a legal obligation to which we are subject. For example, we process your identity data, employment data and financial data in order to notify the relevant public institutions and organizations in accordance with the Relevant Legislation and to fulfill our tax obligations.
● Legitimate Interest: We process your personal data where it is necessary for our or a third party's legitimate interest, provided that it does not prejudice your rights and freedoms. Examples of what may be our or a third party's legitimate interest are as follows:
o Improving our systems and operations
o Security verification of our systems
o Ensuring security during operations
o Detection and prevention of fraud or illegal activities
Where we rely on legitimate interest to process your personal data, we assess the necessity and proportionality of the processing and the impact of the processing on your fundamental rights and freedoms.
● Exercise or Protection of a Right: We process your personal data when it is necessary for the establishment, exercise or protection of a right. In this context, the use of your employment data in a possible dispute can be given as an example.
● Employment and Social Security: We process your personal data to fulfill our obligations regarding employment, social security or occupational health and safety. In this context, for example, we process your personal data for the health examinations processes that must be carried out periodically to ensure occupational health and safety within the framework of the Relevant Legislation.
5.3. To learn which category of personal data is processed, for what purpose and for what reasons, please see Annex-1: Personal Data Processing Table and Annex-2: Country Specific Processing Activities.
6.1. This Privacy Notice has been prepared to cover all Suppliers within the Coral Travel Group. However, in certain cases, there may be differences under the relevant Personal Data Protection Legislation in force in the country where you are located or where you provide services.
6.2. Annex-2: Country Specific Processing Activities has been prepared in this context in order to fulfill the notification requirements of the different legislation we are subject to. In addition to the explanations in this Privacy Notice, you can learn whether there are additional or different issues specific to the country where you are located or where you provide services by examining the Annex-2: Country Specific Processing Activities table.
6.3. In the event of a conflict between the general explanations included herein or the issues in Annex-1: Personal Data Processing Table and the country-specific regulations in Annex-2: Country Specific Processing Activities, Annex-2: Country Specific Processing Activities shall take precedence.
7.1. Coral Travel Group operates globally and works with many third party companies in order to fulfill these global activities. In order to fulfill its legal obligations and to continue its activities, Coral Travel Group shares your personal data with third parties within or outside the country where you are located or where you provide services.
7.2. In certain cases, your personal data may be transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data.
7.3. When your personal data is transferred from Turkey to a third country outside Turkey, it is transferred through standard contracts, which is one of the appropriate safeguards stipulated in the Personal Data Protection Law No. 6698 ("KVKK"). The standard contracts we sign with third-party recipients to whom we transfer your personal data aim to ensure that your personal data can be processed in other countries under the terms and conditions provided by the KVKK.
7.4. In the event that your personal data is transferred to another third country from the European Union and other countries within the scope of the European Union Data Protection Regulation ("GDPR"), we use the standard contractual clauses stipulated in the GDPR and prepared by the European Data Protection Authority ("EDPB") and we conclude contracts containing standard contractual clauses with third parties to whom we transfer your personal data.
7.5. You can request a copy of the contracts we have signed within the framework of KVKK and GDPR from us by using the application methods in the Privacy Notice within the framework of the relevant Personal Data Protection Legislation.
7.6. If you are located or provide services in a country other than Turkey or the European Union, you can see the methods by which your personal data are transferred to third countries in Annex-2: Country Specific Processing Activities.
Unless a longer retention period is mandatory or possible within the framework of the Relevant Legislation in force in the country where you are located or in the country where you provide services, we store your personal data in accordance with the relevant Personal Data Protection Legislation for the period required to achieve the purposes specified in this Privacy Notice.
Some of the criteria we use when determining how long your personal data will be stored are as follows:
• Legal obligations requiring the storage of personal data
• The periods specified in the relevant legislation regarding contractual obligations, lawsuits and disputes
• The need for backups of your personal data
9.1. The rights you have as a data subject within the scope of KVKK are listed below. In case you wish to exercise your rights within the framework of KVKK, you can learn how to exercise your rights through the Data Subject Application Form at Data Subject Application Form Link. You can also review the Contact Us section of this Privacy Notice.
● Learn whether your personal data is being processed
● Request information if your personal data has been processed
● To learn the purpose of processing personal data and whether they are used in accordance with their purpose
● To know the third parties to whom your personal data is transferred domestically or abroad
● To request correction of your personal data in case of incomplete or incorrect processing
● To request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation
● When you request the correction of incomplete or incorrect data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data
● Object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems and
● In case you suffer damage due to unlawful processing of personal data, to demand the compensation of this damage
9.2. The rights you have as a data subject under the GDPR are listed below. If you are subject to GDPR, you can learn how to exercise your rights via the Data Subject Application Form in Data Subject Application Form Link. You can also review the Contact Us section of this Privacy Notice.
● Right to withdraw consent (Article 7, GDPR)
● Right of access (Article 15, GDPR)
● Right to rectification (Article 16, GDPR)
● Right to erasure (Article 17, GDPR)
● Right to restriction of processing (Article 18, GDPR)
● Right to data portability (Art. 20 GDPR)
● Right to object (Article 21, GDPR)
● Right to lodge a complaint and take legal action with the relevant data protection authority (Articles 77-79, GDPR)
9.3. For other countries, the rights you have as a data subject and how to exercise them are explained in Annex-4: Country Specific Rights. You can also review the Contact Us section of this Privacy Notice.
10.1. For all your questions and requests within the scope of this Privacy Notice and the relevant Personal Data Protection Legislation, you can directly contact the relevant Coral Travel Group Company using the contact information in Annex-5: Coral Travel Group Companies List.
This Privacy Notice, together with its annexes below, is a whole and may be amended and updated from time to time by Coral Travel Group Companies. When a change is made to the Privacy Notice, this will be announced through public communication tools such as the Coral Travel Group website. However, we recommend that you review this Privacy Notice periodically so that you have accurate and up-to-date information about how your personal data is processed.
|
Personal Data Category
|
Collection Method |
Processing Purpose |
Legal Grounds |
|
Financial Data |
Declaration by the supplier Digital or printed forms Official channels Software used Use of existing data |
Purchase
of goods and services |
Performance of the contract
|
|
Execution of activities in accordance with the legislation |
Expressly provided for in the law
|
||
|
Execution of activities in accordance with the legislation |
Legal obligation
|
||
|
Execution of activities in accordance with the legislation |
Exercise or protection of a right |
||
|
Storage and archive |
Legitimate interest |
||
|
Data on Physical Space Security |
Printed forms CCTV Devices |
Ensuring
security |
Legitimate interest
|
|
Audio and Visual Recordings |
Audio and visual recording devices Use of existing data Information and documents submitted by the relevant departments and Coral Group Companies Official channels |
Storage
and archive |
Legitimate interest |
|
Fulfillment
of contractual obligations |
Performance of the contract |
||
|
Execution
and supervision of work/operations |
Legal obligation |
||
|
Execution
of activities in accordance with the legislation |
Expressly provided for in the law |
||
|
Legal Information |
Printed documents Declaration by the supplier Official channels Records held by public institutions and organizations Use of existing data Minutes and documents related to the incident |
Execution
of activities in accordance with the legislation |
Expressly
provided for in the law
|
|
Execution
and supervision of work/operations |
Legal
obligation |
||
|
Storage
and archive |
Exercise or protection of a right |
||
|
Providing
information to institutions and organizations |
Our legitimate interest |
||
|
Execution
and supervision of work/operations |
Performance of the contract |
||
|
Contact Data |
Printed or digital forms Declaration by the supplier Use of existing data Software used Email and phone Official channels Public institutions and organizations
|
Execution
of activities in accordance with the legislation |
Expressly provided for in the law
|
|
Finance
and accounting processes |
Performance of the contract
|
||
|
Finance
and accounting processes |
Legal obligation
|
||
|
Execution
and supervision of work/operations |
Legitimate interest |
||
|
Process Security Data |
Software used Digital recordings Use of existing data Information and documents submitted by Coral Group Company Official channels |
Information security processes |
Legitimate Interest
|
|
Execution
of activities in accordance with the legislation |
Legal obligation
|
||
|
Conducting
legal affairs |
Exercise or protection of a right |
||
|
Identity Information |
Printed or digital forms Declaration by the supplier Use of existing data Software used Email and phone Official channels Public institutions and organizations
|
Finance
and accounting processes |
Performance of the contract |
|
Execution
and supervision of work/operations |
Not expressly provided for in the law
|
||
|
Ensuring
security |
Legal obligation
|
||
|
Conducting
legal affairs |
Exercise or protection of a right
|
||
|
Ensuring
security |
Our legitimate interest |
||
|
Location Data |
Vehicle tracking device |
Ensuring
security |
Our legitimate interest |
|
Personnel Data |
Printed or digital forms Declaration by the supplier Printed documents Email and phone Use of existing data Software used |
Execution
of activities in accordance with the legislation |
Performance of the contract |
|
Ensuring
security |
Legal obligation |
||
|
Ensuring
security |
Legitimate interest |
||
|
Conducting
legal affairs |
Exercise or protection of a right |
||
|
Execution
of activities in accordance with the legislation |
Exercise or protection of a right |
||
|
Criminal Conviction and Offense Data |
Printed documents Official channels |
Execution
of activities in accordance with the legislation |
Exercise or protection of a right |
|
Health Data |
Printed or digital forms Declaration by the supplier Use of existing data Official channels Reports
|
Execution
of activities in accordance with the legislation |
Employment and social security
|
|
Execution
of activities in accordance with the legislation |
Exercise or protection of a right |
||
|
Union Membership |
Printed form Declaration by the supplier |
Execution
of activities in accordance with the legislation
|
Employment and social security
|
|
|
|
|
|
1. GERMANY
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
2. MEMBER STATES OF THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR finds an application area.
3. UNITED ARAB EMIRATES
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds |
|
Financial Data |
Storage
and archive
|
Archiving Legal obligation |
|
Data on Physical Space Security |
Ensuring
security |
Implementation of safety measures Legal obligation
|
|
Audio and Visual Recordings |
Storage
and archive |
Archiving Implementation of safety measures |
|
Legal Information |
Providing
information to institutions and organizations |
Establishment and exercise of legal rights Archiving |
|
Contact Data |
Execution
and supervision of work/operations
|
Performance of the contract Legal Liability Archiving
|
|
Process Security |
Information
security processes |
Implementation of safety measures Performance of the contract
|
|
Identity Information |
Ensuring
security
|
Implementation of safety measures Performance of the contract
|
|
Location Data |
Ensuring
security |
Implementation of safety measures Establishment and exercise of legal rights Performance of the contract |
|
Personnel Data |
Ensuring
security |
Implementation of safety measures Archiving Performance of the contract |
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law and with the appropriate safeguards deemed necessary and sufficient by the relevant Personal Data Protection Legislation for transfer abroad.
4. CZECH REPUBLIC
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
5. ESTONIA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
6. GEORGIA
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
In certain cases, your personal data is transferred abroad in accordance with the law with the consent we obtain from you to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table.
7. SPAIN
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds
|
|
Criminal Conviction and Security Measure Data |
Execution
of activities in accordance with the legislation
|
Expressly provided for in the law
|
8. SWITZERLAND
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table by concluding contracts containing the standard contract clauses stipulated in the GDPR and prepared by the EDPB, together with the annex of the Swiss amendments required by the Federal Data Protection Commissioner.
9. LATVIA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
10. LITHUANIA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
11. EGYPT
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
Your Personal Data is processed in accordance with the law with the explicit consent we obtain from you in accordance with the relevant Personal Data Protection Legislation regarding the purpose and legal reason for processing in addition to all of the processing conditions in Annex-1 above.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law with your explicit consent and with the appropriate safeguards that the relevant Personal Data Protection Legislation deems necessary and sufficient for transfer abroad.
12. POLAND
Your personal data are processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds |
|
Criminal Conviction and Security Measure Data |
Execution
of activities in accordance with the legislation
|
Legal Liability
|
13. ROMANIA
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds
|
|
National Identity Number |
Finance
and accounting processes
|
Legal Liability Explicit Consent
|
|
Health Data |
Execution
of activities in accordance with the legislation |
Explicit Consent Employment and social security
|
14. THAILAND
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, with the appropriate safeguards deemed necessary and sufficient by the relevant Personal Data Protection Legislation for transfer abroad.
15. TUNISIA
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
Except for the processes where the purpose and legal grounds for processing is based on “the legal obligation” under Annex-1 above, your Personal Data is processed in accordance with the law with the explicit consent we obtain from you in accordance with the relevant Data Protection Legislation on the purpose and legal reason for processing for all other processing conditions.
In certain cases, your personal data is transferred to the recipient groups specified for the purposes described in Annex-3: Transfer of Your Personal Data table, in accordance with the law with your explicit consent and with the appropriate safeguards that the relevant Personal Data Protection Legislation deems necessary and sufficient for transfer abroad.
16. TURKEY
Your personal data are processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where KVKK finds an application area.
17. VIETNAM
Your personal data is processed in accordance with the provisions of the relevant Personal Data Protection Legislation, the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the relevant Personal Data Protection Legislation finds application.
The following special provisions that differ from the processing conditions in Annex-1 above in accordance with the Relevant Personal Data Protection Legislation regarding the purpose and legal reason for the processing of your Personal Data are valid.
|
Personal Data Category
|
Processing Purpose |
Legal Grounds |
|
Financial Data |
Storage
and archive
|
Consent Performance of the contract |
|
Data on Physical Space Security |
Ensuring
security |
Consent Legal Liability
|
|
Audio and Visual Recordings |
Storage
and archive |
Consent Performance of the contract |
|
Legal Information |
Providing
information to institutions and organizations |
Consent Legal Liability |
|
Contact Data |
Execution
and supervision of work/operations
|
Consent Performance of the contract
|
|
Process Security |
Information
security processes |
Consent Legal Liability
|
|
Identity Information |
Ensuring
security
|
Consent Performance of the contract
|
|
Location Data |
Ensuring
security |
Consent Legal Liability Performance of the contract |
|
Personnel Data |
Ensuring
security |
Performance of the contract Consent |
18. GREECE
Your personal data is processed in accordance with the general terms of this Privacy Notice and the processing conditions in Annex-1 in the processes where the GDPR and the relevant Personal Data Protection Legislation find application.
|
Recipient Groups
|
Transfer Purpose |
|
Coral Travel Group Companies: Your personal data is transferred within Coral Group Companies due to processes such as management, quality and evaluation of service standards within Coral Travel Group and software used within Coral Travel Group.
|
Ensuring security |
|
Suppliers: Your personal data is shared with our suppliers, who are third parties, through the software we use, especially Microsoft and SAP, and the services we purchase in matters requiring expertise, such as consultancy services we receive in tax and legal matters.
|
Ensuring
security Finance and accounting processes Storage and archive Execution of activities in accordance with the legislation Fulfillment of contractual obligations Conducting legal affairs Contact Providing information to institutions and organizations Information security processes
|
|
Authorized Institutions and Organizations: Depending on the country where you are located or where you provide services, your personal data is transferred to authorized public institutions and organizations, especially administrative authorities, courts and regulatory and supervisory institutions related to tax and labor relations. |
Execution of activities in accordance with the legislation Conducting
legal affairs Informing
authorized institutions and organizations |
1. GERMANY
If you are located in Germany, the rights you have within the framework of the GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
2. MEMBER STATES OF THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA
The rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
3. UNITED ARAB EMIRATES
If you are located in the United Arab Emirates, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You may request information about the purposes for which we process your personal data and the appropriate protection measures used in the domestic or international transfer of your personal data by contacting the relevant Data Controller.
1.2. Right of access: Upon your request, you may receive detailed information about the types of personal data processed, the purposes of processing such data, decisions taken based on automated processing including profiling, the sectors or organizations with which your personal data may be shared domestically or internationally, the rules and criteria regarding the storage and retention periods. You also have the right to request additional information on procedures for rectification, erasure, restriction of processing or objection of your personal data, safeguards provided within the scope of cross-border data processing, measures to be taken in the event of a possible data breach and how you can lodge a complaint with the relevant Data Protection Authority.
1.3. Right to rectification: You can request that we correct any inaccuracies relating to the personal data we hold about you.
1.4. Right to erasure: You have the right to request the erasure of your personal data if your personal data is no longer necessary for the purposes for which it was processed, if you withdraw your consent or object to the processing and the relevant Data Controller has no legitimate grounds for continuing the processing, or if your personal data has been processed in violation of the relevant Personal Data Protection Legislation and its erasure is necessary to bring it into compliance with legal regulations. However, you do not have the right to request the deletion of your personal data if your request affects the exercise of legal rights, conflicts with other legislation to which we are subject, or falls within other exceptional circumstances specified in the executive regulation of the Personal Data Protection Legislation.
1.5. Right to object/exit: In cases where your personal data is processed for direct marketing purposes, used for statistical research purposes or the processing activity is carried out in violation of the provisions of the Personal Data Protection Legislation, you have the right to object to the processing of your personal data and to stop the processing.
1.6. Right to data portability: You have the right to request the transfer of your personal data to another data controller where technically feasible.
1.7. Right not to be subject to automated decision-making: You have the right to object to decisions based on automated processing, including profiling, in particular decisions that have a legal effect on you or adversely affect you. However, when decisions based on automated processing are applied in certain circumstances, you may not have the right to object to these decisions.
1.8. Right to restrict processing: If you object to the accuracy of your personal data, if you object to the processing of your personal data contrary to the agreed purposes or if the processing is carried out in violation of the provisions of the Personal Data Protection Legislation, you have the right to request the restriction and cessation of the processing.
4. CZECH REPUBLIC
If you are located in the Czech Republic, the rights you have within the framework of the GDPR regarding your personal data are included in the privacy notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
5. ESTONIA
If you are located in Estonia, the rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
6. GEORGIA
If you are located in Georgia, you may exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you may contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You have the right to receive confirmation as to whether your personal data is being processed or not and to access detailed information upon your request. In this context, you may request information about the categories of data processed, the legal reasons and purposes of processing, the methods of obtaining the data, the retention period or determination criteria. Regarding the transfer of your personal data abroad, you have the right to receive information about the legal basis and purpose of the transfer and the protection measures provided. Furthermore, in the case of decisions based on automated processing, such as profiling, you may request detailed information about how these decisions are made and their impact on you. This information will be provided free of charge no later than ten (10) business days after your request, but in special cases the response period may be extended by a maximum of ten (10) business days and you will be notified.
1.2. Right of access: You have the right to access your personal data and may also request a copy of your data free of charge. The information you request will be provided within ten (10) working days, but in special circumstances and for good cause shown, this period may be extended by a maximum of ten (10) working days and you will be notified of this.
1.3. Right to rectification: You have the right to request that your personal data be corrected, updated or completed if it is incomplete or incorrectly processed. Upon receipt of your request, the necessary action will be taken within ten (10) business days at the latest or you will be notified of the reasons for the rejection of your request. In addition, if an error or deficiency is detected in your personal data without your request according to the relevant Personal Data Protection Legislation, we will inform you about these changes within ten (10) business days at the latest, as we are obliged to correct, update or complete these errors within a reasonable time.
1.4. Right to erasure: You have the right to request the termination of processing, erasure or disposal of your personal data in certain circumstances. We fulfill this request within ten (10) working days at the latest after receiving your request. However, your request for deletion may be rejected if there are appropriate reasons for the processing of your data according to the relevant legislation. If your data has been processed publicly, you also have the right to request that access to this data be restricted and internet links be removed.
1.5. Right to object/exit: In certain circumstances, you may object to the processing of your personal data or request to restrict its processing. You have the right to stop processing against direct marketing, automated decision-making or unlawful data processing activities. You may exercise your right to restrict processing, in particular if you dispute the accuracy of your data, if your data is no longer required for the purposes of processing but can be used in a legal dispute or if the deletion of your data is under consideration. Once a data blocking decision has been made, the data concerned may only be processed with your explicit consent, for the purpose of proving a legal claim or defense, or for reasons of public interest.
1.6. Right to data portability: You have the right to receive your automatically processed personal data in a structured, commonly used and machine-readable format. You may also, where technically feasible, request that your personal data be transmitted directly to another Data Controller.
1.7. Right not to be subject to automated decision-making: You have the right not to be subject to decisions made solely by automated systems that have legal or similar significant effects on you. However, such automated decision-making may be permitted in certain circumstances.
1.8. Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time and without giving any reason. When you withdraw your consent, the processing of your data will be stopped within ten (10) business days at the latest and your personal data will be deleted if there is no other legal basis. Furthermore, before withdrawing your consent, you may request information about the possible consequences of this processing.
7. SPAIN
If you are located in Spain, the rights you have within the framework of the GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
8. SWITZERLAND
If you are located in Switzerland, since it is possible to exercise your rights regarding your personal data within the framework of the GDPR, you can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
9. LATVIA
If you are located in Latvia, the rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
10. LITHUANIA
If you are located in Lithuania, the rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
11. EGYPT
If you are in Egypt, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You may request information about your processed personal data and the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You may request to access or obtain your personal data.
1.3. Right to rectification: You may request rectification of your personal data.
1.4. Right to erasure: You can request the erasure of your personal data.
1.5. Right to object/withdraw: You have the right to object to the processing of your personal data or its consequences in any case where it conflicts with your fundamental rights and freedoms and to withdraw any consent you have given for the storage or processing of your personal data.
1.6. Right to restrict processing: You have the right to request that the purpose of processing your personal data be restricted to a specific scope.
12. POLAND
If you are located in Poland, the rights you have within the framework of the GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
13. ROMANIA
If you are in Romania, the rights you have within the framework of GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
* Differences in the application of the relevant Personal Data Protection Legislation regarding the use of the data subject rights in the GDPR will find priority application area.
14. THAILAND
If you are in Thailand, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You can request information about the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You have the right to access or request a copy of your personal data collected, used or transferred by the relevant Data Controller.
1.3. Right to rectification: You have the right to request correction of your personal data collected, used and transferred by the relevant Data Controller if they are incomplete, inaccurate, misleading or outdated.
1.4. Right to erasure: You have the right to request erasure or anonymization of your personal data that the Data Controller has collected, used and disclosed. However, you do not have the right to request erasure of your personal data where the Data Controller needs to retain such data to comply with a legal obligation or to establish, exercise or defend legal claims.
1.5. Right to object/ opt-out: You have the right to object to the collection, use and transfer of your personal data in a certain way, such as objecting to direct marketing.
1.6. Right to data portability: You have the right to obtain your personal data where the Data Controller organizes the personal data in a readable or commonly usable format through automated means or equipment and where it can be used or transferred by automated means. You also have the right to request the transfer of your personal data to another Data Controller where technically feasible.
1.7. Right to restrict processing: You have the right to restrict the use of your personal data in certain circumstances (e.g. when the retention of such personal data is no longer necessary, but you request that it be retained for the establishment, exercise or defense of legal claims or for the establishment, exercise or defense of legal claims).
15. TUNISIA
If you are in Tunisia, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You can request information about the purposes for which we process your personal data by contacting the relevant Data Controller.
1.2. Right of access: You, your heirs or executors have the right of access to all personal data concerning you and the right to have it corrected, supplemented, updated, amended, disclosed or erased where it is proven to be inaccurate, ambiguous or prohibited by law. The right of access also includes the right to receive a copy of your personal data in clear language, in a form appropriate to the content of the records and understandable in the case of automated processing.
1.3. Right to rectification: You have the right to rectification, completion, amendment, clarification, updating and erasure of personal data relating to you, your heirs or executors, where such data is inaccurate, incomplete or ambiguous.
1.4. Right to erasure: In the event that you, your heirs or your guardian understand that your personal data are inaccurate and you, your heirs or your guardian are notified of this fact, you have the right to request that they be corrected, completed, corrected, updated, amended or deleted on lawful grounds.
16. TURKEY
If you are located in Turkey, the rights you have within the framework of KVKK regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the KVKK and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
17. VIETNAM
If you are in Vietnam, you can exercise your rights below in accordance with the relevant Personal Data Protection Legislation regarding your personal data and our explanations in the Privacy Notice above, and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
In addition to our explanations above, you have the following rights in accordance with the relevant Personal Data Protection Legislation:
1.1. Right to be informed: You have the right to be informed about the method, scope, place and purposes of the collection, processing and use of your personal information.
1.2. Right of access: You have the right to access or view your personal data or to request its editing.
1.3. Right to rectification: You have the right to access or view your personal data or to request its rectification.
1.4. Right to erasure: You have the right to erase your personal data or to request the erasure of your personal data.
1.5. Right to object/exit: You have the right to object to or request the restriction of the processing of your personal data. In addition, you have the right to consent to the processing of your personal data or to withdraw your consent. Any processing of personal data that takes place before consent is withdrawn is lawful and valid.
1.6. Right to data portability: You have the right to request a copy of your personal data from the relevant Data Controller.
18. GREECE
If you are located in Greece, the rights you have within the framework of the GDPR regarding your personal data are included in the Privacy Notice above. You can exercise your rights in accordance with the GDPR and the relevant Personal Data Protection Legislation and our explanations above and you can contact the relevant Data Controller in Annex-5 in order to exercise your rights.
*
Differences in the application of the relevant Personal Data Protection
Legislation regarding the use of the rights of the data subject in the GDPR
will find priority application area.
ANNEX 5 CORAL TRAVEL GROUP COMPANIES
|
|
Title of Company |
Country |
Activity Area |
|
1 |
Coral Holding A.Ş. (Formerly Oti Holding A.Ş.) |
Turkey |
Holding Operations |
|
2 |
Odeon Tourism International Malta Limited |
Malta |
Tour Operator |
|
3 |
Coral Touristik GmbH |
Germany |
Tour Operator |
|
4 |
Coral Travel Lithuania |
Lithuania |
Tour Operator |
|
5 |
Odeon Inbound Greece Touristic M.E.P.E. |
Greece |
Travel Agency |
|
6 |
Odeon Inbound Spain S.L. |
Spain |
Travel Agency |
|
7 |
Odeon Travel & Tourism Co. LLC |
UAE |
Travel Agency |
|
8 |
Odeon Tours Egypt (S.A.E.) |
Egypt |
Travel Agency |
|
9 |
Coral Travel Poland Sp. Zoo. |
Poland |
Tour Operator |
|
10 |
Coral Travel Ltd. |
Georgia |
Travel Agency |
|
11 |
Odeon Turizm İşletmeciliği A.Ş. |
Turkey |
Travel Agency |
|
12 |
Odeon Yazılım ve Teknoloji A.Ş. |
Turkey |
Software Operations |
|
13 |
Coral Seyahat A.Ş. |
Turkey |
Tour Operator |
|
14 |
Otium Otelcilik Turizm Ticaret A.Ş. |
Turkey |
Accommodation |
|
15 |
Odeon Güvenlik Koruma ve Danışmanlık Hizmetleri A.Ş. |
Turkey |
Security |
|
16 |
Serenat Otel İşletmeciliği Turizm ve Ticaret A.Ş. |
Turkey |
Accommodation |
|
17 |
Odeonbeds DMCC |
UAE |
Tour Operator |
|
18 |
Coral Travel Estonia OÜ |
Estonia |
Tour Operator |
|
19 |
Coral Travel Latvia SIA |
Latvia |
Tour Operator |
|
20 |
Odeon Travel and Tourism LLC |
Vietnam |
Travel Agency |
|
21 |
Coral Travel S.r.o. |
Czechia |
Tour Operator |
|
22 |
Coral Travel & Tourism Services S.R.L |
Romania |
Tour Operator |
|
23 |
Coral Travel A.G. |
Switzerland |
Tour Operator |
|
24 |
Asia In Hand Co. Ltd. |
Thailand |
Travel Agency |
|
25 |
Odeon Tours and Travel Services SARL |
Tunisia |
Travel Agency |