White Deck takes the protection of your personal data very seriously. In this Protection of Personal Data Announcement, we inform you about which personal data of yours we process:
(i) When you use our website (see in particular Section 2.1.),
(ii) If you purchase a ticket from us (see Section 2.2.).
1. Controller
Below, we, as the controller (Art. 4(7) GDPR, Art. 3(1) (ı) KVKK),
White Deck (İstanbul Havalimanı | Tayakadın Mah. Terminal Binası Gelen Yolcu Katı Arnavutköy, İstanbul)
(hereinafter also referred to as White Deck, „we“, „us“, „our“), inform you about the processing of your personal data (Art. 4(2) GDPR, Art. 3(1) (e) KVKK) in connection with the sale of our products and services as well as the use of our website https://www.istanbulshuttleport.com („website“).
Your privacy matters to White Deck as much as it matters to you. Thus, we aim to inform you about White Deck’ purposes of processing and manner in which your personal data is processed and to whom White Deck transfers your personal data. Your personal data you share with White Deck via our website and other electronic communication and sale channels will be processed in accordance with this information.
2. Scope, Purpose and Legal Basis of the Processing of Personal Data
The processing of your personal data is performed in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), the EU General Data Protection Regulation (Reg. EU 2016/679) (“GDPR”) and the German laws (especially BDSG 2018), if applicable, (“Data Protection Legislation”).
In the following situations, we collect and use personal data directly from our users or from other sources (as presented below):
2.1. On our website
2.1.1. Delivery of the Website and Creation of Log Files
Every time you as a user access our website, our system automatically records data and information from the requesting computer system. In this context, the following data („technical information“) are collected:
(1) Information on the browser type and version,
(2) The user’s operating system,
(3) The user’s internet service provider,
(4) The user’s IP address,
(5) Date and time of the access,
(6) Websites from which the user’s system accesses our website,
(7) Websites that are accessed by the user’s system via our website.
The data are also saved to our system’s log files. Such data will not be stored together with other personal data of the user.
In this context, we collect and use this technical information for purposes related to (network) security (e.g. to be able to combat cyber-attacks), marketing, to gain a better understanding of our users‘ needs, to continually improve our website and to enable the delivery of the website to the respective user’s computer.
The purpose of storage in log files is to ensure the operability of the website. Moreover, we use the data to optimise the website and to ensure the security of our information technology systems. In this context, the data is not analysed for any marketing purposes.
The legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) GDPR.
2.1.2. Use of Cookies
Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be saved to the user’s operating system. This cookie contains a specific character sequence that enables unique identification of the browser when the website is accessed again.
Cookies are stored on the user’s computer, from where they are transmitted to us. You as the user have full control over the use of cookies. You can deactivate or limit the transmission of cookies by changing the settings of your web browser. Previously stored cookies can be deleted whenever you wish. This can even take place automatically. If cookies are deactivated for our website, it might no longer be possible to fully use all functions of the website.
For further information on the cookies we use, their purpose and legal basis, please refer to our Cookie Policy.
2.1.3. Use of the Services Offered on Our Website
On our website, we offer various services and applications. To render these, we need to collect and process personal data of the user or of our customer.
White Deck may use your personal data for the following purposes:
• Supporting you throughout the transactions you perform on our website via Live Chat,
• Sending you the newsletter (see Section 2.1.4.) and commercial messages through the communication channels you have chosen,
• Contacting you with regard to market research and customer satisfaction studies through the communication channels you have chosen, analysing these research and study results, using such results for statistical studies,
• Sending direct-mailings, newsletters and personalized offers with regard to the Loyalty Programme which may be carried out from time to time,
• Transferring your personal data abroad in compliance with KVKK in order to be able to offer you our products and services on the basis of our contractual obligations or under consideration of our legitimate interests, and to fulfil our obligations arising from public and flight safety rules or airline regulations in the countries in which the travel occurs,
• Making you personalized offers, including personalized use of the website and profiling,
• Supporting you in the use of the website, with reminder features,
based on your given consent according to Art. 6(1) (a) GDPR, Art. 5(1) KVKK;
• Providing you with requested offers and services,
• Administering the Loyalty Programme which may be carried out from time to time,
• Ensuring that members of the Loyalty Programme which may be carried out from time to time can set up and manage their accounts effectively,
• Rewarding members of the Loyalty Programme which may be carried out from time to time with free flights, BonusPoints, and flights and extra White Deck services which can be paid with issued BonusPoints,
based on a contractual obligation according to Art. 6(1) (b) GDPR, Art. 5(2) (c) KVKK;
• Providing special flight and service offers,
• Creating, listing, reporting, verifying, analysing and evaluating databases, producing statistical information,
• Analysing how you use our website and other communication and sales channels, making your communication channels unique to you for better service, contacting you through the communication channels that you have shared directly with us or through the service providers,
• Investigating and improving our products and services and your personal choice possibilities related to these, promoting our services or related products, maintaining promotional commercial communication about new products, providing special flight offers, advantageous flight change offers and other information that you may find interesting,
• The provision of flight safety and security, the protection of life or property of White Deck, White Deck employees, White Deck service providers and their employees or White Deck guests,
• The prevention of fraud, the performance of internal audits, the establishment of security as well as the management of legal and other claims;
based on our legitimate interests according to Art. 6(1) (f) GDPR, Art. 5(2) (f) KVKK; and
• The fulfilment of legal obligations including compliance with the rules to which White Deck is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in White Deck;
based on the legal obligations according to Art. 6(1) (c) GDPR, Art. 5(2) (a), Art. 5(2) (ç) KVKK.
For these purposes, we may collect the following data types from you:
• Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information,
• Identification and passport information,
• Ticket and flight booking details,
• Information about billing and payment instruments,
• Your product order information,
• Your personal interests,
• Information that you have communicated to us in the context of your requests and complaints about our products and services,
• Information about your use of our website and other communication channels,
• Your preferences for our products or services or your past choices.
2.1.4. Newsletter
On our website, you can subscribe to a free newsletter. To that end, we collect and process the e-mail address that you have filled in on the web page. Additionally, the following data are collected during the subscription:
(1) The IP address of the requesting computer
(2) Date and time of the registration
During the subscription process, your consent to the processing of data will be obtained, and reference will be made to this announcement.
If you enter your e-mail address in order to receive a newsletter from our website, the e-mail address may subsequently be used for the transmission of a newsletter. In such a case, the newsletter will contain direct advertising for goods and services of White Deck Travel, its affiliates and business partners.
In connection with the data processing for the dispatch of the newsletter, no data will be transferred to third parties. The data will be used exclusively for sending the newsletter.
The legal basis for the processing of data after the user’s subscription to the newsletter with consent is Art. 6(1) (a) GDPR and Art. 5(1) KVKK.
2.2. Processing for ticket sales
If you buy a flight ticket from us (via the website or through one of our agency partners), we process your personal data for the following purposes:
• Better meet your travel needs,
based on a contractual obligation according to Art. 6(1) (b) GDPR, Art. 5(2) (c) KVKK;
• Also, the purposes stated in Section 2.1.3. above,
based on our legitimate interests according to Art. 6(1) (f) GDPR, Art. 5(2) (f) KVKK.
For these purposes, we may collect the following data types from you:
• Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information,
• Identification and passport information,
• Ticket and flight booking details,
• Information about billing and payment instruments,
• Your product order information,
• Your personal interests,
• Information that you have communicated to us in the context of your requests and complaints about our products and services,
• Information about your use of our website and other communication channels,
• Your preferences for our products or services or your past choices.
2.3. Our Legitimate Interests in the Processing of Personal Data
If Art. 6(1) (f) GDPR is the legal basis for the processing of data, our legitimate interests include the following points apart from the purposes listed above:
• Protection of the company against property and non-property damages
• Professionalization and improvement (of our products and services)
• Cost optimisation (control and minimisation)
2.4. Other Processing Obligations
If we are required by law to do so, we may process your personal data e.g. in order to comply with retention obligations under commercial or tax law or to meet requirements under security law. For further information on retention periods, please see Section „Duration of the Data Processing“.
2.5. The Obligation to Specify Personal Data
According to mandatory legal or contractual requirements, we have indicated the mandatory fields that need to be filled in on our website so that we can perform the contract or service you request.
3. Duration of the Data Processing
Your personal data will be erased as soon as they are no longer needed for the mentioned purposes. Personal data may be retained for the period during which legal claims may be brought against White Deck (the limitation period). Additionally, the personal data will be stored insofar as and for as long as White Deck is required to do so by law. The obligations of documentation and retention arise from the local commercial, tax and anti-money laundering laws. These retention periods may be up to 30 years.
4. Transfer of Personal Data to Third Parties
In order to be able to offer you our products and services on the basis of our contractual obligations or under consideration of our legitimate interests or to fulfil our obligations arising from public and flight safety rules or airline regulations in the countries in which the travel occurs, we may need to transfer your personal data to third parties in or outside White Deck. These recipients can be categorised as follows:
White Deck affiliates,
Service providers,
Transport
Marketing
Information Technologies
Payment services
Credit agencies
Customer Feedback Services
Governmental authorities.
5. Your Rights as the Data Subject
Under Law No. 6698 on the Protection of Personal Data, you have the rights listed below:
(a) Learn whether or not your personal data has been processed,
(b) Request information as to the processing if your personal data has been processed,
(c) Learn the purpose of processing your personal data and whether such data is used in accordance with this purpose,
(ç) Know the third parties in the country or abroad to whom your personal data has been transferred,
(d) Request rectification in case your personal data is processed incompletely or inaccurately,
(e) Request deletion or anonymization of your personal data provided that the purposes for processing your personal data have disappeared,
(f) Request notification of the transactions mentioned in points (d) and (e) to the third parties to whom your personal data has been transferred,
(g) Object to any result against you that has emerged from the analysis of your personal data exclusively through automated systems,
(ğ) Claim damages if you have suffered any damages due to the unlawful processing of your personal data.
You may send your requests regarding your rights above by applying in writing to our postal address in Section 1. above or sending an e-mail to [[email protected]] from the e-mail address which is previously notified by you and registered in the White Deck system.
The information which is mandatory to be included in the application are;
(a) Name, surname and if the application is made in writing, the signature,
(b) Turkish I.D number or nationality along with passport number or foreign identity number, if any,
(c) Residential or work address for notification,
(d) E-mail address, telephone and fax number for notification, if any,
(e) The subject of the request.
Your application will be finalized as soon as possible (according to the nature of the request) and at the latest in 30 days. If the response is in writing, 1 Turkish Lira processing fee may be charged for each page above 10 pages. If the response is given through a data recorder (such as CD, flash memory) then you may be charged the cost of the data recorder as a maximum price.
If your application is not answered at all or in time or the response is found insufficient, you may file a complaint with the Personal Data Protection Board (Art. 14 and 15 KVKK).
Kişisel Verileri Koruma Kurulu
Address : Nasuh Akar Mah. Ziyabey Cad. 1407 Sok. No: 4 06520 Balgat-Çankaya/Ankara, Turkey
Telephone : +90 312 216 5050
Website : http://www.kvkk.gov.tr
6. Consent
If you have given us your consent to process your personal data, we hereby inform you that you can withdraw this consent whenever you wish.
If you have given your consent on this website, please visit the web page, on which you originally gave your consent or log in to your registered account in order to withdraw your consent in the settings.
If you have given your consent for the newsletter, you can withdraw it by clicking the „Unsubscribe“ link directly in the newsletter.
In all other cases or if you have any difficulties with withdrawing your consent on this website, please feel free to contact [[email protected]].
Please note that your withdrawal of consent is only effective for the future and does not affect the legality of data processing that has taken place in the past. In some cases, we may be entitled to continue to process your personal data despite your withdrawal of consent on a different legal basis, e.g. to perform a contract.
7. Information Regarding Commercial Electronic Messages
According to the Law No. 6563 on the Regulation of Electronic Commerce, if you have given your communication consent for commercial electronic messages during booking and through any White Deck channels, you will be deemed to have accepted to receive commercial electronic messages about the promotion of products and services offered by White Deck, its affiliates and business partners, new products and services, special flight offers, information about your travel or any other information you may find interesting via your contact information you have chosen.
You can change your communication preferences at any time by following the links in your messages and stop the transmission of such messages through some or all communication channels.
8. Disclaimer and Limits of This Protection of Personal Data Announcement
This Protection of Personal Data Announcement merely applies to the website of “https://www.istanbulshuttleport.com”. Other websites are not covered by this Protection of Personal Data Announcement and have their own privacy policies.
9. Additional Information for the Users from the European Union
This Section applies only if people from a Member State of the European Union use services provided by White Deck.
9.1. International Transfers of Personal Data
Personal data may be transferred to third countries or international organisations. For your protection and the protection of your personal data, such data transfers are subject to appropriate safeguards pursuant to and in accordance with the statutory requirements (especially the application of EU standard contractual clauses), or an adequacy decision issued by the EU Commission (Art. 45 GDPR).
For information on EU standard contractual clauses, refer to [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF]. The EU Commission provides information about its adequacy decisions under the link: [https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en#dataprotectionincountriesoutsidetheeu].
You can request a copy of the applied security measures from [[email protected]].
Moreover, we are under the statutory obligation to provide personal data to German and international authorities (Art. 6(1) (c) GDPR as well as local and international regulations and treaties).
9.2. Right to Object according to Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
9.3. Your Rights as the Data Subject
Under the EU General Data Protection Regulation (Reg. EU 2016/679) and German laws (especially BDSG 2018), if applicable, you have the rights below:
• Right of access
• Right to rectification
• Right to erasure („right to be forgotten“)
• Right to the restriction of processing
• Right to data portability
• Right to object as above (see Section 9.2.)
To exercise your rights, you can write an e-mail to [[email protected]]. Please note that we will process your personal data based on the legal obligations in order to be able to process your request and for identification purposes.