Personal Data Protection Notice (KVKK)

1. Data controller

FLYNEST TURİZM VE YAZILIM SANAYİ TİCARET LİMİTED ŞİRKETİ (“FlyNest”), registered with the Istanbul Chamber of Commerce under registry no. 1164324, MERSIS no. 0388201590600001, located at Barbaros Hayrettin Paşa Mah. 1995. Sk. Akros İstanbul No: 1-3, İç Kapı No: 45, Esenyurt / İstanbul, Türkiye. E-mail: [email protected].

2. Personal data we process

• Identity data: name and surname; for travellers, passport or ID details where required for travel services.
• Contact data: e-mail address, telephone number, company address.
• Professional data: company name, title, country, travel licence and trade registry details of partners.
• Customer transaction data: enquiries, quotations, contracts, bookings, rooming lists, vouchers, invoices and payment records.
• Travel data: flight details, arrival and departure times, accommodation and service preferences.
• Transaction security data: IP address, log records and access data of the website and the Nestigo portal.
• Marketing data: communication preferences, only where explicit consent is given.
• Special categories of personal data (such as health information relevant to dietary or accessibility needs) are processed only where strictly necessary and in accordance with Article 6 of KVKK.

3. Purposes of processing

• Responding to enquiries submitted through the website, e-mail, telephone or messaging channels.
• Establishing and performing contracts with tour operators, agencies, hotels and other business partners.
• Planning and operating travel services: accommodation, transfers, excursions, guiding, events and flights.
• Opening and managing Nestigo partner accounts and Wingstack customer accounts.
• Carrying out finance, accounting, invoicing and collection processes.
• Fulfilling legal obligations, including tourism, tax, commercial and internet legislation.
• Ensuring information and transaction security, and preventing misuse.
• Sending commercial electronic messages and marketing communications, only with explicit consent.

4. Legal grounds and methods of collection

Personal data is collected by automated and partially automated means through the website, contact forms, e-mail, telephone, WhatsApp, the Nestigo portal, contracts, trade fairs and events, and — for traveller data — through the travel agencies and tour operators that book with us.

Data is processed on the legal grounds set out in Article 5(2) of KVKK: processing is necessary for the establishment or performance of a contract (c); necessary for compliance with a legal obligation (ç); necessary for the establishment, exercise or protection of a right (e); and necessary for our legitimate interests, provided this does not harm the fundamental rights and freedoms of the data subject (f). Marketing communications rely on explicit consent under Article 5(1).

5. Transfer of personal data

Personal data may be transferred, within the purposes above and in line with Articles 8 and 9 of KVKK, to: hotels, transport companies, guides, airlines and other suppliers that deliver the booked services; business partners and travel agencies involved in the booking; accounting, legal and audit advisors; IT, hosting and e-mail service providers; and authorised public institutions and organisations when legally required.

Where a service is delivered abroad or a partner is located abroad, data may be transferred outside Türkiye on the bases provided in Article 9 of KVKK, including where the transfer is necessary for the performance of a contract with the data subject, or subject to appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority.

6. Retention

Personal data is kept for as long as required by the applicable legislation and the purposes of processing, and is then deleted, destroyed or anonymised in accordance with our retention and destruction procedures.

7. Your rights under Article 11 of KVKK

• To learn whether your personal data is processed.
• To request information about the processing if it has been processed.
• To learn the purpose of processing and whether data is used in line with that purpose.
• To know the third parties, in Türkiye or abroad, to whom data is transferred.
• To request correction of incomplete or inaccurate data.
• To request deletion or destruction of data under the conditions of Article 7 of KVKK.
• To request that corrections, deletions or destructions be notified to third parties to whom data was transferred.
• To object to a result against you arising from analysis exclusively by automated systems.
• To claim compensation for damages arising from unlawful processing.

8. How to apply

You may submit your requests in writing to the address above, by registered electronic mail (KEP), or by e-mail to [email protected] from an e-mail address previously notified to us, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Your application must include your name and surname, signature (for written applications), T.R. identity number — or, for foreign nationals, nationality and passport number — your residential or business address for notifications, e-mail address or telephone number, and the subject of your request.

Applications are answered free of charge within 30 days at the latest. If the response requires an additional cost, the fee set by the Personal Data Protection Board may be charged.