GDPR / KVKK

This page describes how Travel Globus complies with the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law (KVKK No. 6698). It applies to all partner agencies and travellers whose data we process.

We are the controller for partner account and platform data. For traveller booking data processed on behalf of an agency, the agency is the controller and we act as a processor under a data-processing agreement.

Processing relies on contract performance, legitimate interests, legal obligation and, where applicable, explicit consent — mirrored under KVKK Articles 5 and 6.

• Access, rectification and erasure
• Restriction of and objection to processing
• Data portability
• Withdrawal of consent at any time
• The right to lodge a complaint with a supervisory authority (e.g. your EU DPA or the Turkish KVKK Authority)

Where data is transferred outside the EEA or Türkiye, we rely on appropriate safeguards such as Standard Contractual Clauses and adequacy decisions, with additional measures where needed.

We maintain a list of vetted sub-processors (hosting, email, payments, currency, analytics), each bound by data-processing agreements. The current list is available on request and updated when it changes.

In the event of a personal-data breach, we notify affected controllers without undue delay and, where required, the relevant supervisory authority within statutory timeframes (72 hours under GDPR).

Our Data Protection Officer oversees compliance for both GDPR and KVKK. Contact the DPO through our contact page.

Submit a request via the contact page. We verify identity and respond within the legal timeframe (one month under GDPR; 30 days under KVKK), free of charge in most cases.

This document is provided in several languages for convenience. In case of any discrepancy, the English version prevails.