İçeriğe atla

Data Processing Agreement (DPA)

Capavia processes personal data on behalf of its corporate clients in accordance with Article 28 of the EU General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”), both of which require that a written contract be in place between the data controller and the data processor (data handler).

Under Article 28 GDPR and the corresponding provisions of KVKK, a data processing agreement must:

  • Specify the subject matter and duration of processing
  • Outline the nature and purpose of the processing
  • Define the type of personal data and categories of data subjects
  • Set out the obligations and rights of the data controller

Capavia’s DPA ensures that:

  • Personal data is processed only on documented instructions from the controller (GDPR Article 28(3)(a); KVKK Article 12)
  • Persons authorized to process the data are subject to confidentiality obligations (GDPR Article 28(3)(b))
  • Appropriate technical and organizational security measures are implemented (GDPR Article 28(3)(c); KVKK Article 12)
  • The controller is assisted in fulfilling its data protection obligations (GDPR Article 28(3)(f))

——————————————————————————————————————————

Data Processing Agreement (DPA)

This Data Processing Agreement (the “Agreement”) is entered into between the Customer (the “Data Controller”) and Cap Havacılık Denizcilik Turizm Sanayi ve Ticaret Ltd. Şti., a company duly incorporated under the laws of the Republic of Türkiye, with its registered address at Portakal Çiçeği Bulv. No:32/B Muratpaşa, Antalya, Türkiye (the “Data Processor”), collectively referred to as the “Parties.”

This Agreement governs the processing of personal data by Capavia on behalf of the Data Controller in accordance with the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK), and applicable secondary legislation.

In accordance with GDPR Article 28 and KVKK data processing provisions, a written contract is required whenever a data controller engages a data processor. Such contract must stipulate the subject matter and duration of processing, the nature and purpose of processing, the categories of personal data, the categories of data subjects, and the obligations and rights of the controller.

Capavia, acting as Data Processor, agrees to:

  • Process personal data only on documented instructions from the Data Controller;
  • Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under statutory confidentiality obligations;
  • Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk;
  • Assist the Data Controller in responding to requests from data subjects exercising their rights under GDPR and KVKK;
  • Make available all information necessary to demonstrate compliance with processor obligations;
  • Delete or return all personal data to the Data Controller upon termination of services, unless retention is required under applicable law.

——————————————————————————————————————————

Security and Confidentiality

Capavia shall maintain the confidentiality of all personal data processed under this Agreement and shall ensure that appropriate technical and organizational measures are implemented to protect such data in compliance with GDPR Article 32 and KVKK Article 12, including safeguards against unauthorized access, loss, alteration, or unlawful disclosure.

Sub-processors

Capavia shall not engage another processor (sub-processor) without prior written authorization of the Data Controller. In the case of general written authorization, Capavia shall inform the Data Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Controller the opportunity to object.

All approved sub-processors shall be contractually bound by data protection obligations equivalent to those set forth in this Agreement and required under GDPR and KVKK, including cross-border data transfer safeguards where applicable.

Data Subject Rights

Capavia shall, insofar as legally and technically feasible, assist the Data Controller in fulfilling its obligation to respond to requests for exercising data subject rights as set out in GDPR Chapter III and KVKK Article 11, including rights of access, rectification, erasure, restriction, objection, and data portability where applicable.

Termination and Deletion

Upon termination or expiry of the Agreement, Capavia shall, at the choice of the Data Controller, delete or return all personal data and securely delete existing copies, unless retention of such data is required by European Union law, Turkish law, or other applicable regulatory obligations.

Article 28 – Processor

“Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organizational measures…”

Capavia acts as a data processor on behalf of its corporate clients and complies fully with the requirements set out in Article 28 of the GDPR and relevant provisions of KVKK. This includes executing written Data Processing Agreements (DPAs) with each client, clearly defining the roles, responsibilities, and scope of processing activities.

In accordance with Article 28(3), each DPA executed by Capavia ensures that:

• Personal data is processed only on documented instructions from the controller
• Personnel involved in processing are bound by confidentiality obligations
• Technical and organizational measures are implemented to ensure data security
• Sub-processors are engaged only with prior authorization and are bound by equivalent obligations
• The processor assists the controller in ensuring compliance with obligations under GDPR Articles 32–36 and KVKK breach notification and compliance requirements
• At the end of the provision of services, all personal data is either returned or securely deleted

Capavia also maintains and regularly updates a register of approved sub-processors and ensures that all third-party vendors provide equivalent levels of data protection and regulatory compliance.

Article 32 – Security of Processing

“Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing… the controller and the processor shall implement appropriate technical and organizational measures…”

Capavia is committed to safeguarding personal data through the implementation of advanced technical and organizational security controls in line with GDPR Article 32 and KVKK data security obligations.

These measures include, but are not limited to:

• Data encryption at rest and in transit using industry-standard cryptographic protocols
• Access controls based on least-privilege principles and multi-factor authentication for critical systems
• Regular security audits and vulnerability assessments
• Secure software development and vendor integration practices
• Incident response and breach notification procedures compliant with GDPR and KVKK timelines
• Employee training on data protection, confidentiality, and secure data handling

Capavia continuously monitors, reviews, and enhances its security framework in alignment with evolving cyber threats, regulatory developments, and industry best practices, ensuring that client and traveler personal data is processed with the highest standards of integrity, confidentiality, and protection.

EN English
SELECT LANGUAGE