Explicit Consent Statement (GDPR & KVKK Compliant)

1. Data Controller Identification

In accordance with the EU General Data Protection Regulation (“GDPR”) and the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data may be processed by Cap Havacılık Denizcilik Turizm Sanayi ve Ticaret Ltd. Şti. (“Capavia” or “the Company”), acting in the capacity of Data Controller, within the scope described below.

Registered Address: Portakal Çiçeği Bulv. No:32/B Muratpaşa, Antalya, Türkiye
Phone: 444 0 977 / +90 242 322 82 85
Email: info@Capavia.com.tr

2. Scope of Personal Data Subject to Explicit Consent

Subject to your explicit consent where legally required, Capavia may process the following categories of personal data:

• Identity information (name, surname, date of birth, passport/ID details)
• Contact information (email address, phone number, company details)
• Travel information (flight, hotel, visa, itinerary, loyalty program data)
• Financial and billing information (payment data, invoicing details)
• Corporate affiliation and employment data (company, title, department)
• Marketing and communication preferences
• Special service requests (meal preferences, accessibility needs, where voluntarily provided)

Special categories of personal data (if shared), such as health or accessibility information necessary for travel arrangements, will be processed only upon separate and explicit consent where required by law.

3. Purposes of Processing Requiring Explicit Consent

Your personal data may be processed, upon your explicit consent, for the following purposes:

• Execution and management of corporate travel, accommodation, transportation, and event services
• Creation and management of traveler profiles and booking records
• Communication regarding reservations, itinerary updates, and operational notifications
• Provision of customer support and traveler assistance services
• Financial processing, invoicing, and reporting
• Sending marketing communications, newsletters, campaigns, and service announcements
• Conducting customer satisfaction surveys and service quality assessments
• Improving digital platforms, booking tools, and user experience

Where processing is based on contractual necessity or legal obligation, explicit consent may not be required; however, Capavia will always rely on consent where mandated under GDPR or KVKK.

4. Transfer of Personal Data

Subject to your explicit consent where required, personal data may be transferred domestically or internationally to:

• Airlines, air charter operators, and aviation authorities
• Hotels, accommodation providers, and destination management companies
• Ground transportation and transfer providers
• Event venues and event service partners
• Visa processing and immigration service providers
• Technology infrastructure and reservation system providers (GDS, booking tools)
• Financial institutions and payment processors
• Authorized public authorities where legally required

International transfers will be conducted in compliance with GDPR Chapter V and KVKK cross-border data transfer provisions, using appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or explicit consent where necessary.

5. Method and Legal Basis of Data Collection

Personal data is collected through digital platforms, booking systems, corporate agreements, email communications, call centers, mobile applications, and physical documentation channels.

Processing activities are carried out based on:

• Explicit consent
• Contractual necessity
• Legal obligations
• Legitimate business interests (where applicable and proportionate)

6. Data Subject Rights

Under GDPR (Articles 12–23) and KVKK (Article 11), you have the right to:

• Learn whether your personal data is processed
• Request information regarding processing activities
• Learn the purpose of processing and whether data is used accordingly
• Know third parties to whom data is transferred
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of data where legal conditions are met
• Object to processing results produced solely by automated systems
• Claim compensation for damages arising from unlawful processing

Requests may be submitted via email to info@Capavia.com.tr in accordance with applicable data subject request procedures.

7. Retention and Destruction

Personal data processed based on explicit consent will be retained for the duration necessary to fulfill the stated purposes and in line with statutory retention periods under Turkish and EU legislation. Upon expiry, data will be deleted, destroyed, or anonymized in accordance with Capavia’s Data Retention and Destruction Policy.

8. Consent Declaration

By approving this Explicit Consent Statement, you acknowledge and declare that:

• You have been informed about the processing of your personal data in a clear and transparent manner.
• You understand the purposes, scope, legal basis, and transfer conditions of processing.
• You freely consent to the processing and transfer of your personal data as described above.
• You are aware that you may withdraw your consent at any time without affecting the lawfulness of prior processing activities.

Your consent may be withdrawn by contacting Capavia via the communication channels listed above.