Privacy Policy (GDPR & KVKK Compliant)
We process all personal information in accordance with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act, and the Turkish Personal Data Protection Law No. 6698 (“KVKK”), particularly with regard to data minimization, lawfulness of processing, transparency, data security, and accountability principles recognized under both EU and Turkish data protection frameworks.
Data Minimization – Article 5(1)(c) GDPR / KVKK Article
4(2)(ç)
“Personal data shall be adequate, relevant and limited to what is necessary in
relation to the purposes for which they are processed.”
Capavia adheres to the principle of data minimization by ensuring that only personal data strictly necessary for the planning, booking, coordination, and management of travel-related services is collected and processed. In line with KVKK’s proportionality and purpose-limitation principles, we do not request, process, or retain excessive, irrelevant, or unrelated personal information.
For example, when arranging flights, accommodation, or transportation, we collect only essential data such as passenger names, dates of birth, identification or passport details, contact information, and payment data where required. Data collection forms, booking tools, and operational workflows are periodically reviewed to eliminate unnecessary fields and prevent disproportionate data retention.
Lawfulness of Processing –
Article 6 GDPR / KVKK Articles 5 & 6
“Processing shall be lawful only if and to the extent that at least one of the
legal conditions is met.”
Capavia ensures that all personal data is processed lawfully, fairly, and transparently, relying on recognized legal bases under both GDPR and KVKK. These include:
• Explicit Consent: Where required (e.g., marketing
communications, special service preferences), we obtain clear, informed, and
freely given consent from data subjects.
• Contractual Necessity: The majority of processing activities are
necessary for the establishment or performance of a contract, such as booking
flights, hotels, or managing corporate travel programs.
• Legal Obligation: Certain data must be processed to comply with legal
and regulatory requirements, including taxation, financial reporting, aviation
security, and immigration regulations under applicable national and
international law.
• Legitimate Interest: In limited circumstances, data may be processed
to support legitimate business interests (e.g., service quality monitoring,
fraud prevention), provided that such interests do not override the fundamental
rights and freedoms of the data subject.
For special categories of personal data (if ever required), Capavia applies heightened protection measures and processes such data only under explicit consent or other lawful exemptions recognized under Article 9 GDPR and Article 6 KVKK.
Capavia evaluates and documents the legal basis applicable to each processing activity in accordance with accountability obligations.
Accountability – Article 5(2) GDPR / KVKK Article 12
“The controller shall be responsible for, and be able to demonstrate compliance.”
Capavia embraces the accountability principle by implementing a comprehensive internal data protection governance framework aligned with both GDPR and KVKK compliance requirements. This framework includes:
• Maintaining up-to-date records of personal data processing
activities
• Assigning internal data protection and privacy compliance coordinators
• Conducting periodic compliance audits and risk assessments
• Delivering data protection and confidentiality training to employees handling
personal data
• Implementing written data processing agreements with suppliers, partners, and
sub-processors containing GDPR- and KVKK-compliant clauses
• Establishing internal policies on data retention, destruction, anonymization,
and breach management
Capavia is prepared to demonstrate its compliance to competent supervisory authorities, including the Swedish Authority for Privacy Protection (IMY) and the Turkish Personal Data Protection Authority (KVKK Kurumu).
Records of Processing Activities – Article 30 GDPR / KVKK Article 16 (VERBIS Alignment)
“Each controller shall maintain a record of processing activities under its responsibility.”
Capavia maintains detailed and continuously updated Records of Processing Activities (RoPA) documenting how personal data is collected, processed, transferred, stored, and secured across its operations. Where required under Turkish law, Capavia also aligns its records with Data Controllers’ Registry (VERBIS) obligations.
These records include:
• The identity and contact details of Capavia as Data
Controller / Data Processor and designated data protection contact points
• The purposes of each processing activity (e.g., flight reservations, hotel
bookings, event logistics, reporting)
• Categories of data subjects (e.g., corporate clients’ employees, business
travelers, event participants) and categories of personal data processed
• Recipient groups to whom data is disclosed, including airlines, hotels, DMCs,
and technology providers
• Details of international data transfers and implemented safeguards (e.g.,
Standard Contractual Clauses, adequacy decisions, contractual undertakings)
• General descriptions of technical and organizational security measures
implemented under GDPR Article 32 and KVKK Article 12
These records are maintained in written and/or electronic form, updated regularly, and made available to competent supervisory authorities upon lawful request as part of Capavia’s transparency and compliance commitment.
Capavia operationalizes these principles by collecting only the personal data necessary to deliver travel services, ensuring that all processing activities rely on valid legal grounds, implementing strong data security safeguards, and maintaining comprehensive processing records in line with GDPR and KVKK obligations.
Identity Information
Data containing information about the person's identity; name and surname, Turkish ID number, nationality information, place of birth, date of birth, gender, workplace information, registration number, tax number, title, biography, etc., as well as documents such as driver's license, professional ID, identity card, and passport.
Contact Information
Phone number, address, email, fax number
Location Data
Information identifying the location of employees of institutions we collaborate with in relation to emergency procedures
Family Members and Close Relatives Information
Information about the family members and close relatives of the personal data owner within the scope of our company's operations and in relation to the products and services we offer, or for the purpose of protecting the legal and other interests of the Company and the data owner
Customer Information
Data obtained about the customer during the course of our commercial activities
Customer Transaction Information
This refers to records related to the use of our products and services, as well as information such as our customers' instructions and requests regarding the use of our products and services.
Physical Premises Security Information
Personal data related to records and documents obtained upon entry to the physical premises and during stay within the physical premises; camera recordings, vehicle information records, and records obtained at security points, etc.
Transaction Security Information
Personal data processed to ensure our technical, administrative, legal, and commercial security during the execution of our activities (e.g., log records, IP information, identity verification information)
Financial Information
Personal data processed in relation to information, documents, and records showing any financial results generated according to the type of legal relationship established between our company and the personal data owner, as well as data such as bank account number, IBAN number, income information, debt/credit information.
Job Applicant Information
Resume information of our job applicants and/or employee and/or intern candidates who have applied to our company in any way
Special Category Personal Data
Data related to individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, attire, membership in associations, foundations, or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data
Request/Complaint Management Information
Personal data related to the receipt and evaluation of any requests or complaints directed to our company
Visual and Audio Data
Photographs and camera recordings (excluding recordings falling under Physical Premises Security Information) and audio recordings
Audit and Inspection Information
Personal data processed in relation to the execution of our company's operational, financial, fraud, and compliance audit activities
Legal Proceedings and Compliance
Personal data processed for the identification and tracking of our legal claims and rights, the fulfillment of our obligations, and compliance with our legal obligations and company policies
Transaction Information
Survey information, declaration information, purchase information, call center records, membership information, cookie records, and other data processed within the scope of activities carried out by our company, in relation to the products or services offered, or for the purpose of protecting the legal and other interests of the company and the personal data owner
-------------------------------------------------------------------------------------------------------------------------------
PERSONAL DATA APPLICATION FORM
Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), personal data subjects have the right to be informed about their personal data, to access such data, to learn whether it is used in line with its purpose, and to request its correction or deletion.
In accordance with Article 13/1 of the KVKK, applications regarding these rights must be submitted in writing to the data controller, Cap Havacılık Denizcilik Turizm Sanayi ve Ticaret Limited Şirketi (hereinafter referred to as “Capavia”), via this Personal Data Subject Application Form or through other methods determined by the Personal Data Protection Board (“Board”).
1. APPLICATION METHODS
Written applications to Capavia may be submitted using the printed version of this form through the following channels:
☐ Personal application by the applicant
☐ Submission via postal mail
☐ Notification through a notary public
☐ Submission to our Registered Electronic Mail (KEP) address signed with a secure electronic signature under Law No. 5070
☐ Submission via the e-mail address previously notified to and registered in our systems
Contact Information:
Cap Havacılık Denizcilik Turizm Sanayi ve Ticaret Limited Şirketi
Yeşilbahçe Mah. Portakal Çiçeği Blvd. Rabia Hanım Sitesi No:32/B
Muratpaşa / Antalya – Türkiye
E-mail: info@Capavia.com.tr
2. APPLICANT INFORMATION
Please complete the fields below in full:
Full Name :
Turkish ID Number / Passport No :
Address :
Mobile Phone :
E-mail Address :
Relationship With Capavia
☐ Visitor
☐ Customer
☐ Employee
☐ Employee of Business Partners
☐ Third Party
☐ Other :
Nature of Your Relationship :
Relationship Status :
☐ Ongoing
☐ Terminated
3. SUBJECT OF REQUEST
Within the scope of Article 11 of the KVKK, you may request:
☐ To learn whether my personal data is processed
☐ To request information if processed
☐ To learn the purpose of processing
☐ To learn whether it is used in line with its purpose
☐ To learn third parties to whom data is transferred
☐ To request correction of incomplete/incorrect data
☐ To request deletion/destruction of data
☐ To request notification to third parties
☐ To object to automated decision-making
☐ To request compensation for damages
Please Describe Your Request in Detail
4. APPLICANT DECLARATION
In line with the requests stated above, I kindly request that my application be evaluated and that I be informed accordingly.
I hereby declare and undertake that the information and documents I have provided are accurate, up to date, and belong to me. I consent to the processing of my personal data submitted within this form solely for the purposes of evaluating and responding to my application, delivering the response to me, and verifying my identity and address by Capavia.
5. RESPONSE PREFERENCE
I request that the response be delivered to me via:
☐ My postal address stated in the form
☐ My e-mail address stated in the form
☐ Hand delivery
(In case of proxy collection, a notarized power of attorney is required.)
6. RESPONSE PERIOD
Applications will be concluded as soon as possible and within 30 days at the latest in accordance with Article 13 of the KVKK. Responses will be delivered in written or electronic form.
Written responses up to 10 pages are free of charge. An administrative fee may be charged for each additional page in accordance with applicable legislation.
7. RIGHT TO COMPLAIN TO THE BOARD
If your application is rejected, the response is found insufficient, or no response is provided within the legal period, you may file a complaint with the Personal Data Protection Board within 30 days from learning the response and in any case within 60 days from the application date.
8. OTHER MATTERS
Capavia may request additional information/documents for identity verification.
You may be contacted to clarify your application.
Applications must be submitted personally by the data subject.
9. APPLICANT
Full Name :
Contact Information :
Application Date :
Signature :
Important Note:
Applications must be made personally by the data subject. Applications on behalf of spouses, children, or relatives are not accepted. A copy of your ID must be attached. Capavia does not accept liability for requests arising from false/incomplete information or unauthorized applications.
-------------------------------------------------------------------------------------------------------------------------------
As Capavia.com.tr, we respect your personal privacy rights and make every effort to ensure this during the time you spend on our website. Explanations regarding the security of your personal information are provided below for your information.
SSL and 3D Secure Systems
Your personal information used on Capavia.com.tr is protected. The information you provide while completing membership and order transactions is secured with the SSL security system. Your credit card information is never stored in our system. Member information is carefully protected against third-party intervention.
Information regarding your purchases made through the Capavia.com.tr website is never shared with other institutions or organizations. Only you can view and modify the information stored in our system. Third parties cannot access or alter your data.
Member information may only be disclosed to official authorities when such information is duly requested in accordance with legal procedures and where disclosure is mandatory under applicable legislation.
During payment, the credit card information you enter is processed through the 3D Secure system directly between you and your bank. Your credit card details are not stored or recorded by Capavia.com.tr.
Mandatory fields completed during registration are retained solely to provide you with better service for your transactions on www.Capavia.com.tr.
Log Files
As with many standard web servers, Capavia.com.tr keeps log files for statistical purposes. These files may include standard information such as your IP address, internet service provider, browser features, operating system, and site entry/exit pages.
Log files are used strictly for statistical purposes and do not violate your privacy. Your IP address and other data are not associated with your personal information.
Cookies
The term “cookie” refers to a small text file placed on your computer’s hard drive by a web page server.
Cookies may be used in certain sections of our site to enhance user convenience. Additionally, cookies and web beacons may be used via advertisements on the site to collect advertising data. This occurs entirely with your consent, and you may prevent it by changing your internet browser settings if you wish.
External Links
The Capavia.com.tr website may provide links to different internet addresses from its pages.
Capavia.com.tr is not responsible for the content or privacy practices of the sites it links to or promotes via banners. Linking is legally considered a form of reference.
Contact
For any questions, opinions, or comments regarding the privacy policy applied on Capavia.com.tr, you may contact us at: