1. Parties and status
This Data Processing Addendum ("DPA") is offered to travel-agency customers ("Customer") of the Turleno platform. It is between the Customer and Turleno, which is operated by Fikret Burak Gazioğlu, a sole proprietorship established in Türkiye, Gülbahar Mah. Cemal Sururi Sk. No: 15 E İç Kapı No: 15, Şişli / İstanbul, Türkiye ("Turleno").
This page publishes a draft form of the addendum. The terms that bind a particular Customer are those agreed with that Customer in writing or through the Platform's acceptance process.
2. Relationship to the master agreement
This DPA supplements the agreement under which Turleno provides the Platform to the Customer (the "Master Agreement"), including the Terms of Service. If this DPA conflicts with the Master Agreement on the processing of personal data, this DPA prevails on that subject.
3. Scope
This DPA applies to personal data that Turleno processes on behalf of the Customer, or on behalf of the Customer's corporate customers, when providing the Platform. It does not apply to personal data that Turleno processes for its own purposes, which is described in the Privacy Policy.
4. Roles of the parties
The roles depend on the processing activity. For processing carried out on the Customer's instructions through the Platform, the Customer (or, where applicable, its corporate customer) may act as the data controller and Turleno may act as a data processor or service provider. For processing that Turleno carries out for its own purposes, such as account administration, security, billing and legal obligations, Turleno may determine the purposes and means itself. Where the Customer processes data on behalf of its own corporate customers, the Customer may act as a processor toward them, and Turleno may act as a sub-processor. The parties will document a different allocation for a specific activity where it applies.
5. Data subjects and categories of data
Data subjects may include the Customer's users, corporate-customer users, managers and approvers, employees and travellers, and their contacts.
Categories of data may include identity and contact data, account data, traveller and passenger data, travel requests and itineraries, booking references, tickets and vouchers, corporate travel policy and approval data, financial and business metadata (balances, credit, ledger, invoice and payment references), support and web-chat communications, WhatsApp data (phone numbers, identifiers, message content, media, message IDs, status events, WABA and phone-number IDs), and technical and security logs.
6. Purposes of processing
Turleno processes the data to provide, secure and support the Platform: authentication, travel search, bookings and changes, policy and approval workflows, tickets and vouchers, notifications, web chat and WhatsApp, reporting, support and troubleshooting.
7. Documented instructions
Turleno processes personal data covered by this DPA only on the Customer's documented instructions, which are the Master Agreement, this DPA and the Customer's use and configuration of the Platform, unless a legal obligation requires otherwise. Turleno will tell the Customer if it believes an instruction infringes applicable data-protection law.
8. Confidentiality
Turleno ensures that persons it authorises to process the data are bound by confidentiality obligations.
9. Security
Turleno applies technical and organisational measures appropriate to the risk, including access control, separation of each agency's data from other agencies' data, encrypted connections, protected handling of credentials, and logging and monitoring. Detailed measures can be discussed under confidentiality.
10. Subprocessors
The Customer authorises Turleno to use the providers listed on the Subprocessors page. Turleno will update that page when it adds or replaces a provider, and will require its subprocessors to protect personal data under terms appropriate to their role. A Customer that needs advance notice can ask at privacy@turleno.com. Travel suppliers and Meta/WhatsApp process information under their own terms and are not Turleno's subprocessors.
11. International transfers
Turleno's core application infrastructure is hosted in the EU (Frankfurt), but providers may process data outside Türkiye or the European Economic Area. Where the law requires it, the parties will use the applicable transfer mechanisms and safeguards.
12. Data-subject requests
Taking into account the nature of the processing, Turleno will reasonably help the Customer respond to requests from data subjects to exercise their rights. If a data subject contacts Turleno about data that Turleno processes for the Customer, Turleno may refer the person to the Customer.
13. Personal-data incidents
Turleno will notify the Customer without undue delay after becoming aware of a personal-data breach affecting data covered by this DPA, and will provide the information reasonably available to help the Customer meet its own notification duties.
14. Deletion and return
When the Master Agreement ends, or on the Customer's written request, Turleno will delete or return the personal data covered by this DPA, unless the law requires it to keep some data. Backups are deleted through their normal lifecycle. See also the Data Deletion Instructions.
15. Information and audits
Turleno will make available the information reasonably necessary to show compliance with this DPA and will allow reasonable audits or inspections, on reasonable notice, during business hours and subject to confidentiality, no more than once a year unless required by a competent authority or following an incident.
16. Duration and termination
This DPA lasts as long as Turleno processes personal data for the Customer under the Master Agreement. Provisions that by their nature should survive termination survive.
17. Applicable law
This DPA is governed by the same law as the Master Agreement. Unless the Master Agreement provides otherwise, that is the laws of the Republic of Türkiye.
Effective from 3 October 2026; last updated 6 November 2026. Contact: privacy@turleno.com.