This notice is provided under the disclosure obligation in the Turkish Personal Data Protection Law No. 6698 (KVKK) to explain how Turleno processes your personal data. It is not an explicit-consent text; if an operation ever requires explicit consent under the law, that consent is requested separately from this notice and given freely. For more detail, see our Privacy Policy. This English version is a courtesy translation; if the two differ, the Turkish text (KVKK Aydınlatma Metni) prevails.
1. Identity of the data controller
For personal data we process for our own purposes, the data controller is the business that operates the Turleno brand, Fikret Burak Gazioğlu (Sole proprietorship established in Türkiye).
- Brand
- Turleno
- Operator (data controller)
- Fikret Burak Gazioğlu
- Legal form
- Sole proprietorship established in Türkiye
- Country
- Türkiye
For personal data processed through the Turleno platform on behalf of a travel agency or a corporate customer, the data controller may be that travel agency or corporate customer, depending on the processing activity; in that case Turleno may act as a data processor on their instructions. The obligation to inform you may then also rest with those organisations.
2. Contact details of the data controller
- Address
-
Gülbahar Mah.
Cemal Sururi Sk. No: 15 E
İç Kapı No: 15
Şişli, İstanbul
Türkiye - Requests about personal data
- privacy@turleno.com
- General contact
- hi@turleno.com
- Website
- turleno.com
3. Categories of personal data processed
Depending on the service you use, we may process personal data in the following categories:
- Identity and contact: first and last name, work email address, phone number, company, role or business relationship.
- Account and transaction security: login and account details, roles and permissions, account activity, IP address, browser and device information, security events and logs (to the extent collected).
- Traveller and trip information: traveller profile, travel preferences, itinerary and dates, booking references, ticket and voucher details; where a supplier or destination country requires it, date of birth, nationality and passport or ID details.
- Corporate travel processes: travel policy, approval requests and decisions, rejection reasons, policy exceptions, budgets.
- Financial and commercial metadata: balances, credit details, ledger records, invoice and payment references.
- Communication records: support correspondence, web chat, WhatsApp and email communications; WhatsApp phone number and identifiers, WABA and phone-number IDs, message IDs, message content, media where applicable, timestamps, template details and delivery/read/failure status.
- Website and demo requests: the name, work email, agency or company, role, team size and optional phone number you share in the demo form.
4. Purposes of processing
- creating and managing accounts and verifying users;
- running travel searches, supplier queries, bookings, changes and cancellations;
- applying company travel policies and running manager approvals;
- handling ticket and voucher operations and sending notifications;
- providing service through web chat and WhatsApp, customer support and reporting;
- invoicing and account management;
- keeping the platform secure, preventing fraud and resolving problems;
- meeting legal obligations; and
- improving the service.
5. Who your personal data may be transferred to
Depending on the purpose and to the extent necessary, your personal data may be transferred to the following groups of recipients:
- the responsible travel agency and corporate customer and their authorised users;
- airlines, GDS and travel inventory providers, hotel providers and suppliers, car rental providers and, where used, transfer and visa support providers;
- Meta / WhatsApp;
- cloud and infrastructure (Amazon Web Services, MongoDB Atlas), email and communications (Resend, Google Workspace, Slack), AI model (Google Cloud Vertex AI) and support service providers;
- professional advisers and public authorities entitled by law.
The service providers we use and can name are listed on the Subprocessors page.
6. Purposes of transfer
- To the travel agency and corporate customer: to provide and manage the service within the relevant account.
- To travel suppliers: to search, create, change and cancel bookings and carry out the trip.
- To Meta / WhatsApp: to enable messaging over WhatsApp.
- To service providers: hosting, email delivery, running the AI-assisted assistant and providing support.
- To advisers and public authorities: to meet legal obligations or protect rights.
7. Transfers abroad
Turleno's core application infrastructure and databases are hosted on Amazon Web Services (AWS) in Frankfurt (Germany); this means the data is hosted outside Türkiye. In addition, some service providers, such as corporate email (Google Workspace), the AI model (Google Cloud Vertex AI), transactional email, internal notifications and WhatsApp (Meta), may process or access personal data outside Türkiye and, depending on the provider, outside the European Economic Area. Until their processing regions are verified, these providers are marked “requires confirmation” on the Subprocessors page.
Transfers abroad are made in line with Article 9 of the KVKK, that is, on the basis of an adequacy decision of the Personal Data Protection Board, appropriate safeguards or another condition listed in the law. You may ask for information about transfers (see section 11).
8. How personal data is collected
Your personal data may be collected, wholly or partly by automated means, through these channels:
- the Turleno website and demo form;
- the Turleno platform, web chat and administration interfaces;
- communications over WhatsApp and email;
- records entered into the platform by your travel agency or company;
- booking and ticket information received from travel suppliers; and
- technical means such as server logs.
9. Legal bases for processing
Depending on the activity, we rely on one or more of the processing conditions recognised by the KVKK, for example: processing is directly related to the formation or performance of a contract, is necessary to comply with our legal obligation, is necessary to establish, exercise or protect a right, or is necessary for our legitimate interests provided your fundamental rights and freedoms are not harmed. Where the law requires explicit consent, processing relies on your explicit consent, which is requested separately.
10. Retention
We keep your personal data for as long as the purpose of processing requires and for the periods that applicable legislation requires or allows. The period may vary by data category, the scope of the service and the agreement with the relevant travel agency or corporate customer. When the period ends or the purpose no longer applies, the data is deleted, destroyed or anonymised unless the law requires us to keep it. For details, see the retention section of the Privacy Policy.
11. Your rights under the KVKK
Under the KVKK you may apply to the data controller to:
- learn whether your personal data is processed;
- request information if it has been processed;
- learn the purpose of processing and whether it is used in line with that purpose;
- know the third parties to whom it is transferred in Türkiye or abroad;
- ask for correction if it is incomplete or inaccurate;
- ask for deletion or destruction within the conditions set by the law, and ask that these actions be notified to third parties to whom the data was transferred;
- object to a result against you produced by analysing the data exclusively through automated systems; and
- request compensation for damage you suffer from unlawful processing.
12. How to apply
You can send your requests about these rights by email to privacy@turleno.com or in writing to the business address above. Please state your identity and your request clearly; we may ask for additional information to verify your identity. Please do not include passwords, access tokens or PINs in your application. Applications are concluded as soon as possible depending on the nature of the request and at the latest within thirty days; if the action requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged. For deletion requests, see also the Data Deletion Instructions. You also have the right to complain to the Personal Data Protection Board (kvkk.gov.tr).
13. The website chat assistant (“Ask Turleno”)
When you use the “Ask Turleno” chat assistant on turleno.com, your personal data is processed as described in this section. The assistant runs separately from the Turleno platform; it has no access to the platform, to agency or company accounts, or to traveller or booking data.
- Data processed: the messages you type and the assistant's replies, the language you choose, a random chat identifier, the times of the messages, and a one-way keyed hash of your IP address that changes every day. The assistant does not store your IP address itself.
- Purposes: answering your questions about Turleno; offering the demo form or WhatsApp; preventing abuse with a daily chat limit per address and a daily usage limit; and improving the assistant's answers.
- Collection method and legal basis: the data is collected by automated means during the chat. The legal basis is that processing is necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed (KVKK Article 5(2)(f)); when you ask for a demo from the chat, also that processing is directly related to the formation of a contract (KVKK Article 5(2)(c)).
- Transfers: your messages and the chat so far are transferred to Google Cloud Vertex AI (europe-west3 region, Frankfurt, Germany) to produce the reply; chats are stored in MongoDB Atlas, in the AWS Frankfurt region. If you submit the demo form from the chat, your form details are sent with a short summary of the chat to Slack for internal notification. These are transfers abroad and are made as described in section 7.
- Retention: chats are deleted automatically 30 days after they are written, and the daily IP-address hash after 2 days.
You can exercise your rights over this processing as described in sections 11 and 12. Please do not give the assistant personal data it does not need to answer you.
This notice took effect on 3 October 2026 and was last updated on 6 November 2026.