KVKK Clarification Text

This is a general KVKK compliance draft for the Elit Travel Club platform. It should be reviewed by local counsel once the final operating country, payment infrastructure, cookie inventory, supplier list and data flow model are confirmed. The Turkish version prevails for Turkish law purposes.

1. Purpose and Scope

This Clarification Text explains how personal data is processed by Elit Travel Club in connection with the website, membership, Elite Member card, bookings, timeshare or seasonal holiday use rights, holiday packages, payments, customer services, call center, WhatsApp, e-mail, marketing, agencies and business partner processes.

This document is drafted with reference to Turkish Personal Data Protection Law No. 6698, secondary legislation and guidance of the Turkish Personal Data Protection Authority.

As Elit Travel Club may operate as a global travel and membership platform, personal data may in certain cases be shared with hotels, service providers, payment institutions, technology infrastructure providers and group companies located abroad.

2. Data Controller

Your personal data may be processed by Tiffany Hotels & Resorts International Ltd., acting under the Elit Travel Club brand, as data controller. If a separate Turkish company, agency or operating unit is established, the relevant data controller details will be notified separately.

For certain services, hotels, payment institutions, insurers, transfer providers, tour operators or local agencies may act as independent data controllers for their own processing activities.

3. Categories of Personal Data Processed

Depending on the service, identity, contact, membership, booking, travel, finance, payment, invoice, customer transaction, call center, marketing, transaction security, technical log, cookie, location and request/complaint data may be processed.

Special categories of personal data are not processed as a rule. However, accessibility requests, health-related accommodation needs, allergy, dietary sensitivity or emergency information may be processed only to the extent necessary for the service and under lawful conditions.

4. Methods of Collection

Personal data may be collected through website forms, membership screens, booking modules, payment pages, user panels, call center, WhatsApp, e-mail, social media, live support, contracts, invoices, hotel and supplier systems, cookies and digital tracking technologies, by automated or non-automated means.

Some data is provided directly by the user, while other data may be obtained from payment institutions, hotels, travel suppliers, technology providers, agencies or legal authorities.

5. Purposes of Processing

Personal data is processed for creating membership accounts, managing user accounts, receiving bookings, selecting rooms/weeks/seasons, arranging hotel accommodation, transfer and tour services, providing Elite Member benefits, payments and invoicing, customer support, complaint handling, security, fraud prevention, campaign notifications, service improvement, reporting, legal compliance and dispute resolution.

Processing activities are carried out in line with the principles of data minimization, purpose limitation, accuracy, retention limitation and security.

6. Legal Grounds

Your personal data may be processed under Articles 5 and 6 of KVKK based on explicit consent, express provision by law, establishment or performance of a contract, compliance with legal obligations, establishment/exercise/protection of a right, legitimate interests provided that fundamental rights and freedoms are not harmed, or protection of life or physical integrity where consent cannot be obtained due to factual impossibility.

Separate explicit consent is obtained where required for marketing, cookies, special categories of data and cross-border transfers.

Data Categories, Purposes and Legal Grounds

7. Transfers of Personal Data

Personal data may be shared, to the extent necessary for the service, with hotels, transfer providers, tour and activity providers, agencies, insurance and assistance companies, payment institutions, banks, technology providers, accountants, lawyers, auditors, group companies and competent public authorities.

Transfers are carried out subject to data processing agreements, confidentiality obligations, access restrictions and technical/organizational security measures.

8. Cross-Border Transfers

Because Elit Travel Club provides global travel services, booking hotels, payment providers, cloud systems, call center tools or technology providers may be located outside Türkiye.

Cross-border transfers from Türkiye are carried out under Article 9 of KVKK by relying on applicable mechanisms such as adequacy decisions, appropriate safeguards, standard contractual clauses, binding corporate rules, Board authorization, necessity for contract performance or explicit consent.

Where explicit consent is required for cross-border transfer, users are informed of the purpose, scope, recipient groups, potential risks and the right to withdraw consent.

9. Retention Periods

Personal data is retained for the period required for the processing purpose and for statutory retention periods. Membership data may be retained during membership and limitation periods; booking and contract records during limitation periods; accounting and invoice records under tax and commercial law; call records for a reasonable period; and marketing consents until withdrawal and expiry of evidential periods.

Data whose retention period has expired is deleted, destroyed or anonymized.

Indicative Retention Periods

10. Data Security

Elit Travel Club applies technical and organizational measures such as SSL/TLS encryption, access authorization, strong password rules, multi-factor authentication, backup, logging, firewalls, malware protection, role-based access, staff confidentiality undertakings and data processing agreements.

No digital system can guarantee absolute security; however, reasonable industry-standard safeguards are applied.

11. Rights of Data Subjects

Under Article 11 of KVKK, data subjects may request information on whether personal data is processed; information if processed; the purpose of processing; whether it is used in accordance with the purpose; third parties to whom data is transferred domestically or abroad; correction of incomplete or inaccurate data; deletion or destruction; notification of such operations to third parties; objection to unfavorable results arising from automated analysis; and compensation for damages.

Requests may be sent to info@elittravelclub.com. Additional information may be requested for identity verification.

12. Application Procedure

Applications should include name, surname, contact information, subject of request, relevant membership/booking number and identity verification details. Applications are handled within the statutory periods, in principle no later than 30 days.

If the application requires additional cost, a fee based on the tariff determined by the Turkish Personal Data Protection Board may be charged.

13. Children's Data

For family bookings, children's name, surname, age, date of birth, passport or travel document information may be processed. These data should be provided only by a parent, guardian or legal representative and used only to the extent necessary for booking/accommodation services.

Children are not targeted with direct marketing.

14. Changes

This text may be updated due to changes in legislation, operations, technology, payment systems, cookie infrastructure or supplier structure. The current version is published on the website.

ANNEX 1: Short Clarification Text for Web Forms

Your personal data will be processed by Elit Travel Club for receiving your request, contacting you, carrying out membership/booking/offer processes, payment and legal obligations. Your data may be shared where necessary with hotels, payment institutions, business partners, technology providers and competent authorities. For details, please review our KVKK Clarification Text and Privacy Policy; you may exercise your rights via info@elittravelclub.com.

ANNEX 2: Marketing Explicit Consent Text

I give explicit consent to Elit Travel Club contacting me via e-mail, SMS, phone, WhatsApp and digital notification channels regarding campaigns, discounts, special offers, membership benefits, travel recommendations and announcements. I understand that I may withdraw this consent at any time.

ANNEX 3: Cross-Border Transfer Explicit Consent Text

I give explicit consent to the transfer of my personal data to hotels, service providers, payment institutions, cloud services, technology providers and group companies located abroad for booking, accommodation, payment, technology infrastructure, customer support and operational processes. I have been informed that cross-border transfers may involve different risks depending on foreign laws and that I may withdraw my consent at any time.

ANNEX 4: KVKK Application Form Fields

An application may include name, surname, Turkish ID/passport information, e-mail, phone, address, membership/booking number, subject of request, explanation of request, preferred response method, date and signature. No third-party data is disclosed before identity verification.

ANNEX 5: Example Consent Checkboxes

I have read and been informed through the KVKK Clarification Text. / I consent to receiving commercial electronic communications for marketing purposes. / I have been informed about cross-border data transfers and give explicit consent.

KVKK Application Form