Privacy Policy

Last updated: 17 May 2026
Data controller: Mokan Tur Turizm Travel Agency (TÜRSAB Doc. No. 10997)
Registered address: Tayakadın Mah. Havalimanı Cad. Airport Terminal Building No: 1/820507, Istanbul Airport Arnavutköy / Istanbul, Türkiye
Privacy contact: [email protected]

1. Scope of this policy

This Privacy Policy applies to personal data that Mokan Tur Turizm Travel Agency ("Mokan", "we", "us") processes when you interact with the getmokan.com website, our B2B trade portal, our email channels, our WhatsApp business numbers, or when your agency contracts our services and we process passenger information on your behalf.

For data processed in our consumer-facing operations (mokantravel.com), please refer to the privacy policy on that website.

2. What personal data we collect

We process the following categories of personal data:

Category	Examples	Source
Partner contact data	Name, role, email, phone, agency name, country	Provided by you via forms or correspondence
Programme data	Annual volume estimates, target markets, product interest	Provided by you during partnership discovery
Passenger manifests	Names, flight numbers, contact details for your clients	Provided by your agency under data-processing agreement
Communication records	Email correspondence, WhatsApp messages, call logs	Generated during business correspondence
Technical data	IP address, browser type, pages viewed, referring URL	Automatically collected via website analytics

3. How we use your data

Personal data collected via this website and our B2B channels is used to:

• Respond to partnership enquiries and provide rate sheets / contracts
• Operate the services contracted by your agency (transfers, tours, hotels, events)
• Issue invoices, reconcile bookings and manage credit accounts
• Send partner communications including operational notices and (with consent) newsletters
• Comply with Turkish tax, tourism and travel-agency legal obligations
• Improve our website and partner-facing services through aggregated analytics

4. Legal basis for processing

Where the European GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b) GDPR) to perform services your agency has contracted from us
• Legitimate interests (Art. 6(1)(f)) to respond to B2B enquiries and operate the website
• Legal obligation (Art. 6(1)(c)) to meet Turkish accounting and travel-agency record-keeping requirements
• Consent (Art. 6(1)(a)) for newsletter sign-up and non-essential cookies

Under Turkish KVKK (Law No. 6698) we apply the equivalent statutory grounds.

5. Who we share data with

We share personal data only where necessary for service delivery or as required by law. Recipients include:

• Our service-delivery partners (transport sub-operators, hotels, licensed guides) on a need-to-know basis
• Professional advisors (auditors, lawyers) under confidentiality obligations
• Turkish public authorities where legally required (TÜRSAB, tax authorities)
• Payment processors and banks for invoicing and settlement
• IT and hosting providers operating under data-processing agreements

We do not sell personal data and do not share it with third parties for their own marketing purposes.

6. How long we keep data

• Active partnership enquiries: 24 months after last interaction
• Contracted partner records: duration of contract plus 10 years (Turkish accounting law)
• Passenger manifests: 5 years post-trip, then anonymised
• Website analytics: aggregated indefinitely; raw logs 12 months
• Newsletter subscriptions: until you unsubscribe

7. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to our retention obligations)
• Object to or restrict certain processing
• Data portability where the processing is based on consent or contract
• Withdraw consent at any time (for consent-based processing)
• Lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu) or your local EU supervisory authority

To exercise these rights, contact [email protected]. We respond within 30 days.

8. Security

We apply technical and organisational measures appropriate to the risk profile of the data we process, including: TLS encryption in transit, access controls limited to authorised staff on a need-to-know basis, vetted IT contractors operating under written confidentiality agreements, and regular security review of our partner-facing systems.

9. International transfers

Our primary processing takes place in Türkiye. Where personal data is transferred to partners or processors outside Türkiye and the European Economic Area, we ensure appropriate safeguards are in place including Standard Contractual Clauses for transfers to GDPR-covered jurisdictions, and equivalent contractual protections elsewhere.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or regulatory environment. The "Last updated" date at the top of this page indicates when the most recent revision took effect. Material changes will be communicated to contracted partners via email.

This Privacy Policy is the master version. Translations may be added for convenience. In case of conflict, the English version governs unless local law requires otherwise.