Effective date: November 2, 2026
This notice is provided by the data controller FLEX TURİZM TİCARET VE SEYAHAT ANONİM ŞİRKETİ to guides, tour leaders and staff using the FlexTour Mobile app (the "Data Subject") under Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
| Data controller | FLEX TURİZM TİCARET VE SEYAHAT ANONİM ŞİRKETİ ("Flex Travel") |
| Address | 19 Mayıs Mah. 19 Mayıs Cad. Nova Baran Plaza No: 4 Door No: 54, Şişli / Istanbul, Türkiye |
| Tax office / no | Mecidiyeköy Tax Office / 3880450633 |
| info@flextravel.com.tr | |
| Phone | +90 212 231 67 70 |
| Website | https://flextravel.com.tr |
Identity: first name, last name.
Contact: mobile phone number, email address (if provided).
User transactions: username, account status, messages, support and call-back requests, survey answers.
Financial: expense, advance, cash, currency exchange, shop visit and optional tour sales records and amounts.
Visual records: photos of expense/advance receipts and documents.
Transaction security: hashed password, session records, IP address, device/browser information, push token, activity logs.
No special categories of personal data (KVKK Art. 6) are processed.
Creating and approving user accounts and authentication,
Running tour operations; communicating tour assignments, schedules and changes,
Carrying out finance and accounting; expense, advance and guide account reconciliation,
Communication and support processes,
Complying with statutory retention, bookkeeping and disclosure obligations,
Information security, preventing unauthorized access and fixing errors,
Handling legal matters and using records as evidence in possible disputes.
Your personal data is collected electronically: entered by you through the mobile app and web panel, recorded by the Flex Travel office, and generated automatically while using the app. It is processed on the following legal grounds under KVKK Art. 5/2:
(c) Necessary for the conclusion or performance of a contract: account, tour assignment, expense/advance and communication data,
(ç) Necessary for compliance with a legal obligation of the data controller: accounting, tax and commercial book records,
(e) Necessary for the establishment, exercise or protection of a right: financial records and correspondence,
(f) Legitimate interest of the data controller, provided it does not harm your fundamental rights and freedoms: security logs, IP address, error logs, online status.
Your personal data may be transferred, limited to the purposes above and in accordance with KVKK Arts. 8 and 9, to the following recipients:
| Service provider | Service | Location |
| YATPORT TURİZM TEKNOLOJİ DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ | Software development, hosting, maintenance and technical support (data processor) | Türkiye |
| NetGSM İletişim ve Bilgi Teknolojileri A.Ş. | Sending SMS verification codes | Türkiye |
| Expo (650 Industries, Inc.) and Google LLC (Firebase Cloud Messaging) | Delivering push notifications (push token and notification text only) | USA |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iOS devices | USA |
| Cloudflare, Inc. | Network security, attack protection and traffic routing | USA / global |
| Functional Software, Inc. (Sentry) | Monitoring technical error logs | USA |
Competent public authorities: where legally required or requested (e.g. tax offices, courts).
Accountants and auditors: within the scope of accounting and audit obligations.
Limited data (push token, notification text, IP address, technical error logs) is transferred to service providers located abroad for push notifications, network security and error monitoring, subject to one of the appropriate safeguards set out in KVKK Art. 9 (including the standard contract published by the Personal Data Protection Board).
Financial records and related documents are retained for 10 years under Turkish Commercial Code Art. 82 and Tax Procedure Law Art. 253; account and contact data for as long as the account is active; other data for as long as required by the purpose of processing and applicable law. At the end of the period, data is deleted, destroyed or anonymized.
To learn whether your personal data is processed,
To request information if it has been processed,
To learn the purpose of processing and whether it is used accordingly,
To know the third parties to whom it is transferred in Türkiye or abroad,
To request correction if it is incomplete or inaccurate,
To request deletion or destruction under the conditions of KVKK Art. 7,
To request that corrections, deletions and destructions be notified to third parties to whom the data was transferred,
To object to a result against you arising exclusively from automated analysis,
To claim compensation for damages arising from unlawful processing.
In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in writing, with information identifying you (name, surname, Turkish ID number or, for foreign nationals, nationality and passport number, address, phone/email and the subject of the request), by hand or post to 19 Mayıs Mah. 19 Mayıs Cad. Nova Baran Plaza No: 4 Door No: 54, Şişli / Istanbul, Türkiye, or by email from the email address registered in our system to info@flextravel.com.tr with the subject "KVKK Request". Requests are concluded free of charge within 30 days at the latest; if the process requires an additional cost, the fee schedule set by the Board may apply.