Personal Data Protection — Privacy Notice

This notice is provided under Turkish Personal Data Protection Law No. 6698 (“PDP Law”) to inform you as the data subject about how your personal data is processed.

Data Controller

FRACASSO TURİZM SEYAHAT ACENTASI VE TİCARET LTD. ŞTİ. (“the Agency”) acts as data controller under the PDP Law. This document describes how personal data of our customers, website visitors and third parties we interact with is collected, processed and protected.

Categories of Personal Data

The categories of data that may be processed in connection with our ferry ticketing service are:

• Identity: full name, date of birth, national ID; passport details on international routes.
• Contact: email address, phone number, postal address.
• Booking: voyage details, PNR / ticket number, passenger type, refund and change records.
• Payment: billing information; card details are stored by the bank infrastructure — never on our systems.
• Technical: IP address, device and browser information, session cookies, log records.

Purposes of Processing

• Executing the ticket booking and purchase process
• Fulfilling customs and immigration notifications required for international routes
• Securely completing 3D Secure payment flow
• Handling customer support, changes, refunds and complaints
• Complying with tax, financial and TÜRSAB regulatory obligations
• Preventing fraud and safeguarding system security
• Where consent is given: informational and marketing communication

Transfers

Your data may be shared with the following parties where strictly necessary for service delivery:

• Ferry operators carrying the voyage
• Banks and payment infrastructure providers
• Customs, immigration and port authorities for international voyages
• Competent public authorities and supervisory bodies
• Our legal, financial and technology service providers

Cross-border transfers to ferry operators outside Türkiye are treated as necessary for service delivery under Article 9 of the PDP Law and are executed with appropriate technical and organisational safeguards.

Collection Methods and Legal Basis

Data is collected through our website, call centre, email correspondence and physical office visits. The legal basis includes performance of a contract, compliance with statutory obligations, our legitimate interests and — for marketing communications — your explicit consent.

Retention

Ticket and voyage records are retained for a minimum of 10 years as required by tax and finance regulations. Other data is deleted, destroyed or anonymised once the processing purpose ceases and the minimum retention period under applicable law expires.

Your Rights under the PDP Law

Under Article 11 of the PDP Law you have the right to:

• Learn whether your data is processed and, if so, request information about it
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom your data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request erasure, destruction or anonymisation
• Object to analysis outcomes generated exclusively by automated systems
• Seek compensation for damages arising from unlawful processing

How to Contact Us

Updates

This notice may be revised in line with regulatory changes or updates to our processes. The latest version is always available at /en/kvkk.