Website Confidentiality Agreement
During your visit to this website and your use of the services we offer through this website, how the information we obtain about you and the services you request will be used and protected is subject to the terms set out in this “Privacy Policy”. By visiting this website and requesting to benefit from the services we offer through this site, you agree to the terms set out in this “Privacy Policy”.

1. The purpose of the policy on the protection and processing of personal data
   To date, due to the sensitivity of the work we have been dealing with as LUGGA, the data from our customers or prospective customers have been kept confidential and have never been shared with third parties. The protection of personal data is the basic policy of our company. Even before any legal regulation, the company and our subsidiaries attached great importance to the confidentiality of personal data and adopted this as a working principle and instructed their employees to work in line with this principle. As LUGGA, we also undertake to comply with all the responsibilities imposed by the Law on the Protection of Personal Data. Our Company’s principles regarding the protection of personal data also cover our subsidiaries.
2. Scope and amendment of the personal data protection and processing policy
   This Policy prepared by our Company has been prepared in accordance with the Personal Data Protection Law No. 6698 (“KVKK”). The Law has entered into force with all its provisions as of today. The data obtained from you with your consent or in accordance with other legal requirements listed in the Law will be used to improve the quality of the services we provide, to improve the services offered to you and our quality policy. Again, some of the data we have are de-personalized and anonymized. These data are used for statistical purposes and are not subject to the application of the Law and our Policy. LUGGA Personal Data Protection and Processing Policy aims to protect the automatically obtained data of our customers, prospective customers, employees and customers and employees of companies working in solution partnership with us or other persons and includes the relevant regulations.
   Our Company has the right to change our Policy and Regulation – provided that it complies with the Law and personal data is better protected.

III. Basic rules on the processing of personal data
a) Compliance with the law and good faith: LUGGA questions the source of the data it collects or receives from other companies and attaches importance to ensuring that they are obtained in accordance with the law and good faith. Within this framework, LUGGA makes the necessary warnings and notifications to third parties (agencies and other intermediary institutions) that sell the services offered by LUGGA in order to protect personal data.
b) Being accurate and up-to-date when necessary: LUGGA attaches importance to ensuring that all data within the organization are accurate, do not contain false information, and finally, if there are changes in personal data, update them as soon as they are communicated to LUGGA.
c) Processing for specific, explicit and legitimate purposes: LUGGA processes data limited to the purposes it provides and for which it obtains the consent of the persons during the service. LUGGA does not process, use or make data used for purposes other than business purposes.
d) Being relevant, limited and proportionate to the purpose for which they are processed: LUGGA only uses the data limited to the purpose for which they are processed and to the extent required by the service.
e) Being retained for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed: LUGGA retains the data arising from the contracts for the duration of the dispute periods of the Law and the requirements of commercial and tax law. However, it deletes or anonymizes the data when these purposes cease to exist.

It is important to note that whether LUGGA collects or processes data with consent or in accordance with the law, these principles listed above still apply.

According to Article 11 of the Personal Data Protection Law, you have the following rights. In order to facilitate these rights, LUGGA has also prepared an application form for you.

Persons whose personal data are processed may apply to our contact person announced by LUGGA on our website in relation to their data;
a) Learn whether your personal data is being processed,
b) Request information if personal data has been processed,
c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
ç) To know the third parties to whom personal data are transferred domestically or abroad,
d) To request correction of personal data in case of incomplete or incorrect processing,
e) To request the deletion or destruction of personal data within the framework of the conditions stipulated in the law,
f) To request notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data are transferred,
g) To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,
ğ) In case of damage due to unlawful processing of personal data,
has the right to demand compensation for the damage. As LUGGA, we respect these rights.

Maximum Savings Principle/Sparsimony Principle

According to this principle, called the principle of maximum economy or the principle of parsimony, the data received by LUGGA is processed only to the extent necessary. Therefore, the data we collect is determined according to the purpose. Data that is not necessary is not collected. Other data transferred to our company are transferred to the company information systems in the same way. Excess information is not saved in the system, deleted or anonymized. This data can be used for statistical purposes. Health data from special categories of data is collected only for the purpose of providing better service to customers and protecting their health and is carefully kept in the system.

When the periods required to be kept by law expire, judicial processes are completed or other requirements are eliminated, personal data are deleted, destroyed or anonymized by our company automatically or upon the request of the person concerned.

Accuracy and timeliness of data
As a rule, the data held by LUGGA is processed in the manner declared by the data subjects upon their declaration. LUGGA is not obliged to verify the accuracy of the data declared by customers or persons who come into contact with LUGGA, nor is this required by law or our business principles. The declared data is considered correct. The principle of accuracy and timeliness of personal data has also been adopted by LUGGA. Our company updates the personal data it has processed upon the official documents received or upon the request of the relevant person. It takes the necessary measures for this.

Privacy and data security
Personal data is confidential and LUGGA respects this confidentiality. Personal data can only be accessed by authorized persons within the company. LUGGA takes all necessary technical and administrative measures to protect the personal data collected by LUGGA and to prevent unauthorized access and victimization of our customers and prospective customers. In this context, it is ensured that the software complies with the standards, third parties are carefully selected and the data protection policy is complied with within the company.

Additional health data may be requested or collected from our employees due to Covid-19 and epidemics, and the collected data may be shared with the relevant official authorities.

1. Purposes of data processing
   LUGGA’s collection and processing of personal data will be carried out in accordance with the purposes specified in the information text. Data is collected and processed for the purposes of establishing a contract and providing better customer service.
2. Customer, potential customer and business and solution partner data

Collection and processing of data for the contractual relationship
If a contractual relationship has been established with our customers and potential customers, the collected personal data may be used without the customer’s consent. However, this use is limited to the contractual purpose. Data is used to facilitate the performance of the contract and to the extent necessary for the service, and is updated by contacting customers as necessary. Furthermore, the data provided by our potential customers (potential customers) is processed to provide them with easier and higher-quality service. This data is deleted upon request if it has not yet been established as a contractual relationship.

Business and Solution Partner Data
LUGGA is committed to acting lawfully when sharing data with both its business and solution partners. We share data with our business and solution partners with a commitment to data confidentiality, but only to the extent required for the service, and we require these parties to take data security measures.

Data processing for advertising purposes
In accordance with the Law on the Regulation of E-Commerce and the Regulation on Commercial Communications and Commercial Electronic Messages, electronic messages for advertising purposes may only be sent to individuals who have received prior consent. The explicit consent of the person to whom the advertisement will be sent is required. LUGGA also complies with the details of “consent” determined under the same legislation. Personal data is transferred to İleti Yönetim Sistem A.Ş. in accordance with the Regulation on Commercial Electronic Messages to enable electronic messages to be sent.

Data processing carried out due to the legal obligation of the company or as expressly provided for in the law
Personal data may be processed without obtaining consent if the processing is explicitly stated in relevant legislation or for the purpose of fulfilling a legal obligation established by legislation. The type and scope of data processing must be necessary for legally permitted data processing activities and comply with relevant legal provisions.

Company’s data processing
Personal data may be processed in accordance with the services and legitimate purposes offered by the Company. However, data may not be used for any unlawful purposes.

Processing of special data
According to the Law, data related to a person’s race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data, constitute special personal data. LUGGA also takes adequate measures, as determined by the Board, when processing special personal data.

LUGGA may process sensitive data only with the consent of the individual to improve service delivery and for the purposes for which it was collected. The property you book through us may request certain personal data from guests, including sensitive personal data such as health data related to the guest and their relatives, in accordance with the circulars and legal regulations issued regarding Covid-19. This personal data may be shared with official authorities and healthcare institutions when necessary.

Data obtained through membership transactions
If you become a member of LUGGA, the personal data you share with us for registration will be processed in our systems. If you register with our system through Facebook, Google, or other social media platforms, we will access information provided by the relevant social media platform to its partners, such as your first name, last name, profile picture, and email address, and this information will be transferred to LUGGA’s systems.

Data processed by automated systems
LUGGA complies with the law regarding data processed through automated systems. Information obtained from this data cannot be used against individuals without their explicit consent. However, LUGGA may use the data in its own system to make decisions about the individuals it will process.

Cookie Policy
LUGGA, like many other websites, uses technologies such as cookies to enhance website users’ visiting experiences and improve service quality. The LUGGA Cookie Policy has been prepared to inform website users about cookies and the types of cookies used, and to guide them on how to manage their cookie preferences.

If you do not consent to the use of cookies, we kindly ask you to discontinue the use of the website or change your cookie preferences as described in this Policy. Please note that disallowing cookies may result in the loss of functionality of some website features.

What is a Cookie?
Cookies are small text files stored on your computer or mobile device when you visit a website. These files store data such as your IP address, session information, the pages you access, etc. Cookies can help us remember your website preferences, keep you logged in, or present you with content you’re interested in. For detailed information about cookies,www.aboutcookies.org ve www.allaboutcookies.orgYou can visit their addresses.

Types of Cookies
Cookies are divided into different types based on criteria such as how long they are stored on mobile devices and who places them. The main distinctions within these criteria are as follows:

Session Cookies:Session cookies are temporary cookies that are deleted from your device after you close the browser. Their primary function is to ensure the proper functioning of the website.

Persistent Cookies:Persistent cookies remain on the device after the browser is closed until they are deleted by the user or until they expire.

First Party Cookies:First-party cookies are cookies placed on the device by the operator of the visited website.

Third Party Cookies:Third-party cookies are cookies placed on the device and controlled by parties other than the operator of the website visited.

When personal data is collected, processed, and used on LUGGA’s websites and other systems or applications, relevant individuals will be informed about the privacy notice and, if necessary, cookies. Individuals will be informed about our practices on the websites. Personal data will be processed in accordance with the law.

When you visit our website, we would like to bring to your attention the following information regarding the cookies we use/will use on our website.

Cookies Used on the LUGGA Website
LUGGA uses different types of cookies in accordance with its Privacy Policy.

Mandatory Cookies:These are technical cookies that enable the website to function properly and allow you to use its features. They are classified as session cookies. Blocking these cookies will result in the website’s features being unavailable. Your consent is not required for the use of mandatory cookies.

Analytical Cookies:Analytics cookies are used to improve your website experience. Analytics cookies allow us to understand how you use the website (e.g., which pages you visit, how long your visit lasts, etc.). This allows us to improve the content we offer or adjust the website design.

Functionality Cookies:It allows your language preferences, region selection, etc. to be remembered when you revisit the website.

Targeting/Advertising Cookies:LUGGA uses various first-party and third-party cookies on its website for targeting and advertising purposes. You can block these cookies by changing your browser settings or by changing your cookie preferences as described in this Policy.

How to Change Your Cookie Preferences?

You can customize cookies or block them entirely by changing the settings of your browser. Detailed information on the steps to follow for different browsers can be found at the links below:

To manage cookie preferences on other browsers, you can review the help or support page of the relevant browser.

Your Rights Regarding Your Personal Data

By applying to LUGGA as the data owner;

• Learning whether your personal data is being processed,
• Request information regarding your personal data if it has been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom your personal data is transferred, whether domestically or abroad,
• To request correction of your personal data if it is processed incompletely or incorrectly and to request that the actions taken in this context be notified to third parties to whom your personal data has been transferred,
• To request the deletion or destruction of your personal data in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, and to request that the actions taken within this scope be notified to third parties to whom your personal data has been transferred,
• To object to any adverse results arising from the analysis of your processed data exclusively through automated systems,
• If you suffer damage due to the unlawful processing of your personal data, you have the right to demand compensation for the damage.

Your requests regarding your rights listed aboveCommuniqué on the Procedures and Principles for Application to the Data ControllerIf you submit your request to our Company in accordance with the application procedures set forth in , LUGGA will process your request free of charge, depending on its nature, as soon as possible and within 30 (thirty) days at the latest. However, if the process requires additional costs, LUGGA may charge the fee set by the Personal Data Protection Board.

Functional and Analytical
Cookies help us remember your preferences, optimize the website to meet user needs, and contain data about how visitors use the site. By their nature, these types of cookies may contain personal information such as your username, etc.

Third Party Cookies
Lugga websites/mobile apps/mobile websites work with trusted, well-known third-party advertising providers. Third-party service providers place their own cookies to provide you with personalized advertising. These third-party cookies collect and process visitors’ browsing information on the websites, and analyze how they use it.

Commercial cookies
It serves to enhance your user experience by presenting products/content similar to your targeted content based on your interests and preferences, and by offering a more advanced, personalized advertising portfolio. Session, persistent, functional, analytical, and commercial cookies, as mentioned above, are retained in the background for approximately two (2) months, and these can be adjusted through your individual browser settings. The removal process may vary depending on the browser.

How can I delete cookies?
Many web browsers are set to automatically accept and use cookies when they are first installed on your computer. You can block cookies or receive a notification when cookies are sent to your device by using your web browser’s help or settings menus. You can learn about different ways to manage cookies and find detailed information on how to adjust your browser’s settings by visiting your browser’s instructions or help options screen.

1. Data belonging to our employees
   
   Processing of data for business relationship
   Our employees’ personal data may be processed without consent to the extent necessary for employment relationships and health insurance. However, LUGGA ensures the confidentiality and protection of its employees’ data.

Processing Due to Legal Obligations
LUGGA may process personal data belonging to its employees without obtaining separate consent, unless the processing is explicitly stated in the relevant legislation or for the purpose of fulfilling a legal obligation established by legislation. This is limited to obligations arising from the law.

Processes for the Benefit of Employees
LUGGA may process personal data without obtaining consent for transactions that benefit company employees, such as private health insurance. LUGGA may also process employee data for disputes arising from employment relationships.

Processing of special data
According to the Law, data related to a person’s race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance, membership in associations, foundations or unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data, constitute special personal data. LUGGA also takes adequate measures, as determined by the Board, in addition to the consent of the relevant person, when processing special personal data. Special personal data may only be processed without the consent of the individual and only in limited circumstances permitted by the Law. Special data collected from our employees to ensure their access to insurance and healthcare services is used only for specific purposes.

Data processed by automated systems
Employee data processed through automated systems may be used for internal promotions and performance evaluations. Our employees have the right to appeal any unfavorable outcome and may do so in accordance with internal company procedures. Employee objections are also reviewed internally.

Telecommunications and the Internet
The computers, phones, emails, and other applications allocated to employees within the company are provided solely for work purposes. Employees may not use any of these company-provided devices for personal purposes or communication. The company may monitor and inspect all data on these devices. From the moment they begin work, employees undertake not to store any data or information other than work-related information on their assigned computers, phones, or other devices.

VII. Transfer of personal data domestically and internationally
Personal data may be shared with business and solution partners and LUGGA affiliates in order to provide services by LUGGA.

LUGGA may transfer personal data to the following persons and institutions for certain purposes;
» To LUGGA’s business partners, to ensure that the purposes for which the business partnership was established are fulfilled,
» To LUGGA’s suppliers, to ensure that our Company provides the services that our Company outsources from suppliers and that are necessary for the fulfillment of our Company’s commercial activities,
» To LUGGA’s solution partners, limited to ensuring the execution of our company’s commercial activities that require the participation of affiliates,
» To LUGGA’s affiliates.

LUGGA has the authority to transfer personal data domestically and abroad, in accordance with the conditions determined by the Board in the law, in accordance with other conditions in the Law and subject to the consent of the person.

VIII. Rights of the relevant person
LUGGA acknowledges that, within the scope of the Law, the data subject has the right to obtain consent before data processing and the right to determine the fate of his/her data after processing.

Regarding personal data, by contacting the person in charge announced by LUGGA on our website;
a) To learn whether your personal data is being processed,
b) Request information regarding the processing of personal data,
c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
d) To know the third parties to whom personal data is transferred, either domestically or abroad,
d) To request correction of personal data in case it is processed incompletely or incorrectly,
e) Request the deletion or destruction of personal data within the framework of the conditions set forth in Article 7,
f) To request that the operations carried out in accordance with clauses (d) and (e) be notified to third parties to whom personal data has been transferred,
g) To object to the emergence of a result to the detriment of the person himself/herself, by means of analysis of the processed data exclusively through automated systems,
g) In case of incurring damages due to unlawful processing of personal data, the person has the right to demand compensation for the damages.
However, individuals within the Company do not have any rights regarding anonymized data. LUGGA may share personal data with relevant institutions and organizations in accordance with business and contractual relationships, or for the purposes of exercising legal powers of a judicial authority or government authority.

Personal data subjects may submit their requests regarding the aforementioned rights by fully completing the application form available at the Company’s official website, www.Luggatur.com.tr, signing it with a wet signature, and sending it to the Company via registered mail with a return receipt, along with a photocopy of their ID (for ID cards, only the front cover will be a photocopy). Depending on the content of your application, your applications will be answered as soon as possible, or within 30 days of receipt by the Company. Applications must be submitted by registered mail with a return receipt. Furthermore, only the portion of your application that pertains to you will be answered; applications regarding your spouse, relative, or friend will not be accepted. LUGGA may request additional relevant information and documents from applicants.

1. Privacy Policy
   The data held by LUGGA, whether employees or others, is confidential. No one may use, copy, reproduce, transfer, or otherwise use this data for any purpose other than business purposes without contract or legal compliance.
2. Transaction security
   All necessary technical and administrative measures are taken to protect personal data collected by LUGGA, prevent it from falling into unauthorized hands, and prevent our customers and prospective customers from being harmed. This includes ensuring that software complies with standards, third-party providers are carefully selected, and the company adheres to its data protection policy. Security measures are constantly updated and improved.
3. Audit
   LUGGA conducts the necessary internal and external audits regarding the protection of personal data.

XII. Notification of Violations
When LUGGA is notified of any breach of personal data, it takes immediate action to remedy the breach. It minimizes and compensates the damages suffered by the data subject. If personal data is obtained by unauthorized parties, it immediately notifies the Personal Data Protection Board.

Applications regarding notification of violations can also be made in accordance with the procedures specified at http://www.lugga.com.tr.

Communication
For your questions and requests regarding the confidentiality agreement, you can print and fill out the form below and send it by registered letter to the address below.