Turkish Airlines GDPR Privacy Notice For Miles&Smiles

Introduction

Türk Hava Yolları Anonim Ortaklığı (hereinafter referred to as “THY”, “Company” or “We”), pays the utmost attention to the lawfulness of the processing of personal data relating to its customers. The Turkish Airlines Privacy Notice (“Privacy Notice”) herein have been prepared in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) to ensure that the personal data of our customers are processed in a transparent manner during processes within the scope of the Miles&Smiles Program (“Miles&Smiles”).

In this respect, within this Privacy Notice we provide you information on, as a data controller, which personal data of yours we process and for what purposes within Miles&Smiles membership, the third parties we share your data with, your rights and methods that you may contact us.

For more detailed information about the processing of your personal data, you may read the Turkish Airlines GDPR Privacy Notice on https://www.turkishairlines.com/en-tr/legal-notice/gdpr-privacy-notice.

How Do We Collect Your Personal Data? What Is the Legal Basis for Processing Your Personal Data?

Your personal data can be collected within services we provide with Miles&Smiles program via Turkish Airlines’ online channels, documented forms, sales offices, check-in counters, kiosks, call center, internet service provided inside the plane and IFE, member request and concerns, admission points to the plane, authorized travel agencies for the sale of Turkish Airlines products and services, GDSs, online sales channels, questionnaire and evaluation activities, program partners and other airlines verbally, in written form or digitally.

As per the GDPR, personal data can only be processed in the presence if at least one of the conditions set forth under the GDPR and/or required by international legislation. In this respect, as Turkish Airlines, we may rely on different legal bases, including:

To fulfil a contract, or take steps linked to a contract we have with you. (According to Art. 6/(1), Subparagraph 1(b) GDPR)
As required to conduct our business and pursue our legitimate interests (According to Art. 6/(1), Subparagraph 1(f) GDPR)
For purposes which are required by law (According to Art. 6/(1), Subparagraph 1(c) GDPR) (legal obligations)
Where you give us consent (According to Art. 6/(1), Subparagraph 1(a) GDPR) If this is the case, personal data will be processed limited to the scope of your freely given explicit consent. You may at any time revoke your explicit consent.

Which Personal Data We Process?

General information on your personal data processed by THY are as follows (For more detailed information about the type of personal data processed, Turkish Airlines GDPR Privacy Notice on https://www.turkishairlines.com/en-tr/legal-notice/gdpr-privacy-notice.):

Identity and Contact Information : Personal data such as name, surname, identification number, passport information and contact information such as e-mail address, address, phone and cell phone number or social media contact information that you have provided to us while creating accounts, changing membership status, making plane ticket reservations or applying for exclusive services offered by THY and its partners.
Flight Information : Reservation or ticket information or other information related to your flights,
Advanced Passenger Information (“API”) : Personal data relating to your name, nationality, birth date, gender, type and number of your travel documents and its date of validity, and its issuing country.
Evaluations and requests : Information regarding your assessments, complaints and requests relating to our services.
Payment Information : Credit/Debit card information, bank account information, IBAN information, balance and receivable information and other financial data,
Membership Program Information : If you are a member, information regarding Miles&Smiles ve Turkish Airlines Corporate Club membership programs.
Special Service Requests : Provided that you have your request and approval, information about the disease, disability, allergy and special dietary requirements and the information contained in the documents related to them, to provide the service you need during your travel.
Households and Relatives Information ; households information obtained in case of having a family membership.

Why Do We Process Your Personal Data?

We process personal data of customers who accepts Miles&Smiles Program Rules and Conditions and becomes a member for the following purposes (For more detailed information about the purposes of processing of your personal data, you may refer to the Turkish Airlines GDPR Privacy Notice on https://www.turkishairlines.com/en-tr/legal-notice/gdpr-privacy-notice.):

to provide Miles (“Miles”) from flights with Turkish Airlines and with program partner airlines,
to introduce a personal security code (“PIN Code”) and a card for each member,
to design and provide special services to program members via our more than a a hundred program partners (https://www.turkishairlines.com/en-nl/miles-and-smiles/program-partners/index.html ) operating in a wide range of sectors such as airlines companies, car-rental companies, banks which provide credit cards used to accumulate Miles, hotels, insurance companies, health service providers, tourism companies, organizations providing shopping and entertainment services, telecommunication companies, educational institutions and energy companies,
to spend Miles at Shop&Miles and to provide Miles for spendings with a credit card,
to benefit our Miles&Smiles credit card holder members with Miles in different rates according to the sector,
to make our members and their preferred relatives benefit from various advantages (such as free tickets, cabin upgrades) with earned Miles&Smiles Miles according to the membership status,
to perform transactions such as buying Miles, transferring Miles, activating miles that are outdated, paying ticket taxes with Miles and converting Miles,,
to enable booking a ticket from the website and mobile applications, to design special campaigns for Miles&Smiles members through various surveys, to offer special opportunities for our members' birthdays, to cut celebration cakes, to organize special surprises and services for our members such as valet parking and private driver service,
in case you request a [Family Membership], to take necessary actions within the Miles collected by family members, (If you open a family membership account, all members within the family can view the account movements of other family members) As a general feature of loyalty programs, to reward loyal member behavior and shape the program according to the member expectations. follow-up of member behavior.
in case you have a RFID baggage card, to inform you by SMS about the status of your baggage at the airport,
to reward loyal members as a general feature of loyalty programs and to follow member behaviours to customize the program according to the member’s expectations.

To Whom We Transfer Your Personal Data and Why?

Under certain circumstances, we may transfer your personal data that we process to third parties residing within borders or abroad, in accordance with applicable laws.

The categories of third parties that we may transfer your data to can be listed categorically as follows:

Our business partners residing within borders or abroad ; e.g. ground operation service providers at airports, agencies, transportation service providers, global distribution systems, partner airlines that will provide you services during connecting flights,
Group companies , e.g. certain services offered by THY are carried out by our affiliates, within this context, your personal data may be shared with our relevant affiliates. You may find more detained information regarding our group companies on Türk Hava Yolları Anonim Ortaklığı Policy on Protection and Processing of Personal Data or from the following link: https://www.turkishairlines.com/en-tr/press-room/about-us/index.html
Suppliers ; e.g. software companies that we procure technical services, research companies, agencies that perform special campaign service for members, security firms, transportation service providers,
Foreign countries that the transportation is carried out to and private and public institutions authorized by national or international legislations ; e.g. to enforcement agencies, executive or judicial bodies in relation to ongoing investigations or when travelling to United States of America, to United States National Security Council etc.

What are Your Rights as Data Subjects?

Where permitted by law you are entitled to a number of rights:

YOUR RIGHTS
	Learn whether data relating you is being processed.
	Request further information if personal data relating to you has been processed.
	Learn the purpose for the processing of personal data and whether data are being processed in compliance with such purpose.
	Request a copy of your personal data we hold.
	Learn to which third-party recipients your data is disclosed.
	Request rectification of the processed personal data which is incomplete or inaccurate and request such process to be notified to third persons to whom personal data is transferred.
	Request deletion or destruction of personal data in the event that the data is no longer necessary in relation to the purpose for which the personal data was collected, despite being processed in line with the Law and other applicable laws and request such process to be notified to third persons to whom personal data is transferred.
	Obtain the personal data you provided to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller.
	Object to negative consequences that you experienced as a result of analysis of the processed personal data by solely automatic means.
	Object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing purposes).
	If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.

Under the GDPR, these rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in the GDPR. We will inform you of relevant exemptions we rely upon when responding to any request you make.

In most cases we will not charge a fee for your requests. However, where the request is manifestly unfounded or excessive we may charge a reasonable fee based on the administrative costs generated by your request.

The right to object to processing of personal data (Article 21 of the GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6 (1) (e) or (f) of the GDPR, including profiling based on those provisions.

We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Contact Information

If you have any concerns about how we process your data, or if you would like to opt-out of direct marketing, based on the laws applicable to you, you can reach out to:

Türk Hava Yolları Genel Yönetim Binası Yeşilköy Mah. Havaalanı Cad. No:3/1 34149

00 90 212 463 63 63

If you live in Germany and have an unresolved concern you can also contact our German DPO:

+49 069 955171 22/53

Turkish Airlines Inc. Hamburger Allee 4 (Westendgate) 60486 FRANKFURT

OTHER LANGUAGES

You can use the documents below to examine the translations of this page in other languages.