KVKK Disclosure Notice

Last updated: 23 July 2026 -- yournext.tours

Pursuant to Article 10 of Personal Data Protection Law No. 6698 ("KVKK"), in our capacity as data controller we hereby inform you as follows regarding the processing of your personal data.

The data controller is First Point Yazılım Limited Şirketi (providing services under the Your Next Tours brand). Address: Balgat Mah. Ceyhun Atuf Kansu Cad. No: 36 İç Kapı No: 6, Çankaya, 06520, Ankara, Türkiye. MERSIS No: 0386104970700001. Trade Registry No: 513972 (Ankara Trade Registry Directorate). Tax Office/No: Hitit / 3861049707. Registered electronic mail (KEP): [email protected]. Contact: [email protected], +90 505 794 47 75.

This disclosure notice covers the personal data processed by First Point Yazılım Limited Şirketi (Your Next Tours) in its capacity as DATA CONTROLLER; namely the data of guides and company representatives relating to their account, subscription/billing and use of the panel.

With respect to the data collected from participants during a tour and the data contained in pre-tour check-in forms, First Point acts in the capacity of DATA PROCESSOR, on behalf of and under the instructions of the tour company or guide to which it provides services (KVKK Art. 3/1; Decision No. 2020/71 of the Personal Data Protection Board). With respect to the processing of such data, the data controller is the relevant tour company; the processing conditions and the obligations of the parties are set out in the Data Processing Agreement (DPA) concluded between First Point and the tour company, and requests in this regard should primarily be directed to the relevant tour company.

Identity and contact data: e-mail address, display name, organisation/company information.

Profile data: language preference, avatar.

Transaction and usage data: session durations, ratings, service usage records.

Invoice and payment history data: subscription/plan information, invoice records, payment transaction history (amount, date, transaction status). Payment instrument information such as the card number, expiry date and security code (CVV) is NOT STORED by First Point; such information is processed directly by the relevant payment institution (iyzico, PayTR or Polar), within the scope of that institution's own data controllership.

Financial configuration data: the crypto wallet address entered by the guide at their own discretion.

Technical data: SSID/password information relating to the local network (WiFi) configuration of the guide application.

Support correspondence.

Pre-tour check-in data: name, phone model, equipment status, free-text note field (for First Point's role in this category, see Section 2 -- Scope of This Disclosure Notice).

Information constituting special categories of personal data, such as race, ethnic origin, health status, religion, sect or the like, must not be entered into "note"/free-text fields; these fields are not designed for the collection of special categories of personal data.

Retention period: Your personal data is retained for the period required by the relevant processing purpose and for the statutory limitation periods prescribed by legislation. Account, subscription and billing data is retained for the period prescribed by the relevant tax and commercial legislation following the termination of the contractual relationship; support correspondence and pre-tour check-in data for a reasonable period following the completion of the relevant service/tour process; and cookie and log records for a period appropriate to the technical requirements of the relevant system.

Providing and maintaining the service, account management, carrying out subscription and payment/billing processes, providing support services, measuring and improving service quality, and fulfilling legal obligations.

Within the scope of Article 5/2 of the KVKK, each category of personal data processed relies on the following specific legal ground:

• Identity/contact data and profile data: Art. 5/2(c) (being directly related to the establishment or performance of a contract), for the purpose of creating and maintaining the account and providing the service.

• Transaction/usage data and support correspondence: Art. 5/2(c) and Art. 5/2(f) (being mandatory for the legitimate interests of the data controller), for the purposes of providing the service and measuring and improving service quality.

• Invoice and payment history data: Art. 5/2(c), for the purpose of carrying out subscription/payment processes; and additionally Art. 5/2(ç) (being mandatory in order for the data controller to fulfil its legal obligation) with respect to records whose issuance and retention is mandatory under tax legislation.

• Financial configuration data (wallet address) and technical data (WiFi SSID/password): Art. 5/2(c), for the purpose of providing the service features preferred by the guide.

• Pre-tour check-in data: First Point acts in the capacity of data processor in this category (see Section 2); the legal ground is the ground determined by the relevant tour company in its capacity as data controller, together with the Data Processing Agreement between First Point and the tour company.

• All processing requiring the fulfilment of legal obligations (e.g. requests from competent public authorities): Art. 5/2(ç).

In the event that a processing activity requiring explicit consent is to be carried out beyond those listed above (e.g. processing for marketing/campaign measurement purposes that may be offered in the future), such processing will be based solely on consent obtained separately and expressly from the data subject pursuant to Article 5/1 of the KVKK; the present provisions of this notice do not constitute implied or blanket explicit consent for any processing activity.

Your personal data may be shared with hosting and cloud infrastructure service providers and with our e-mail communication/delivery service provider, for the purpose of providing and maintaining the service.

For the purpose of carrying out your payment and subscription transactions, your card information is transferred directly to the relevant payment institution (iyzico, PayTR or Polar) without being stored by First Point; those institutions process the transferred data within the scope of their own data controllership.

For the purpose of fulfilling legal obligations, sharing may be carried out with competent public institutions and organisations where necessary.

In the event that the servers/infrastructure of some of these recipients are located abroad, the transfer is carried out within the framework of the provisions of Article 9 of the KVKK: for transfers to countries affording an adequate level of protection, the existence of one of the conditions listed in Article 5/2 of the KVKK is required; for transfers to countries not affording an adequate level of protection, the transfer is carried out by executing the standard contract published by the Personal Data Protection Board and notifying the Board, or by providing the other appropriate safeguard mechanisms prescribed by legislation. All transfers are carried out in accordance with the conditions provided for in Articles 8 and 9 of the KVKK.

Personal data is collected electronically through the website and panel, the guide application and the participant client, including by means of cookies and server log records.

Pursuant to Article 11 of the KVKK, as a data subject you have the following rights: (a) to learn whether your personal data is processed, (b) to request information if it has been processed, (c) to learn the purpose of processing and whether the data is used in accordance with that purpose, (ç) to know the third parties to whom the data is transferred domestically or abroad, (d) to request rectification if the data has been processed incompletely or inaccurately, (e) to request erasure or destruction of the data within the conditions set out in Article 7 of the KVKK, (f) to request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred, (g) to object to a result to your detriment arising from the analysis of the data exclusively by automated systems, (ğ) to claim compensation if you suffer damage due to unlawful processing. Your applications are concluded free of charge within 30 days at the latest, depending on their nature.

You may submit requests relating to your rights by the methods provided for in the Communiqué on Application to the Data Controller: (i) in writing, to the address specified in Section 1, by registered return-receipt mail or by hand delivery, (ii) to the registered electronic mail (KEP) address [email protected], (iii) via the e-mail address you have previously notified and which is registered in our system, or (iv) by e-mail to [email protected].

Your requests are concluded free of charge within the period specified in Section 8 (Rights of the Data Subject).