Last Updated: April 22, 2026

Corporate Information and Jurisdiction: This website and all services provided herein are owned and operated by Zenrota Limited, a company incorporated under the laws of Hong Kong. Operational, regional support, and ground fulfillment services are managed by our regional office in Istanbul, Turkiye.

Primary Contracting Entity:
Zenrota Limited (Hong Kong)
Unit 909, Prosperity Millennia Plaza, 663 King's Road, Quarry Bay, Hong Kong.

Regional Operational Support:
Zenrota Tourism Travel and Trade Limited Company (Türkiye)
Okul Sokak No:1 Altunizade Sitesi A Blok Kat: 4 Daire: 17, 34662 Uskudar / Istanbul, Turkey.

Contact Information:
Email: [email protected]
Global Support — WhatsApp Only: +44 7751127859
Local Office: +90 850 304 7936
Direct Operations: +90 539 234 65 02
Website: zenrota.com

PERSONAL DATA PROTECTION NOTICE UNDER TURKISH LAW NO. 6698 (KVKK)

Effective Date: April 22, 2026

1. Introduction and Identity of the Data Controller

This Notice explains how Zenrota Turizm Seyahat ve Ticaret Limited Şirketi, referred to in English as Zenrota Tourism Travel and Trade Limited Company (the “Company”), processes personal data in its capacity as data controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Data Controller: Zenrota Turizm Seyahat ve Ticaret Limited Şirketi
Address: Okul Sokak No:1 Altunizade Sitesi A Blok Kat: 4 Daire: 17, 34662 Uskudar / Istanbul, Turkey.
Email:[email protected]
Local Office: +90 850 304 7936
Direct Operations: +90 539 234 65 02

This Notice concerns processing activities for which the Company determines the purposes and means of processing. The designation of Zenrota Limited as the platform’s primary contracting entity does not replace the Company’s responsibilities as data controller for those activities.

This Notice provides information under the KVKK and does not constitute a request for consent. Where explicit consent is required, it shall be requested separately.

2. Categories of Personal Data

Depending on the service requested and the information necessary to provide it, the Company may process:

• Identity information: Name, surname, date of birth, nationality, Turkish identity number, passport details, and other identification information required for the relevant booking.
• Contact information: Telephone number, email address, and residential or billing address.
• Financial and transaction information: Payment transaction details, payment status, invoicing information, and refund records.
• Travel and reservation information: Itineraries, passenger details, transportation tickets, accommodation bookings, rental arrangements, tour reservations, and service preferences.
• Digital information: IP address, device and browser information, website activity records, and cookie-related information.
• Health information: Where relevant to a requested health tourism service, the medical information described in Section 6.

The Company limits processing to information relevant and proportionate to the specified purpose.

3. Purposes of Processing

Personal data are processed, where necessary and supported by an applicable legal basis, for the following purposes:

• Receiving and responding to service inquiries.
• Arranging, confirming, managing, and fulfilling reservations and purchases.
• Coordinating services with the relevant travel suppliers.
• Processing payments, issuing invoices, and administering cancellations and refunds.
• Providing customer support, resolving complaints, and improving service quality.
• Sending essential booking confirmations and operational notifications.
• Sending optional campaigns, promotions, and personalized offers where the required consent or authorization has been obtained.
• Fulfilling legal obligations and responding to lawful requests from competent authorities.
• Protecting systems, detecting and preventing fraud, and investigating security incidents.
• Establishing, exercising, or defending legal rights.

Health tourism processing is additionally subject to Section 6.

4. Recipients and Transfers of Personal Data

Only the information necessary for the relevant purpose may be disclosed to the following recipient categories:

• Travel service providers: Airlines, bus, train and ferry operators, hotels, rental providers, tour operators, and other relevant suppliers receive necessary identity, contact, and reservation information to arrange and fulfill the booked services.
• Banks, payment service providers, and financial institutions: Necessary payment, transaction, identity, and billing information may be disclosed to process payments, verify transactions, prevent payment fraud, and administer refunds.
• Authorized public institutions and competent authorities: Relevant information may be disclosed where required or permitted by law.
• Healthcare providers: Necessary identity, contact, and health information may be disclosed for the purposes and subject to the safeguards described in Section 6.

Domestic transfers are subject to Article 8 of the KVKK. Transfers outside Turkey, including any transfer to Zenrota Limited in Hong Kong or to international reservation systems and suppliers, are subject to Article 9 of the KVKK.

International transfers require an applicable statutory transfer mechanism, such as an adequacy decision, appropriate safeguards, or a permitted exception whose conditions are satisfied. A contractual relationship, corporate affiliation, or acceptance of this Notice does not by itself authorize an international transfer.

Where an occasional transfer lawfully relies on explicit consent under Article 9, the relevant transfer information and potential risks shall be explained separately before consent is requested. This Notice does not obtain blanket consent for international transfers.

5. Collection Methods and Legal Bases

Personal data may be collected electronically or in physical form through the website, mobile applications, call center, correspondence, contracts, reservation forms, and other service-related communications.

Where necessary for a booking or service, information may also be received from the person making the reservation on your behalf or from the relevant service provider.

For personal data other than special categories, the applicable legal bases under Article 5 of the KVKK include:

• Contractual necessity: Processing identity, contact, booking, and transaction information where directly related to and necessary for entering into or performing a contract with you.
• Compliance with legal obligations: Processing information necessary to meet applicable accounting, invoicing, recordkeeping, reporting, and other statutory requirements.
• Establishment, exercise, or protection of a right: Processing relevant records to handle disputes and legal claims.
• Legitimate interests: Processing necessary for proportionate fraud prevention, system security, and service improvement, provided that your fundamental rights and freedoms are not prejudiced.
• Explicit consent: Processing for optional purposes where no other applicable legal basis exists, including relevant personalization, marketing, or non-essential cookie activities.

Optional marketing communications are also subject to applicable commercial electronic communication requirements. Consent choices shall be obtained separately where required and may be withdrawn.

Special categories of personal data are governed by Article 6, as explained below. Contractual necessity or legitimate interests under Article 5 alone do not authorize the processing of health data.

6. Special Categories of Personal Data in Health Tourism

Where you request health tourism services, the Company may receive health information necessary to coordinate those services, including medical reports, pre-assessment forms, relevant medical history, appointment information, and treatment-related communications.

Such information is processed only to the extent necessary for the relevant service and where a valid condition under Article 6 of the KVKK applies.

The relevant purposes may include:

• Coordinating appointments, preliminary assessments, and communications with healthcare providers.
• Facilitating the secure transmission of necessary medical information to the relevant healthcare provider.
• Supporting the administrative coordination of treatment and care arrangements.
• Maintaining patient-related administrative records where required by applicable law.
• Responding to lawful audits and requests from competent authorities, including the Turkish Ministry of Health where applicable.
• Coordinating requested post-treatment follow-up.

Processing must comply with Article 6 of the KVKK and applicable Turkish Ministry of Health legislation governing health tourism.

Where explicit consent is the applicable legal basis, it shall be specific, informed, freely given, and obtained separately before processing.

The statutory condition concerning public health, preventive medicine, medical diagnosis, treatment, care, and the planning, management, or financing of health services applies only where its legal requirements are satisfied, including requirements concerning persons subject to professional confidentiality or authorized institutions and organizations. The Company does not acquire that status merely by arranging health tourism services.

Where another condition under Article 6 applies, such as processing expressly required by law or necessary to establish, exercise, or protect a right, processing shall remain limited to that condition and purpose.

Healthcare providers are responsible for their own clinical processing activities in accordance with their applicable legal obligations and privacy notices.

Disclosure of health data requires a valid processing and transfer basis. Transfers outside Turkey must additionally satisfy Article 9; a health-data processing condition alone does not authorize an international transfer.

Health data shall not be used for promotional targeting under this Notice. Any satisfaction assessment shall avoid collecting health information unless necessary and supported by an appropriate legal basis.

7. Your Rights Under the KVKK

Under Article 11 of the KVKK, you have the right:

• To learn whether your personal data are being processed.
• To request information about processing where it has occurred.
• To learn the purposes of processing and whether your data are used in accordance with those purposes.
• To know the third parties to whom your data have been transferred within Turkey or abroad.
• To request rectification of incomplete or inaccurate personal data.
• To request erasure or destruction under the conditions set out in Article 7 of the KVKK.
• To request notification of rectification, erasure, or destruction to third parties to whom the relevant data have been transferred.
• To object to an adverse result arising from the analysis of your personal data exclusively through automated systems.
• To claim compensation for damage arising from unlawful processing.

You may submit a request using the methods recognized under the KVKK and the applicable Communiqué on applications to data controllers. These include a written application to the Company’s address or an email to [email protected] from an email address previously provided to the Company and recorded in its systems.

Further details are available in the KVKK Data Subject Application Form. Use of that form is not mandatory where your application otherwise meets the legal requirements.

8. Retention and Security

Personal data shall be retained for the periods required by applicable law and for as long as necessary for the specified processing purposes. Where the conditions for processing cease to exist, data shall be erased, destroyed, or anonymized in accordance with applicable requirements.

The Company implements technical and organizational measures appropriate to the nature of the data and the risks involved. These include access restrictions, role-based permissions, encryption where appropriate, access logging, and confidentiality controls.

Special categories of personal data are subject to the additional safeguards required by the Turkish Personal Data Protection Board. Access shall be limited to authorized persons who need the information for the relevant lawful purpose.

GET IN TOUCH WITH ZENROTA

Our multilingual support team is available to assist with flight bookings, hotel reservations, customized tours, airport transfers, and general inquiries.

Corporate Headquarters — Hong Kong

Company Name: Zenrota Limited
Registered Address: Unit 909, Prosperity Millennia Plaza, 663 King's Road, Quarry Bay, Hong Kong
Corporate, Administrative, and Financial Inquiries: [email protected]
Global Support — WhatsApp Only: +44 7751127859

Regional Operational Office — Türkiye

Company Name: Zenrota Tourism Travel and Trade Limited Company
Address: Okul Sokak No:1 Altunizade Sitesi A Blok Kat: 4 Daire: 17, 34662 Uskudar / Istanbul, Turkey
Local Office: +90 850 304 7936
Direct Operations: +90 539 234 65 02

Customer Support

General Inquiries and Bookings: [email protected]
Personal Data Protection Inquiries: [email protected]
Availability: 24/7/365 Customer Service and Live Chat