Personal Data Protection Notice (KVKK Disclosure Statement)

1. Identity of the Data Controller

The data controller responsible for your personal data is Cappadocia Experience LLC, operating under the public brand "Cappadocia Balloon Flights".

We are a Wyoming Limited Liability Company established in the State of Wyoming, United States (filing ID 2026-002075110). We are not established in Türkiye. Because we offer services to, and process the personal data of, people located in Türkiye, this notice is provided under the KVKK; the obligations that the KVKK places on controllers resident abroad apply to us in that capacity.

We act as a booking intermediary: we let you discover and book flights and tours and we earn our own booking fee, while the flight or tour itself is performed by independent licensed operators. Each operator acts as a separate and independent data controller for its own purposes (safety manifest, pickup, insurance).

• Legal entity: Cappadocia Experience LLC (Wyoming Limited Liability Company, State of Wyoming, United States)
• Registered office: 30 N Gould St, Ste R, Sheridan, WY 82801, United States
• Operational address: Aydınlı-Orta Mah., Kağnı Yolu Sok. No: 1, 50180 Göreme — Nevşehir, Türkiye
• KVKK / data-protection contact: fly@cappadociaballoonflights.com
• General contact: fly@cappadociaballoonflights.com
• Privacy contact: fly@cappadociaballoonflights.com
• Phone: +90 384 271 23 88

2. Categories of Personal Data We Process

We process only the data we genuinely need to take your booking, deliver the flight or tour through the operator, comply with the law, prevent fraud and (with your consent) improve our service and contact you. We do not collect more than this.

• Identity & passenger data: name and surname, nationality, and — where the operator's safety manifest requires it — passenger weight; the number of participants and, for group bookings, the details of co-passengers entered by the lead guest.
• Contact data: email address, phone number, and the hotel or pickup location you provide.
• Booking & transaction data: the flight or tour booked, date and time, price, the display currency you select, discount/promo codes, deposit and balance amounts, booking reference and booking history. Prices may be shown in a display currency of your choice, but the actual charge settles in EUR.
• Payment data: payment is processed by Stripe; we receive a confirmation and payment token but NEVER store your full card number.
• Account & authentication data: account credentials managed via Supabase, and — if you choose it — sign-in via Google (Google Sign-In / One Tap, where enabled). Guest checkout without an account is also available.
• Technical & fraud-prevention data: at booking time, your IP address and browser/user-agent are captured for fraud prevention; for first-party analytics, only an approximate country is derived from your IP (the raw IP is NOT stored) and a device type is added server-side.
• Usage / analytics data (consent-based): a first-party events log (analytics_events) and listing view counters (listing_views), and — only if you consent — Google Analytics 4 (the _ga / _ga_* cookies). We use NO third-party advertising/ad-targeting cookies and NO ad pixels.
• Reviews / user content: reviews you choose to submit, which are stored and may be displayed.
• Communication data: messages you send us and our correspondence with you (e.g. support, cancellation, refund).

3. Health-Related Eligibility Information (Special-Category Data)

Some flights may be unsuitable during pregnancy or for certain mobility, height/weight or health conditions. Where you or the operator share such information so we can assess suitability or safety, it may constitute special-category (özel nitelikli) personal data under the KVKK.

We minimise this data, use it only for flight-suitability and safety purposes, and process it on the basis of your explicit consent and/or the protection of life and physical safety, as permitted by the KVKK. We do not use it for any other purpose.

4. Purposes of Processing

• Creating and managing your account or guest checkout, and authenticating you.
• Taking your booking and arranging performance of the flight or tour by the independent licensed operator (including passing the safety-manifest details to that operator).
• Processing payments, deposits and balances via our payment service provider, applying discount/promo codes, and handling refunds to your original payment method.
• Sending transactional communications (booking confirmation, cancellation, rebooking and refund notices) that are necessary to perform our agreement with you.
• Complying with legal obligations, including civil-aviation passenger manifests to the relevant authorities (SHGM/DHMI) and tax/accounting record-keeping.
• Preventing, detecting and investigating fraud and securing our platform.
• Measuring and improving our service through analytics — our first-party analytics and Google Analytics 4 — (only with your consent).
• Sending you marketing and measuring our advertising — abandoned-cart recovery email, opt-in commercial email/SMS, and Google Ads conversion tracking for our own campaigns — only where you have given marketing consent.
• Storing and, where applicable, displaying your reviews; moderating and removing content that breaches our standards.
• Establishing, exercising or defending legal claims and responding to authorities' lawful requests.

5. Legal Grounds for Processing (KVKK Art. 5 / Art. 6)

We rely on the following legal grounds, mapped to each purpose. Consent-based processing is always separate from this notice and can be withdrawn at any time.

• Performance of a contract (Art. 5/2-c): taking and fulfilling your booking, processing payment, and sending transactional emails — directly necessary for the agreement between us.
• Compliance with a legal obligation (Art. 5/2-ç): civil-aviation passenger manifests to SHGM/DHMI, and tax/commercial record-keeping.
• Legitimate interests of the controller (Art. 5/2-f): fraud prevention (IP + user-agent captured at booking) and platform security, balanced against your rights and freedoms.
• Establishment/exercise/defence of a legal right (Art. 5/2-e): retaining records needed for disputes and claims.
• Explicit consent (Art. 5/1 / Art. 6 for special-category data): first-party analytics, marketing email/SMS, abandoned-cart recovery, and any health-related eligibility information. These are gathered through separate, unbundled consent and are not a condition of booking.
• Protection of life or physical safety (Art. 5/2-d / Art. 6): where strictly necessary for flight safety and the person cannot give consent.

6. Recipients and Purpose of Transfer

We share your personal data only with the parties below and only to the extent needed. We do NOT sell your personal data and we use no advertising networks. Our one third-party analytics provider is Google (Google Analytics 4), used only if you consent to analytics.

• Independent licensed operators / tour providers: to actually perform and insure the flight or tour. The operator receives the booking and safety-manifest details (name, nationality, weight where asked, reachable phone/email) and acts as a separate, independent data controller for its own purposes (manifest, pickup, insurance).
• Stripe (payment processor): to take payment and process refunds. Stripe handles card data; we never store full card numbers.
• Resend (email service): to send transactional and opt-in email.
• Supabase (database & authentication hosting): to store account, booking and platform data.
• Vercel (application hosting): to run and serve the platform.
• Upstash (hosted Redis): rate-limiting and caching. Your IP address is used as a short-lived rate-limit key; cached search results contain no personal data.
• Arcjet (abuse and bot protection): receives your IP address and basic request metadata to block automated or abusive traffic.
• Google (Maps Places): only while you type a hotel name on the booking form, so Google can return matching suggestions.
• Google (Sign-In): only if you choose to sign in with Google, to authenticate you and return your name and e-mail.
• Google (Google Analytics 4): only if you consent to analytics, Google LLC processes your usage data (pages viewed, an approximate location derived from your IP, device/browser type) as our analytics processor to produce aggregate reports. Google states that Google Analytics 4 does not store IP addresses (your IP is used only transiently to derive an approximate location); our integration denies advertising and personalisation signals (Consent Mode) and we keep Google's advertising features switched off — this never runs for advertising.
• Google (Google Ads): only if you consent to marketing and we are running Google Ads, Google LLC receives conversion data (that a booking occurred, its reference, value and currency) to attribute it to an ad click, as our processor — for conversion measurement of our own campaigns only (no remarketing, Google Signals or ad personalisation).
• Public authorities where legally required: in particular civil-aviation passenger manifests to SHGM/DHMI, and tax/judicial authorities on a lawful basis.
• Professional advisers (e.g. lawyers, accountants) where necessary to protect or exercise our rights.

7. Domestic and Cross-Border Transfers (KVKK Art. 8 / Art. 9)

Sharing of passenger-manifest data with SHGM/DHMI is a domestic transfer (Art. 8) made to comply with a legal obligation.

Some of our sub-processors (Stripe, Resend, Supabase, Vercel, Upstash, Arcjet, and — where you consent to analytics or marketing, or if you use Google Sign-In or the hotel search — Google) operate partly outside Turkiye/the EEA, so your data may be transferred abroad (Art. 9). These are recurring transfers; we rely on appropriate safeguards rather than one-off consent derogations.

Specifically, we rely on adequacy where it exists and otherwise on appropriate safeguards such as the Board-published standard contract (standart sözleşme) / Standard Contractual Clauses (SCCs). You may request a copy of the relevant safeguard via fly@cappadociaballoonflights.com.

We do not transfer data to advertising or remarketing networks for ad targeting; the only ad-related processor we use is Google, for conversion measurement of our own campaigns and only with your marketing consent.

Note on our establishment: we are established in the State of Wyoming, United States, so personal data collected through this platform is processed abroad from the outset. Where the KVKK requires it, we rely on your explicit consent or on the other grounds permitted for cross-border transfer under KVKK Art. 9.

8. Method of Collection and Legal Basis

We collect your personal data through the following channels, on the legal grounds set out in Section 5:

• Directly from you: when you create an account or check out as a guest, complete a booking, enter passenger details, contact us, or submit a review (contract / legal obligation / consent).
• Automatically and server-side: technical/fraud data (IP + user-agent at booking) and first-party analytics signals collected through our website and necessary/consented cookies (legitimate interest / consent).
• From third parties acting for us: payment confirmation from our payment service provider, authentication data from Supabase, and — if you choose it — sign-in data from Google.
• From the lead booker about co-passengers: where a lead guest books for others, that guest confirms they are authorised to share those companions' details.

9. Retention Periods

We keep personal data only as long as necessary for the purpose it was collected and for the periods required by law, then delete or anonymise it.

• Analytics events (analytics_events): automatically deleted after 180 days.
• Raw IP address: NOT stored for analytics — only an approximate country is derived; device type is added server-side.
• Fraud-prevention signals (IP + user-agent captured at booking): retained only as long as needed for fraud defence.
• Booking, payment and financial records: retained for the period required by Turkish tax and commercial law, then deleted or anonymised.
• Account data: retained while your account is active and for any legally required period thereafter.
• Marketing consent records: retained while consent is active and as needed to prove lawful processing.

10. Your Rights as a Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed;
• Request information about the processing if it is;
• Learn the purpose of processing and whether your data is used in line with that purpose;
• Know the third parties to whom your data is transferred, at home or abroad;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of your data where the grounds for processing no longer apply;
• Request that corrections and deletions be notified to third parties to whom the data was transferred;
• Object to a result that works against you arising solely from automated analysis of your data;
• Claim compensation for damage suffered due to unlawful processing.
• In addition, you may withdraw any consent you have given (analytics, marketing, special-category data) at any time, without affecting the lawfulness of prior processing.

11. How to Exercise Your Rights and Complaint Route

To exercise your Article 11 rights, please apply to us in writing or by registered electronic mail (KEP) in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, including the information required to verify your identity.

We will conclude your request free of charge and at the latest within 30 days; a fee set in the Board's tariff may apply where the process entails additional cost.

If your application is rejected, our reply is insufficient, or we do not respond in time, you may file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning our response and in any case within 60 days of the date of your application.

• By email / KEP: fly@cappadociaballoonflights.com
• By post: Cappadocia Experience LLC, Aydınlı-Orta Mah., Kağnı Yolu Sok. No: 1, 50180 Göreme — Nevşehir, Türkiye
• Through your account settings (for access and correction of certain data)
• Withdraw consent any time via the footer "Cookie settings" link and via the unsubscribe link in any marketing message

12. Automated Decisions, Security and Minors

Automated decisions: we do not make any decision producing legal or similarly significant effects on you based solely on automated processing. Automated checks may assist fraud screening, but a human reviews any fraud-related hold.

Security: payments are handled by our payment service provider (we never store full card numbers); authentication and data are hosted on Supabase; data is encrypted in transit; access is restricted. In the event of a personal data breach, we will notify affected individuals and the Personal Data Protection Board within the legally required time.

Minors: our accounts and bookings are intended for adults. Minors may participate only as part of a booking made by a responsible adult and subject to the operator's age and safety rules; we delete account data of minors created without authority.

13. Note for EU/EEA Visitors (GDPR)

If you are in the EU/EEA, our processing is also informed by the GDPR. The legal bases above correspond to GDPR Art. 6 (contract, legal obligation, legitimate interests and consent), and special-category data is processed under the relevant GDPR Art. 9 condition.

You have the GDPR rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Cross-border transfers to our sub-processors rely on appropriate safeguards such as Standard Contractual Clauses.

You may lodge a complaint with your local EU/EEA supervisory authority in addition to, or instead of, the Turkish Board.

14. Changes to This Notice and Contact

We may update this notice from time to time to reflect changes in our processing or the law; the effective date appears at the top. Material changes will be communicated where appropriate.

This notice should be read together with our Privacy Policy, Cookie Policy and Terms & Conditions.

For any question about this notice or your personal data, contact us at fly@cappadociaballoonflights.com or fly@cappadociaballoonflights.com, generally at fly@cappadociaballoonflights.com, by phone at +90 384 271 23 88, or by post at Aydınlı-Orta Mah., Kağnı Yolu Sok. No: 1, 50180 Göreme — Nevşehir, Türkiye.