SunExpress Protection of Personal Data Announcement

This page is only available in the current language.

Table of Contents

  1. Controller
  2. Scope, Purpose and Legal Basis of the Processing of Personal Data
    1. On our website
      1. Provision of the Website and Creation of Log Files
      2. Use of Cookies
      3. Use of the Services Offered on Our Website
      4. Newsletter
    2. Processing for ticket sales
    3. Our Legitimate Interests in the Processing of Personal Data
    4. Other Processing Obligations
    5. Obligation to Specify Personal Data
  3. Duration of the Data Processing
  4. Right to Object Pursuant to Art. 21 GDPR
  5. Forwarding of Personal Data to Third Parties
  6. Your Rights as the Data Subject
  7. Consent
  8. Disclaimer and Limits of this data protection information

SunExpress takes the protection of your personal data very seriously. In this data protection information we inform you about which personal data we process from you:
(i) when using the website (see in particular Section 2.1.) and also
(ii) if you purchase a ticket from us (see section 2.2.)

1. Controller

Below, we as Controller (Art. 4 Nr. 7 GDPR, Art. 3 (1) (i) KVKK),

  • SunExpress Güneş Ekspres Havacılık A.Ş. (TR-07230 Antalya, Türkiye, P.O Box 28, Yenigöl Mah. Nergiz Sok. No: 84 PK, Muratpaşa / Antalya / Türkiye)

and

  • SunExpress Deutschland GmbH (Gateway Gardens, De-Saint-Exupéry-Straße 10, D-60549 Frankfurt am Main, Deutschland)

(hereinafter also referred to as “SunExpress”, „we“, „us“, „our“), inform you about the processing of your personal data (Art. 4 Nr. 1 GDPR, Art. 3 (1) (b) KVKK) in connection with the use of our website https://www.SunExpress.com („website“) as well as the sale of our products and services.

Should you have any other questions concerning data protection in connection with our website or the services offered on the website, please contact our Data Protection Officer:

[Data protection officer of SunExpress Güneş Ekspres Havacılık A.Ş.:
E-mail: [email protected]]

[Data protection officer of the SunExpress Deutschland GmbH:
E-mail: [email protected]]

Your privacy matters to SunExpress as much as it matters to you. Thus, we aim to inform you on the processing purposes, manners of your personal data by SunExpress and to whom it will be transferred. Your personal data you share with SunExpress via our website and other electronic communication and sale channels will be processed in accordance with this information.

The processing of personal data is performed in accordance with the Law on the Protection of Personal Data numbered 6698, as well as the General Data Protection Regulation (Reg. EU 2016/679) (“GDPR”) and German Laws (especially BDSG 2018) if applicable (“Data Protection Legislation”).

In the following situations, we collect and use personal data directly from our users or from other sources (as presented below):

2.1. On our website

2.1.1. Provision of the Website and Creation of Log Files

Every time you as a user access our website, our system automatically records data and information from the requesting computer system. In this context, the following data („technical information“) are collected:

(1) Information on the browser type and version
(2) The user’s operating system
(3) The user’s Internet service provider
(4) The user’s IP address
(5) Date and time of the access
(6) Websites from which the user’s system accesses our website
(7) Websites that are accessed by the user’s system via our website

The data are also saved to our system’s log files. These data will not be stored together with other personal data of the user.

In this context, we collect and use this technical information for purposes related to (network) security (e.g. to be able to combat cyber-attacks), marketing, to gain a better understanding of our users‘ needs, to continually improve our website and to enable the delivery of the website to the respective user’s computer.

The objective of the storage in log files is to ensure the operability of the website. Moreover, we use the data to optimise the website and to ensure the security of our information technology systems. In this connection, the data are not analysed for any marketing purposes.

The legal basis for the temporary storage of the data and of the log files is Art. 6 (1) f GDPR.

2.1.2. Use of Cookies

Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be saved to the user’s operating system. This cookie contains a specific character sequence that enables unique identification of the browser when the website is accessed again.

Cookies are stored on the user’s computer, from where they are transmitted to us. You as the user have full control over the use of cookies. You can deactivate or limit the transmission of cookies by changing the settings of your web browser. Previously stored cookies can be deleted whenever you wish. This can even take place automatically. If cookies are deactivated for our website, it might no longer be possible to fully use all functions of the website.

For further information on the cookies we use, their purpose and legal basis, please refer to our Cookie Policy.

2.1.3. Use of the Services Offered on Our Website

On our website, we offer various different services and applications. To render these, we need to collect and process personal data of the user or of our customer.

SunExpress may use your personal data for the following purposes:

  • Supporting you throughout the transactions you perform on our website via Live Chat,
  • Newsletter (see section 2.1.4.)
  • In connection with loyalty programs which may be carried out from time to time, sending newsletters and personalized offers,

based on your given consent according to Art. 6 (1) (a) GDPR, Art. 5 (1) KVKK;

  • Providing you with requested offers and services,
  • Administering loyalty programs which may be carried out from time to time,
  • In loyalty programs which may be carried out from time to time, ensuring that members can set up and manage their accounts effectively,
  • In loyalty programs which may be carried out from time to time, rewarding members with flights, “BonusPoints”, free flights and extra SunExpress services which can be paid with issued BonusPoints,

based on a contractual obligation according to Art. 6 (1) (b) GDPR, Art. 5 (2) (c) KVKK;

  • Providing special flight offers and services,
  • Creating databases, listing, reporting, verifying, analyzing and evaluating; producing statistical information,
  • Analyzing how you use our website and other communication and sales channels and making your communication channels unique to you for better service and contacting you through the communication channels that you have shared directly with us or through the service providers,
  • Investigating and improving our products and services and your personal choice possibilities related to these and promoting our services or related products, maintaining promotional commercial communication about new products, special flight offers, advantageous flight change offers and other information that you may find interesting,
  • The provision of flight safety and security, the protection of life or property of SunExpress, SunExpress employees, SunExpress service providers, or their employees or SunExpress guests,
  • The prevention of fraud, performance of internal audits, establishment of security as well as the handling of legal and other claims;

based on our legitimate interests according to Art. 6 (1) (f) GDPR, Art. 5 (2) (f) KVKK; and

  • The fulfillment of legal obligations including compliance with the rules to which SunExpress is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

based on legal obligations according to Art. 6 (1) (c) GDPR, Art. 5 (2) (a), Art. 5 (2) (ç) KVKK.

For these purposes we may collect the following data types from you:

  • Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information,
  • Identification and passport information,
  • Ticket and flight booking details,
  • Provide information about billing and payment instruments,
  • Your product order information,
  • Your personal interests,
  • Your information that you have communicated to us in the context of your requests and complaints about our products and services,
  • Your information about your use of our website and other communication channels,
  • Pick up your preferences for products or services or your past experience.

2.1.4. Newsletter

On our website, you can subscribe to a free newsletter. For this we collect and process your e-mail address that you enter in the input dialogue. Additionally, the following data are collected during the subscription:
(1) IP address of the requesting computer
(2) Date and time of the registration
In the course of the subscription process, your consent to the processing of the data will be obtained, and reference will be made to this Privacy Policy.

If you purchase goods or services on our website and enter your e-mail address while doing so, the e-mail address may subsequently be used for the transmission of a newsletter. In such a case, the newsletter will only contain direct advertising for similar goods or services of our company.

In connection with the data processing for the dispatch of the newsletter, no data will be forwarded to third parties. The data will be used exclusively for the purpose of sending the newsletter.

The legal basis for the processing of data after the user’s subscription to the newsletter with the user’s consent is Art. 6 (1) a GDPR and for sending the newsletter due to the purchase of goods or services is Art. 6 (1) f GDPR.

2.2. Processing for ticket sales

For the case of you buying a flight ticket from us (via Website or through one of our agency partners) we process your personal data for the following purposes:

  • Better meeting your travel needs

based on contractual obligations according to Art. 6 (1) (b) GDPR, Art. 5 (2) (c) KVKK as well as our legitimate interests according to Art. 6 (1) (f) GDPR, Art. 5 (2) (f) KVKK;

  • As well as the purposes stated in 2.1.3. above.

For these purposes we may collect the following data types from you:

  • Your name, surname, occupation, address, telephone and fax numbers, e-mail address and other contact information,
  • Identification and passport information,
  • Ticket and flight booking details,
  • Provide information about billing and payment instruments,
  • Your product order information,
  • Your personal interests,
  • Your information that you have communicated to us in the context of your requests and complaints about our products and services,
  • Your information about your use of our website and other communication channels,
  • Pick up your preferences for products or services or your past experience.

2.3. Our Legitimate Interests in the Processing of Personal Data

In case Art. 6 (1) (f) GDPR represents the legal basis for the processing, our legitimate interests comprise the following points apart from the purposes listed above:

  • Protection of the company against material and non-material damage
  • Professionalisation and Improvement (of our products and services)
  • Cost optimisation (control and minimisation)

2.4. Other Processing Obligations

If we are required by law to do so, we may process your personal data e.g. in order to comply with retention obligations under commercial or tax law or to meet requirements under security law. For further information on retention periods, please refer to „Duration of the Data Processing“.

2.5. Obligation to Specify Personal Data

With respect to mandatory statutory or contractual requirements, we have indicated the mandatory fields that need to be completed in the input dialogues on our website so that we can perform the contract or service you request.

3. Duration of the Data Processing

Your personal data will be erased as soon as they are no longer needed for the said purposes. Personal data may be retained for the period during which claims may be asserted against SunExpress. Additionally, the personal data will be stored insofar as and for as long as SunExpress is required to do so by law. Among other things, the obligations to furnish evidence and the retention obligations are governed by the local commercial, tax and anti-money laundering laws. These retention periods provide for storage times of up to 30 years.

4. Right to Object Pursuant to Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6 (1), including profiling based on those provisions.
The controller will no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

5. Forwarding of Personal Data to Third Parties

In order to be able to offer you our products and services on the basis of our contractual obligations or under consideration of our legitimate interests, we may need to forward your personal data to third parties in or outside SunExpress. These recipients can be categorised as follows:

  • Other SunExpress entities
  • Service provider
    • Transport
    • Marketing
    • IT
    • Payment services
    • Credit agencies
    • Customer feedback services
  • Governmental authorities

In this context, personal data may be transmitted to third countries or international organisations. For your protection and the protection of your personal data, such data transfers are subject to appropriate safeguards pursuant to and in accordance with the statutory requirements (especially application of EU standard contractual clauses), or the EU Commission has issued an adequacy decision (Art. 45 GDPR).

For information on EU standard contractual clauses, refer to [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF]. The EU Commission makes the information on its adequacy decisions available under [https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en#dataprotectionincountriesoutsidetheeu].

You can request a copy of the security measures applied from [email protected].

Moreover, we are under the statutory obligation to provide personal data to German and international authorities (Art. 6 (1) c GDPR in conjunction with local and international regulations and treaties).

6. Your Rights as the Data Subject

SunExpress endeavours to ensure fair and transparent processing. To us, it is important that data subjects can exercise both their right of objection and, if the respective legal conditions are on hand, the following rights:

  • Right of access
  • Right to rectification
  • Right to erasure („right to be forgotten“)
  • Right to restriction of processing
  • Right to data portability
  • Right to object as above (see section 4)

Those rights are governed by the Law on the Protection of Personal Data numbered 6698 as well as the General Data Protection Regulation (Reg. EU 2016/679) and German Laws (especially BDSG 2018) if applicable (“Data Protection Legislation”).

To exercise your right, you can write an e-mail to [email protected]. Please note that we will process your personal data pursuant to a legal obligation in order to be able to process your request and for identification purposes.

Furthermore, you may file a complaint with a supervisory authority (Art. 77 GDPR, Art. 14, 15 KVKK). Supervisory authority responsible for SunExpress:

Der Hessische Datenschutzbeauftragte
Prof. Dr. Michael Ronellenfitsch
Postfach 31 63
65021 Wiesbaden

Telephone: +49 (0) 6 11/140 80
Fax: +49 (0) 6 11/14 08-900 or 901

E-mail: [email protected]

Kişisel Verileri Koruma Kurumu
Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4
06520 Balgat-Çankaya/Ankara

Telephone: +90 312 216 5050
Homepage: http://www.kvkk.gov.tr

If you have given us your consent to the processing of your personal data, we hereby inform you that you can revoke this consent whenever you wish.

If you gave your consent on this website, please visit the page on which you had originally given your consent or log in to your registered account in order to revoke your consent in the settings.

If you have given us your consent for the newsletter, you can revoke it by clicking the „Unsubscribe“ link directly in the newsletter.

In all other cases or if you have difficulties revoking your consent on this website, please feel free to contact [email protected].

Please note that your revocation of consent will only apply in the future and does not affect the legitimacy of the processing that has taken place in the past. In some case, we may be entitled to continue to process your personal data despite your revocation on a different legal basis, e.g. to fulfil a contract.

8. Disclaimer and Limits of this data protection information

This privacy policy merely applies to processing by the website https://www.sunexpress.com. Other websites are not covered by this privacy policy and provide their own specific privacy policies.