Privacy Notice (KVKK Disclosure)

Effective: 2026-04-27 Version: v1 (test phase draft, pending legal review)

This English version is provided for informational purposes. In case of any conflict with the Turkish version, the Turkish version prevails.

1. Data Controller

This notice is issued under the Turkish Personal Data Protection Law no. 6698 ("KVKK") by the data controller below.

• Legal name: REPERA İÇ VE DIŞ TİCARET LİMİTED ŞİRKETİ
• MERSIS: 0123083863300001
• Trade Registry No: 170704-5 (Istanbul Trade Registry)
• Tax office / number: Tuzla / 1230838633
• Address: Aydınlı Mah. Çakır Sk. Toki 3. Etap Konutları B1 25 Blok No:8 D:4, Tuzla / İstanbul, Türkiye
• Web: suso.travel
• Email: [email protected]

In this notice, "Suso" refers to the flight package / travel service brand operated by Repera.

2. Categories of Personal Data Processed

When you purchase a flight package through Suso, the following personal data is processed:

• Identity data: first and last name, date of birth, gender, national ID or passport number, nationality
• Contact data: email and phone you provide for Suso to communicate with you
• Financial data: transaction details for payments made to Suso and, if you opt for deferred payment, the result of your Findeks credit score query
• Travel data: route, dates, airline, cabin class, PNR
• Technical data: IP address, cookies, device and browser information

3. Purposes of Processing

The data above is processed for the following purposes:

1. Creation and fulfillment of the flight package you have requested
2. Transmitting the necessary information to Suso's contracted TURSAB-licensed travel agency so that the underlying flight ticket can be issued
3. Receiving payment, issuing invoices and meeting financial obligations
4. Performing a Findeks eligibility check if you have requested deferred payment
5. Service notifications, PNR delivery and customer support communication
6. Compliance with retention, reporting and audit obligations under applicable law
7. Service improvement and fraud prevention

4. Legal Basis

Data is processed on the following legal grounds under KVKK Articles 5 and 6:

• Necessity for the conclusion or performance of a contract
• Compliance with a legal obligation
• The legitimate interests of the data controller, provided that the fundamental rights of the data subject are not harmed
• Explicit consent (only for processing types that require it, e.g. Findeks query)

5. Recipients of Data

Your personal data may be shared with the following third parties, limited to what is necessary to deliver the service:

• Contracted TURSAB-licensed travel agency: passenger identity and travel data, for the purpose of issuing the flight ticket. The agency's identity is determined at the time of purchase and disclosed to you in the PNR delivery email.
• Airlines and GDS providers: in the course of ticket issuance through the agency.
• Payment service provider (PSP): for processing the payment made to Suso.
• Findeks (KKB): only with your explicit consent, for assessing eligibility for deferred payment.
• Accountant, e-invoice / e-archive provider: for invoice issuance and retention as required by law.
• Public authorities: in case of a lawful request.

Personal data is transferred outside Turkey only to the extent required for the performance of the flight service and in accordance with KVKK Article 9.

6. Method of Collection

Data is collected through the Suso website and mobile application, via the forms, contracts, payment interfaces and customer support channels you interact with, by automated or partially automated means.

7. Retention

Personal data is retained for the periods required by applicable law and the duration of the purposes set out above. Financial records are retained for at least 10 years under Turkish Tax Procedure Law (no. 213) and Turkish Commercial Code (no. 6102). Other data is deleted, destroyed or anonymized once the processing purpose has ended.

8. Data Subject Rights (KVKK Article 11)

Under KVKK you have the right to:

a. Learn whether your data is being processed b. Request information if it is c. Learn the purposes of processing and whether the data is used in accordance with those purposes d. Know the third parties to whom data is transferred, in Turkey or abroad e. Request correction of incomplete or inaccurate data f. Request deletion or destruction of data within the conditions set by KVKK g. Request that corrections, deletions and destructions be communicated to third parties to whom data has been transferred h. Object to outcomes adverse to you that result solely from automated analysis i. Claim damages if you suffer loss as a result of unlawful processing

9. How to Exercise Your Rights

You may exercise the rights above in writing to Suso through:

• Registered email (KEP): (KEP address pending)
• Email: [email protected]
• Postal address: Aydınlı Mah. Çakır Sk. Toki 3. Etap Konutları B1 25 Blok No:8 D:4, Tuzla / İstanbul, Türkiye

Requests are responded to within 30 days, in line with the Turkish Communique on the Procedures and Principles for Application to the Data Controller.

Note: This is a test-phase draft. Review by a Turkish-law attorney is recommended before publication.