Data Protection Notice (KVKK & GDPR)

Prepared under Art. 10 of the Turkish Personal Data Protection Law no. 6698 (KVKK).

1. Data controller

This Information Notice has been prepared in respect of the processing of your personal data within the scope of services offered through the AllinAlanya brand (the website www.allinalanya.com and mobile app), within the framework of the Turkish Personal Data Protection Law no. 6698 ("KVKK") and the EU General Data Protection Regulation ("GDPR" — EU 2016/679).

The data controller processing your data:

• Entity: BLUELAND GIDA İTRİYAT ELEKTRONİK TİCARET VE PAZARLAMA LİMİTED ŞİRKETİ
• Address: Hacet Mah. Eşref Kahvecioğlu Cad. 07400 Antalya
• Tax number: 1781870189
• MERSİS number: 0178187018900001
• Trade registry number: 32123
• Applications / contact: order@allinalanya.com

2. Personal data processed

AllinAlanya offers multiple services (hubs) under a single brand. The personal data processed varies by the service you use. Data common to all services and data specific to each service are set out separately below.

Common to all services

• Identity: first name, last name
• Contact: phone number, email address
• Transaction security: IP address, browser and device info, log records, cookie data
• Customer transactions: order/booking history, requests and complaint records

Delivery hub (Food, Grocery, Cosmetics, OTC, Flowers)

• Delivery address, hotel and room info
• Order contents (items, quantity, amount)
• Location (via mobile app during delivery)

Note: payments are taken in cash or via card terminal at the door; since no online payment is taken, card details are not collected or stored by us.

Excursions & Activities hub

• Booking details (excursion/activity name, date, number of participants)
• Hotel and room info (for the pick-up point)

Airport Transfer hub

• Flight info (flight number, arrival/departure time)
• Hotel and room info (for the transfer point)
• Number of passengers and baggage info

Tax-Free (VAT Refund) hub

• Passport number and nationality
• Information relating to departure abroad and VAT refund processes

Note: passport and nationality data are processed only if you choose the Tax-Free service, as required by the relevant legislation.

3. Purposes of processing

• Receiving, creating and fulfilling orders and bookings
• Running and verifying delivery and service processes
• Managing customer support and complaint processes
• Invoicing, accounting and meeting tax obligations
• Meeting legal obligations and resolving disputes
• Preventing fraud and ensuring information security
• Where you have given explicit consent: sending campaign, discount, promotion and new-service announcements (marketing)
• Where you have given explicit consent: analysing site usage and carrying out advertising activities (analytics and marketing cookies)

4. Legal grounds for processing

Your personal data is processed under Art. 5 of the KVKK on the following grounds:

• Formation and performance of a contract (Art. 5/2-c): creating the order/booking, carrying out delivery and the service.
• Legal obligation (Art. 5/2-ç): fulfilling tax, invoicing and accounting obligations.
• Legitimate interest (Art. 5/2-f): preventing fraud, ensuring service quality and information security.
• Explicit consent (Art. 5/1): commercial electronic marketing messages and analytics/marketing cookies. This consent is optional and can be withdrawn at any time.

5. Parties to whom data is transferred

To the extent necessary to achieve the purposes above, your data is shared with:

• Courier / delivery team: delivery address and phone (Delivery hub only).
• Excursion and transfer service providers (agency/operator): booking and contact details (Excursion and Transfer hubs).
• Email and SMS providers (Mailchimp, Klaviyo): contact details — only with your marketing consent.
• Analytics provider (Google Analytics 4): anonymous/cookie-based usage data.
• Advertising providers (Meta Pixel, Google Ads, TikTok): cookie-based data — only with your marketing/cookie consent.
• Accountant / financial advisor: invoice and order information.
• Competent public authorities and institutions: within legal requests and obligations.

Since no online payment is taken, no card data is shared with any payment institution or bank.

6. International transfer of data

Some technical providers we use (Mailchimp, Klaviyo, Google, Meta, TikTok) may hold servers abroad (e.g. the US and EU). Your personal data may therefore be transferred abroad under Art. 9 of the KVKK and the relevant GDPR provisions.

These transfers are carried out where the conditions under Art. 9 of the KVKK are met, using protection mechanisms such as Standard Contractual Clauses (SCC) with providers, or on the basis of your explicit consent. Marketing and cookie-based transfers rely solely on your explicit consent.

7. Retention periods

Data type	Retention period	Basis
Order and invoice records	10 years	Tax Procedure Law / TTK
Customer support records	3 years	General limitation period
Site logs	2 years	Law no. 5651
Cookie data	Up to 13 months	KVKK Board practice
Marketing consent / contact	Until consent is withdrawn	Explicit consent
Deleted-account data	Reasonable period after deletion request	Security / legal retention

8. Your rights as a data subject

Under Art. 11 of the KVKK and Art. 15–22 of the GDPR, you have the right to:

• learn whether your personal data is processed and request related information;
• learn the purpose of processing and whether it is used accordingly;
• learn the third parties to whom data is transferred;
• request correction of incomplete or incorrectly processed data;
• request deletion or destruction of data;
• request that correction, deletion or destruction be notified to third parties to whom data was transferred;
• object to processing;
• claim compensation if you suffer harm due to unlawful processing;
• (GDPR) request that your data be transferred in a structured, commonly used format to you or another controller (data portability).

9. How to apply

To exercise the above rights, send your request by email to order@allinalanya.com or in writing to the controller's address above. Applications are concluded within 30 days at the latest, under Art. 13 of the KVKK.

Data subjects located in Türkiye also have the right to complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu, www.kvkk.gov.tr).

10. Children's data

AllinAlanya does not serve users under 18. Over-the-counter (OTC) health products are sold only to users aged 18 and over. If data belonging to an under-18 user is found to be processed, it is deleted immediately.

11. Updates to this Notice

This Information Notice may be updated in line with legislative changes or developments in our services. The current text is always published at www.allinalanya.com; the last-updated date appears at the top.