GDPR Privacy Policy

Easy Alliance Yazılım Turizm Anonim Şirketi (“Company”, “we”, “us”, or “our”), as the data controller, is committed to protecting the privacy and personal data of our users, clients, and visitors navigating https://tourismos.co and utilizing our TourismOS Software-as-a-Service (SaaS) platform.

This Privacy Policy and GDPR Compliance Statement details how we collect, use, process, disclose, and safeguard your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation.

1. Data Controller Information

Legal Entity Name: Easy Alliance Yazılım Turizm Anonim Şirketi
Registered Address: Sultan Selim Mah., Eski Büyükdere Cd. No:61 İç Kapı No:2, 34415 Kağıthane / Istanbul, Türkiye
Phone Number: +90 850 302 8909
Website: https://tourismos.co
Data Protection Contact / Email: [email protected]

2. Categories of Personal Data We Process

Depending on your interactions with the TourismOS platform, we may collect and process the following categories of personal data:

Identity Data: First name, last name, job title, and tax identification details (for billing and enterprise accounts).
Contact Data: Email address, telephone number, billing/business address.
Account & Profile Data: Username, encrypted passwords, plan subscription details, and user preferences.
Financial & Transaction Data: Payment details, billing history, invoice records, and transaction logs. (Note: Credit card payments are processed securely via third-party PCI-DSS compliant payment gateways).
Technical & Usage Data: IP address, browser type and version, time zone setting, operating system, login logs, session duration, and navigation patterns on the platform.
Communications Data: Support tickets, inquiries, live assistance logs, and feedback submitted to us.

3. Lawful Bases for Data Processing

We only process your personal data when we have a valid legal basis under Article 6 of the GDPR:

Performance of a Contract (Art. 6(1)(b) GDPR): Processing necessary for the provisioning, onboarding, and operation of TourismOS services under our Terms of Service.
Legal Obligation (Art. 6(1)(c) GDPR): Processing required to comply with statutory accounting, tax, electronic commerce, and logging laws.
Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary for platform security, fraud prevention, service enhancement, infrastructure optimization, and technical troubleshooting.
Consent (Art. 6(1)(a) GDPR): Where explicit consent has been given for non-essential cookies, analytics, or direct marketing communications.

4. Purposes of Data Processing

Your personal data is collected and processed for the following purposes:

To set up, manage, and maintain tenant accounts on TourismOS.
To execute financial transactions, issue invoices, and manage subscriptions.
To provide technical support, resolve software tickets, and offer customer assistance.
To ensure network and information security, monitor system availability, and prevent cyber threats.
To send operational notices, system maintenance alerts, and security updates.
To analyze platform usage metrics and optimize overall performance (subject to consent where applicable).

5. Third-Party Service Providers & Data Transfers

To deliver our SaaS solutions efficiently, we work with trusted external service providers (data processors). Your data may be shared with or processed by:

Cloud Hosting & Infrastructure Providers (for database hosting, server deployment, and storage).
Payment Processing Platforms (for secure subscription billing).
Communication & Notification Gateways (for sending transactional emails, SMS, or system notifications).
Analytics & Performance Monitoring Tools (for user interface and bug tracking).

International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are implemented in compliance with Chapter V of the GDPR. This includes transferring data to countries recognized by the European Commission as offering an adequate level of protection, or utilizing Standard Contractual Clauses (SCCs) adopted by the European Commission.

6. Data Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, tax, accounting, or reporting obligations.

When your subscription ends or your account is terminated, your personal data will either be deleted, anonymized, or securely archived in accordance with statutory retention periods under applicable law.

7. Your Rights Under the GDPR

Under Articles 15–22 of the GDPR, as a data subject within the EEA or UK, you possess the following rights:

Right of Access (Art. 15): Request access to and receive a copy of your personal data.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
Right to Erasure / "Right to be Forgotten" (Art. 17): Request erasure of your personal data under certain conditions.
Right to Restriction of Processing (Art. 18): Request restriction of data processing under specific circumstances.
Right to Data Portability (Art. 20): Request to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21): Object to data processing based on legitimate interests or direct marketing.
Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing relies on your consent, without affecting the lawfulness of prior processing.
Right to Lodge a Complaint (Art. 77): Lodge a complaint with a competent Supervisory Authority in your EU Member State of residence.

8. Data Security Measures

We implement robust technical and organizational security measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. These measures include encryption in transit and at rest, strict role-based access controls (RBAC), multi-tenant isolation, continuous monitoring, and routine security reviews.

9. How to Exercise Your Rights

To exercise any of your privacy rights, or if you have questions regarding this GDPR Policy, please contact our Data Protection team at:

Email: [email protected]
Postal Address: Easy Alliance Yazılım Turizm A.Ş., Sultan Selim Mah., Eski Büyükdere Cd. No:61 İç Kapı No:2, 34415 Kağıthane / Istanbul, Türkiye

Requests will be responded to without undue delay and at least within one (1) month of receipt.

Updates to This Policy: We reserve the right to modify this GDPR Privacy Policy to reflect technical, operational, or legal developments. The latest version will always be accessible at https://tourismos.co.