Last Updated: August 16, 2026

This policy provides information about third-party platforms, APIs, and technical integrations used or potentially to be used in the future in GuvenTravel Sherlock and GüvenTravel's other digital services provided by GÜVENTUR SEYAHAT TURİZM ACENTESİ TİCARET LİMİTED ŞİRKETİ.

The purpose of this page is to ensure that users can clearly see which digital services may be used for which purposes and the fundamental principles applied to data processing in these integrations.

1. Basic Approach

The following fundamental principles are applied in GüvenTravel's digital systems:

• Processing only the data necessary for the service
• Requesting only the necessary system and API permissions
• Limiting unauthorized access
• Not selling user data as commercial data
• Clearly informing users
• Not retaining unnecessary data
• Enabling users to submit requests regarding their data
• Complying with the security and usage rules of third-party platforms

The fact that an integration is technically possible does not mean that GüvenTravel has access to all services or all user data of the relevant platform.

2. GuvenTravel

GuvenTravel Sherlock is the corporate application infrastructure that helps manage GüvenTravel's customer communication and digital integration processes.

The system may be used for purposes such as;

• customer communication,
• management of WhatsApp messages,
• reservation support,
• routing customer requests,
• operational notifications,
• secure data exchange with third-party systems

GuvenTravel Sherlock's integrations may change over time according to service needs.

Under this policy, actual data processing activities take place only within the scope of activated integrations.

3. General Data Flow

If a user communicates with GüvenTravel through digital channels, the general data flow may occur as follows:

User → Communication Platform → GuvenTravel Sherlock / GüvenTravel Systems → Authorized GüvenTravel User

For example, a customer message sent via WhatsApp may;

1. be received through the WhatsApp infrastructure,
2. be transferred to the GuvenTravel Sherlock system through an authorized integration,
3. be viewed by GüvenTravel's authorized employees,
4. be used to respond to the customer's request or carry out the relevant reservation process.

Data is transferred only to the systems necessary to provide the relevant service.

4. Meta and WhatsApp Business

GüvenTravel may use the WhatsApp Business Platform and relevant business services provided by Meta for customer communication.

The data that may be processed within the scope of this integration may include the following, depending on the transaction performed by the user:

• phone number,
• WhatsApp profile information,
• message content,
• message date and time information,
• message identifiers,
• delivery or status information,
• documents, photographs, or other files sent by the user.

These data may be used for;

• responding to customer requests,
• providing reservation support,
• providing information about travel services,
• conducting operational communication

purposes.

GüvenTravel does not transfer user data obtained through WhatsApp to third parties for the purpose of selling data.

Data processing activities carried out by Meta and WhatsApp within their own infrastructures are subject to the policies and terms of the relevant platforms.

5. Google Integrations

GüvenTravel may establish integrations with digital services provided by Google in the future, depending on service requirements.

These may include, for example:

• authentication with a Google account,
• Google Drive,
• Google Sheets,
• Google Calendar,
• Gmail,
• Google Workspace services

.

If a Google integration is used, GüvenTravel aims to request only the permissions necessary for the relevant feature to function.

Use of Google Data

When a Google API integration is activated, user data accessed is used only to provide the feature requested or explicitly authorized by the user.

For example, if an application was developed only to perform calendar operations, access to Gmail or Drive data that is not required for the function is not requested.

The scope of the Google permissions used by GüvenTravel is determined according to the active integration, and this policy is updated when necessary.

User data obtained from Google APIs is not used to create advertising profiles or sell personal data.

6. Microsoft Integrations

GüvenTravel may establish integrations with services provided by Microsoft when necessary.

These may include, for example:

• Microsoft Entra ID,
• Microsoft Graph,
• Microsoft 365,
• Outlook,
• OneDrive,
• SharePoint,
• Teams

services.

In Microsoft integrations, care is taken to use only the permissions necessary for the relevant application to function.

If an integration requires only the user's profile information, access to unnecessary mailboxes, files, or other corporate data is not requested.

Microsoft user data is used only to provide the relevant service and perform the actions authorized by the user.

7. Communication and Virtual Switchboard Systems

GüvenTravel may use telephone, virtual switchboard, call management, and customer communication systems within the scope of customer services.

Through these systems, data such as;

• phone number,
• call time,
• call routing information,
• communication transaction records

may be processed depending on the nature of the service.

If a service involving voice recording is used, the relevant legal notices and requirements are also applied separately.

8. Reservation and Travel Systems

It may be necessary to exchange data with various reservation or operational systems in order to provide the services offered by GüvenTravel.

These may include;

• ferry reservation systems,
• hotel reservation systems,
• tour operation systems,
• transfer and transportation providers,
• other relevant travel service providers

.

Transferred information is limited to the scope necessary to carry out the relevant reservation or service.

9. Email Systems

GüvenTravel may use email services for customer and operational communication.

When email integration is active;

• sender and recipient information,
• email addresses,
• message content,
• date and time,
• message attachments

may be processed within the scope of carrying out the relevant communication process.

10. API Permissions and the Principle of Least Privilege

The principle of least privilege is applied as much as possible to the APIs and integrations used by GüvenTravel.

According to this principle, an application should have only the access authority necessary to perform the task it is required to carry out.

For example:

• if only profile verification is required, unnecessary file access is not requested,
• if only calendar operations are required, unnecessary email access is not requested,
• if only messaging is required, access to user data unrelated to the service is not requested.

If the scope of an integration is expanded, the necessary permissions and purposes of data use are reevaluated.

11. OAuth and Access Authorizations

OAuth or similar secure authorization mechanisms may be used in integrations with Google, Microsoft, or other providers.

In these systems, GüvenTravel's purpose is not to obtain the password of the user's third-party account.

The user views which permissions will be granted on the relevant provider's own authorization screen and grants permission.

As a result of the authorization process, technical access keys or tokens may be created for the application to function.

These data may be used for;

• providing application access,
• performing authorized API operations,
• session and security management

purposes.

12. Passwords and Security Codes

GüvenTravel does not request passwords for third-party platform accounts from users.

Users must not send the following information to GüvenTravel:

• Google account password,
• Microsoft account password,
• Meta or Facebook account password,
• WhatsApp verification codes,
• one-time security codes,
• bank or card passwords.

Authorization processes are carried out, as far as possible, through the platforms' own secure login and approval screens.

13. Access Tokens and Technical Credentials

Access tokens, API keys, or other technical credentials used in API integrations may be used to the extent necessary for the operation of the service provided to the user.

Appropriate access controls are sought to be implemented to prevent these data from being viewed by unauthorized persons.

Technical access credentials are not published on publicly accessible pages.

14. Access by Employees and Authorized Users

Access to user data is limited according to job and authorization requirements.

GüvenTravel personnel or authorized users may access data only for legitimate and service-related reasons such as;

• responding to a customer request,
• carrying out a reservation process,
• resolving a technical problem,
• investigating a security incident,
• fulfilling a legal obligation

.

15. Sharing Data with Third Parties

GüvenTravel does not transfer user data to third parties for the purpose of commercial data sales.

However, when necessary to provide the requested service, data may be shared with;

• communication platforms such as Meta or WhatsApp,
• technology providers such as Google or Microsoft,
• hosting and technical infrastructure providers,
• hotels,
• ferry operators,
• transportation companies,
• other travel service providers,
• authorized public institutions

to the extent required by the relevant transaction.

16. Data Retention

Personal data obtained through integrations is retained only;

• for the provision of the service,
• for concluding the customer request,
• for security requirements,
• for operational requirements,
• for legal obligations

for the period necessary.

When the purpose requiring retention ceases to exist and there is no other legal obligation, the relevant data may be deleted, destroyed, or anonymized.

17. Data Deletion

Users may request the deletion of their personal data contained in systems controlled by GüvenTravel.

How to submit a deletion request is explained in detail on the GuvenTravel User Data Deletion Instructions page.

Applications may be submitted to:

info@dikiliguventur.com

.

Data or account information retained in a third-party platform's own systems is subject to the relevant platform's own data management rules.

18. Removal of an Integration

The user may revoke the access permissions granted to GüvenTravel through the account settings of third-party platforms.

When an integration is removed, GüvenTravel's authority to receive new data from the relevant platform may end.

However, deleting data previously transferred to GüvenTravel systems may additionally require a data deletion request.

19. New Integrations

GüvenTravel's digital infrastructure may be developed over time.

When a new;

• API,
• communication platform,
• reservation system,
• authentication system,
• cloud service,
• automation service

is put into operation, data processing activities are evaluated.

If a new integration creates a significant change in the use of personal data, this policy is updated.

20. Inactive Integrations

Mentioning Google, Microsoft, or other platforms in this policy does not mean that all services of these platforms are currently actively used by GüvenTravel.

Data access takes place only when the relevant integration is technically activated and the necessary authorizations are provided.

This approach aims to establish a general framework for digital services that may be used in the future.

21. Related Policies

This page should be evaluated together with the following GüvenTravel policies and documents:

• GuvenTravel Sherlock
• GuvenTravel Application Privacy Policy
• GuvenTravel Application Terms of Use
• GuvenTravel User Data Deletion Instructions
• Law No. 6698 Clarification Text
• General Privacy Agreement
• User Agreement

22. Contact

For questions regarding digital integrations, data use, or personal data:

GÜVENTUR SEYAHAT TURİZM ACENTESİ TİCARET LİMİTED ŞİRKETİ

Brand: GüvenTravel

TÜRSAB Certificate No: 18232

Address: İsmetpaşa Mahallesi, Şehit Sami Akbulut Caddesi No:32/A, 35980 Dikili / İzmir / Türkiye

Telephone: +90 232 700 17 00

Email: info@dikiliguventur.com

KEP: guventurseyahat@hs01.kep.tr

Web: www.guventravel.com