This notice explains how personal data is processed when a person requests an insurance quote, applies for a policy, makes a payment, receives a policy, requests a correction, cancellation or refund, or contacts the Company about an insurance transaction. It is an information notice, not an explicit-consent request. Reading the notice is not recorded as consent.
This notice is provided for information. It does not require a consent or contractual acceptance checkbox. Evidence that the notice was presented may be retained separately.
1. Data controller and insurance roles
For the Company's own website, insurance-agency, quote coordination, premium collection, policy delivery, communication, security and record-keeping activities, the data controller is Mark Sigorta Aracılık Hizmetleri Anonim Şirketi, Istanbul Trade Registry No. 348433-5, MERSIS No. 0612151602000001, Insurance Agency Registry No. T220706-6UJ6, at Üçevler Mahallesi 955. Sokak No: 1 D: 38, 34513 Esenyurt, Istanbul, Türkiye. KEP: [email protected].
The Company is an insurance agency, not an insurer. The licensed insurer identified in the quote, pre-contractual information, transaction summary and policy provides the insurance coverage and may act as a separate data controller for underwriting, policy administration, assistance and claims. Payment institutions, assistance companies and other regulated recipients may also act under their own legal responsibilities.
2. Persons whose data may be processed
Depending on the transaction, data may relate to the applicant, policyholder, insured person, beneficiary, payer, parent, guardian, representative, emergency contact or another person whose information is lawfully required for the selected product. A person submitting data for another individual must have lawful authority and must provide the relevant notices to that individual where required.
3. Categories of personal data
The Company may process, to the extent required for the selected product and stage:
- identity data, including name, other given names, surname, date and place of birth, nationality, gender and identification details;
- passport or travel-document data, including document type, number, issuing country, issue date and expiry date;
- contact data, including email address, telephone number, postal address and notification preferences;
- travel and policy data, including destination, arrival and departure dates, policy period, selected product, coverage option and persons insured;
- quote and application data, including declarations, answers, product eligibility, premium calculation, quote validity and transaction history;
- policy data, including insurer, policy number, inception and expiry dates, premium, coverage limits, endorsements, cancellation and delivery records;
- payment and accounting data, including amount, currency, payment status, payment reference, payer relationship, invoice details, refund and chargeback records, but not full card number or card security code in the Company's application database;
- communication and support data, including email, SMS, request, complaint, correction, cancellation and dispute records;
- technical and security data, including IP address, date and time, device and browser characteristics, server logs, verification events and fraud-prevention indicators;
- documents voluntarily or lawfully provided for the application, policy, correction, cancellation, assistance or claim-related guidance.
The standard online travel-insurance application does not require health data merely to start the ordinary form. Health or other special-category data must not be requested as a routine field unless the selected product, underwriting, assistance or claims process genuinely requires it and the applicable processing condition has been determined.
4. Purposes of processing
Personal data may be processed to:
- create and secure an insurance draft and preserve progress;
- identify the requested insurance product and obtain or calculate a quote;
- check completeness, format and apparent consistency of application information;
- transmit necessary application data to the insurer identified for the transaction;
- support underwriting and policy-issuance operations within the Company's agency authority;
- display the product, insurer, policy period, coverage summary, premium and other price items;
- collect and reconcile the premium or other disclosed amount;
- issue, retrieve and deliver the policy through the insurer's system or authorized agency infrastructure;
- provide application and policy status information;
- handle correction, endorsement, cancellation, withdrawal and refund requests;
- direct the insured to the insurer or assistance channel and provide administrative guidance;
- manage accounting, tax, invoicing, audit and regulatory records;
- prevent unauthorized applications, payment fraud, duplicate transactions and technical misuse;
- establish, exercise or protect rights and resolve complaints, payment disputes or litigation;
- comply with lawful requests and insurance, consumer, tax, commercial and data-protection obligations.
5. Legal grounds
Ordinary identity, contact, travel, application, policy and payment data may be processed because processing is necessary to take steps at the person's request before a contract, to conclude or perform the insurance and agency-related transaction, to comply with legal obligations, to establish or protect rights, or for the Company's legitimate interests in security, auditability and transaction integrity after a balancing assessment.
Special-category data is processed only where a condition permitted by applicable law exists. If explicit consent is legally required for a specific health-data operation, it is requested separately after a specific notice. Consent is not used as a blanket substitute for another applicable legal ground.
6. Collection methods
Data may be collected directly from the person through forms, document uploads, payment and tracking screens, email, telephone or support channels; from a lawful representative; and from the selected insurer, payment provider, assistance provider or another authorized service provider involved in the transaction. Technical data is generated automatically when the website or secure transaction links are used.
7. Recipients
Only to the extent necessary and lawful, data may be disclosed to:
- the licensed insurer identified in the quote, transaction summary or policy;
- the insurer's authorized policy, underwriting, assistance, claims or technical service providers;
- banks, payment institutions, card networks and fraud-prevention providers;
- hosting, cybersecurity, email, SMS, document-delivery and customer-support providers;
- accounting, audit and legal advisers;
- the Insurance Information and Monitoring Center and other insurance-sector systems where the transaction or law requires it;
- the Insurance and Private Pension Regulation and Supervision Agency, Financial Crimes Investigation Board, tax authorities, courts, law-enforcement bodies and other authorized institutions where required or permitted by law.
The selected insurer's own privacy notice applies to processing carried out under that insurer's responsibility. The Company does not sell personal data to third parties.
8. International transfers
An international transfer is made only where a lawful transfer mechanism is available and the transfer is necessary for a defined purpose. A general insurance-contract checkbox is not treated as international-transfer consent.
If a specific transfer must rely on explicit consent, the recipient, destination country, data categories, purpose, necessity, safeguards, material risks and consequence of refusal are shown in a transaction-specific notice. The separate conditional transfer consent is activated only for that transfer.
9. Retention
Access to an incomplete encrypted draft expires seven days after the draft was last saved. Short-lived signed handoff and payment-intent records expire within their technical periods. Completed quote, application, policy, payment, acceptance, delivery, cancellation, complaint and security records are retained only for periods necessary for the service, the insurance relationship, statutory accounting and regulatory duties, limitation periods and the establishment or defence of rights.
Where the Company is not legally entitled or operationally required to keep a document, it is deleted, destroyed or anonymized after the relevant purpose and retention period end. An insurer may have separate statutory retention duties for its own records.
10. Automated checks
Automated tools may validate formats, calculate product eligibility or premium using configured insurer rules, detect duplicates or suspicious activity and route the transaction. These checks do not constitute a claim or indemnity decision by the Company. A material Company-side result may be reviewed by a person after identity and transaction verification.
11. Children and representatives
Where insurance is requested for a child or another person who cannot act alone, the person making the request confirms that they are the parent, guardian or otherwise authorized representative. Evidence of authority may be requested. A policyholder or payer who supplies another person's data must act lawfully and accurately.
12. Rights and contact
Subject to Article 11 of Law No. 6698 and its conditions, the data subject may request information, correction, deletion or destruction, information about recipients, objection to certain solely automated outcomes and compensation for unlawful processing.
Requests concerning the Company's processing may be submitted through the visas.org.tr data-subject request channel, by signed letter to the registered address or from a registered electronic mail account to [email protected]. Proportionate identity and authority verification may be required. Requests concerning the insurer's own processing may also need to be directed to the insurer identified in the transaction documents.
This notice should be read with the general Privacy Policy, the Türkiye Visa Privacy Supplement where the insurance flow follows a Türkiye visa journey, and the selected insurer's privacy notice.