This notice applies to the single status-search form on visas.org.tr, which requires the transaction reference together with the email address used in that transaction. It is an information notice and not an explicit-consent request.
This notice is provided for information. It does not require a consent or contractual acceptance checkbox. Evidence that the notice was presented may be retained separately.
1. Data controller
The data controller is Mark Sigorta Aracılık Hizmetleri Anonim Şirketi, Istanbul Trade Registry No. 348433-5, MERSIS No. 0612151602000001, at Üçevler Mahallesi 955. Sokak No: 1 D: 38, 34513 Esenyurt, Istanbul, Türkiye. KEP: [email protected].
2. What the status tool is
The status tool searches records maintained in the Company's visa, pre-application and insurance workflows. It is not a direct search of a government, consular, border or insurer claim database unless a result expressly states otherwise.
A Company-side status label describes the recorded stage of the relevant workflow. It does not itself grant a visa, create entry permission, establish insurance coverage or decide a claim.
3. Data processed
The tool may process:
- the application or policy reference entered by the user;
- the normalized form of that reference;
- the email address entered by the user for that transaction, and the keyed, non-reversible value derived from it that is compared with the value recorded on the transaction;
- the date and time of the search;
- a site-specific keyed value derived from the requesting IP address for rate limiting, rather than storing that value as the reference-search identity;
- technical security logs generated by the request;
- the country route, record date and permitted status returned when a match is found.
The status form asks only for the reference and the email address used in the transaction. It does not ask for passport data or payment-card data. Do not enter such information into these fields.
4. Purposes and legal grounds
Data is processed to:
- locate the Company record associated with the reference, and disclose it only where the email address entered matches the address recorded on that transaction;
- display the permitted status through the correct country result route;
- prevent automated enumeration, repeated abuse and unauthorized discovery of records;
- troubleshoot the service and protect legal rights.
Processing may be necessary to perform or support the relevant service contract and for the Company's legitimate interests in secure status access, data minimization and fraud prevention after a balancing assessment. Legal obligations and the establishment or protection of rights may also apply.
5. Security design
A search requires both the reference and the email address used in the transaction; the reference alone does not open a record. The tool uses a limited search rate, and an unsuccessful email match consumes an attempt in the same way as an unknown reference. A matching and a non-matching reference must not produce a response that unnecessarily exposes whether another person's record exists, and a non-matching email address produces the same response as an unknown reference. The address recorded on a transaction is never displayed by the tool. A user must keep the reference confidential and must not search a reference they are not authorized to use.
Rate-limit attempt rows are maintained in a rolling window of approximately fifteen minutes. General server security logs may be retained for the period stated in the general Privacy Policy and operational security schedule.
6. Recipients
Data may be accessible to authorized Company operations and security personnel and to hosting or cybersecurity providers acting under appropriate arrangements. It may be disclosed to authorized institutions where required or permitted by law. The status-search data is not sold or used for advertising.
7. Rights and contact
Subject to Article 11 of Law No. 6698 and its conditions, the data subject may request information, correction, deletion or destruction, information about recipients, objection to certain solely automated outcomes and compensation for unlawful processing.
Requests may be submitted through the visas.org.tr data-subject request channel, by signed letter to the registered address or from a registered electronic mail account to [email protected]. Identity and authority may be verified before information about a transaction is disclosed.
Further information is available in the general Privacy Policy.