Privacy Policy

Last updated: 14 September 2026

1. Purpose and scope

This Privacy Policy explains how personal data is processed in connection with visits to visas.org.tr, public information pages, contact forms, application and insurance flows, payment coordination, status searches, support communications and related security records.

It is a general policy. Shorter, transaction-specific notices are displayed before personal data is collected in visa, insurance, contact and status contexts. Those layered notices describe the exact data and purposes of the relevant process. They should be read together with this Policy.

This Policy is an information notice. You are not asked to consent merely to having been informed. Where a particular operation legally requires explicit consent, that consent is requested separately and specifically.

2. Data controller

The data controller for the Company's own website, application intake, administrative support, insurance agency, payment coordination, communication, security and record-keeping activities is:

Mark Sigorta Aracılık Hizmetleri Anonim Şirketi

• Istanbul Trade Registry number: 348433-5
• MERSIS number: 0612151602000001
• Tax office and number: Esenyurt / 6121516020
• Insurance agency registry number: T220706-6UJ6
• Address: Üçevler Mahallesi 955. Sokak No: 1 D: 38, 34513 Esenyurt, Istanbul, Türkiye
• KEP: [email protected]
• Website: visas.org.tr

An official authority, insurer, payment institution or other organization may act as a separate data controller for processing carried out under its own legal authority and purposes. Its own privacy notice applies to that separate processing.

3. Processing principles

The Company processes personal data lawfully, fairly and transparently; for specified, explicit and legitimate purposes; in a manner that is relevant, limited and proportionate; with reasonable accuracy and security; and only for as long as the relevant purpose and legal retention requirement continue.

The Company does not sell personal data to third parties. Personal data is not used for an unrelated purpose merely because it has been collected through the website.

4. Categories of personal data

Depending on the service used, the Company may process the following categories.

4.1 Identity and civil-status information

Name, surname, other given names, date and place of birth, nationality, gender and, where required by the selected process, parent or guardian details.

4.2 Passport, identity and travel-document information

Document type, country or region of issue, document number, issue date, expiry date, document image or supporting-document details where the process requires them.

4.3 Travel and application information

Destination, purpose of travel, planned arrival date, selected service, application answers, eligibility-related declarations, supporting-document status, application reference, process stage, corrections, result category and document-delivery records.

4.4 Contact and address information

Email address, telephone number, address, language preference and communication history.

4.5 Insurance information

Selected insurance product or period, insured, policyholder and applicant details, insurer, premium, policy reference, issue or delivery status and support records. Health or other special-category data is not requested in the standard insurance intake unless a particular product, underwriting, assistance or claim process makes it necessary and a separate lawful basis and notice apply.

4.6 Payment and accounting information

Payment status, amount, currency, price items, transaction reference, payment date, refund or chargeback status, invoice information and limited information supplied by the payment provider. The Company does not store full card numbers or card security codes in its application database.

4.7 Communication and request records

Contact-form content, emails, messages, support requests, complaints, cancellation or refund requests, data-subject requests and documents submitted for identity or authority verification.

4.8 Technical and security data

IP address, date and time, requested route, browser and device characteristics, server and application logs, security events, form and token events, rate-limit records, fraud indicators and transaction-integrity records.

4.9 Cookie and preference data

Signed opaque workflow references, phone-country preference, consent or preference choices if a preference tool is activated, and other first-party information described in the Cookie Policy.

4.10 Special categories of personal data

The Company does not ask you to submit health, biometric, criminal-conviction, religious, political, trade-union or similar special-category data through a general form. Such data may nevertheless appear in a document you choose to upload. Do not submit special-category data unless it is expressly requested and necessary for the selected process. If it must be processed, the Company applies the conditions and safeguards required by law and provides a separate notice or consent mechanism where necessary.

5. How data is collected

Personal data may be collected:

• directly from you through forms, uploads, payments, status searches and communications;
• from a representative who is authorized to act for you;
• from an official system or authority in connection with a process you requested;
• from an insurer, payment provider, bank, communications provider or other service provider involved in the requested transaction;
• automatically through security logs, server records and essential cookies when the website is used.

If you provide another person's data, you confirm that you are authorized to do so and that the person has received the relevant notice where required.

6. Purposes and legal grounds

The Company processes personal data only where a legal ground applies. The main purposes and grounds are set out below.

6.1 Taking steps at your request and performing a contract

Data may be processed to:

• create and maintain a secure draft;
• assess the route or service indicated by your answers;
• prepare, review, correct and process an application;
• create a quote or coordinate policy issuance as an insurance agency;
• calculate and display price items;
• create and reconcile a payment transaction;
• deliver a document, policy or transaction result;
• provide status information and customer support;
• handle cancellation, refund or correction requests.

This processing is generally necessary to take steps at your request before a contract or to perform the contract you choose to conclude.

6.2 Compliance with legal obligations

Data may be processed to meet obligations relating to insurance agency activity, consumer information, accounting, invoicing, tax, payment records, anti-fraud controls, regulatory reporting, personal-data protection, record preservation and lawful requests from competent authorities.

6.3 Establishment, exercise or protection of rights

Application, acceptance, communication, payment, security and transaction records may be processed to resolve complaints, defend or exercise rights, respond to chargebacks, investigate misuse and manage judicial, administrative or arbitration proceedings.

6.4 Legitimate interests

Subject to a balancing assessment that protects your fundamental rights and freedoms, limited technical data may be processed to secure the website, prevent unauthorized access and fraud, diagnose faults, maintain service continuity, measure internal operational quality and keep evidence of the integrity of a transaction.

6.5 Explicit consent

Explicit consent is used only when the intended processing cannot lawfully rely on another ground and the conditions for valid consent are met. Examples may include a specifically identified optional special-category processing activity, a transfer abroad that genuinely relies on consent, optional non-essential cookies or optional commercial communications. Each consent is separate, specific, informed, freely given and capable of withdrawal.

Refusing an optional consent does not prevent use of an unrelated service. If a particular requested feature cannot technically or legally be provided without the processing described in a separate conditional consent, the consequence of refusal is explained before the choice is made.

7. Recipients and disclosures

Personal data may be disclosed only to the extent necessary to:

• official authorities, official application systems, diplomatic or consular units and other public institutions competent for the requested process;
• an application-processing partner or intermediary service provider that operates a platform used to receive, prepare or forward the transaction on the Company's instructions;
• the insurer identified in an insurance transaction, insurance information systems, assistance or claim service providers and authorized insurance-sector institutions;
• banks, payment institutions, card networks and fraud-prevention providers;
• hosting, infrastructure, cybersecurity, email, SMS, support, document-delivery and other technical providers acting under appropriate instructions or their own legal responsibilities;
• accountants, auditors, legal advisers and other professional advisers where necessary;
• courts, law-enforcement authorities, regulators and other competent bodies where disclosure is required or permitted by law;
• a buyer, successor or restructuring party where a lawful corporate transaction occurs and appropriate confidentiality safeguards apply.

The Company does not disclose more data than reasonably necessary for the recipient's role.

8. International transfers

The use of an official foreign system, an international infrastructure provider or another recipient may involve a transfer of personal data outside Türkiye. A transfer is made only where it is actually necessary and a mechanism permitted by Article 9 of Law No. 6698 is available, such as an adequacy decision, appropriate safeguards, a standard contract or a limited statutory exception.

The Company does not state that a transfer occurs when no transfer is made. If a specific transfer must rely on explicit consent, the recipient, destination country, data categories, purpose, method and material risks must be described in a separate transaction-specific transfer notice, and consent must be requested separately. A generic blanket consent is not used.

9. Automated checks and decision support

The website may automatically validate formats, compare answers with configured rules, detect duplicate or suspicious activity, apply rate limits and produce a preliminary result category. These tools support security and workflow routing.

A preliminary result is not a decision of an Official Authority or insurer. Where an automated result has a material adverse effect within the Company's own process, you may contact the Company and request human review, subject to identity and transaction verification.

10. Cookies, local storage and tracking

The website uses first-party essential or workflow cookies described in the Cookie Policy. They carry signed opaque references or preferences and are not designed to store passport or application content in the browser.

Yandex Metrica (counter 112543243) loads automatically on public information pages, including when no cookie preference has been saved or permission has been declined. Alongside page visits, it measures website use through Session Replay (Webvisor), click maps, link tracking and bounce measurement. The page content you view, your interactions and browser identifiers from cookies or local storage may be sent to Yandex. It is not loaded on application, status, payment, other private transaction or legal pages. Google Ads (tag AW-18448435823) loads automatically on public information pages, independently of saved cookie preferences. Google may receive your IP address, browser and device information, page visits and advertising identifiers, and may use cookies for advertising measurement and personalization. It is not loaded on application, status, payment, other private transaction or legal pages. Google Analytics, Matomo and the site’s conversion events remain disabled. A future provider must not be activated until its exact purpose, data fields, recipient, transfer position, retention, cookie or storage behaviour, consent requirement and preference controls are reflected in the live privacy and cookie documentation. Non-essential tracking must remain off until the legally required choice is made.

11. Retention

The Company applies a purpose-based retention schedule.

• Access to an incomplete encrypted draft expires seven days after the draft was last saved.
• Short-lived form, handoff and payment-intent records expire according to their security purpose; payment intents are designed to expire within one hour and some handoff links expire sooner.
• Completed application, transaction, legal-acceptance, payment, policy, accounting and communication records are retained for the periods necessary to perform the service, comply with statutory duties, establish or defend rights and observe applicable limitation periods.
• Security logs and rate-limit records are retained for a proportionate period based on security need, incident history and legal obligations.
• A record subject to a dispute, lawful hold or regulatory request may be retained until that matter is resolved, even if the ordinary period would otherwise expire.

When the relevant purpose and legal period end, data is securely deleted, destroyed or anonymized in accordance with applicable law and Company policy.

12. Security

The Company applies technical and administrative measures appropriate to the nature of the data and risk. These may include encryption, signed opaque references, restricted access, role separation, secure transmission, logging, monitoring, rate limits, backup controls, provider due diligence and incident-response procedures.

No internet transmission or storage method is absolutely secure. If a personal-data breach occurs, the Company investigates, limits the impact and makes notifications required by applicable law.

13. Children and represented persons

Personal data of children is processed only to the extent necessary for the requested application or insurance process. The person submitting data for a child must be the parent, guardian or another legally authorized person. The Company may request evidence of authority and may refuse or suspend a transaction where authority cannot be verified.

14. Your rights

Subject to Article 11 of Law No. 6698 and the conditions in applicable law, you may request to:

• learn whether your personal data is processed;
• obtain information about processing;
• learn the purpose of processing and whether data is used consistently with that purpose;
• learn the recipients in Türkiye or abroad;
• have incomplete or inaccurate data corrected;
• request deletion or destruction where the legal conditions are met;
• request notification of correction, deletion or destruction to eligible recipients;
• object to a result produced against you solely by automated analysis;
• claim compensation where you suffer damage because personal data was processed unlawfully.

A request may be refused or limited where an exception in applicable law applies, another person's rights would be harmed, identity cannot be verified or retention is legally required. The reason will be explained where required.

15. How to exercise your rights

You may submit a data-subject request:

• through the data-subject request channel made available on visas.org.tr;
• by sending a signed written request to the Company's registered address;
• by sending a request from your registered electronic mail account to [email protected];
• by another method permitted by the applicable application-procedure rules.

The request should identify the applicant, explain the requested right and provide enough information to locate the relevant record. The Company may ask for proportionate identity or authority verification. Do not send a full passport copy unless specifically requested through a secure channel.

Requests are handled as soon as possible and within the statutory period. If the request requires a cost beyond the ordinary response, the tariff permitted by law may apply.

You may also lodge a complaint with the Personal Data Protection Authority after first applying to the data controller in the manner and periods prescribed by law.

16. Service communications and marketing

The Company may send messages necessary to perform a requested service, including security, missing-information, payment, status, delivery, policy and support messages. These are service communications.

Marketing communications are separate. They are sent only where the legal conditions are met and, when consent is required, after a separate optional channel-specific choice. Withdrawing marketing consent does not stop necessary service or security messages.

17. Third-party websites

The website may link to an official portal, insurer, payment provider or another third party. That third party's privacy notice applies to its separate processing. You should review it before providing data directly to the third party.

18. Changes

The Company may update this Policy to reflect legal, operational or technical changes. The revision date will be published. A material change will be communicated by an appropriate method where required.

The notice and revision presented when a transaction is performed are recorded with that transaction where legally or operationally necessary.

19. Language and contact

The English and Turkish versions are intended to have the same meaning. If an inconsistency cannot be resolved, the Turkish version is used for interpretation to the extent permitted by mandatory law.

Questions about this Policy or personal-data processing may be submitted through the contact page, the registered address or the KEP address stated above.