Privacy Policy and Personal Data Notice
Last updated: 14 October 2026
This notice has been prepared by NGT Turizm Seyahat Acenteliği Sanayi ve Ticaret Anonim Şirketi (Progo), as data controller, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
This is a translation; in case of any discrepancy, the Turkish version prevails.
1. Data controller
| Item | Details |
|---|---|
| Company name | NGT Turizm Seyahat Acenteliği Sanayi ve Ticaret Anonim Şirketi |
| Address | Şerifali Mahallesi, Hendem Caddesi No: 38, 34764 Ümraniye / İstanbul, Türkiye |
| Tax office / Tax ID | Sarıgazi Tax Office / 6311259375 |
| MERSİS | 0631125937500002 |
| Registered email (KEP) | ngtseyahat@hs01.kep.tr |
| Phone | +90 850 308 0 444 |
| support@progotravel.com | |
| Website | progotravel.com |
| TÜRSAB licence no | 10057 |
2. Categories of personal data processed
- Identity: First name, last name, gender. Where an invoice is required, Turkish ID number or tax number.
- Contact: Email address, phone number and country code, address.
- Customer transactions: Booking records, pickup and drop-off addresses, date and time, flight number, vehicle preference, number and names of passengers, selected extra services, campaign code used.
- Financial: Billing address, billing name, tax office and number, payment record and amount, refund records. Your card number is not stored; payment is taken through the bank's virtual POS and our systems keep only the masked last four digits and the expiry date of the card.
- Account: If you created an account, your password (stored in irreversibly encrypted form); if you signed in with a social media account, the user ID and profile picture link from that provider.
- Loyalty programmes: Miles&Smiles number, Pegasus BolBol membership status and consent date (only if you linked these programmes to your account).
- Marketing: Consent to campaign notifications, traffic source (search engine, advertisement or referring site), advertising click ID if any.
- Transaction security: IP address, browser and device information, session records, transaction timestamps.
- Cookies: The detailed list, with the purpose, duration and destination country of each cookie, is published in an automatically updated table on the Cookie Policy page.
3. Purposes of processing
- Creating, planning and carrying out bookings
- Assigning drivers and vehicles, operational tracking of transfers
- Taking payments and handling refunds
- Issuing invoices and complying with legal retention obligations
- Sending booking notifications by email, SMS and WhatsApp
- Responding to customer support requests
- Measuring service quality and satisfaction surveys (only with your explicit consent)
- Sending commercial electronic messages (only with your explicit consent)
- Operating the website and remembering your preferences
- Measuring website usage and advertising performance (only with your explicit consent)
- Handling legal disputes, preventing fraud and ensuring information security
4. Method of collection
Your personal data is collected by automated and partly automated means through booking and registration forms on our website and mobile app, the contact form, requests made by phone and WhatsApp, corporate customer agreements, our partners' booking systems and cookies used on the website.
5. Legal grounds
| Processing activity | Legal ground (KVKK Art. 5) |
|---|---|
| Booking, payment and carrying out the transfer | Conclusion and performance of a contract (Art. 5/2-c) |
| Issuing invoices, keeping financial records | Legal obligation (Art. 5/2-ç) |
| Booking notifications (email, SMS, WhatsApp) | Performance of a contract (Art. 5/2-c) |
| Support requests, handling disputes | Establishment, exercise or protection of a right (Art. 5/2-e) |
| Information security, fraud prevention | Legitimate interest (Art. 5/2-f) |
| Marketing and measurement cookies | Explicit consent (Art. 5/1) |
| Commercial electronic messages | Explicit consent (Art. 5/1) |
| Satisfaction surveys | Explicit consent (Art. 5/1) |
6. Recipients of personal data
| Recipient | Purpose | Location |
|---|---|---|
| Contracted supplier companies and drivers | Carrying out the transfer | Türkiye |
| Türkiye İş Bankası (virtual POS) | Taking payments | Türkiye |
| Posta Güvercini | Sending SMS | Türkiye |
| Mikro Yazılım | Issuing e-invoices and e-archive invoices | Türkiye |
| Competent public authorities | Upon legal request | Türkiye |
| Brevo (Sendinblue) | Sending email and WhatsApp messages | France |
| Booking.com | Bookings received through the partner | Netherlands |
| Cookiebot (Usercentrics) | Recording and managing cookie consent | Denmark |
| Hotjar | Measuring website usage (subject to explicit consent) | Malta |
| Google Ireland / Google LLC | Analytics and advertising measurement (subject to explicit consent), map services | Ireland and USA |
| Cloudflare | Content delivery network and security | USA |
7. Transfers abroad
Personal data that is necessary to provide the service is shared with the service providers located outside Türkiye listed in section 6, only to the extent required for that service. As also stated in the Terms of Use, by making a booking you consent to your information that is necessary for providing the service being shared with these third-party service providers.
Transfers for measuring website usage and advertising performance (Google Analytics, advertising measurement, Hotjar) take place only if you consent in your cookie preferences. You can withdraw this consent at any time via the "Cookie Settings" link at the bottom of the page.
8. Retention periods
| Data | Period | Basis |
|---|---|---|
| Booking and customer records | 10 years from the end of the relationship | Limitation periods under the Turkish Code of Obligations |
| Invoices and financial records | 10 years | Turkish Tax Procedure Law, Turkish Commercial Code |
| Payment and refund records | 10 years | Turkish Tax Procedure Law, Turkish Commercial Code |
| Cookie data | Period stated for each cookie in the Cookie Policy | Cookie Policy |
| Consent to commercial electronic messages | 3 years from withdrawal of consent | Regulation on Commercial Communication and Commercial Electronic Messages |
| Website traffic and security logs | 2 years | Law No. 5651 and related legislation |
Data whose retention period has expired is deleted, destroyed or anonymised.
9. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request its deletion or destruction; to request that these actions be notified to the third parties to whom the data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.
You can submit your requests to our registered email address (ngtseyahat@hs01.kep.tr), by a signed letter to our address above, or from the email address registered in our system to support@progotravel.com. Requests are concluded within thirty days at the latest.