Privacy Policy

1. PRIVACY NOTICE

1.1. Who We Are

This Notice is provided by Percon Bilişim Çözümleri ve Danışmanlık A.Ş., the data controller for the Ferientiger mobile application and https://ferientiger.de/app. You may reach our data protection team at info@percon.com.

1.2. What We Collect and Why

1.3. Sensitive Personal Information

Ferientiger DOES NOT collect date of birth, precise geolocation (GPS), home address, phone number, health data, biometric data, race or ethnic origin, religion, or political opinions. If you voluntarily upload sensitive content to the profile picture area, such data are processed only under your separate explicit consent (see Section 7).

1.4. Your Choices

• Consent Management: 'Settings > Privacy > Advertising & Analytics Preferences'
• Data access, deletion, correction, portability: info@percon.com
• California residents — 'Do Not Sell or Share My Personal Information': https://ferientiger.de/app/do-not-sell
• Complaints: your national data protection authority

1.5. Retention

Account data is retained for the duration of your account; other categories per Section 2.8 of the Privacy Policy.

2. PRIVACY POLICY

2.1. Introduction

This Privacy Policy explains how Percon Bilişim Çözümleri ve Danışmanlık A.Ş. ('Ferientiger', 'we', 'us') collects, uses, discloses and protects your personal information when you use our mobile application or visit https://ferientiger.de/app (collectively, the 'Service'). The Policy is prepared in accordance with Turkish KVKK (Law 6698), and — for users in the EU/EEA — Regulation (EU) 2016/679 (GDPR), and — for users in the UK — UK GDPR and DPA 2018.

2.2. Age Restriction

Ferientiger is intended for users aged 13 and above. In the EU and UK the minimum age is 16 in accordance with Article 8 GDPR and national implementations. Ferientiger 2.0 does NOT collect date of birth; age verification is performed by self-attestation at registration.

2.3. Data Processing Principles (GDPR Art. 5 / KVKK Art. 4)

We process personal data in accordance with the following principles:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

2.4. Controller and Representatives

• Data Controller: Percon Bilişim Çözümleri ve Danışmanlık A.Ş.
• Address: Büyükdere Cad. Meydan Sok. No:1 Beybi Giz Plaza Kat:15 Maslak, Sarıyer/İstanbul, Türkiye
• Email: info@percon.com
• EU Representative (Art. 27 GDPR): Ender Ekinci, Kronenstr. 57, 53840 Troisdorf, Germany, Phone: +49 157 5878 2430, Email: info@ekinci-consulting.de
• UK Representative (Art. 27 UK GDPR): [REPRESENTATIVE COMPANY + UK ADDRESS]

2.5. Categories of Personal Data

2.5.1. Account and Identity Data

• Email address: Obtained via Google or Apple OAuth. The only mandatory datum for account creation.
• Username: Auto-generated (e.g., 'Ferientiger_A3f9K2xN'). Changeable ONCE.
• Profile picture (optional): Stored so that only you can see it on your device.

2.5.2. Device and Connection Data

IP address (anonymized), device model, OS version, app version, session timestamps, error logs, language and time-zone preference.

2.5.3. Advertising Data (consent-based)

Advertising ID (AAID/IDFA) upon UMP consent; approximate location (IP-derived, city/country level); in-app interaction events. Without consent: only contextual ads.

2.5.4. Affiliate Interaction Data

Click timestamp, product ID clicked, Ferientiger referral ID for commission tracking. Specific purchase details are NOT shared with Ferientiger.

2.6. Sensitive Personal Data

We do not process sensitive personal data as a rule. If a user voluntarily uploads such content to the profile picture area, the data are processed only under separate explicit consent (see Section 7).

2.7. Legal Bases (GDPR Art. 6 / KVKK Art. 5)

2.8. Recipients of Personal Data

2.9. International Transfers and Schrems II Compliance

Transfers outside the EU/EEA rely on: (a) European Commission adequacy decisions (including the EU-U.S. Data Privacy Framework for certified U.S. recipients such as Google and Amazon); (b) Standard Contractual Clauses under Art. 46(2)(c) GDPR; or (c) your explicit consent per Art. 49(1)(a) GDPR. UK transfers rely on the UK IDTA/Addendum. Turkish transfers are governed by KVKK Art. 9 (following the 12 March 2024 amendments) under Standard Contractual Clauses published by the Turkish Data Protection Authority on 10 July 2024, filed with the Authority within five (5) business days. For transfers to the United States, Ferientiger performs a Transfer Impact Assessment (TIA) in accordance with the CJEU judgment C-311/18 (Schrems II).

2.10. Data Retention and Periodic Erasure

In accordance with the Turkish Regulation on the Erasure, Destruction or Anonymization of Personal Data, expired data are erased, destroyed or anonymized at least every SIX (6) MONTHS as part of a periodic disposal process, governed by our Personal Data Retention and Disposal Policy.

2.11. Security (GDPR Art. 32 / KVKK Art. 12)

We apply the following technical and organizational measures:

• Access authorization based on the principle of least privilege
• TLS 1.3 in transit; AES-256 for sensitive data at rest
• OAuth 2.0 (Google/Apple) — passwords are not stored by us
• Two-factor authentication (2FA) for administrative access
• Firewalls and anti-malware protection
• Regular backups and disaster recovery planning
• Signed Data Processing Agreements (DPA) with all processors
• Employee written confidentiality undertakings and regular training
• System logging and periodic review
• Annual penetration testing and vulnerability scans

2.12. Data Breach Management

Upon detection of a personal data breach, we notify the competent supervisory authority within seventy-two (72) hours pursuant to GDPR Art. 33 (and the Turkish Data Protection Authority under KVKK Art. 12(5)). Where a breach is likely to result in a high risk to affected individuals, we notify them without undue delay via in-app notification and email (GDPR Art. 34). Breach records are retained for at least five (5) years.

2.13. Your Rights under GDPR (EU/EEA & UK)

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure / 'right to be forgotten' (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object (Art. 21)
• Object to automated decision-making (Art. 22)
• Withdraw consent at any time with effect for the future (Art. 7(3))
• Lodge a complaint with your supervisory authority (Art. 77)

2.14. California Rights (CCPA / CPRA)

2.14.1. Categories Collected in the Last 12 Months

Identifiers (email, unique user ID, advertising ID, IP address); internet or other electronic network activity information; approximate geolocation; commercial information (affiliate click events).

2.14.2. Sale / Sharing

We DO NOT SELL personal information for money. Sharing of advertising identifiers with AdMob for cross-context behavioral advertising qualifies as 'sharing' under CPRA. You may opt out via 'Settings > Privacy > Ad Preferences' or https://ferientiger.de/app/do-not-sell.

2.14.3. Your California Rights

• Right to Know / Access (Cal. Civ. Code §1798.100)
• Right to Delete (§1798.105)
• Right to Correct (§1798.106)
• Right to Opt-Out of Sale/Sharing (§1798.120)
• Right to Limit Use of Sensitive Personal Information (§1798.121)
• Right to Non-Discrimination (§1798.125)
• Right to Data Portability (§1798.100(d))

Verified requests are answered within 45 days (extendable to 90).

2.15. Automated Decision-Making

Ad personalization by AdMob does not constitute automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR. You may nonetheless withdraw your consent to personalized ads at any time.

2.16. Children's Data

Ferientiger is intended for users aged 13 and above (16 and above in the EU). We do not knowingly collect data from children under the applicable age limit. If we learn that a child has provided personal information, we will delete it promptly. Please contact info@percon.com.

2.17. Changes to this Policy

This Policy is versioned. Material changes will be announced by in-app notification and/or email at least 30 days in advance.

4. COOKIE POLICY

_(Based on KVKK, ePrivacy Directive 2002/58/EC, GDPR, and § 25 TDDDG)_

4.1. What are cookies?

Cookies are small text files placed on your device when you visit a website. In mobile apps the equivalents are advertising identifiers (AAID/IDFA), SDKs and local storage.

4.2. Types of Cookies and Identifiers

• Strictly Necessary: Required for functionality and security. No consent needed.
• Functional: Language, theme preferences. Consent-based.
• Analytics: Usage statistics. Consent-based.
• Marketing: Interest-based content and advertising. Consent-based.

4.3. Consent Management (CMP)

On your first visit to https://ferientiger.de/app a CMP banner is displayed with 'Reject All', 'Customize' and 'Accept All' buttons of EQUAL VISIBILITY. 'Reject All' is available in ONE CLICK; no non-essential cookies are set by default (CJEU C-673/17 Planet49, CJEU C-604/22 IAB Europe).

In the mobile app, additional in-app consent screens are shown for analytics and advertising tracking (Google User Messaging Platform — UMP + Apple App Tracking Transparency — ATT).

4.4. Website Cookies

Strictly Necessary

Analytics (consent required)

Advertising (consent required)

4.5. Tracking Technologies in the App

4.6. Third-Party Cookies and International Transfers

Analytics and some functional cookies/SDKs are provided by third-party services (especially Google Ireland Ltd. and Amazon EU S.à r.l.) which may transfer data to the EU and USA under the safeguards described in the Privacy Policy (KVKK Art. 9 SCC, GDPR Art. 46 SCC, EU-US Data Privacy Framework). Third parties' own privacy policies apply.

4.7. Your Choices

• Accept All: All consent-based cookies/SDKs are activated.
• Reject All: Only strictly necessary cookies. Ads are contextual.
• Manage Preferences: Select individual purposes or vendors.
• Withdraw: Effective immediately for the future. To delete previously collected data, submit a separate request to info@percon.com.

4.8. Browser Controls

• Chrome: Settings > Privacy and security > Cookies
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Site permissions > Cookies

7. EXPLICIT CONSENT DECLARATION

This Consent Declaration is issued pursuant to KVKK Art. 5(1) and 6, and GDPR Art. 6(1)(a), 7 and 9. It defines the scope of explicit consent that Percon Bilişim Çözümleri ve Danışmanlık A.Ş. requests from Ferientiger users. Each consent item is independent; you may consent to any subset.

Important — Consent is given freely, for a specific purpose, and on the basis of information. Declining any of the items below, or withdrawing prior consent, does not prevent you from using the core service (account creation, use of the app).

7.1. Personalized Advertising Consent

I consent to Percon Bilişim Çözümleri ve Danışmanlık A.Ş. processing my device advertising ID (AAID/IDFA), approximate IP-derived location and in-app interaction events through Google Ireland Ltd. and advertising partners for personalized advertising, and to the transfer of such data to servers in the EU and USA.

[ ] I consent [ ] I do not consent

7.2. App Usage Analytics Consent

I consent to processing of my app usage data (session information, screen views, crash reports, device type) via Firebase Analytics and Google Analytics 4 for performance measurement, error detection and user-experience improvement, and to the transfer of such data to servers in the USA.

[ ] I consent [ ] I do not consent

7.3. Personalized Marketing and Commercial Electronic Messages Consent

I consent to processing of my contact and usage data for promotional purposes and to receiving commercial electronic messages (email and in-app notifications) from Ferientiger. For users in Türkiye, this consent operates as an approval under the Turkish Law No. 6563 on the Regulation of Electronic Commerce and is registered with the Turkish Message Management System (İYS).

[ ] I consent [ ] I do not consent

7.4. Optional Profile Picture Consent

If I upload a profile picture, I consent to the picture data being processed solely for displaying it on my own device. I acknowledge that the picture is NOT processed for biometric or facial-recognition purposes and is NOT visible to other users.

[ ] I consent [ ] I do not consent

7.5. International Data Transfer Consent

I consent to the transfer of my personal data to servers in the EU and USA in the context of cloud infrastructure (Google Ireland Ltd. — Firebase, GA4, AdMob), affiliate services (Amazon EU S.à r.l.) and app-store payment processing (Apple Distribution International, Google Ireland Ltd.). I acknowledge that these transfers are conducted under the Standard Contractual Clauses of the Turkish DPA (KVKK Art. 9), and, for US transfers, under additional safeguards (SCC, EU-US Data Privacy Framework).

[ ] I consent [ ] I do not consent

7.6. Withdrawal of Consent

You may withdraw any or all of the above consents at any time. Withdraw via 'Settings > Privacy Preferences' or by email to info@percon.com. Withdrawal takes effect PROSPECTIVELY from receipt by the Company and does not affect processing carried out lawfully on the basis of consent prior to withdrawal.

7.7. Declaration

I have read and understood this Consent Declaration and the Privacy Policy. My consent is freely given and limited to the items I have checked above.