Merhaba Connect
AR

Last updated: 18 October 2026

Privacy Policy

This notice explains how Merhaba Tourism processes personal data through the Merhaba Connect portal, as required by Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data controller

The data controller is Merhaba Tourism, a company registered in Türkiye, whose registered details are shown in the Company details box on this page. It can be reached through the contact details on the Support page.

This notice covers the staff of companies that use the portal, the travellers whose eSIMs are issued through it, and visitors to the site.

2. Data we process

  • Account data: work email, contact person's name, preferred language, the record of acceptance of the Terms (date and version), and the sign-in records kept by our sign-in service.
  • Company data: company name, country, WhatsApp number, tax number (optional) and logo.
  • Order data: orders, top-ups, amounts, payment status and dates, refund requests and their reasons, and alerts. We do not store card details in the portal.
  • eSIM data: ICCID and eSIM number, activation codes and QR code, plan, status, installation and expiry times, and usage. Most of it comes from our connectivity providers.
  • Traveller labels: a name or booking reference, only if the company enters one. We do not collect travellers' emails, phone numbers or passport details.
  • Technical data: IP address, browser and device details, and access times, recorded by our hosting and sign-in services, plus the visit statistics described under “Cookies and browser storage”.
  • Correspondence: messages you send us for support or any request.

3. How we collect data

We collect data electronically: from the portal's forms, from the sign-in emails, automatically from your browser while you use the site, and from our connectivity providers when eSIMs are issued and used. Part of this is done by automated means. Traveller labels are entered by the company.

4. Purposes

  • Opening and managing company accounts, and letting users sign in.
  • Receiving orders and top-ups, confirming payments, issuing eSIMs and delivering them in the account, the traveller link and the PDF voucher.
  • Showing usage and alerts, handling refunds and providing support.
  • Protecting the portal and preventing fraud and misuse.
  • Keeping accounting, tax and commercial records, and meeting other legal obligations.
  • Establishing or defending legal rights.
  • Measuring site visits and fixing errors.

5. Legal bases

We process data on the following bases in Article 5(2) of KVKK, and we do not ask for explicit consent for the processing described in this notice:

  • (c) contract: opening and managing accounts, sign-in, orders, top-ups, payment confirmation, issuing and delivering eSIMs, usage and alerts, refunds and support.
  • (ç) legal obligation: accounting, tax and commercial records, and requests from authorities.
  • (e) establishing, exercising or protecting a right: keeping evidence of orders and correspondence for disputes.
  • (f) legitimate interest, provided it does not harm your fundamental rights and freedoms: processing the data of company staff who use the account, sign-in security, fraud, misuse and sanctions checks, and visit statistics.

6. Traveller data

Traveller names or booking references are entered only if a company chooses to. The company decides what to enter and is the controller of that data; we process it on the company's instructions to provide the service. The company must have a lawful basis and must inform its travellers.

A traveller label appears in the company's account, on the PDF voucher, and on the traveller page, which anyone with the link can open. The company can change or clear the label shown on an eSIM at any time, and revoke or regenerate the link. Names entered when ordering also stay in the order record and are kept with it. We recommend a booking reference rather than a full name.

When a traveller opens the traveller page, we ask for no personal data, but the page and the recipients listed below receive the technical data of the visit.

7. Recipients

We share data only as far as the purposes above require, with the following groups:

  • The hosting, database, sign-in and file-storage providers that run the portal.
  • The email delivery provider that sends sign-in emails.
  • Our connectivity providers, which receive order and eSIM numbers to issue and manage eSIMs. We do not send them company details, traveller labels, emails or phone numbers.
  • Google, which provides the fonts the site loads; your browser connects to it directly. The QR code itself is generated on the site.
  • Apple or Google, which receive the activation code when the iPhone or Android install button is pressed, and WhatsApp when a company chooses to share a traveller link through it.
  • Our accountants and legal advisers, and public authorities and courts where the law requires.

8. Transfers outside Türkiye

Our hosting, database, email and connectivity providers and the font service run servers outside Türkiye, including in the European Union, the United States, Hong Kong and other countries where these providers operate. Using the portal therefore involves transferring personal data abroad.

These transfers are subject to Article 9 of KVKK. We rely on the exceptions in Article 9(6) only for occasional transfers.

9. Cookies and browser storage

We use only the following. You can delete them in your browser settings; deleting the sign-in session signs you out.

  • Sign-in session: kept in the browser's local storage so you stay signed in, and removed when you sign out. It is necessary for the portal to work.
  • Language: taken from the page address (/ar or /en); nothing is stored for it.
  • Visit statistics: the hosting platform's statistics tool sets one cookie named session-id, which expires after 30 minutes. It records the full address of the page visited, the referring page, browser and device type, language, approximate country based on time zone, time on page, and page errors. We use these statistics only to count visits and fix errors; the platform that provides them processes them as our service provider.
  • We do not use advertising or social-media cookies.

10. Retention

We keep data for the periods below. When a period ends, or when you ask us to delete data we no longer need, our staff delete or anonymise it; the portal does not yet do this automatically.

  • Order, payment, invoice and refund records, with the related eSIM records: 10 years, as Turkish commercial and e-commerce law requires.
  • Account and company data: while the account exists, then for as long as legal claims can be brought, and in any case as long as the related order records are kept.
  • Traveller labels: with the order and eSIM records (see above). Changing an eSIM's label does not change the names entered on the order.
  • Logos: until the account is closed (earlier versions included).
  • Sign-in session in the browser: until you sign out. Statistics cookie: 30 minutes.

11. Security

Company data is accessible only to the company's own users, our authorised administrators and our service providers, except the company name, logo, traveller label and eSIM details on traveller pages, which anyone holding the link can see. Logos are kept in private storage and are shown only through links that expire after a short time.

The portal uses no passwords. We keep only a one-way fingerprint (hash) and the first 10 characters of each traveller link in our database. When an eSIM expires or is cancelled, the traveller page hides its codes.

12. Your rights

Under Article 11 of KVKK, you have the right to:

  • learn whether your personal data is processed and, if so, request information about it;
  • learn the purpose of processing and whether the data is used for that purpose;
  • know the parties in Türkiye or abroad to whom the data is transferred;
  • ask for incomplete or incorrect data to be corrected, for data to be deleted or destroyed under the conditions of Article 7, and for the recipients to be told;
  • object to a result against you that arises solely from automated analysis of the data;
  • claim compensation for damage caused by unlawful processing.

13. How to apply

Send your request in Turkish, as the Communiqué on the Procedures and Principles of Application to the Data Controller requires; we also accept requests in Arabic or English. You can send it in writing with a wet signature to our registered address shown in the Company details box on this page, or by email to the address on the Support page, either signed with a secure electronic or mobile signature or sent from the email address registered with us.

Include your name and surname, a signature for paper requests, your Turkish ID number or, for non-Turkish citizens, nationality and passport or ID number, your address, an email or phone number, and the subject of the request.

We reply free of charge within 30 days at the latest. If a cost arises, we charge only the fee set by the Personal Data Protection Board. If you are not satisfied with our reply, you may complain to the Board within the periods set by Article 14 of KVKK.

14. Updates to this notice

We may update this notice when the way we process data changes. The current version always stays on this page with its date.