Privacy Policy

Odamigo Turizm Ltd. Sti. is the data controller responsible for processing your personal data. Company: Odamigo Turizm Ltd. Sti. Tax Office: Mecidiyekoy (Istanbul) Tax ID (VKN): 6340420923 TURSAB License: 12754 (Group A) Contact for data protection inquiries: privacy@eurotrain.tr Website: https://eurotrain.tr

2.1 Data You Provide: a) Identity data: Full name, date of birth, nationality (required for booking). b) Contact data: Email address, phone number. c) Travel document data: Passport or ID number (required for certain international routes). d) Payment data: Processed by our PCI DSS-certified payment provider; we do not store full card numbers. e) Account data: Email, encrypted password (if you register). f) Communication data: Messages to our support team. 2.2 Data We Collect Automatically: a) Device and browser information (type, version, operating system). b) IP address and approximate location (country level). c) Pages visited, features used, and interaction patterns on the Platform. d) Cookies and similar technologies (see Section 8). 2.3 Data from Third Parties: a) Booking and ticket data from rail Operators (directly or via distribution partners). b) Payment confirmation from our payment service provider. c) Authentication data if you sign in via Google (name, email, profile photo).

We process your data for the following purposes and legal bases: • Process your booking and issue tickets GDPR: Art. 6(1)(b) Contract | KVKK: Art. 5(2)(c) Contract • Process payments securely GDPR: Art. 6(1)(b) Contract | KVKK: Art. 5(2)(c) Contract • Send booking confirmations and travel updates GDPR: Art. 6(1)(b) Contract | KVKK: Art. 5(2)(c) Contract • Provide customer support GDPR: Art. 6(1)(b) Contract | KVKK: Art. 5(2)(c) Contract • Comply with tax and legal obligations GDPR: Art. 6(1)(c) Legal obligation | KVKK: Art. 5(2)(c)(e) Legal • Improve Platform performance and security GDPR: Art. 6(1)(f) Legitimate interest | KVKK: Art. 5(2)(f) Legitimate • Send marketing communications (with consent) GDPR: Art. 6(1)(a) Consent | KVKK: Art. 5(1) Explicit consent • Fraud prevention and security GDPR: Art. 6(1)(f) Legitimate interest | KVKK: Art. 5(2)(f) Legitimate

We share your personal data only as necessary to provide our services: • Railway Operators (directly or via authorized distribution partners): Name, DOB, travel documents — for ticket issuance and carriage • Payment provider (PCI DSS Level 1): Transaction data (no full card numbers) — for secure payment processing • Error monitoring service: Anonymized technical data — for platform stability • Hosting providers (EU-primary): Anonymized access logs — for content delivery • Database provider (EU-hosted): Encrypted booking data — for data storage • Email service provider: Email address, booking reference — for transactional emails For a detailed list of our current sub-processors, visit eurotrain.net/sub-processors. We do not sell your personal data to third parties. We do not use your data for profiling or automated decision-making that produces legal effects.

Your data may be transferred to service providers located in the EU/EEA, Turkey, and other countries with appropriate data protection safeguards (Standard Contractual Clauses). For a current list of our sub-processors and their locations, visit eurotrain.net/sub-processors. For KVKK compliance: Cross-border transfers are made pursuant to Article 9 of Law No. 6698, using approved standard contractual clauses and the KVKK Authority's adequacy determinations. For GDPR compliance: Transfers outside the EEA are protected by Standard Contractual Clauses (Art. 46(2)(c) GDPR) or adequacy decisions (Art. 45 GDPR).

• Booking records: 10 years (Turkish Tax Law, TTK Art. 82) • Payment records: 10 years (Tax and PCI compliance) • Account data: Until account deletion + 30 days • Support communications: 3 years from last contact • Technical logs: 90 days (rolling) • Cookie data: See Cookie Policy (Section 8) • Marketing consent records: Duration of consent + 3 years

Under both KVKK and GDPR, you have the following rights: a) Right of access: Request a copy of your personal data. b) Right to rectification: Correct inaccurate or incomplete data. c) Right to erasure: Request deletion of your data (subject to legal retention requirements). d) Right to restriction: Limit how we process your data. e) Right to data portability: Receive your data in a structured, machine-readable format. f) Right to object: Object to processing based on legitimate interest or for direct marketing. g) Right to withdraw consent: Withdraw consent at any time without affecting prior processing. To exercise your rights, contact privacy@eurotrain.tr. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the KVKK Authority (kvkk.gov.tr) or your local data protection authority in the EU.

• Strictly Necessary: Session, auth, security — Duration: Session — Consent not required • Functional: Language, currency preferences — Duration: 1 year — Consent required • Analytics: Platform improvement — Duration: 2 years — Consent required • Performance: Error monitoring — Duration: Session — Legitimate interest You can manage your cookie preferences through our cookie banner or your browser settings. Disabling strictly necessary cookies may affect Platform functionality.

Our Platform is not directed at children under 16. We do not knowingly collect personal data from children under 16 without parental consent. If you believe a child under 16 has provided us with personal data, please contact privacy@eurotrain.tr immediately.

We implement appropriate technical and organizational measures to protect your personal data, including: a) TLS/SSL encryption for all data in transit (HTTPS everywhere). b) Encryption at rest for sensitive data in our database. c) PCI DSS compliant payment processing (card data never touches our servers). d) Role-based access control and audit logging. e) Regular security assessments and continuous monitoring. f) Rate limiting and DDoS protection on all endpoints. In the event of a data breach, we will notify the KVKK Authority and affected individuals within 72 hours, as required by both KVKK and GDPR.

We may update this Privacy Policy periodically. Material changes will be notified via email and posted on the Platform at least 30 days before taking effect. The "Last Updated" date at the top reflects the most recent revision.