← Back to Gruso

Privacy Notice

Last updated: June 2026

Data Controller: [Company's registered name] (hereinafter referred to in this text briefly as “Gruso” or the “Company”)

As Gruso, we attach a high degree of importance to the processing and protection of your personal data. This Privacy Notice has been prepared, in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the relevant legislation and legal regulations, in order to ensure that you are informed regarding the personal data that is processed and transferred while various services are provided and developed within the scope of the Gruso mobile application (the “Platform”).

You may find detailed information regarding the processing of your personal data obtained by automated means through the cookies and mobile software development kits (SDK) used on the Platform, as well as regarding your management preferences relating to these technologies, in the Cookie Notice.

1. THE PURPOSE, LEGAL BASIS AND METHODS OF COLLECTION FOR THE PROCESSING OF YOUR PERSONAL DATA

By creating a membership through the Gruso mobile application, you may benefit from personalized travel assistant and collaborative planning services. Your personal data is processed within the framework of the following processes and legal bases during your activities on the Platform:

1.1. During the Conduct of Membership Processes on the Mobile Application

• Data processed: Identity (name, surname), contact (mobile phone number, e-mail address), transaction security (password information) and customer transaction (membership type, Premium subscription status).
• Processing purposes: Creating the user registration, conducting membership processes, ensuring account security and verification, tracking Premium subscription processes and conducting operational communication activities.
• Legal basis: The legal basis under Article 5, paragraph 2, sub-clause (c) of the Law, namely “the processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract.”

1.2. During Personalized Travel Planning and Artificial Intelligence-Assisted Profiling Activities

• Data processed: Travel preferences (desired destinations, travel dates, vacation style, food & beverage and activity preferences, areas of interest) and budget information (defined lower-upper budget ranges).
• Processing purposes: Creating personalized travel routes, which is Gruso's core function; performing automated profiling and segmentation (grouping) work by analyzing user preferences through artificial intelligence algorithms; preparing smart packing lists and budget breakdowns and improving the customer experience.
• Legal basis: Under Article 5, paragraph 2, sub-clause (f) of the Law, namely “the processing of data being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,” and, where necessary depending on the depth of the profile analysis, the “explicit consent of the data subject” under Article 5, paragraph 1 of the Law.

1.3. During the Provision of Location-Based Assistant Services

• Data processed: Location data (instantaneous geographic location information, or geographic location information of the place to be travelled to, obtained from the device's GPS receiver or from the IP address).
• Processing purposes: Integrating dynamic weather forecasts for the location to be travelled to, and listing in real time the nearby restaurant, event and place-to-visit recommendations suited to the travel plan.
• Legal basis: The “explicit consent of the data subject” under Article 5, paragraph 1 of the Law, which you provide of your own free will within the operating system permissions of your device.

1.4. During Collaborative Travel Planning, Group Creation and Smart Survey (Voting) Processes

• Data processed: Identity (profile name, profile photo if any), group interaction data (the groups joined, information on invited participants, the votes used in surveys and selection preferences) and transaction security (device notification identifier / Push Token).
• Processing purposes: Establishing and managing groups for planning travel together, operating survey/voting processes, reporting to the other participants in the same group the survey results and who voted for which option in order to ensure transparency in the decision-making mechanism, and delivering instant notifications (push notifications) regarding changes in survey status to group members.
• Legal basis: Under Article 5, paragraph 2, sub-clause (c) of the Law, namely “the processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract,” and under sub-clause (f), namely “the legitimate interests of the data controller.”

1.5. During the Receipt of Support Through Complaint, Request and Communication Channels

• Data processed: Identity (name, surname), contact (e-mail address, phone number) and customer transaction (request/complaint content, details of the system errors encountered).
• Processing purposes: Tracking users' support requests, resolving complaints, receiving suggestions aimed at improving business processes and conducting after-sales support services for goods/services.
• Legal basis: Under Article 5, paragraph 2, sub-clause (c) of the Law, namely the “performance of the contract,” and under sub-clause (f), namely the “legitimate interests of the data controller.”

1.6. During Campaign, Product/Service Promotion and Commercial Communication Activities

• Data processed: Identity (name, surname), contact (e-mail address, phone number) and customer transaction (commercial electronic message consent information).
• Processing purposes: Conducting marketing analysis work regarding new features offered by Gruso, Premium subscription campaigns, travel opportunities and promotions, and sending electronic commercial messages through the communication channels (SMS, telephone, e-mail) for which you have given consent.
• Legal basis: The “explicit consent of the data subject” set out in Article 5, paragraph 1 of the Law and the commercial electronic message consent requirement under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce (“ETK”).

1.7. During Information Security, Technical Log Management and the Conduct of Legal Processes

• Data processed: Identity (name, surname, Turkish ID number), transaction security (IP address information, application login-logout logs, device brand/model, traffic data, session durations, IDFA/GAID mobile advertising identifiers) and legal transaction (in the event of a dispute, information in the case file, formal notices and correspondence with official authorities).
• Processing purposes: Conducting the Platform's information security processes, instantly detecting and blocking unauthorized automated access (bot/scraping) activities, conducting activities in compliance with legislation, following up legal affairs and providing information to authorized persons, institutions and organizations.
• Legal basis: The legal bases under Article 5, paragraph 2 of the Law, namely sub-clause (a) “being expressly stipulated in the laws,” sub-clause (ç) “being mandatory for the data controller to fulfil its legal obligation,” and sub-clause (e) “the processing of data being mandatory for the establishment, exercise or protection of a right.”

2. THE TRANSFER OF YOUR PERSONAL DATA (DOMESTIC AND ABROAD)

Your processed personal data may be transferred to the following parties for the legal reasons listed above, by complying with the rules in Article 8 of the KVKK titled “Transfer of Personal Data” and Article 9 titled “Transfer of Personal Data Abroad,” and by taking the necessary technical and administrative measures:

• Transfer to Group Participants: Due to the nature of the Platform's “collaborative planning” model, the votes you use in the surveys within the group you have joined, your travel preferences and your profile name are transferred to and displayed to the other participants in the same group, in order to enable group decisions to be clarified in a transparent manner.
• Transfer of Data Abroad (Technology Infrastructure Providers): Gruso works with infrastructure suppliers established abroad in the technology field for the purposes of running artificial intelligence models, providing the cloud server infrastructure and delivering instant notifications. Accordingly, your personal data is recorded and transferred to our secure systems and service providers abroad, only to the extent necessary for the realization of the relevant purpose, based on the legal ground of the “signing of a standard contract” under Article 9 of the KVKK (Art. 9).
• Third-Party Travel Providers (Technical Integration): When you click on a travel option (flight, hotel, etc.) through the Platform and switch to the relevant external company for a reservation, limited search data and technical redirection codes are transferred to the relevant travel provider so that the counterparty platform can technically recognize the request and open the correct search parameters.
• Authorized Public Institutions and Organizations: In order to fulfil our legal obligations, your data may be transferred, as required by legal regulations and legislation, to authorized persons and official institutions (courts, administrative authorities, etc.) and to our suppliers from whom we receive legal advisory support.

3. THE STORAGE AND DESTRUCTION OF PERSONAL DATA

Our Company has established a Storage and Destruction Policy for the storage and deletion of personal data. The storage and destruction operations relating to your personal data are carried out within the scope of this policy:

• If a period has been determined in the KVKK or in the relevant laws and other relevant legislation for the storage of the data, the data in question must be stored at least for this period. Taking into account possibilities such as a potential court request reaching us late or the occurrence of a dispute to which we may be a party, the storage period of the data is determined by adding a period of between 6 months and 1 year to the periods stipulated in the legislation for the storage of your data.
• If no period regarding the storage duration of the data we process has been stipulated in the legislation, as a requirement of the relationship between us and taking into account potential disputes as well, your data is deleted, destroyed or anonymized without any request on your part upon the lapse of the 10-year statute of limitations for litigation as of the termination of our legal relationship.
• If all of the conditions for processing personal data have ceased to exist or the storage period has expired, your data is deleted, destroyed or anonymized ex officio on the first periodic destruction date or within 6 months at the latest. If you make a request for the deletion of your data with a valid reason, your data is deleted, to the extent legally possible, within 30 days at the latest. In the event that you request the deletion or destruction, before the stipulated periods, of your data whose storage period is determined in the legislation, such request of yours cannot be fulfilled.

4. YOUR RIGHTS UNDER THE KVKK

Within the scope of the KVKK and the relevant legislation, with respect to your personal data, you have the rights to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of the processing and whether it is used in accordance with its purpose; know the third parties to whom it is transferred domestically or abroad; request the correction of your data in the event that it has been processed incompletely or incorrectly; request its deletion or destruction within the framework of the conditions stipulated in the KVKK legislation; request that the correction/deletion operations be notified to the third parties to whom the data has been transferred; object to a result arising against you through the analysis of the processed data exclusively by means of automated systems; and request the compensation of the damage in the event that you suffer damage due to unlawful processing.

5. APPLICATION AND CONTACT

You may submit your applications and requests relating to your personal data to Gruso, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller (in a manner that includes the mandatory information such as name, surname, signature, Turkish ID number, address for service of notice, telephone, etc.), by the following methods:

• Written Application: By applying in person, together with a valid identity document and your wet-ink signature, to the address [Your company's registered address], or by sending it via notary public;
• By E-mail: By sending it to our address [Support email, e.g. privacy@gruso.com] from your electronic mail address that you have previously notified to our Company and that is registered in our systems.

Your requests concerning your rights relating to your personal data will be evaluated and answered free of charge within 30 days at the latest as of the date they reach our Company. In the event that your application is evaluated negatively, the reasoned grounds for refusal will be conveyed to you, via electronic mail or by post, to the address you specified in the application.