GORIL.IO; processes the data necessary to provide the service, keep your account and transactions secure, process purchases and reservations, and fulfill its legal obligations. Optional actions, such as marketing, rely on your separate consent when necessary.
Scope and data controller
This policy; goril.ioapplies to GORIL.IO mobile applications, customer support channels and their associated eSIM, travel, payment and communications services.
The data controller in terms of your personal data is the service provider that operates these platforms under the GORIL.IO brand. The legal entity providing the service may also be shown in your transaction or invoice document. For privacy applications support@goril.io You can reach the address .
Personal data we process
Name, email, phone number, country, language, verification status and login information.
Order, amount, currency, payment result, return and chargeback records. Full card information is not stored by GORIL.IO; It is processed by the authorized payment institution.
Package, installation, activation, usage, device compatibility, allocated number and service statuses.
Search preferences, route and date, passenger or guest information and contact data required for reservation.
IP address, device/app version, session, error, risk, fraud prevention and audit logs.
Support correspondence, notification, marketing and personalization preferences and privacy requests.
Identity proof, proof of address or similar additional information is requested only when it is mandatory for the telecommunications or travel service in the relevant country and is clearly communicated before the transaction.
Processing purposes and legal reasons
Your data; It is processed for the purposes of account creation and identity verification, order and payment transactions, eSIM installation and usage tracking, provision of reservation and communication services, customer support, security and prevention of abuse, accounting and regulatory obligations and improving service quality.
According to the processing activity, the establishment or compensation of the contract, legal obligation, the facility/user/protection of a right, one of the legitimate interests or clear consent legal reasons that do not harm your fundamental rights. Separate confirmation is taken when it is necessary for marketing communication and non-neasure; you can withdraw this consent at any time.
Sharing and international transfer
Data only to the extent necessary for the service; It may be shared with eSIM and telecommunication providers, payment institutions, flight/hotel/transfer/insurance business partners, identity verification and fraud prevention services, hosting and communication infrastructure providers, authorized consultants and legally authorized public institutions.
Transfer if a service provider or booking partner is located abroad; The adequacy decision stipulated in the current legislation is made based on appropriate assurance or, when necessary, one of the open consent mechanisms and by applying data minimization. During the transaction, the party providing the service and the applicable conditions are also displayed.
Storage and security
As long as the data, relevant service and contractual relationship continues; Afterwards, it is kept for the period required for tax, consumer, payment, telecommunication, dispute and other legal retention obligations. When the period expires, the data is deleted, destroyed or anonymized.
TLS, access authorization, encryption, confidential information masking, logging and auditing controls, and secure development measures are applied during transmission. Considering that no method can provide absolute security over the Internet, controls are evaluated regularly.
Cookies and device data
Website and applications; may use mandatory cookies or similar device storage technologies to maintain session, security, remember language/interface preferences and measure service performance. When non-essential analytics or marketing technologies are enabled, upfront choice is offered where required by legislation.
Access keys in the mobile application are kept in the secure storage area of the operating system. Application; Accesses contacts, location, notification or similar features that require permission only when you use the relevant feature and give device permission.
Your rights and application method
Within the scope of Article 11 of the Personal Data Protection Law No. 6698; You have the right to learn whether your data is processed, to request information if it is processed, to learn the purpose of processing and whether it is used in accordance with the purpose, to know the transferred parties, to request correction of incomplete or inaccurate data, to delete/destroy it when the conditions are met and to request that these transactions be notified to the recipients, to object to the automatic analysis result and to request compensation for damages due to unlawful processing.
From your verified account Profile → My data and privacy You can use section or by explaining your identity and request support@goril.io You can apply to . The application is finalized within the legal period after identity and authorization verification. Account deletion request does not mean that records that must be kept in accordance with the legislation will be deleted immediately.
Children, communication and updates
The Services are directed to individuals who are authorized to take binding action on their own behalf. If you think that a child's data is being processed unauthorized, you can contact us.
This text; It may be updated whenever there are changes in services, providers or legislation. Important changes are announced through the application or appropriate communication channels. The current version is always published at this address.