Version: 1.3 — Last updated: 15 October 2026
1. DATA CONTROLLER
The data controller under Personal Data Protection Law No. 6698 (“KVKK”) is:
Leona Travel Turizm Ticaret Limited Şirketi
Address: Kozyatağı Mah. Gülbahar Sk. PS Plaza No:17/82
34742 Kadıköy / İstanbul
Tax Office: Erenköy
Tax Identification Number: 6081594764
Trade Registry Number: 422703-5
MERSİS: 0608159476400001
Rennkron is a sports event discovery and race travel platform operated by Leona Travel Turizm Ticaret Limited Şirketi.
2. PERSONAL DATA THAT MAY BE PROCESSED
Depending on how Rennkron services are used, the following categories of personal data may be processed:
- Identity Information: First name, surname and, where required by the service, information identifying the user or passenger.
- Contact Information: Email address, telephone number and other contact information provided by the user.
- Account Information: Membership status, email verification status, language preference, sports preferences, notification preferences and account settings.
- Account and Transaction Security Information: Password digest/hash, session information, verification records, device/session identifiers, IP and security records.
- Race and Preference Information: Saved races, races of interest or planned participation, and sports preferences set by the user.
- Reservation and Service Information: Requests relating to accommodation, transfers, activities, experiences or other services; room, passenger, guest, date, capacity and configuration information.
- Transaction and Financial Information: Order, payment status, transaction currency, billing and similar records for purchase transactions.
- Customer Communication: Support requests, complaints, reservation requests and correspondence with Rennkron.
- Consent and Legal Transaction Information: Acceptance of the Membership Agreement, KVKK notice records, preference and consent history, and records relating to disputes or legal proceedings.
- Technical Usage Information: Technical logs, error records and usage information necessary for the security and operation of the Platform.
3. PURPOSES OF PROCESSING PERSONAL DATA
Your personal data may be processed for the following purposes:
- creating and managing the Rennkron account;
- verifying the email address;
- ensuring user security;
- providing user preferences and My Rennkron features;
- managing saved races, races of interest or planned participation;
- personalisation relating to race and sports preferences;
- providing accommodation, transfer, activity and other race travel services or handling request processes;
- handling reservation or service requests with relevant suppliers;
- managing customer support and complaints;
- handling order and payment transactions;
- fulfilling billing, accounting and legal obligations;
- preventing abuse, fraud and security breaches;
- establishing, exercising or protecting legal rights;
- improving Platform performance and security.
4. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Depending on the nature of the processing activity, your personal data may be processed on the legal grounds set out in Article 5 of the KVKK. These include, in particular:
- being directly related to the establishment or performance of a contract;
- being necessary for the controller to fulfil a legal obligation;
- processing being necessary for the establishment, exercise or protection of a right;
- processing being necessary for the controller’s legitimate interests, provided that the data subject’s fundamental rights and freedoms are not harmed;
- being expressly provided for by law.
If a separate processing activity must rely on explicit consent, that consent is obtained separately from membership acceptance or other contractual approvals.
Consent to commercial electronic messages is also not a mandatory condition of membership.
5. SPECIAL CATEGORIES OF PERSONAL DATA
Rennkron’s approach is not to request special categories of personal data unless necessary for the service.
Where it is necessary for a user to provide allergy, health or similar special-category information for services such as meals/activities, that information is processed only to the extent necessary to provide the relevant service and on an appropriate processing condition under Article 6 of the KVKK.
Where sharing such information is unnecessary, users are advised not to enter special categories of personal data in free-text fields.
6. METHODS OF COLLECTING PERSONAL DATA
Your personal data may be collected electronically by automated or partly automated methods through:
- the Rennkron website;
- membership and account forms;
- race service and travel request forms;
- reservation and product configuration screens;
- email and customer support channels;
- the Platform’s technical and security systems.
7. TRANSFER OF PERSONAL DATA
Where necessary to provide the relevant service and in accordance with the conditions in Article 8 of the KVKK, your personal data may be shared on a limited basis with the following recipient groups:
- accommodation properties;
- transfer and transport providers;
- activity and experience providers;
- race organisers, only to the extent required by the service;
- information technology, hosting, email and security service providers;
- payment institutions and banks to handle payment transactions;
- accounting, financial advisory, legal and audit service providers;
- legally authorised public bodies and judicial/administrative authorities.
Transfers are limited to the data necessary to perform the relevant service.
8. TRANSFER OF DATA ABROAD
Rennkron’s Natro WP Max Kurumsal production infrastructure includes hosting and database processing in Belgium. Depending on use of the service, account, identity and contact information, and verification, preference, consent, service request and technical security records may be processed on that infrastructure.
The active Wordfence Security Network may transfer IP and request data relating to security events to Defiant. Defiant’s published documents describe processing in the United States and at relevant service provider facilities. The active Natro Site Assistant / Extendify integration is also configured to transmit the site administration and technical usage information explained in the Privacy Policy to Extendify; Extendify’s policy describes processing in the United States and other countries. This is not a statement that all records for these services are stored in one data centre or that every sub-provider is used in every operation.
International transfers of personal data are limited to cases where the applicable transfer condition under Article 9 of the KVKK and relevant secondary legislation is met for the specific processing activity and the necessary technical/administrative measures are taken. This text is updated if the service provider, country or transfer safeguard changes.
9. DATA BELONGING TO THIRD PARTIES
A user may provide Rennkron with information about a guest, passenger or other third party travelling with them.
In that case, the user accepts that they are authorised to provide the relevant data to Rennkron and have informed the person about that data sharing to the extent necessary.
Rennkron processes third-party data only to the extent necessary for the relevant reservation or service.
10. RETENTION AND DELETION OF PERSONAL DATA
Personal data may be retained:
- for as long as the relevant processing purpose continues;
- for mandatory retention periods prescribed by legislation;
- for the period necessary to establish, exercise or protect a right.
Once all processing conditions cease to exist, the data are deleted, destroyed or anonymised under the KVKK and relevant legislation.
Deletion of the user’s account may not mean simultaneous deletion of transactions or records that must legally be retained.
11. DATA SECURITY
Leona Travel/Rennkron applies technical and administrative measures proportionate to risk to prevent unlawful processing of, unauthorised access to, loss of or alteration of personal data.
Passwords are not held in plain text and secure authentication/session methods are used.
12. RIGHTS OF THE DATA SUBJECT
Under Article 11 of the KVKK, you have the following rights concerning your personal data:
- to learn whether your personal data are processed;
- to request information if they have been processed;
- to learn the purpose of processing and whether they are used in accordance with that purpose;
- to know the third parties to whom personal data are transferred;
- to request correction of incomplete or inaccurate data;
- to request deletion or destruction where the legal conditions are met;
- to request notification of correction, deletion or destruction to third parties to whom the data have been transferred;
- to object to a result against you arising from analysis exclusively through automated systems;
- to claim compensation for damage caused by unlawful processing.
13. KVKK APPLICATIONS
You may submit requests under the KVKK in writing to:
Leona Travel Turizm Ticaret Limited Şirketi
Kozyatağı Mah. Gülbahar Sk. PS Plaza No:17/82
34742 Kadıköy / İstanbul
For applications sent from an email address you previously supplied and that is registered in the Rennkron/Leona Travel system, you may use: destek@rennkron.com.
An application may require identity verification and the mandatory information prescribed by legislation.
Under Article 13 of the KVKK, applications are concluded as soon as possible according to the nature of the request and no later than 30 days.
14. CHANGES TO THIS PRIVACY NOTICE
This Privacy Notice may be updated due to changes in legislation, Rennkron services or personal data processing activities.
The current text remains accessible through Rennkron.
Version: 1.3 — Last updated: 15 October 2026
Pre-payment form and service documents
Depending on your invoice preference, first name, surname, contact and address information; a Turkish identity number for individual invoices in Türkiye; or company name, tax office and tax number for corporate invoices are processed with the order record.
The pre-payment form draft and discount code can be restored for 30 minutes from a temporary server record linked to your account so that you can continue the purchase. This temporary record is cleared when an order is created or you sign out.
After verified successful payment, an account-specific PDF service document may be generated from the order and existing service information. The document is not a fiscal invoice and can be downloaded only by the relevant account. Personal data in these records are also processed within the purposes, legal grounds, retention limits and application rights described in this text.