KVKK Personal Data Disclosure

1. Identity of the Data Controller

Under Article 3(1)(ı) of the KVKK, the data controller (veri sorumlusu) is the company identified below:

• Data controller (registered company name): Onur Özdemir
• Registered address: Altıntaş Mah. Yörükoğlu Cad. B Blok No: 24B İç Kapı No: 6, Aksu / Antalya, Türkiye
• Tax office: Kalekapı Vergi Dairesi Müdürlüğü
• Tax number: 6790474919
• Phone: +90 551 086 83 68
• E-mail: [email protected]
• Website: antalyatransfer.taxi

The data controller is the party that determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. For data subjects resident in the European Union, the same company is also the "controller" within the meaning of the General Data Protection Regulation (GDPR, Regulation 2016/679).

2. Method of Collection

Your personal data is obtained through the channels below, by wholly or partly automated means or by non-automated means forming part of a data filing system:

• Booking and contact forms on the antalyatransfer.taxi website,
• The Turkey Transfer mobile application and in-app sign-in (Sign in with Google),
• Communication by WhatsApp, telephone and e-mail,
• The live support (chat) tool on the website,
• Cookies and similar technologies, and automatic records of website/app usage,
• Publicly available flight information services, where a flight number is supplied with a booking.

3. Categories of Personal Data Processed

• Identity data: First name, surname.
• Contact data: E-mail address, telephone number (including WhatsApp number), pickup and drop-off address.
• Customer transaction data: Booking reference, travel date and time, pickup/drop-off points, number of passengers (including children), vehicle class, flight number and airline, special requests (child seat, wheelchair access, extra luggage), payment method, fare and currency, booking status.
• Financial data: Payment amount, currency and payment method. The card number, expiry date and security code are NOT processed or stored by the data controller; when online card payment is activated, that data will be processed solely within the infrastructure of the licensed payment institution.
• Transaction security data: IP address, browser type and version, operating system and device type, session and authentication records, server logs.
• Marketing and usage data: Pages viewed, time on site, navigation paths, referring URL, language preference, screen resolution, campaign measurement data.
• Account data: Where you sign in with Google: name, e-mail address, profile photo and account identifier.
• Image data: Profile photo, only as provided through Sign in with Google.
• Request and complaint management data: WhatsApp, e-mail and live-support correspondence, feedback and review content.

4. Purposes of Processing

• Creating, confirming, managing and performing the transfer booking,
• Sending the booking confirmation, voucher (PDF) and driver details by e-mail and WhatsApp,
• Assigning a suitable vehicle and driver and planning the operation,
• Monitoring flight status for airport pickups and adjusting the pickup time accordingly,
• Providing customer support by WhatsApp, e-mail and live chat, and handling requests and complaints,
• Carrying out cancellations, amendments and refunds,
• Invoicing and fulfilling tax, accounting and other statutory obligations,
• Measuring and improving service quality, analysing website and app usage and measuring campaign performance,
• Preventing fraud and ensuring system and transaction security,
• Where you have given explicit consent, sending campaign and promotional messages,
• Exercising the right of defence in legal disputes and retaining evidence.

5. Legal Grounds for Processing (KVKK Art. 5)

Your personal data is processed on the following legal grounds listed in Article 5(2) of the KVKK and, where explicit consent is required, on the basis of your explicit consent under Article 5(1):

• Art. 5(2)(c) — Directly related to the conclusion or performance of a contract: Creating and confirming the booking and performing the transfer service; assigning a driver and vehicle; sending the confirmation and voucher; cancellations, amendments and refunds. (GDPR equivalent: Art. 6(1)(b))
• Art. 5(2)(a) — Expressly provided for by law: Processing to the extent necessary to comply with the duties that Law No. 6502 on Consumer Protection places on a service provider. (GDPR equivalent: Art. 6(1)(c))
• Art. 5(2)(ç) — Compliance with a legal obligation: Issuing invoices and retaining commercial books and records under the Tax Procedure Law and the Turkish Commercial Code; and meeting the information and performance duties that remain applicable to passenger carriage under Article 2(2)(h) of the Distance Contracts Regulation (Mesafeli Sözleşmeler Yönetmeliği) — Articles 5(1)(a), (b) and (d), 18 and 19: the essential characteristics of the service; the provider’s name, address and contact details; the total price including taxes; and performance, and refund where performance becomes impossible. (GDPR equivalent: Art. 6(1)(c))
• Art. 5(2)(e) — Necessary for the establishment, exercise or protection of a right: Retaining booking records and correspondence as evidence in the event of a dispute. (GDPR equivalent: Art. 6(1)(f))
• Art. 5(2)(f) — Legitimate interests of the data controller: Improving service quality, preventing fraud and ensuring system and transaction security. This ground applies provided it does not harm the data subject’s fundamental rights and freedoms. (GDPR equivalent: Art. 6(1)(f))
• Art. 5(1) — Explicit consent: Campaign and promotional messages and notifications. Information on cookies is set out in the Cookie Policy. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it. (GDPR equivalent: Art. 6(1)(a))

6. Recipients of Transfers and the Purpose of Transfer

Within the framework of Articles 8 and 9 of the KVKK and Articles 44 et seq. of the GDPR, your personal data is transferred only to the parties listed below and only for the purposes stated. This list is based on the systems the data controller actually uses:

Transfers abroad are made under Article 9 of the KVKK as amended by Law No. 7499 (in force since 1 June 2024) and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Official Gazette 10 July 2024, No. 32598). As at the effective date of this notice the Personal Data Protection Board has issued no adequacy decision (Art. 9(1)) for any country, sector or international organisation, so the continuing transfers listed above rest on the appropriate safeguards of Article 9(2) — in practice the standard contract announced by the Board, which is notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within five business days of signature. Explicit consent is not the basis of the regular transfers in this table; under Article 9(6) it can come into play only for occasional, non-continuous transfers. Separately, and without replacing the Article 9 safeguards, the GDPR Standard Contractual Clauses (SCCs) also apply to data subjects resident in the European Union.

7. Systems Not Yet in Use

Stated for transparency: technical integration code for the services below exists in the system, but those services are NOT CONFIGURED OR NOT SWITCHED ON and therefore NO personal data is transferred to them:

• Error monitoring service (Sentry) — no access key is defined, so no data is sent.
• Online card payment infrastructure — the virtual POS will be provided by Türkiye Garanti Bankası A.Ş. (Garanti BBVA). Card payment is not open until that application is approved, and no data reaches the bank before then. Once it is open, the card number, expiry date and security code are processed solely within the bank’s own infrastructure; the seller neither sees nor stores them, and the bank moves into the transfer table in Section 6 at that point.
• Bot protection service (Cloudflare Turnstile) — no key is defined, so no verification request is sent.
• Mobile push notification service (Firebase Cloud Messaging) — no server key is defined, so it is not used.
• Google Places address service — disabled; address autocomplete runs through the OpenStreetMap-based services listed in Section 6.
• Telegram notification bridge — no token is defined, so it is not used.
• Map tile provider CARTO — no longer used; map tiles are served by the OpenStreetMap Foundation listed in Section 6.
• Flight data service AeroDataBox (RapidAPI) — no access key is defined, so it is not used; it will be added to Section 6 when activated.
• Apple AdServices (iOS campaign measurement) — activates with the iOS build; no data is transferred to Apple at present.

If any of these services is activated, this disclosure will be updated and the relevant party added to the transfer list in Section 6.

8. Retention Periods

Your personal data is retained for as long as the purpose of processing requires, without exceeding the maximum periods laid down in legislation:

• Booking records: 3 years for legal, tax and operational purposes. For records constituting invoices and commercial documents, the retention periods required by the Tax Procedure Law and the Turkish Commercial Code apply additionally.
• User accounts: Until you request deletion, or after 2 years of inactivity.
• Communication records (WhatsApp, e-mail): 2 years for customer service purposes.
• Analytics data: 14 months in Google Analytics (default GA4 setting).
• Notification records: Retained while the app is installed; automatically removed on uninstallation.
• Cookie data: Varies by cookie type; the detailed duration table is in the Cookie Policy.
• Log and transaction security records: For the period required by the applicable legislation.

Once the retention period expires or the purpose of processing ceases to exist, personal data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

For cookie types and durations: Cookie Policy

9. Rights of the Data Subject (KVKK Art. 11)

Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights:

1. To learn whether your personal data is being processed,
2. To request information about the processing, if your personal data has been processed,
3. To learn the purpose of processing and whether your data is used in accordance with that purpose,
4. To know the third parties, in Turkey or abroad, to whom your personal data has been transferred,
5. To request rectification of your personal data where it has been processed incompletely or inaccurately,
6. To request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK,
7. To request that any rectification, erasure or destruction be notified to the third parties to whom your data has been transferred,
8. To object to an adverse outcome arising from the analysis of your data exclusively by automated means,
9. To claim compensation for damage suffered as a result of unlawful processing of your personal data.

Data subjects resident in the European Union additionally have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7) under the GDPR.

10. How to Apply

You may submit requests concerning the rights above by the following routes, in accordance with the Communiqué on the Procedures for Applications to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ):

• In writing, by a wet-signed petition delivered in person or through a notary to the data controller’s registered address stated above,
• Using a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature,
• From the e-mail address registered in the data controller’s system, to [email protected].

Under Article 5 of the Communiqué, your application must contain: your name and surname; your signature (for written applications); your Turkish ID number for citizens of the Republic of Turkey (for foreign nationals, your nationality, passport number or identity number if any); your domicile or place-of-business address for service; your e-mail address, telephone and fax number for notification, if any; and the subject of your request. Attaching relevant information and documents speeds up the assessment of your request.

Your application is concluded free of charge as soon as possible and in any event within THIRTY DAYS, according to the nature of the request. However, where the process entails an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

11. Data Security

Under Article 12 of the KVKK, the data controller takes technical and administrative measures to ensure an appropriate level of security, in order to prevent unlawful processing of and access to personal data and to ensure its safekeeping:

• SSL/TLS encryption for all data transmission,
• A web application firewall (WAF) providing attack and DDoS protection,
• A restricted-access database reached only over an encrypted connection,
• Role-based authorisation for staff and the principle of least privilege,
• Secure token-based authentication and automatic session termination,
• Regular security reviews and vulnerability monitoring,
• Card data is never held on the data controller’s systems in any form.

12. Changes to This Notice

This disclosure may be updated because of legislative changes, changes in the systems used, or changes in processing activities. The current text is always published on this page; material changes are additionally announced.

For our data processing practices in full: Privacy Policy