Privacy Policy

Effective Date: February 17, 2026 | Last Updated: September 12, 2026
Applies to: antalyatransfer.taxi website and Turkey Transfer mobile application (Android & iOS)

1. Data Controller

This Privacy Policy explains how your personal data is collected, used, and protected by:

Name: Ali Karel
Turkish identity number (T.C.): 50010234522
Address: Aksu 3801 Sokak No:35/5 Antalya
Website: antalyatransfer.taxi
Mobile App: Turkey Transfer (available on Google Play Store)

Turkey Transfer acts as the Data Controller under EU GDPR (Regulation 2016/679) and the Turkish Personal Data Protection Law (KVKK, Law No. 6698).

2. Scope of This Policy

This Privacy Policy applies to:

Our website at antalyatransfer.taxi and all its subpages
Our Turkey Transfer mobile application available on Google Play Store (Android) and Apple App Store (iOS)
All communications via email, WhatsApp, phone, and in-app messaging
Booking and payment processing services

3. Legal Basis for Processing

We process your personal data under the following legal bases:

Contract Performance (Art. 6(1)(b) GDPR): To fulfill your transfer booking and provide the requested services.
Legitimate Interest (Art. 6(1)(f) GDPR): To improve our services, prevent fraud, and ensure security.
Consent (Art. 6(1)(a) GDPR): For analytics cookies, push notifications, and marketing communications. You may withdraw consent at any time.
Legal Obligation (Art. 6(1)(c) GDPR): To comply with tax, accounting, and regulatory requirements.

4. Personal Data We Collect

4.1 Data You Provide Directly

When you make a booking, create an account, or contact us:

Full name
Email address
Phone number (including WhatsApp)
Profile photo (if signed in via Google or Apple)
Flight number and airline details
Pickup and drop-off addresses
Number of passengers (including children)
Special requests (child seats, wheelchair access, extra luggage)
Payment information (processed securely via payment providers, not stored on our servers)

4.2 Data Collected Automatically (Website)

When you visit our website, we automatically collect:

IP address (anonymized for analytics)
Browser type and version
Operating system and device type
Pages visited, time spent, and navigation paths
Referring URL (how you found us)
Language preference
Screen resolution

4.3 Data Collected via Mobile App

When you use our mobile application, we may additionally collect:

Device Information: Device model, operating system version, unique device identifiers
Push Notification Token: Firebase Cloud Messaging (FCM) token for sending booking updates and travel notifications
Authentication Data: Account details when signing in with Google or Apple (name, email, profile photo)
Geolocation (optional): Your approximate location to suggest nearby airports and destinations. Location is only accessed with your explicit permission and can be disabled in device settings at any time.
App Usage Data: Screens viewed, features used, session duration (via Firebase Analytics)
Apple Ads Attribution (iOS): A random installation identifier and Apple-provided campaign information used to measure our own App Store advertising. See Section 6.8.
Network Status: Online/offline connectivity to manage booking synchronization

4.4 Data from Third Parties

Flight tracking data (arrival times) from public flight information services
Authentication profile data from Google Sign-In or Apple Sign-In

5. How We Use Your Data

To process, confirm, and manage your transfer bookings
To send booking confirmations, vouchers (PDF), and driver details via email, WhatsApp, and push notifications
To match you with an available driver and vehicle
To provide real-time support via WhatsApp, email, and in-app support
To track your flight arrival for airport pickups
To send push notifications about booking status, driver updates, and promotions (with your permission)
To analyze website and app usage and improve our services (via Google Analytics and Firebase Analytics)
To prevent fraud and ensure the security of our platform
To comply with legal and regulatory obligations
To personalize your experience based on language and location preferences

6. Google & Firebase Services

We use the following Google and Firebase services. Each may collect data as described:

6.1 Google Analytics 4 (GA4)

Measurement ID: G-7SD301D6W0
Purpose: To understand how visitors use our website, including pages visited, session duration, and traffic sources.
Data Collected: Anonymized IP addresses, browser information, device data, page interactions.
Cookies: _ga, _ga_* (duration: up to 2 years).
Opt-out: Install the Google Analytics Opt-out Browser Add-on.

6.2 Firebase Analytics & Crashlytics (Mobile App)

Purpose: To analyze app usage patterns, monitor performance, and identify crashes in the mobile application.
Data Collected: App events, screen views, session data, device information, crash logs.
Data Processing: Data is processed by Google LLC under Standard Contractual Clauses (SCCs).

6.3 Firebase Cloud Messaging (FCM) — Push Notifications

Purpose: To send push notifications about booking confirmations, driver updates, travel reminders, and promotional offers.
Data Collected: FCM device token (a unique identifier for your device).
Opt-out: You can disable push notifications in your device settings or within the app at any time.

6.4 Google Sign-In & Apple Sign-In

Purpose: To provide a convenient and secure authentication method for our mobile app and website.
Data Received: Name, email address, profile photo, and a unique account identifier.
Storage: Authentication tokens are stored securely on your device. We store only your name and email on our servers for booking management.
Revocation: You can revoke access at any time through your Google Account settings or Apple ID settings.

6.5 Google Tag Manager (GTM)

Container ID: GTM-K6693S72
Purpose: To manage analytics and marketing tags on the website.
Data Collected: GTM itself does not collect personal data; it deploys tags that may collect data (e.g., GA4).

6.6 Google Maps Platform

Purpose: To display maps and provide location autocomplete for booking addresses.
Data Collected: Location searches, interaction with maps.
Privacy: Google Privacy Policy

6.7 Google Fonts

Purpose: Typography rendering (Inter font family).
Privacy Note: Fonts are self-hosted — no data is sent to Google Fonts servers.

6.8 Apple Ads Atıflandırması (iOS)

Amaç: Kendi Apple Ads kampanyalarımızdan hangisinin uygulama kurulumu ve daha sonraki bir transfer rezervasyonu sağladığını ölçmek.
Veri akışı: iOS 14.3 veya sonraki sürümlerde uygulama, kısa ömürlü bir AdServices atıflandırma tokenı alır ve sunucumuza gönderir. Sunucumuz bu tokenı Apple Ads’e iletir. Ham tokenı saklamayız.
Alınan veriler: Apple; atıflandırma durumu ile kampanya, reklam grubu, anahtar kelime, reklam, yerleşim, ülke, dönüşüm ve tıklama ya da gösterim bilgilerini döndürebilir. Apple’ın gizlilik korumaları nedeniyle bazı alanlar bulunmayabilir.
Rezervasyon bağlantısı: Uygulama ayrıca rastgele bir kurulum UUID’si üretir. Sunucumuz bunu hemen SHA-256 bağlantı anahtarına dönüştürür ve ham UUID’yi saklamaz. Bu anahtar, birinci taraf kampanya ölçümü için Apple Ads kampanya verisini sonraki rezervasyonla ilişkilendirmemizi sağlar.
Saklama: Tekrar kullanımını önleyen token özeti en fazla 25 saat tutulur. Apple Ads atıflandırma kayıtları ve rezervasyon bağlantıları en fazla 14 ay tutulur; ardından silinir veya anonimleştirilir. Rezervasyon kayıtlarına Bölüm 10’daki ayrı süre uygulanır.
Şirketler arası takip yok: Bu entegrasyonda IDFA kullanmayız, Uygulama Takibi Şeffaflığı izni istemeyiz ve bu alanları başka şirketlere ait uygulama veya internet sitelerinde sizi takip etmek için kullanmayız.

7. Mobile App Permissions

Our mobile application may request the following permissions:

Internet Access: Required for booking, real-time updates, and communication with our servers.
Push Notifications: To receive booking confirmations, driver updates, and travel alerts. Optional
Location (Approximate/Precise): To suggest nearby airports and destinations for easier booking. Optional
Network State: To detect connectivity and ensure smooth offline/online transitions.
Vibration/Haptics: For subtle feedback on interactions within the app.

All optional permissions can be denied or revoked at any time through your device's Settings → Apps → Turkey Transfer → Permissions. The app will continue to function without optional permissions.

8. Who We Share Your Data With

We share your personal data only when necessary for service delivery:

Transfer Drivers: Your name, pickup location, flight details, and phone number — strictly for service delivery.
Google LLC (USA): Anonymized analytics data via GA4, Firebase Analytics, and FCM. Google acts as a Data Processor under Standard Contractual Clauses (SCCs).
Apple Inc. (USA): Authentication data if you sign in with Apple; on iOS, an AdServices token is sent to Apple Ads to retrieve privacy-protected attribution data for our own campaigns.
Hostinger International Limited (Germany): Website and database hosting. The server stands in Frankfurt, Germany, so this is a transfer abroad. Hostinger acts as a Data Processor.
Cloudflare Inc. (USA): CDN and security in front of that server. Cloudflare acts as a Data Processor.
Email Service Provider: For sending booking confirmations and vouchers.

We do NOT sell, rent, or trade your personal data to any third party for marketing or advertising purposes. Ever.

9. International Data Transfers

Your data may be transferred to countries outside Turkey and the EU/EEA (primarily the USA) when using Google, Firebase, and Cloudflare services. These transfers are protected by:

EU Standard Contractual Clauses (SCCs)
EU-U.S. Data Privacy Framework (where applicable)
Adequate safeguards required by KVKK Article 9

10. Data Retention

Booking data: Retained for 3 years for legal, tax, and operational purposes.
User accounts: Retained until you request deletion or 2 years of inactivity.
Analytics data: Google Analytics retains data for 14 months (default GA4 setting).
Apple Ads attribution data: Campaign attribution and booking-link records are retained for up to 14 months. The token digest used only to prevent replay is retained for no more than 25 hours. Raw attribution tokens and raw installation UUIDs are not stored on our server.
Push notification tokens: Retained while the app is installed; automatically removed upon uninstallation.
Cookie data: Varies by cookie (see Cookie Policy).
Communication records: WhatsApp and email records retained for 2 years for customer service purposes.

After the retention period, data is securely deleted or anonymized.

11. Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

Right of Access (Art. 15): Request a copy of your personal data.
Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten").
Right to Restrict Processing (Art. 18): Limit how we use your data.
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to Object (Art. 21): Object to processing based on legitimate interest.
Right to Withdraw Consent (Art. 7): Withdraw consent for analytics, push notifications, or marketing at any time.

To exercise any of these rights, write to Ali Karel, Aksu 3801 Sokak No:35/5 Antalya. We will respond within 30 days.

You also have the right to lodge a complaint with your local Data Protection Authority.

12. Your Rights Under Turkish KVKK

Under the Turkish Personal Data Protection Law (KVKK, Law No. 6698), you have the right to:

Learn whether your personal data is being processed
Request information about data processing activities
Learn the purpose of data processing and whether it is used accordingly
Know the third parties to whom your data has been transferred
Request correction of incomplete or inaccurate data
Request deletion or destruction of your data under Article 7
Object to automatic processing that produces negative results about you
Claim compensation for damages caused by unlawful processing

KVKK requests can be submitted in writing to Ali Karel, Aksu 3801 Sokak No:35/5 Antalya.

13. Account & Data Deletion

You can request complete deletion of your account and all associated personal data at any time by:

Writing to Ali Karel, Aksu 3801 Sokak No:35/5 Antalya, with the subject "Delete My Account"

Upon receiving your request, we will delete your account and personal data within 30 days, except for data we are legally required to retain (e.g., tax records, completed booking records for legal compliance).

14. Children's Privacy

Our services and mobile application are not directed at children under 16. We do not knowingly collect personal data from children. Our target audience is adults aged 18 and above who book transfer services.

If you believe a child has provided us with personal data, please write immediately to Ali Karel, Aksu 3801 Sokak No:35/5 Antalya, and we will promptly delete the information.

15. Data Security

We implement appropriate technical and organizational measures to protect your data:

SSL/TLS encryption for all data transmission (website and app)
Cloudflare WAF (Web Application Firewall) for DDoS and attack protection
Secure PostgreSQL database with encrypted connections
Role-based access controls for staff
Secure token-based authentication (JWT) for app sessions
Regular security audits and vulnerability monitoring
Automatic session expiration and secure logout

16. Cookies

We use cookies and similar technologies on our website. For a detailed list of all cookies, their purposes, and durations, please see our Cookie Policy.

Our mobile application does not use browser cookies but may use local storage and secure token storage for session management.

17. Changes to This Privacy Policy

We may update this policy to reflect changes in our practices, services, or legal requirements. Material changes will be communicated via our website and/or push notifications in the app.

We encourage you to review this page periodically. The "Last Updated" date at the top indicates the most recent revision.

18. Contact the Data Controller

For any privacy-related questions, data requests, or complaints:

Name: Ali Karel
Turkish identity number (T.C.): 50010234522
Address: Aksu 3801 Sokak No:35/5 Antalya