KVKK Privacy Notice

Data Controller

Your personal data is processed by [İşletme sahibinin adı soyadı] — VipiGo Software and IT Services (“VipiGo”), as data controller, within the scope described below.

• Address: [Açık adres], İzmir
• Tax details: [Vergi dairesi] — VKN/TCKN: [numara]
• Email: [email protected]
• Phone: +90 551 674 73 33
• Website: vipigo.com.tr

VipiGo is a software platform and does not provide transport. D2-licensed carriers who take on transfer requests sent via the platform are separate data controllers for the personal data they process as part of the transport service.

Personal Data Processed

Passengers (those creating a transfer request): full name, phone number, email address (if provided), pickup and drop-off addresses, transfer date and time, number of passengers, vehicle preference, request note (e.g. flight number, luggage details) and the language you selected on the site.

Carriers (subscribed users): full name or trade name, contact details, tax details, D2 authorization certificate details, vehicle plate and registration details, insurance policy details, drivers' SRC and psychotechnical certificate details, subscription and payment/invoice records.

Contact form and KVKK applicants: full name, contact details and message content; for KVKK applications, also the Turkish ID number (for foreigners, nationality and passport or ID number) and notification address for identity verification.

All site visitors: transaction security records such as IP address, browser and device information, visit date and time, and the session cookie.

Purposes of Processing

• Receiving your transfer request, forwarding it to a suitable carrier and contacting you about it
• Setting up and running carrier subscriptions, collecting and invoicing subscription fees
• Verifying carriers' authorization certificates, vehicle and insurance details
• Answering your messages and KVKK applications
• Keeping the platform secure and preventing misuse (e.g. automated requests)
• Fulfilling our legal obligations and responding to information requests from competent authorities
• Protecting our rights in possible disputes

Legal Bases

Your personal data is processed on the following legal bases under Article 5(2) of the Law:

• Directly related to the conclusion or performance of a contract (Art. 5/2-c): receiving your transfer request and forwarding it to a carrier, running the carrier subscription.
• Compliance with the data controller's legal obligation (Art. 5/2-ç): records under tax and commercial law and Law No. 5651, requests from competent authorities.
• Establishment, exercise or protection of a right (Art. 5/2-e): records that may be used as evidence in the event of a dispute.
• Our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f): site security, preventing misuse and improving the service.

Processing not based on these grounds (e.g. sending commercial electronic messages for campaigns and announcements) is carried out only with your explicit consent; no data is currently processed for this purpose.

Method of Collection

Your personal data is collected electronically via the transfer request, contact and KVKK application forms on the site, email, phone and WhatsApp correspondence, carrier registration processes and automatically (server logs and session cookie).

Recipients

• The D2-licensed carrier who will handle your request: full name, phone, pickup and drop-off address, date and time, number of passengers, vehicle preference and your request note; for planning and carrying out the transfer.
• Competent public authorities and judicial bodies: under a legal obligation and upon request.
• Business partners we use: server hosting, financial advisory and accounting, and payment service providers; only to the extent the service requires.

Transfer Abroad

For the secure and fast operation of the site and for our business processes, we use the following services whose servers are located abroad:

• Cloudflare (content delivery and security): your IP address and request details when you connect to the site.
• Telegram (internal notifications): the content of new transfer requests and contact messages, as notifications to our team.
• Translation service: texts of requests and messages written in a language other than Turkish, when translated into Turkish for our team.
• OpenStreetMap (fare calculator map): when the map section opens, map images are loaded from OpenStreetMap Foundation servers, and your IP address and browser information are sent to those servers. Addresses you search for and points you select on the map are sent via our server to the OpenStreetMap (Nominatim) and OSRM routing services for route and price calculation, without sharing your IP address.

These transfers are carried out in accordance with the conditions and procedures set out in Article 9 of the Law.

Retention Periods

• Transfer requests and contact messages: 2 years from the request date
• Carrier subscription, payment and invoice records: 10 years (Turkish Commercial Code No. 6102 Art. 82 and Tax Procedure Law No. 213 Art. 253)
• KVKK applications and replies: 3 years from the application date
• Transaction security records (server logs): 2 years

When the period ends, personal data is deleted, destroyed or anonymised.

Your Rights

Under Article 11 of the Law, you may apply to VipiGo to exercise the following rights:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties in Türkiye or abroad to whom the data is transferred
• To request correction if the data is incomplete or inaccurate
• To request deletion or destruction under the conditions of Article 7 of the Law
• To request that correction, deletion or destruction be notified to the third parties to whom the data was transferred
• To object to a result against you arising from analysis of the processed data exclusively by automated systems
• To claim compensation for damage suffered due to unlawful processing

How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your application via the KVKK Application Form, from the email address registered in our system or with a secure electronic or mobile signature to [email protected], or with a wet-signed petition to our address above.

Your application is concluded free of charge within 30 days at the latest; if the process involves an additional cost, a fee per the tariff set by the Personal Data Protection Board may be charged. If your application is rejected, you find the reply insufficient or no reply is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the Law.