Privacy Policy & Data Protection Notice

1. Identity of the Data Controller

Under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles for Fulfilling the Disclosure Obligation, our details as data controller are as follows:

Şirketimiz, 6698 sayılı KVKK kapsamında VERBİS kayıt yükümlülüğü doğuran eşiklerin altında kaldığından sicile kayıt zorunluluğu bulunmamaktadır.

2. Categories of Personal Data Processed

3. Purposes of Processing

Your personal data is processed for the following purposes under Articles 4, 5 and 6 of the KVKK:

• Formation and performance of the contract: providing the transfer service, creating/updating/cancelling bookings, planning drivers and vehicles
• Compliance with legal obligations: tax legislation, invoicing/e-invoicing, Consumer Protection Law No. 6502, Ministry of Culture and Tourism regulations
• Financial reconciliation and audit: collection, refunds, accounting and audit activities
• Communication and customer service: booking confirmations, change notifications, support requests
• Information security: detecting unusual activity, preventing fraud, keeping log records
• Improving service quality: statistical analysis and service improvements
• Marketing (with explicit consent): campaign, discount and promotion messages (within the scope of Law No. 6563 on the Regulation of Electronic Commerce and the İYS system)

4. Legal Grounds for Processing

Your data is processed on the following legal grounds under Articles 5/2 and 6/3 of the KVKK:

• Processing is directly related to the formation or performance of a contract (Art. 5/2-c)
• Processing is necessary to fulfil our legal obligation (Art. 5/2-ç)
• Processing is mandatory for the establishment, exercise or protection of a right (Art. 5/2-e)
• Processing is necessary for our legitimate interests (Art. 5/2-f)
• Your explicit consent (in particular for marketing messages)

5. Recipients of Personal Data and Purposes of Transfer

Your personal data may be shared with the following parties, strictly as the service requires:

• Drivers and supplier/fleet partners: name, phone, pickup and drop-off points and flight details, so the transfer can physically take place
• Virtual POS / payment service providers (iyzico, PayTR, Param, Stripe, etc. — PCI DSS certified): secure payment collection
• Cloud infrastructure providers (AWS, Supabase, Netlify): data hosting and application infrastructure
• Communication service providers: transactional e-mail (Resend/Gmail SMTP), SMS, WhatsApp Business notifications
• Public authorities: courts, prosecutors, tax offices, the Ministry of Culture and Tourism, the Personal Data Protection Board — only where legally required
• Professional advisers: legal, financial and audit advisers, under contractual confidentiality

Transfers abroad: some of our cloud infrastructure providers host their servers outside Türkiye (in the EU or the USA). Such transfers are carried out under Article 9 of the KVKK, based on your explicit consent or appropriate safeguards (contractual undertakings, standard contractual clauses).

6. Methods of Collection

Your personal data is collected through our website, mobile applications, call centre, e-mail, social media, our physical office, our business partners and third-party booking channels (such as Booking.com); by fully or partly automated means, verbally, in writing or electronically.

7. Retention Periods

• Booking and transfer records: 10 years (Turkish Commercial Code, Art. 82)
• Invoices and financial records: 10 years (Tax Procedure Law, Art. 253)
• Contract-related data: 10 years from the end of the contract (Turkish Code of Obligations, Art. 146)
• Data processed for marketing: until your explicit consent is withdrawn
• Cookie data: for the periods stated in the Cookie Policy
• Log records: 2 years (Law No. 5651)

At the end of these periods, personal data is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK and the Regulation on Deletion, Destruction or Anonymisation of Personal Data.

8. Data Security Measures

We apply the following technical and organisational measures:

9. Your Rights under the KVKK

Under Article 11 of Law No. 6698 you have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether the data is used accordingly
• Know the third parties in Türkiye or abroad to whom your data has been transferred
• Request rectification if your data has been processed incompletely or inaccurately
• Request erasure or destruction of your personal data under the conditions set out in the KVKK
• Request that rectification, erasure or destruction be notified to third parties to whom the data was transferred
• Object to a result against you arising from analysis of your data solely by automated systems
• Claim compensation if you suffer damage due to unlawful processing of your personal data

10. How to Submit a Request

To exercise the rights above, you may apply through one of the following methods under the Communiqué on the Procedures and Principles of Application to the Data Controller:

• Written application in person: Akevler Mah. 1059. Sk. Çemberlitaş İnş. No: 17/A, Esenyurt / İstanbul
• Written notice through a notary public
• Registered electronic mail (KEP): simsekvia@hs01.kep.tr
• E-mail (from the address registered in our systems): kvkk@viagotransfer.com

Your application must contain your name and surname, signature (for written applications), national ID number (or nationality and passport number for foreign nationals), address for notification, e-mail/phone if any, and the subject of your request. We respond free of charge within 30 days at the latest. If the process incurs additional cost, a fee may be charged according to the tariff set by the Board.

If your application is rejected, you find our response insufficient, or you receive no reply in time, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.

11. Cookies

For details about the cookies used on our website, please see our Cookie Policy.

12. Changes to this Notice

This notice may be updated when necessary. The current version is always published on this page. Significant changes are also announced on our website and, where appropriate, sent to your registered contact details.

13. Contact

For your data protection requests and questions: