Privacy notice (KVKK)

1. Data controller

Your personal data is processed by the following company as data controller:

• Company name: REST ORGANİZASYON HİZMETLERİ TURİZM TAŞ. İNŞ. OTO AL. SAT. KİRALAMA SAN. TİC. İTH. İHR. LTD. ŞTİ. (the "Company")
• MERSIS number: 0734270570900001
• Tax office and number: Antalya Kurumlar V.D. · 7342705709
• Address: Molla Yusuf Mah. 1418 Sk. Canpolat Residence No:7 D:1, Konyaaltı / ANTALYA
• Email: info@restorganizasyon.com · Phone: +90 554 883 66 50
• REST Transfer (resttransfer.com) is the Company's transfer services brand.

2. Categories of personal data processed

• Identity: first name and surname.
• Contact: phone number (with country code), email address; if you contact us by WhatsApp, phone or email, the content of the messages and calls.
• Travel and flight details: transfer direction, airport, region, hotel name or address, transfer and return date and time, flight number, number of bags, selected vehicle and extras (child seat, stop on the way, extra waiting time, etc.), your booking note.
• Passenger details: number of adults, children and infants and the need for child seats. No names, ages or identity details of child or infant passengers are collected. If an alcoholic beverage is selected, your declaration that the passengers are over 18.
• Payment details: booking number, price, selected payment method, payment and refund status; for bank transfers, the details in the bank transaction such as the sender's name, amount and date. Your card details (card number, expiry date, security code) are not received or stored by us; card payments are made only on the secure payment page of the bank or payment institution.
• Legal transaction details: the texts you ticked as read or accepted in the booking and when, and delivery records of the emails sent to you.
• Transaction security details: date and time the booking was made; to prevent abuse, only an irreversible hash of your IP address (the raw IP address is not stored).
• Please do not write special categories of personal data, such as health information, in the booking note.

3. Purposes and legal grounds of processing

Your personal data is processed for the following purposes, on the legal grounds under Article 5(2) of the KVKK stated for each purpose:

• Taking the booking: calculating the price from the form details, recording the booking, creating the booking number and your personal confirmation link. Legal ground: establishment and performance of a contract (Art. 5(2)(c)).
• Planning and carrying out the transfer: assigning the vehicle and driver; passing the date, time, flight, route, hotel/address, number of passengers and bags, extras, your name and phone number to the driver; meet and greet with a name sign. Legal ground: Art. 5(2)(c).
• Flight tracking: monitoring the landing time using your flight number and directing the driver according to delays. Legal ground: Art. 5(2)(c).
• Communication about the booking: sending booking, confirmation, payment and cancellation emails; informing you by WhatsApp or phone before and during the transfer. Legal ground: Art. 5(2)(c).
• Payments and refunds: receiving payment, matching bank transfers with bookings, sending payment links, making refunds. Legal ground: Art. 5(2)(c).
• Handling changes, cancellations, requests and complaints: recording and assessing your request and getting back to you. Legal ground: Art. 5(2)(c).
• Invoicing, accounting and tax records: issuing invoices and keeping commercial books and records under the Turkish Commercial Code and the Tax Procedure Law. Legal ground: compliance with a legal obligation (Art. 5(2)(ç)).
• Compliance with consumer law: keeping consent records to prove that pre-contractual information was provided and the contract was accepted. Legal ground: Art. 5(2)(ç).
• Age check for alcoholic beverages: obtaining an age declaration so that alcohol is not served to persons under 18. Legal ground: Art. 5(2)(ç).
• Responding to requests of competent authorities: answering legally based information requests from courts, public prosecutors, law enforcement and other competent public authorities. Legal ground: Art. 5(2)(ç).
• Information security and prevention of abuse: limiting the number of bookings made from the same connection within a short time using the IP hash, and blocking fake and automated bookings. Legal ground: our legitimate interest, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)).
• Tracking email delivery: recording whether an email reached you and resending emails that could not be delivered. Legal ground: Art. 5(2)(f).

4. Method of collection

Your personal data is collected on the legal grounds above, by automated means through the booking form on our website, and by partly automated means via email, WhatsApp and phone, electronically and orally.

5. Recipients of personal data

Your personal data is transferred to the following parties only to the extent necessary for the purposes above:

• Drivers carrying out the transfer: name, phone, date, time, flight, route, hotel/address, number of passengers and bags, extras and your booking note (the job details are sent to the driver via WhatsApp).
• Banks and payment institutions: payment details required for bank transfers, card payments and refunds.
• Hosting provider: Hostinger (servers in the European Union / Germany); operation of the website (the information you submit through the website and the booking form passes through these servers).
• Database provider: Supabase (servers in the European Union / Germany); storage of booking records.
• Email provider: Resend (sending region European Union / Ireland); sending booking emails (name, email address, booking summary).
• WhatsApp (Meta): when you message us on WhatsApp and when job details are sent to the driver.
• Competent public authorities: where required by law, competent authorities such as courts, public prosecutors, law enforcement and the tax administration.

6. Transfers abroad

As the servers of Hostinger, Supabase, Resend and WhatsApp (Meta) are located abroad, your personal data is transferred abroad when these services are used. These transfers are made under Article 9 of the KVKK, in accordance with the transfer conditions and safeguards provided for in the Law.

7. Retention periods

• Booking, payment, invoice and accounting records: 10 years from the beginning of the year following the year of the transaction (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253).
• Consent records and email delivery records: together with the related booking, for the same period.
• Request and complaint correspondence not linked to a booking (email, WhatsApp): 3 years from the conclusion of the request.
• IP address hash: deleted automatically after the request limit period (1 hour) expires; not stored permanently.
• Personal data whose retention period has expired is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8. Your rights under Article 11 of the KVKK

Under Article 11 of the KVKK, by applying to the Company you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom the data is transferred,
• request correction if the data is incomplete or inaccurate,
• request deletion or destruction under the conditions of Article 7 of the KVKK,
• request that the correction, deletion or destruction be notified to the third parties to whom the data was transferred,
• object to a result against you arising from analysis of the data exclusively by automated systems,
• claim compensation for damage suffered as a result of unlawful processing.

9. How to apply

You can submit requests regarding your rights, in Turkish, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller: in writing to Molla Yusuf Mah. 1418 Sk. Canpolat Residence No:7 D:1, Konyaaltı / ANTALYA (by hand, through a notary or by registered mail with return receipt), or by email to info@restorganizasyon.com from the email address you previously provided to us and that is registered in our system.

Your application must include your name, surname, signature (for written applications), Turkish ID number for Turkish citizens or nationality and passport or ID number for foreigners, address for notifications, email address if any, phone number and the subject of your request.

Your application will be concluded free of charge as soon as possible according to its nature and within 30 days at the latest; if the process involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.