Driver Location Data Notice and Consent

This notice is presented to you when you are registered as a driver on the PickupTime platform. Its purpose is to inform you about the processing of your location data, in line with Turkish Law No. 6698 (KVKK) and, where applicable, the GDPR, and to obtain your consent where required. Please read it carefully.

1. Parties and Roles

The platform is operated by PickupTime (pickuptime.io) ("PickupTime"). The business that registers you on the platform and plans your trips (the "Operator") is the data controller of your location data; PickupTime processes that data on the Operator's behalf as a data processor. Questions about the processing of your location data should be addressed to your Operator in the first instance, or to business@pickuptime.io.

2. What Data Is Collected, and When?

Your device's GPS location data (latitude, longitude, speed, heading and timestamp) is collected and transmitted only while a trip assigned to your vehicle is active, that is, during the window from when the trip is started until it is completed (the planned-to-completed window).

We want to be explicit about the following:

• No location data is collected outside of trips, during breaks, between shifts, or in your private time.
• Location sharing stops automatically when the trip is completed or cancelled.
• You can effectively stop sharing at any time by disabling location services on your device; however, guest tracking and operational coordination will not function during an active trip if you do so.
• The application does not access your microphone, camera, contacts or messages.

3. Purposes of Processing

Your location data is processed solely for the following purposes:

• Showing guests the vehicle's live position and estimated time of arrival (ETA) through their personal tracking link;
• Propagating a delay at one stop to subsequent stops and informing the operations team;
• Producing trip reports for the agencies the Operator works with;
• Calculating fleet kilometre statistics.

Your location data is never used for advertising, marketing, profiling or monitoring of your behaviour outside trips, and is never transferred to third parties for such purposes.

4. Legal Grounds

The processing of your location data during active trips is based on the performance of the employment or service relationship between you and your Operator (Art. 5/2(c) KVKK; Art. 6(1)(b) GDPR where applicable) and on the legitimate interest in running the operation safely and efficiently (Art. 5/2(f) KVKK; Art. 6(1)(f) GDPR). Where the storage of your data on hosting infrastructure located abroad (Supabase/AWS, EU region) requires your explicit consent under Article 9 of the KVKK, the consent declaration at the end of this notice applies. If you do not give consent, your Operator will inform you whether the service can be provided through domestic alternatives; you may withdraw your consent at any time without giving reasons.

5. Device Pairing and Token Revocation

Your access to the driver interface is provided through a device token assigned to your device. This token can be revoked by your Operator at any time. Once revoked, your device loses its pairing with the platform and location transmission ceases immediately. If you leave your job or change vehicles, you may ask your Operator to revoke the token.

6. Retention

Your location data is retained for a maximum of 90 days after the relevant trip is completed; your Operator may configure a shorter period. After this period, location records are deleted or converted into anonymous fleet statistics that can no longer be linked to you. Anonymous statistics (for example, total fleet kilometres) do not constitute personal data.

7. Disclosure of Data

Your location data is transferred, to the extent required by the service, to our hosting provider (Supabase/AWS, EU region) and to the mapping/routing provider (Google Maps). Guests see only the vehicle's position, its plate number and the driver's first name through their personal tracking link; no other personal data of yours is shared with guests. Tracking links are generated as unguessable tokens and stop working when the trip ends.

8. Your Rights

Under Article 11 of the KVKK (and, where applicable, Articles 15-21 GDPR) you have the right to learn whether your data is processed, to request information, rectification and erasure, to know the third parties to whom your data is transferred, to object to results produced by exclusively automated analysis, and to claim compensation for unlawful processing. You may submit requests to your Operator or to business@pickuptime.io.

9. Consent Declaration

I have read and understood this notice. I freely consent to the processing of my location data, solely during active trips assigned to my vehicle, for the purposes described above, and to its storage on hosting infrastructure located abroad. I understand that I may withdraw my consent at any time by contacting my Operator or business@pickuptime.io.

PickupTime (pickuptime.io), Cumhuriyet Mahallesi, İstiklal Caddesi No 8, Ürgüp/Nevşehir, Türkiye