KVKK Disclosure Statement (Law No. 6698)

This is a courtesy English translation of the KVKK Disclosure Statement. The Turkish version is the legally binding text under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"); in case of any discrepancy, the Turkish version prevails. This statement is provided by PickupTime (pickuptime.io) ("PickupTime") acting as data controller, pursuant to Article 10 of the KVKK and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform.

1. Data Controller

Legal name: PickupTime (pickuptime.io)Address: Cumhuriyet Mahallesi, İstiklal Caddesi No 8, Ürgüp/Nevşehir, TürkiyeEmail: business@pickuptime.io

PickupTime is the data controller for operator account data. For guest and driver data entered into the platform by operators, the data controller is the relevant operator, and PickupTime acts as a data processor within the meaning of the Law. In those cases the duty to inform rests primarily with the relevant operator; this statement is provided to all data subjects for transparency about the processing carried out on the platform.

2. Personal Data Processed

• Operator representative data: name, email, phone, business and billing details, session and transaction records.
• Driver data: name, phone, assigned vehicle plate, and GPS location data transmitted from the driver's device only while a trip assigned to that driver's vehicle is active (from the start of the trip until its completion). No location data is collected outside of trips, during breaks or in private time.
• Guest data: name (optional to enter), hotel or pickup point, contact details (phone/email), booking and trip information.
• Vehicle data: plate, make, model, model year and other particulars contained in the vehicle registration document ("ruhsat"), which is read using AI-assisted OCR.
• Technical data: IP address, device and browser information, essential cookies, log records.

3. Purposes of Processing

Personal data is processed for: planning and executing transfer and pickup operations; providing guests with a vehicle tracking link and estimated time of arrival; propagating delays to subsequent stops; producing agency reports and fleet kilometre statistics; creating vehicle records automatically from registration documents; managing membership and subscription processes; billing; ensuring information security; improving service quality; and fulfilling legal obligations.

4. Legal Grounds

Personal data is processed on the following grounds set out in Article 5 of the Law:

• Art. 5/2(c) (establishment or performance of a contract): performance of the subscription agreement; execution of trip operations; location sharing as part of the driver's performance of work duties; coordination of the transfer service promised to the guest.
• Art. 5/2(f) (legitimate interests): ensuring service security, detecting errors and misuse, operational reporting and statistics, subject always to a balancing against the fundamental rights and freedoms of the data subject.
• Art. 5/2(ç) (legal obligation): retention and notification obligations arising from tax, commercial and electronic communications legislation.
• Explicit consent (Art. 5/1): where the above grounds do not apply, in particular where the transfer of personal data to servers and service providers established abroad requires explicit consent under Article 9 of the Law. Giving explicit consent is not mandatory and any consent given may be withdrawn at any time.

5. Transfers of Personal Data

Personal data is transferred, only to the extent required by the service, to suppliers established abroad from whom we obtain hosting and database infrastructure (Supabase/AWS, EU region), mapping and routing services (Google Maps), email delivery (Resend) and registration-document OCR processing (OpenAI). Cross-border transfers are carried out pursuant to Article 9 of the Law, on the basis of your explicit consent or through the mechanisms prescribed by the Turkish Personal Data Protection Board (adequacy decision, undertaking, standard contract). Data may also be disclosed to legally authorised public bodies upon lawful request.

6. Method of Collection

Personal data is collected by partially automated means: electronically through the web and mobile interfaces, via the location services of the driver's device (only during an active trip), through the upload of the vehicle registration document, and through automated logging systems.

7. Retention Periods

GPS location data is retained for a maximum of 90 days after a trip is completed; operators may configure a shorter period, after which the data is deleted or anonymised. Account and billing data is retained for the duration of the contractual relationship and thereafter for the limitation periods prescribed by applicable legislation; guest data is retained in accordance with the relevant operator's instructions and configuration. Data whose retention period has expired is deleted, destroyed or anonymised through periodic disposal processes.

8. Rights of the Data Subject (Art. 11 KVKK)

Under Article 11 of the Law you have the right to: learn whether your personal data is processed; request information about such processing; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom data is transferred domestically or abroad; request rectification of incomplete or inaccurate data; request erasure or destruction of data under the conditions of Article 7; request that such rectification, erasure or destruction be notified to third parties to whom the data has been transferred; object to a result arising against you through analysis exclusively by automated systems; and claim compensation for damage suffered as a result of unlawful processing.

9. How to Apply

You may submit your requests, together with documents verifying your identity and in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, by email to business@pickuptime.io or in writing to Cumhuriyet Mahallesi, İstiklal Caddesi No 8, Ürgüp/Nevşehir, Türkiye. Applications are concluded free of charge within 30 days at the latest; where the process entails an additional cost, the fee set by the Board's tariff may be charged. If your application is rejected or you consider the response insufficient, you retain the right to lodge a complaint with the Personal Data Protection Board.