enINFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
WhatsApp Communication
1. WHY ARE WE PROVIDING THIS NOTICE?
YOLCU360 BİLİŞİM ANONİM ŞİRKETİ (hereinafter referred to as “Yolcu360” or the “Company”), acting as the Data Controller, provides this information notice in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Regulation on Principles and Procedures for Fulfilling the Obligation to Inform published in the Official Gazette dated 10.03.2018 and numbered 30356.
This notice is prepared to inform you, in accordance with Articles 10 (“Obligation to Inform by the Data Controller”) and 11 (“Rights of the Data Subject”) of KVKK and Articles 4 and 5 of the aforementioned Regulation, about:
the purposes for which your personal data will be processed,
to whom and for what purposes it may be transferred,
the method and legal basis of data collection,
and your rights under Article 11 of KVKK.
2. WHAT DO WE INFORM YOU ABOUT?
|
|
3. WHAT PERSONAL DATA DO WE PROCESS?
If you contact us via the WhatsApp channel linked to our number 905050360360, and you share information during this communication process;
Identity Information | Name, surname, Turkish ID number |
Contact Information | Mobile phone number, email address |
Customer Transaction Information | Contact request category and subject, priority level, request details, provided explanations, documents attached to your request, date and time of communication, responses provided to your request. Damage report information under the Assurance Package (damage details, accident date, accident time, driver’s license, accident report, vehicle registration, insurance policy, bank account number, accident photos), and if applicable, detailed car rental reservation information (reservation number, reservation price, vehicle information, rental company, rental location, additional package information, financial information, etc.), and if applicable, flight ticket-related information (order number, ticket price, flight details, airline company, financial information, etc.). |
We kindly request that you do not share any personal data or sensitive personal data that requires your explicit consent under the Turkish Personal Data Protection Law (KVKK) within the explanations or documents you provide in relation to your requests. If you nevertheless share such data, it will be deemed that you have given your explicit consent for its processing for the purposes stated below, and if necessary, deletion/destruction procedures will be carried out for such data.
4. WITH WHOM AND FOR WHAT PURPOSES DO WE SHARE YOUR PERSONAL DATA?
Where legal obligations exist or under the conditions set forth in Articles 8/2 and 9 of the KVKK, your personal data specified in Section 3 may be shared for the purposes specified in Section 6 with our contracted suppliers and service providers in order to provide our services through our website and improve service quality, with our legal counsel for the follow-up of legal matters, and with judicial and administrative authorities requesting information for the exercise of our legal defense rights in the event of potential legal disputes, investigations, judicial or administrative audits, or similar circumstances, as well as to respond to official or legal requests for information and documentation.
In addition, your personal data specified in Section 3 may also be transferred to Meta Platforms Inc., whose servers are located abroad, due to the technical nature of communication and customer relationship management processes conducted via WhatsApp Business, for the purposes specified in Section 6. Such transfer is incidental and carried out in accordance with Article 9/6 (a), (c), and (d) of the KVKK.
Please note that communication via WhatsApp Business is not mandatory. Users who do not prefer this channel may contact us via our call center at 0850 360 5 360 or through other communication channels listed on the “Contact” page of www.yolcu360.com.
Your personal data processed under the request form may be stored in cloud environments due to the use of third-party cloud service providers whose servers are located abroad (Amazon Web Services). This is done for the operation of the Yolcu360 Platform, delivery of services, handling communication requests, ensuring secure storage, backup, and access to your data.
Such transfers are carried out in accordance with Article 9/4(c) of the KVKK, based on the existence of a standard contractual clause covering matters such as data categories, purposes of transfer, recipient groups, and technical and administrative measures. A standard contract has been signed between the Company and Amazon Web Services, Inc., ensuring that transfers are conducted in compliance with KVKK and in a secure manner.
Similarly, the Company uses Google Cloud Platform, Google Workspace, Cloud Identity, Looker (original), SecOps services, Application Services, and/or other Google Cloud services (“Google Solutions”) in its commercial and administrative operations. As a result, certain personal data processed through these services (e.g., user access logs, appointment data stored in Google Workspace calendar applications, or user interaction analytics processed via Looker) may be transferred to Google Cloud EMEA Limited, whose servers are located within the European Union, due to technical requirements.
The Company has entered into a standard contractual clause with Google Cloud EMEA Ltd. under Article 9/4(c) of the KVKK, and such international data transfers are carried out in compliance with applicable law and in a secure manner.
5. WHAT IS THE METHOD AND LEGAL BASIS FOR COLLECTING YOUR PERSONAL DATA?
Your personal data is collected automatically when you contact us via the WhatsApp channel linked to our number 905050360360, based on the legal grounds specified in Article 5/2 of the KVKK, namely:
necessity for the establishment, exercise, or protection of a legal right, and
necessity for the legitimate interests of the data controller, provided that such processing does not harm your fundamental rights and freedoms.
6. WHAT ARE THE PURPOSES AND LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA?
Personal Data Category | Processing Purposes | Legal Grounds |
|---|---|---|
Identity Information | Your personal data is processed for purposes such as creating records related to requests, classifying communication subjects, conducting reviews in line with requests, carrying out the process of fulfilling requests, carrying out the feedback process within the scope of your requests, conducting communication activities, fulfilling our relevant legal obligations, carrying out activities necessary for fulfilling our company's legitimate interests such as fulfilling our company's administrative or commercial business processes, conducting activities in compliance with legislation, following up and conducting legal affairs, conducting/auditing business activities, and conducting assignment processes. | "It being mandatory to process data for the establishment, exercise, or protection of a right," as regulated under Article 5/2(e) of Law No. 6698; "It being mandatory to process data for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject," as regulated under Article 5/2(f) of Law No. 6698 |
Contact Information | Your personal data is processed for purposes such as creating records related to requests, classifying communication subjects, conducting reviews in line with requests, carrying out the process of fulfilling requests and providing feedback, conducting communication activities, fulfilling our relevant legal obligations, carrying out activities necessary for fulfilling our company's legitimate interests such as fulfilling our company's administrative or commercial business processes, conducting activities in compliance with legislation, following up and conducting legal affairs, conducting/auditing business activities, and conducting assignment processes. | "It being mandatory to process data for the establishment, exercise, or protection of a right," as regulated under Article 5/2(e) of Law No. 6698; "It being mandatory to process data for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject," as regulated under Article 5/2(f) of Law No. 6698 |
Customer Transaction Information | Your personal data is processed for purposes such as creating records related to requests, classifying communication subjects, conducting reviews in line with requests, carrying out the process of fulfilling requests and providing feedback, conducting communication activities, fulfilling our relevant legal obligations, carrying out activities necessary for fulfilling our company's legitimate interests such as fulfilling our company's administrative or commercial business processes, conducting activities in compliance with legislation, following up and conducting legal affairs, conducting/auditing business activities, and conducting assignment processes. | "It being mandatory to process data for the establishment, exercise, or protection of a right," as regulated under Article 5/2(e) of Law No. 6698; "It being mandatory to process data for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject," as regulated under Article 5/2(f) of Law No. 6698 |
7. YOUR RIGHTS UNDER THE KVKK
By applying to our Company, you have the right to:
a) learn whether your personal data is processed,
b) request information if it has been processed,
c) learn the purpose of processing and whether it is used in accordance with that purpose,
d) know the third parties to whom your data is transferred domestically or internationally,
e) request correction if your data is incomplete or inaccurate,
f) request deletion or destruction within the scope of Article 7 of KVKK,
g) request notification of actions taken under (d) and (e) to third parties to whom your data has been transferred,
h) object to the occurrence of a result against you through automated processing,
j) request compensation for damages in case you suffer harm due to unlawful processing.
You may submit your requests regarding the exercise of the above rights in Turkish and in writing, in accordance with Article 13(1) of KVKK and the Regulation on Procedures and Principles for Applications to the Data Controller dated 10.03.2018 (No. 30356), or via registered electronic mail (KEP), secure electronic signature, mobile signature, or the email address previously notified to and registered in our systems.
Requests will only be answered regarding the applicant, and no information will be provided about family members or third parties. The Company reserves the right to verify your identity before responding.
Your application must include:
Your name, surname, and signature (if written),
Your Turkish ID number (for Turkish citizens) or nationality, passport number, or ID number (for foreigners),
Your residential or workplace address for notification purposes,
Your email address, phone, and fax number (if any),
The subject of your request and relevant documents (if any).
Written applications may be submitted with required documents to:
Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R İç Kapı No:13 Ataşehir / İstanbul, Türkiye.
Applications may also be submitted via the contact channels on https://yolcu360.com using the email address previously registered in our system.
Applications signed with a secure electronic signature under Law No. 5070 on Electronic Signature may also be submitted via KEP. Only messages sent from KEP addresses to KEP addresses will be accepted.
Incomplete or inaccurate information may prevent proper processing of your request. The Company reserves all legal rights in such cases.
8. MEASURES FOR THE PROTECTION OF YOUR PERSONAL DATA
The protection of personal data is an important matter for our Company. We take necessary technical and administrative measures to protect personal data against unauthorized access, loss, misuse, disclosure, alteration, or destruction.
Although the Company takes necessary information security measures, in the event of any damage or unauthorized access resulting from cyberattacks, the Company shall immediately notify you and the Personal Data Protection Authority.
9. ACCURACY AND UP-TO-DATE MAINTENANCE OF YOUR PERSONAL DATA
Individuals sharing their personal data with the Company acknowledge that accuracy and up-to-dateness are important under KVKK and other applicable legislation, and that they are solely responsible for any consequences arising from providing incorrect information.
Any changes or updates to your personal data may be submitted in writing to the address below or via the contact channels on https://yolcu360.com.
10. DELETION, DESTRUCTION OR ANONYMIZATION OF YOUR PERSONAL DATA
Your personal data processed for the purposes stated in this notice will be deleted, destroyed, or anonymized by the Company in accordance with Article 7/1 of KVKK when the purpose of processing ceases to exist and when statutory retention periods expire.
Processing will be carried out in accordance with the Company’s Personal Data Retention and Destruction Policy, prepared under the Regulation on Deletion, Destruction or Anonymization of Personal Data. This may be done ex officio or upon your request.
11. DATA CONTROLLER INFORMATION
YOLCU360 BİLİŞİM ANONİM ŞİRKETİ
MERSIS No: 0981139899000001
Address: Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R İç Kapı No: 13 Ataşehir / İstanbul, Türkiye
KEP Address: yolcu360bilisim@hs01.kep.tr