حقوقی

سیاست حریم خصوصی

آخرین به‌روزرسانی: 2026-09-20

این صفحه به زبان‌های ترکی و انگلیسی منتشر شده است؛ متن انگلیسی نمایش داده می‌شود.

1. Scope

This policy explains which personal data are collected through istanbulvitotransfer.com (the “Site”), for what purposes they are used, with whom they are shared, how long they are kept and what your rights are. The Site is a platform that connects Mercedes Vito owners directly with passengers; the transport service is provided by the vehicle owner. The data controller operating the Site: Book Grup Organizasyon Hizmetleri Sanayi ve Ticaret Limited Şirketi, Limonluk Mah. 2453 Sokak, No: 3/C, Yenişehir / Mersin. Email: [email protected]

2. Whose data are collected, and which

Visitors

  • Technical data: the server access logs of our hosting provider Cloudflare (IP address, date and time, requested page, browser information).
  • Cookieless visit counter: Cloudflare Web Analytics is used to count how often each page is visited. This counter uses no cookies or browser storage, does not identify you and does not track you across visits; the page viewed, the referring site, country, browser and device type, and page load timings are kept only as aggregate statistics. Because it uses no cookies, it runs on all pages of the Site independently of your choice in the cookie banner. Visits from the European Union are not included in this counter.
  • Visit statistics (only if you allow it): If you choose “Accept” in the cookie banner, Google Analytics is loaded to measure how the Site is used: the pages you view, where you came from, your approximate location (city level), and your device and browser type are sent to Google together with a random cookie identifier (see “Cookies” and section 5). If you do not allow it, the Google Analytics script is never loaded. No measurement takes place on the password reset and email verification pages.
  • Ad measurement (Meta Pixel): to measure the results of our Facebook and Instagram ads, the page viewed, contact button clicks and form submissions are sent to Meta Platforms; in the registration, listing, request and membership payment steps your email and phone number are sent only as a digest (hash); in the payment steps the chosen package, amount and payment number are also sent. Details in the “Cookies” section.
  • Browser storage: your language preference (ivt-lang), your favourite listings (ivt_favorites) and your cookie choice (ivt-consent) are kept only in your browser’s local storage; they are not sent to the server.
  • Contact and quote forms: the quote form on the home page and the contact form open your email app; we receive only the full name, phone, email address and message in the email you send. The Site does not store the content of these forms on its own server.
  • Listing videos (YouTube): listings of members on the Vito Pro plan may contain a YouTube video. The video is not loaded when the page opens; only when you press play is the player loaded from Google via youtube-nocookie.com, and your IP address and browser/device information are transmitted to Google during that request. As long as you do not play it, no request reaches Google and therefore no cookie is set.

Passengers (those who submit a booking request)

  • The booking request form on a listing page is sent directly to our server and stored: full name, email, phone, route, date and time, number of passengers, your message, the language you selected, the status of the request and the IP address at the time of submission.
  • No membership is required for a booking request; your request is passed to the owner of the listing you selected (see section 4).

Vehicle owners (members)

  • Account: full name, email, phone, an irreversible digest (hash) of your password, language preference, the time your email was verified, and the times you read the privacy notice and accepted the terms of use. Your password is never stored in plain text.
  • Session: when you sign in, a session identifier, sign-in time, IP address and browser information; single-use link records for email verification and password reset.
  • Listing: vehicle model, year, trim, seat and luggage capacity, location (district), the languages you speak, route prices and photos. The optional plate number is visible only to you and the site administrator. Photos are resized in your browser before upload; location (GPS) and device information (EXIF) are removed in the process.
  • Listing statistics: how many times your listing page has been viewed is kept only as a daily total; the visitor’s IP address or identity is not recorded.
  • Membership and payment records: your plan (Vito Yayın / Vito Pro), billing period (yearly / monthly), membership start and end dates, free-trial dates, the amount, reference code and status of the payment instruction, and the invoicing details you entered on the payment form, if any (company title, tax/ID number, address).
  • Trial history: to prevent abuse of the free trial, an irreversible digest of your phone number produced with a secret key (not the number itself) is kept for 24 months from the start of the trial; it is retained until that period expires even if you delete your account. Legal basis: legitimate interest (KVKK Article 5(2)(f)).
  • Administrative records: the approval, rejection or removal of your listing and the suspension of your account are recorded together with the reason.

Cookies

Only when you sign in as a member are two strictly necessary cookies set to maintain your session: ivt_session (session identifier, read only by the server) and ivt_auth (signed-in yes/no flag). Both are valid for at most 30 days and are deleted when you sign out. In addition, only if you allow it in the cookie banner, Google Analytics 4 cookies are set to measure visit statistics: _ga and _ga_GCEXZD37KK (a random identifier that distinguishes your browser; up to 2 years). Your permission is valid for 12 months; you can withdraw it at any time via the “Cookie preferences” link at the bottom of the page — when you do, these cookies are deleted and measurement stops. Separately, to measure the results of our Facebook and Instagram ads, Meta Pixel runs on the Site. It sets the _fbp cookie (up to 90 days) and sends events such as the page you view, the contact button you click and the form you submit to Meta Platforms. In the registration, listing and transfer request forms your email address and phone number are sent to Meta only as an irreversible digest (hash); your name and message text are not sent. An event is also sent when you create a membership payment instruction and when your payment is approved; it contains the package and period you chose, the amount, the payment number and an irreversible digest of your member ID. The payment approval event is sent while you are not on the Site, at the time of the administrator’s approval. This measurement runs independently of your choice in the cookie banner; you can manage Meta’s advertising settings from your Facebook and Instagram account. The Site works the same way without these cookies.

3. Publicly visible information

When your listing is published, the following information is publicly visible on the listing page, in the listing directory and in search engines: the short form of your name (e.g. “Mehmet K.”), your phone number, your location (district), the languages you speak, vehicle details, prices and photos. Your phone number is published so that passengers can call you directly; when you pause or delete the listing, this information is no longer public. Your email address and full name are not public.

4. Purposes of use and sharing

  • Passenger → vehicle owner: your booking request (name, phone, email, route, date, number of passengers, message) is passed to the owner of the listing you selected, both in the member panel and by email. The vehicle owner may use this information only to communicate about your transfer and is responsible for that use on their own behalf.
  • Vehicle owner → passenger: the email sent to you when your request is received contains the owner’s short name and phone number.
  • Site administrator: to approve listings and prevent misuse, sees members’ full name, email and listing details, and booking requests when necessary.
  • Membership and payment: your plan choice, payment instruction and approval record are processed to perform the membership contract, verify the payment and issue invoices; your reference code is matched against our bank account movements to identify which transfer is yours.
  • Protecting the trial entitlement: the keyed digest of your phone number is used only to decide whether a second free trial may be granted for the same number; it is used for no other purpose and shared with no one.
  • Transactional emails: email verification, password reset, listing approval/rejection, request notifications and membership/payment notifications (payment instruction, approval or rejection, expiry reminder, performance report). No marketing or bulk emails are sent.
  • Security: IP address and request counts are kept for a short time to prevent misuse and automated attacks.

5. Service providers

  • Cloudflare (USA) — hosting and content delivery (Pages), database (D1), photo storage (R2) and the cookieless visit counter (Web Analytics). Data are kept on Cloudflare’s servers abroad.
  • Resend (USA) — delivery of transactional emails. The recipient address, subject and email content are passed to Resend for delivery.
  • Google Fonts — fonts are loaded from fonts.googleapis.com and fonts.gstatic.com; your IP address is transmitted to Google during this request.
  • Google Analytics (Google Ireland Ltd. / Google LLC, USA) — visit statistics, only if you allow it. Page views and the usage data listed in section 2 are processed on Google’s servers. Google Analytics 4 does not store your IP address; it is used only to derive an approximate location.
  • YouTube (Google Ireland Ltd. / Google LLC, USA) — the video on a Vito Pro listing is loaded from youtube-nocookie.com only when you press play; at that moment your IP address and device information are transmitted to Google.
  • Meta Platforms (Meta Platforms Ireland Ltd., Ireland / Meta Platforms, Inc., USA) — Facebook and Instagram ad measurement (Meta Pixel and Conversions API). The page viewed, event type, IP address, browser information, the _fbp cookie identifier and, in forms, the digest (hash) of your email and phone number, and in the membership payment steps also the package, period, amount, payment number and a digest of your member ID, are processed on Meta’s servers.
  • Banks — when you pay for your membership by bank transfer, your full name and reference code appear in our bank account movements. For that transaction banks are separate data controllers under their own legislation.
  • Your data are not sold. The data passed to Meta for ad measurement are described above. Apart from the above and the sharing described in section 4, data are transferred to competent authorities only in the case of a legal request.

6. Retention periods

  • Booking requests: at most 12 months after creation; deleted immediately when the related listing or the vehicle owner’s account is deleted.
  • Membership data: for as long as your account remains open. When you delete your account, your listings, photos and incoming requests are deleted; the account record is anonymised (name, email and phone are removed).
  • Membership and payment records (plan, period, amount, reference code, invoicing details): 10 years under Article 82 of the Turkish Commercial Code. These records are kept until that period expires even if you delete your account.
  • Trial history (keyed digest of the phone number): 24 months from the start of the trial.
  • Session records: at most 30 days; deleted immediately when you sign out. Verification and reset links are deleted immediately once used and within 7 days at the latest once expired.
  • Email delivery records (recipient address, subject, delivery status): 90 days.
  • Email correspondence ([email protected]): at most 2 years.
  • Server access logs: for Cloudflare’s standard retention period.
  • Language preference and favourites: until you clear your browser data, only on your own device.

7. Your rights

Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) you have the right to access your data, to request their correction or erasure and to object to their processing. Members can correct their details and delete their account from the account settings; passengers can request the deletion of their requests by email. Details and how to apply are set out in the KVKK Notice.

8. Changes

This policy is updated when necessary; the current version is on this page and the update date is shown at the top. Significant changes are notified to members by email.

9. Contact

For questions and applications: [email protected]