Privacy Policy

Last updated: April 28, 2026

Data controller

Kusadasi Transfer (tax no: 4600334983). Address: Kicesmelik Mah. Damlacik Yolu Sk. No:29, Kusadasi / Aydin, Turkey.

We are the data controller under Turkish KVKK and EU GDPR.

What we collect

Booking: name, WhatsApp phone, email (optional), hotel/address, flight or ship details.

Payment: only status via Stripe; card details never touch our servers.

Technical: IP, browser, language preference cookie. No analytics tracking.

Purpose

Arrange your transfer, process payment, assign a driver, send WhatsApp/email notifications.

Legal compliance (invoicing, D2 license record-keeping).

Sharing

Your data is shared with the assigned driver (name, phone, pickup details).

Processors: Stripe (payment), Cloudflare (CDN), Google Workspace (email), Meta (WhatsApp Business).

No transfers outside Turkey or EEA (except Cloudflare edge locations).

Retention

Booking records: 10 years (Turkish Tax Law). OTP codes deleted after 10 minutes.

Cookie preference: 1 year.

Your rights

Access, correction, deletion, portability, objection (GDPR 15-22, KVKK Art. 11).

Contact via WhatsApp +90 532 407 7712. We respond within 30 days.

Cookies

Essential only: language (kt_locale), session token, consent record. No tracking or ads.

Mobile apps (KusadasiTransfer + Driver)

Location permission — In the Driver app we request 'always allow' location during an active shift so customers can track you on the map. Stops completely when shift is off. In the Customer app we only request 'while using' location — optional, for live tracking.

Notification permission — For job assignments, booking status changes, and campaign announcements.

Photos/Gallery — Only to upload driver profile photo; access limited to files you pick.

Location history is auto-deleted after 30 days. All permissions can be revoked instantly from your device settings.

Account deletion request: via WhatsApp +90 532 407 7712 or [email protected] — all personal data is erased within 90 days (except booking records legally required to be retained).