Personal Data Information Notice
This notice is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1.1. Data controller
RATE EXTRA TOURISM L.L.C ("Transferyar", the "Company"), Dubai Department of Economy and Tourism licence no. 1253634, commercial register no. 2115485, address: Office J-02, Fronds Capital Properties L.L.C building, Al Quoz Industrial Area 4, Dubai, United Arab Emirates. Email: destek@transferyar.com. Data controller representative in Türkiye: Sindibad Turizm Ticaret Anonim Şirketi.
1.2. Personal data processed
| Category | Data |
|---|---|
| Identity | First and last names of the booker and the passengers (in Latin characters, for the name board and the passenger list) |
| Contact | Email address, telephone number (so that the driver and the support team can reach you) |
| Country | Country of the booker |
| Customer transaction | Booking details: pickup and drop-off points (address, airport, location marked on the map), pickup date and time, return details, vehicle class, number of passengers, flight number and airline, selected extras, notes to the driver, cancellation and refund records, account details |
| Location | Only if you use "Use my location": the approximate current location of your device, to set the pickup or drop-off point (only the point you select is stored) |
| Financial | Payment amount and status, currency, card brand and last four digits. Card number and security code never reach Transferyar's servers and are processed directly by the payment institution Stripe |
| Transaction security | Hashed IP address, session and login records, verification code records, device and browser information |
| Customer support | Conversations with the AI support assistant Defne and human agents |
| Marketing | Only if explicit consent is given: newsletter preference and message records |
| Site usage (analytics) | Only if explicit consent to analytics cookies is given: pages viewed, device and browser information, approximate location, Google Analytics cookie ID |
Passport numbers, passport images, dates of birth and gender are not collected. Please do not share health data or other special categories of personal data in notes to the driver; needs such as a child seat are selected as extras.
1.3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating the booking, sending it to the carrier, confirmation, driver assignment and change notices | Establishment and performance of a contract (5/2-c) |
| Tracking the flight and adjusting the pickup time to a delay, if a flight number is given | Performance of a contract (5/2-c) |
| Passing your name and telephone number to the carrier so that the driver can find you at the pickup point | Performance of a contract (5/2-c) |
| Taking payment, refunds and cancellations | Performance of a contract (5/2-c) |
| Invoicing, accounting and tax records | Legal obligation (5/2-ç) |
| Opening and managing the account | Establishment and performance of a contract (5/2-c) |
| Customer support, conversations with Defne, handling complaints and no-show disputes | Performance of a contract (5/2-c) and legitimate interest (5/2-f) |
| Fraud prevention, information security, detection of misuse | Legitimate interest (5/2-f) |
| Protecting rights in disputes | Establishment, exercise or protection of a right (5/2-e) |
| Keeping language, country and currency preferences beyond the session | Explicit consent (5/1) |
| Measuring and improving how the site is used (Google Analytics) | Explicit consent (5/1) |
| Sending campaigns and newsletters | Explicit consent (5/1) and approval under Law No. 6563 |
1.4. Method of collection
Data is collected electronically, by automated and partly automated means, through the transferyar.com website, booking and membership forms, the map and location selection, the payment step, the post-booking passenger and flight details form, the support chat, email correspondence and cookies.
1.5. Recipients
| Recipient | Purpose | Country |
|---|---|---|
| Sindibad Turizm Ticaret A.Ş. (Safaryar Holidays — TravelDistro platform) | Creating the booking, assigning the vehicle and driver, flight tracking | Türkiye |
| The driver and vehicle operator performing the transfer | Meeting you at the pickup point and performing the transfer (only name, telephone, pickup details, number of passengers, flight number, notes) | Türkiye |
| Stripe | Payment processing and fraud prevention (taking and refunding payments) | USA, Ireland |
| Resend | Sending transactional emails | USA, Ireland |
| Anthropic | Running the AI support assistant | USA |
| Slack | Internal team notifications | USA |
| Vercel and Railway | Hosting (web: Frankfurt; API and database: Amsterdam) | Germany, Netherlands |
| Bugsink | Error tracking | EU (Netherlands) |
| Google (Google Ireland Ltd / Google LLC) | Site usage statistics (Google Analytics), only with explicit consent to analytics cookies | Ireland, USA |
| Competent public authorities, courts | Legal obligation | Relevant country |
As the Company is established in the United Arab Emirates and some service providers are located abroad, personal data is transferred abroad within the meaning of KVKK Art. 9. These regular transfers rely on appropriate safeguards under KVKK Art. 9/4, namely the standard contracts published by the Personal Data Protection Board; standard contracts are notified to the Board within the statutory period after signature. The occasional-transfer cases listed in KVKK Art. 9/6 are used only for non-recurring, exceptional transfers. The transfer under Google Analytics (Ireland, USA) also relies on a standard contract with Google; Google Analytics itself runs only if you give explicit consent to analytics cookies (KVKK Art. 5/1). You can withdraw your consent at any time via the "Cookie preferences" link at the bottom of the site.
1.6. Your rights (KVKK Art. 11)
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Türkiye or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request erasure or destruction where the conditions of KVKK Art. 7 are met, and notification of these actions to third parties; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
1.7. How to apply
In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your request from the email address registered with Transferyar to destek@transferyar.com, or in writing to the address above. Requests are concluded free of charge within 30 days at the latest. If an additional cost arises, the fee set by the Personal Data Protection Board may be charged.