GDPR / KVKK Data Rights
Your data-subject rights under the GDPR (EU) and KVKK (Türkiye), the bases we rely on, and how to make a request.
1. Applicable Law and Responsible Parties
Your personal data is protected under two legal frameworks: • In Türkiye: Personal Data Protection Law No. 6698 ("KVKK") • For customers based in the EU / EEA: the General Data Protection Regulation ("GDPR") The Platform is operated, and payments are collected, by RATE EXTRA TOURISM L.L.C (Commercial Licence No: 1253634, Dubai, UAE). The transfer service is fulfilled in Türkiye by our partner Sindibad Turizm Ticaret A.Ş. (Safaryar Travel brand, TÜRSAB Licence No: 10028); operational data is processed in that context.
2. Data We Process
During booking and service delivery we process: • Booking customer data: name, email, phone number, flight number, route and addresses • Passenger manifest: under Turkish law the full names of ALL passengers taking part in the transfer must be recorded as a legal requirement • Payment data: your card details are processed directly by Stripe on PCI-DSS-compliant infrastructure — we do NOT see or store card numbers; we hold only the transaction reference and amount • Support communication: requests you send by email and WhatsApp
3. Lawful Bases
We rely on the following lawful bases: • PERFORMANCE OF CONTRACT — Creating the booking, assigning a driver, performing the transfer, payment and refund processing (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) • LEGAL OBLIGATION — Passenger manifests, invoicing and accounting records (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç) • LEGITIMATE INTEREST — Fraud prevention, service-quality measurement, request and complaint handling (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) • CONSENT — Marketing messages and non-essential cookies are used only with your explicit consent, which you may withdraw at any time (GDPR Art. 6(1)(a); KVKK Art. 5/1)
4. International Transfers
The Platform operator and collection party, RATE EXTRA TOURISM L.L.C, is established in Dubai (UAE); data limited to payment and refund processes is transferred there. We use Stripe for payment processing, Resend for transactional email, and Vercel infrastructure for hosting and analytics; these providers' servers may be located outside the EU. For EU/EEA customers, transfers rely on the safeguards of GDPR Articles 44-49 (including standard contractual clauses). For customers in Türkiye, transfers are carried out under the KVKK provisions on cross-border transfers. In every case, transfers are limited to the minimum data required to deliver the service.
5. Retention
Booking and passenger data is retained after the completed transfer for the duration of potential statutory limitation periods. Invoicing and accounting records are kept for 10 years as required by law. Marketing consents remain valid until withdrawn. Expired data is deleted, destroyed or anonymised.
6. Your Rights
Under GDPR Articles 15-22 and KVKK Article 11 you have the right to: • ACCESS — learn whether and which of your data we process • RECTIFICATION of incomplete or inaccurate data • ERASURE of your data where the conditions are met (the "right to be forgotten") • RESTRICTION of processing (GDPR) • DATA PORTABILITY — receive your data in a structured format (GDPR) • OBJECT to processing based on legitimate interest • Not be subject to solely automated decisions that significantly affect you • WITHDRAW consent at any time where processing is based on consent
7. Making a Request (DSAR)
To exercise your rights, email hello@transfelo.com describing your request and including your booking reference if you have one. We may ask for additional information to verify your identity; requests are answered free of charge within 30 days at the latest. You can also reach us on WhatsApp at +90 501 147 67 71.
8. Complaints to a Supervisory Authority
If you believe your request has not been handled properly, you retain the right to complain: • Türkiye: the Personal Data Protection Authority (KVKK) — kvkk.gov.tr • EU/EEA: the data protection authority of the country where you live (for example, the state data protection authorities in Germany) You are not required to contact us before complaining, but requests sent to hello@transfelo.com are handled as a priority. Last updated: August 2026.