Personal Data Protection (KVKK)

Data Controller / Service Provider Identity

Under Turkey's Law No. 6698 on the Protection of Personal Data (KVKK) and Law No. 6563 on the Regulation of Electronic Commerce, our identifying information as data controller / service provider is:

• Registered trade name: Metin Aksoy - 1Rides
• Address: Bahçelievler Mah., Atatürk Blv. 187/B, 52200 Altınordu/Ordu, Türkiye
• Tax office: Köprübaşı Tax Office (Köprübaşı Vergi Dairesi)
• Tax identification number (VKN): 0360595913
• Email: [email protected]
• Phone / WhatsApp: +90 543 163 31 35

At 1Rides, we take the protection of our customers' personal data seriously. This notice informs you about the processing of your personal data under Turkey's Law No. 6698 on the Protection of Personal Data ("KVKK"), which is Turkey's equivalent of the EU's GDPR. This notice covers processing carried out through www.1rides.com.tr, the 1R Rent iOS/iPadOS app, and our staff management panel.

What is personal data?

Under KVKK, personal data means any information relating to an identified or identifiable natural person. A special category, "special categories of personal data," covers data about race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Wherever this notice refers to your personal data, it also covers any special categories of personal data you provide.

How and on what legal basis do we collect your personal data?

In all our personal data processing activities we act in accordance with KVKK and other applicable legislation, and we take the technical and organizational measures necessary to keep your personal data secure.

We collect your personal data — automatically or not, verbally, in writing, or electronically — through the channels listed below (and any channel added in the future), and we process it under Articles 5.1, 5.2, 6.2 and 6.3 of KVKK depending on the purpose of processing:

• Through www.1rides.com.tr and related websites, mobile apps (1R Rent), and online channels, or via cookies,
• Through 1Rides sales and marketing points, as part of sales and marketing activities,
• Through our field staff during rental check-in/check-out (ID/license, photos, signature),
• Through our social media accounts,
• Through email, SMS, MMS and other communication tools,
• Through our call center or customer service,
• Through third parties such as business partners, manufacturers, or suppliers of products/services we provide.

What personal data do we process?

Examples of the personal data we process include:

• Identity and contact data: full name, date of birth, Turkish national ID number, phone number, email address, home address.
• Rental and contract data: ID/driving license image, check-in/check-out photos, vehicle use/damage records, your digital signature, running account and payment records.
• Invoice and financial document data: the information contained in the invoices / e-Archive Invoices issued in your name (invoice number and date, description of the service or product, amounts and tax details, billing address and, where applicable, tax office and tax or national ID number), together with the related collection records. You can access and download the invoices issued in your name from your account on www.1rides.com.tr.
• Financing/transaction data: payment preference and contact information shared through our sales-financing and installment tools.
• Data collected automatically: data collected via cookies and similar technologies (see Privacy Policy).
• Data from other sources: up-to-date contact and address information shared, with your consent, by business partners or third parties.

For what purposes is your personal data processed?

As a rule, we process your personal data without relying on your explicit consent, on the processing conditions listed in Article 5/2 of KVKK. Your rental and sales transactions, your invoices and other financial documents. We process this data because it is necessary for the conclusion and performance of a contract, and because it is mandatory for us to fulfil our legal obligations (KVKK Art. 5/2). Our obligations to issue invoices and to retain and produce documents arise from Tax Procedure Law No. 213 and Turkish Commercial Code No. 6102. This processing does not depend on your explicit consent and does not end if a consent is withdrawn. Identity verification, collections and running-account management, handling of damage, penalty and dispute files, and keeping our services and systems secure. Processing for these purposes relies on it being mandatory for the establishment, exercise or protection of a right, and on our legitimate interests, provided your fundamental rights and freedoms are not harmed (KVKK Art. 5/2). Explicit consent is sought only for processing that genuinely rests on consent. As of today the only such activity is sending you commercial electronic messages (SMS/email) for campaigns, advertising and marketing. You may withdraw this consent at any time, without giving any reason and free of charge. Withdrawing it does not stop the contract-based and legal-obligation-based processing described above; it only stops marketing messages being sent to you.

How long is your personal data processed?

Your personal data is retained for as long as required by the purpose of processing, subject to applicable statutory limitation periods. Data relating to your rental/sales contract, your invoices and other commercial records is retained for 10 (ten) years. This period arises from Article 82 of Turkish Commercial Code No. 6102 and starts to run at the end of the calendar year in which the record was created. The five-year retention period that Tax Procedure Law No. 213 prescribes for books and documents falls within it. Once those legitimate purposes no longer apply, your data is deleted, destroyed, or anonymized.

Transfer of your personal data to third parties and/or abroad

For the purposes described above, your personal data may be transferred, domestically or abroad, to third parties that support us in areas such as storage, information technology (hosting/database infrastructure), web analytics and security (e.g. Google Analytics, Google reCAPTCHA), and call center services, as well as to business partners, banks/financing institutions, consultancy firms, and authorized public institutions. Subject to your explicit consent, your data may also be transferred to third parties that provide marketing and sales support. Any transfer abroad is carried out in accordance with the conditions set out in Article 9 of KVKK.

Your rights under Article 11 of KVKK

By applying to 1Rides, you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties to whom it is transferred; request correction if it has been processed incompletely or incorrectly; request deletion or destruction once the reasons for processing no longer apply; request that these corrections be notified to third parties; object to a result that is unfavorable to you arising solely from automated analysis; and request compensation for damages arising from unlawful processing.

You can send requests relating to these rights to [email protected].

How to apply

In line with the Turkish Personal Data Protection Board's Communiqué on the Procedures and Principles for Applications to Data Controllers, you may submit a written request together with identity-verifying documents in person at our address above, by notary, or by email from the address registered with us to [email protected]. We will respond free of charge within 30 days at most, depending on the nature of the request; if the request requires an additional cost, a fee set by the Personal Data Protection Board's tariff may be charged.