Privacy Policy
Last updated: 09.10.2026
This Privacy Policy explains how City VIP Transfer collects your personal data when you visit citytransfer.info, make a booking and use our transfer service; why and on what legal basis we use it; who we share it with; how long we keep it; and your rights. The statutory notice under Turkish Law No. 6698 is in our Personal Data Notice (KVKK), and details on cookies are in our Cookie Policy.
1. Data controller
City VIP Transfer
Address: Dalaman / Muğla / Türkiye
E-mail: Show email
2. What we collect and where from
- Booking details: name, phone / WhatsApp number, e-mail, flight number and time, pickup and drop-off addresses, passenger and luggage numbers, child seat needs and your notes. They come from the form on our site, WhatsApp, e-mail, or the partner transfer platforms and travel agencies that pass your booking to us.
- Passenger notification details: passengers' names, nationality and gender where a legal passenger notification requires them.
- Account details: if you open a customer account, your e-mail address and an irreversible hash of your password (the password itself is never stored).
- Payment details: amount, currency and status. Card details are entered directly with the payment institution iyzico and are never stored on our website or servers.
- Correspondence: WhatsApp, e-mail and driver chat messages on the tracking page, including the automatic translation of chat messages.
- Location: your live location, only if you allow it on the tracking page, so the driver can find you.
- No-show record: a photo, time and location showing that the driver waited at the meeting point.
- Technical and security data: IP address, browser details, login attempts and attack logs.
- Site statistics: the pages viewed, where the visit came from, device type and browser language (cookieless; IP addresses are not stored).
3. Purposes and legal grounds
| Purpose | Data used | Legal ground |
|---|---|---|
| Taking, confirming and performing your transfer | Booking and contact details | Performance of a contract |
| Tracking your flight and meeting you with a name sign | Flight number, landing time, name | Performance of a contract |
| Sending driver, vehicle and meeting details 1 day before | Phone / WhatsApp, booking | Performance of a contract |
| Helping the driver find you | Live location, chat messages | Consent (location) · performance of a contract |
| Payment, invoicing and accounting | Amount, payment status, invoice details | Performance of a contract · legal obligation |
| U-ETDS passenger notification to the Ministry of Transport | Passenger name, nationality, gender, trip details | Legal obligation |
| Handling requests, changes and complaints | Contact details, correspondence | Performance of a contract · legitimate interest |
| Documenting a no-show | Photo, time, location | Establishing and defending legal claims |
| Protecting the website and accounts from attacks | IP address, browser details, security logs | Legitimate interest · legal obligation |
| Cookieless site statistics | Page, referring source, device type, browser language | Legitimate interest |
| Visit analytics (Yandex Metrica) | Cookie ID, browsing and click data, session replay | Consent (cookie choice) |
| Commercial electronic messages such as a return-transfer offer | Name, phone / e-mail, previous booking | Explicit consent and your prior approval under Turkish Law No. 6563 |
Service messages about your booking (confirmation, driver and vehicle details, time changes, payment notices) are not commercial messages and need no separate approval. Commercial electronic messages such as promotions or a return-transfer offer are sent only if you have given your approval; you can opt out at any time through the opt-out option in each message or by writing to us, and your opt-out is applied within 3 business days at the latest.
We do not take decisions about you based solely on automated processing that significantly affect you. Requests flagged by our bot filter are reviewed by our team.
4. Who we share it with
We do not sell your data or give it to anyone for advertising. We share it only as far as needed for the service:
| Recipient | Why | Location |
|---|---|---|
| The driver and partner carriers performing the transfer | Meeting and transfer | Türkiye |
| The partner platform or agency that passed us your booking | Transfer status updates | Depends on the platform |
| Ministry of Transport (U-ETDS) and competent authorities | Legal notifications and requests | Türkiye |
| iyzico Payment Services | Card payments | Türkiye |
| Our hosting and e-mail provider | Running the website, database and e-mail | Türkiye |
| Meta Platforms (WhatsApp) | Messaging with you | EU / USA |
| Cloudflare (Turnstile) | Bot and attack verification | USA |
| TomTom | Address search, maps and arrival time | EU |
| Translation service provider | Automatic translation of driver chat | Abroad |
| Yandex (only with your cookie consent) | Visit analytics | Russian Federation |
5. International transfers
Transfers to the providers located abroad in the table above are limited to the stated purpose and are made under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad: to countries covered by an adequacy decision of the Personal Data Protection Board; where there is none, with one of the appropriate safeguards listed in the Law (in particular the standard contracts announced by the Board, which are notified to the Authority within five business days of signature); and only where these cannot be provided and the transfer is incidental, on one of the grounds in Article 9(6) (e.g. it is necessary for the performance of the contract, or your explicit consent).
6. How long we keep it
| Data | Period |
|---|---|
| Booking, invoice and accounting records | The period required by Turkish tax and commercial law (10 years) |
| U-ETDS passenger notifications | The period set by the relevant regulation |
| Correspondence, chat and no-show evidence | For the period of possible disputes and limitation after the service |
| Your live location on the tracking page | Used only during the transfer |
| Customer account | Until you ask us to delete it |
| Security and login logs | Up to 2 years |
| Cookieless site statistics | 400 days |
| Yandex Metrica data | Yandex's retention periods; see the Cookie Policy for cookie lifetimes |
Expired data is deleted, destroyed or anonymised.
7. How we protect your data
- The site and its forms run over an encrypted connection (HTTPS / TLS).
- Passwords are stored as irreversible hashes; the admin panel is protected with two-factor authentication.
- Only staff and drivers who need the data for their work can access it, and only for the transfer concerned.
- Forms and logins are protected with bot verification, attempt limits and attack blocking.
- Card payments are taken through the PCI-DSS compliant payment institution iyzico with 3D Secure.
- Regular backups are taken.
8. Your rights
Under Article 11 of the KVKK you may learn whether your data is processed, request information, ask for it to be corrected, deleted or destroyed, learn who it was shared with, object, and claim compensation. If you use our service from the European Union, under the GDPR you may also ask us to restrict processing and to port your data, and you may withdraw your consent at any time. How to apply, what your request must contain and the deadlines are set out in our Personal Data Notice (KVKK); requests are concluded free of charge within 30 days at the latest. You also have the right to complain to the Turkish Personal Data Protection Board or the data protection authority in your country. Withdrawing your consent does not affect the lawfulness of processing before the withdrawal.
9. Children
Bookings are made by people aged 18 or over. Children's details (age and seat needs) are provided only by the adult making the booking and only for safe transport.
10. Changes
We may update this policy when our service or the law changes. The current version is always on this page; the date at the top shows the last update.