The Turkish text of this document is the authoritative version; this English text is a translation. Read the Turkish text
Privacy Notice (KVKK) and Privacy Policy
Last updated: 13 October 2026
Seller / Data Controller
- Hasan Karalök TMA Turuncu Motorlu Araçlar
- Gülbahar Mah. Sütçüler Sok. Meriç İş Merkezi No:1/A, Şişli / İstanbul
- Tax Office and No: Zincirlikuyu, 10916265134
- MERSİS: 1091626513400001
- Trade Registry No: 156311-5 (İstanbul Ticaret Odası)
- Phone: +90 505 123 71 11
- Email: kurumsal@turuncumotor.com
This notice has been prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and the Communiqué on the Principles and Procedures for Fulfilling the Obligation to Inform. It tells visitors of turuncumotor.com, customers who make a reservation and people who contact us how their personal data is processed. This notice is not a declaration of consent; processing that relies on explicit consent is covered separately in the Explicit Consent Statement.
1. Data Controller
Your personal data is processed by Hasan Karalök TMA Turuncu Motorlu Araçlar ("Turuncu Motors") as data controller. The controller's address, tax office and number, MERSIS number and contact details are shown in the identity box at the top of this page.
For any matter concerning your personal data you can write to kurumsal@turuncumotor.com or call +90 505 123 71 11.
2. Personal Data Processed, Purposes and Legal Grounds
The table below shows which data we process, for which purpose and on which provision of the Law.
| Data category | Data processed | Purpose | Legal ground |
|---|---|---|---|
| Identity | First and last name; the identity details on the ID card or passport you present when you collect the vehicle. | Creating the reservation, drawing up the rental agreement, handing the vehicle to the right person, making statutory notifications. | KVKK Art. 5/2-c (conclusion and performance of a contract); Art. 5/2-a and 5/2-ç (provided for by law and legal obligation). |
| Contact | Email address, phone number, the delivery address you request; if you write via WhatsApp or Telegram, the name and number shown on your account. | Confirming the reservation, communication for handover and return, answering your questions and requests. | KVKK Art. 5/2-c; Art. 5/2-f (legitimate interest: answering requests). |
| Customer transaction | Pickup and return date, time and branch, selected model, reservation number, anything you write in the note field, the rental agreement and handover and return records, cancellation and change requests. | Providing the rental service, calculating the price, cancellations, changes and refunds. | KVKK Art. 5/2-c. |
| Driving licence | The details on the driving licence you present when you collect the vehicle (including licence class and validity). | Verifying that you are entitled to ride the vehicle, drawing up the rental agreement, obligations under traffic legislation. | KVKK Art. 5/2-c; Art. 5/2-ç. |
| Finance and payment transaction | Payment amount, date and type (prepayment or full payment), transaction number and result, refund records, invoice details, the record of the deposit taken at handover. We never see or store your card number, expiry date or security code; these are processed directly by the payment institution iyzico. | Collecting payment, making refunds, issuing invoices, keeping accounting records. | KVKK Art. 5/2-c; Art. 5/2-ç. |
| Legal transaction | Traffic fines and toll records for the rental period, damage and accident records, complaint and request correspondence, dispute files. | Passing fines and tolls on to the person who used the vehicle, handling damage claims, resolving requests, establishing, exercising and protecting legal rights. | KVKK Art. 5/2-ç; Art. 5/2-e (establishment, exercise or protection of a right); Art. 5/2-f. |
| Transaction security | IP address, time of request, browser and device information, server access and error logs. | Keeping the site secure, preventing abuse and automated submissions, fixing errors, responding to requests from competent authorities. | KVKK Art. 5/2-f; Art. 5/2-ç. |
| Marketing | Your permission for commercial electronic messages and its date, the email address and phone number to which messages are sent, your opt-out notices. | If you have given permission, sending offers and discount announcements; keeping permission and opt-out records. | KVKK Art. 5/1 (explicit consent) and Law No. 6563 Art. 6 (approval); Art. 5/2-ç for keeping the records. |
| Cookie and usage data | Cookie identifiers, pages you visit, clicks, device and browser information, approximate location derived from the IP address, whether you arrived from an advertisement. | Measuring visit statistics and advertising results. | KVKK Art. 5/1 (explicit consent). If you do not consent, this data is not collected. |
We do not ask for special categories of personal data such as health data, biometric data, religion or criminal convictions. Please do not include such information in the reservation note field or in messages you send us.
If you do not provide the data required to conclude and perform the contract, the reservation cannot be created or the vehicle cannot be handed over. Processing that relies on explicit consent is optional; refusing consent does not prevent you from using the service.
No decision that produces legal effects for you is taken solely by automated processing.
3. How Personal Data Is Collected
Your data is obtained directly from you when you fill in the reservation form on the site, contact us by phone, email, WhatsApp or Telegram, and present your documents when collecting the vehicle; automatically through server logs and, if you consent, cookies when you visit the site; from the payment institution iyzico as regards the result of a payment; and from the competent authorities as regards traffic fines and toll records for the rental period.
Data is collected electronically (the site, the reservation management software, email and messaging applications) and physically at the branch (the rental agreement and handover documents); it is processed wholly or partly by automated means, or by non-automated means as part of a data filing system.
4. Recipients of Personal Data and Purposes of Transfer
Your personal data is transferred to the following groups of recipients in line with Articles 8 and 9 of the Law and only for the purposes stated:
| Recipient | Data transferred | Purpose and legal ground |
|---|---|---|
| Payment institution: iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., Türkiye) | First and last name, email address, phone number, IP address, payment amount and reservation details. You enter your card details directly on iyzico's payment page. | Collecting and refunding online payments. KVKK Art. 5/2-c. |
| Reservation management software provider (the software that keeps reservation records and serves them through api.motorcyclerentalturkiye.com) | The details in the reservation form: first and last name, email address, phone number, dates, branch, model and notes. | Keeping and managing reservation records. The provider acts as a data processor, only on our instructions. KVKK Art. 5/2-c. |
| Hosting provider (a data centre service operating under the GüzelHosting brand, with servers located in Türkiye) | Data passing through the server while the site runs: IP address, access logs and form content. | Hosting the site and keeping it secure. The provider acts as a data processor. KVKK Art. 5/2-f. |
| Accountant and legal advisers | Invoice and payment records; in a dispute, the information in the relevant file. | Meeting statutory bookkeeping and tax filing obligations, protecting legal rights. KVKK Art. 5/2-ç and 5/2-e. |
| Competent public authorities (law enforcement, traffic units, the tax administration, courts and enforcement offices) | Identity, driving licence, rental agreement and vehicle details; other records requested under legislation. | Notifying law enforcement of rented vehicles and renters (Law No. 1774 on Identity Notification), naming the person who used the vehicle for traffic fines incurred during the rental (Highway Traffic Law No. 2918), tax legislation and requests from judicial authorities. KVKK Art. 5/2-a and 5/2-ç. |
| Insurance company and loss adjuster (only in the event of an accident or damage) | Identity, driving licence, rental agreement and records of the incident. | Handling damage and compensation claims. KVKK Art. 5/2-ç and 5/2-e. |
| Google Ireland Limited and Google LLC (only if you give cookie consent) | Cookie identifiers, IP address, pages visited, device and browser information. | Measuring visit statistics (Google Analytics 4). KVKK Art. 5/1. |
| Meta Platforms Ireland Limited and Meta Platforms, Inc. (only if you give cookie consent) | Cookie identifiers, IP address, pages visited, device and browser information. | Measuring advertising results (Meta Pixel). KVKK Art. 5/1. |
| Google (Google Maps) | IP address and browser information. | Displaying the map in the contact section. The map is not loaded unless you press "Show map" or give cookie consent. |
| Email and messaging service providers (if you choose to correspond with us by email, WhatsApp or Telegram) | The content of your message, your email address or phone number. | Communicating through the channel you choose. KVKK Art. 5/2-c and 5/2-f. |
Your data is not sold, rented or shared for marketing purposes with any third party other than these recipients.
5. Transfers Abroad
The site is hosted in a data centre whose servers are located in Türkiye. Your personal data is transferred abroad only in the following cases:
- If you consent to analytics and advertising cookies in the cookie banner, the data collected by those cookies is transferred to Google's and Meta's servers abroad, primarily in the United States. If you do not consent, this transfer never takes place.
- If you pay online with a card issued outside Türkiye, the transaction is passed through iyzico and the card schemes to the foreign bank that issued the card. This transfer is necessary for the payment to be made.
- If you open the Google map in the contact section, your IP address is sent to Google.
- If you choose to correspond with us by email, WhatsApp or Telegram, your messages are transmitted and stored on those services' servers, which may be located abroad.
Under Article 9 of the Law (as amended by Law No. 7499), a transfer abroad requires an adequacy decision of the Personal Data Protection Board for the country, sector or international organisation concerned or, in the absence of such a decision, one of the appropriate safeguards listed in the Law (for example the standard contract published by the Board). Where neither exists, a transfer may be made only on an incidental basis and only in one of the cases in Article 9(6): these include your explicit consent given after being informed of the possible risks, and the transfer being necessary for the performance of a contract between you and us.
Transfers to Google and Meta are made only with the explicit consent you give in the cookie banner; the possible risks of the transfer are explained in the Explicit Consent Statement. For payments with a foreign card, the transfer relies on its being necessary for the performance of the contract.
6. Retention Periods
Your personal data is kept for as long as is necessary for the purpose for which it is processed and as required by legislation:
| Data | Retention period | Basis |
|---|---|---|
| Reservation, rental agreement and customer records (including identity and driving licence details) | 10 years from the end of the contractual relationship | Turkish Code of Obligations No. 6098 Art. 146 (general limitation period); Turkish Commercial Code No. 6102 Art. 82 |
| Invoice, payment and accounting records | 10 years from the end of the relevant calendar year | Turkish Commercial Code No. 6102 Art. 82; Tax Procedure Law No. 213 Art. 253 |
| Approval and opt-out records for commercial electronic messages | 3 years from the date the approval ceases to be valid | Law No. 6563; Regulation on Commercial Communication and Commercial Electronic Messages |
| Server access logs and transaction security records | 2 years | In line with the retention periods in Law No. 5651; KVKK Art. 5/2-f |
| Request, application and complaint records (including KVKK applications) | 3 years from the date the application is concluded | Proof that the application was answered in time; KVKK Art. 5/2-e |
| Cookies and similar records in the browser | The periods shown in the table in the Cookie Policy | Explicit consent; until consent is withdrawn |
Where a dispute, lawsuit or official investigation is pending, the relevant records are kept until the process is finally concluded. Data whose retention period has expired is erased, destroyed or anonymised in the first periodic destruction process after expiry and within six months at the latest.
7. Data Security
Under Article 12 of the Law we take the technical and organisational measures needed to prevent unlawful processing of and unlawful access to your data and to keep it safe:
- All communication between the site and your browser takes place over an encrypted connection (HTTPS).
- Your card details are never entered, seen or stored on our site; payment is made on iyzico's payment page with 3D Secure verification.
- The reservation form is validated on the server; rate limiting is applied against automated and malicious submissions.
- Non-essential cookies and third-party scripts are not loaded without your consent.
- Personal data is accessed only by people who need it for their duties; service providers are required to maintain the same level of security.
If we learn that your personal data has been obtained by others unlawfully, we notify you and the Personal Data Protection Board as soon as possible.
8. Your Rights as a Data Subject
Under Article 11 of the Law you may apply to the data controller to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of the processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is transferred,
- request correction of your personal data if it is incomplete or inaccurate,
- request erasure or destruction of your personal data under the conditions in Article 7 of the Law,
- request that correction, erasure and destruction be notified to the third parties to whom your personal data has been transferred,
- object to a result against you arising from analysis of the processed data exclusively by automated systems,
- claim compensation if you suffer damage because your personal data has been processed unlawfully.
Where processing relies on explicit consent, you may withdraw your consent at any time without giving a reason; withdrawal does not affect the lawfulness of processing carried out before that date.
9. How to Apply
You can submit requests concerning your rights in one of the following ways under the Communiqué on the Principles and Procedures of Application to the Data Controller:
- By a signed written petition delivered in person, through a notary or by registered mail with return receipt to: Gülbahar Mah. Sütçüler Sok. Meriç İş Merkezi No:1/A, Şişli / İstanbul.
- Electronically, using a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature.
- By writing to kurumsal@turuncumotor.com from the email address you previously gave us and that is registered in our system.
An application must include: first and last name and, if the application is in writing, signature; for citizens of the Republic of Türkiye the Turkish ID number, for foreign nationals nationality and passport number or ID number if any; residential or business address for notifications; email address, telephone and fax number for notifications if any; the subject of the request. Supporting information and documents are attached to the application. For convenience you can use the Data Subject Request Form.
We conclude your application free of charge as soon as possible depending on the nature of the request and within 30 days at the latest. If the process involves an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. Our reply is given in writing or electronically.
If your application is rejected, if you find the reply insufficient or if no reply is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the reply and in any case within 60 days of the date of application. You must apply to the data controller before lodging a complaint with the Board.
To prevent your data from being disclosed to someone else, we may ask you for additional information where we cannot verify your identity.
10. Cookies
Besides the necessary records, analytics and advertising cookies are used on the site only if you consent. The name, provider, purpose and lifetime of the cookies and how to change your choice are explained in the Cookie Policy.
11. Children's Data
Our site and rental service are not intended for anyone under 18; the minimum rental age is 21. We do not knowingly collect data from anyone under 18.
12. Updates to This Notice
This notice may be updated in line with changes in legislation or in our data processing activities. The current text is published on this page and the update date at the top of the page changes.