Avis de confidentialité

Last updated: [date]

This notice explains how [Company name] ("Tranigo"), a company established in Dubai, United Arab Emirates, processes your personal data when you use our website and mobile app, book a transfer or tour, or create an account. Your personal data is processed in accordance with [the UAE Federal Personal Data Protection Law (No. 45 of 2021) / the DIFC Data Protection Law (2020) — depending on where the company is established], the Turkish Personal Data Protection Law No. 6698 ("KVKK") for individuals in Türkiye, and the EU General Data Protection Regulation ("GDPR") for individuals in the European Union.

1. Data controller and representatives

• Data controller: [Company name] — Address: [Dubai address] — Trade licence no.: [number] — Place of establishment: [Dubai mainland / name of free zone] — E-mail: [privacy@tranigo.com]
• Data controller representative in Türkiye (KVKK): [name, address, e-mail] [requirement to be confirmed by the lawyer]
• EU representative (GDPR Article 27): [name, address, e-mail] [requirement to be confirmed by the lawyer]

2. Personal data we process

• Identity and contact: first name, last name, e-mail address, phone number.
• Booking / travel: transfer or tour date and time, pick-up and drop-off points, hotel or address, flight number, number of passengers, children's ages, your notes.
• Customer account: account details, password (stored only in a non-reversible form), account ID when you sign in with Google or Apple, booking and review history, wallet / points movements.
• Payment / transaction: amount, method and result of the payment, transaction reference. Card data is processed by payment institutions (iyzico, PayPal); Tranigo does not store card numbers or security codes.
• Communication records: messages, requests and reviews you send us.
• Security / technical: shortened (masked) IP address, device and browser information; analytics cookies only with your consent (see the Cookie Policy).
• Marketing (only with your explicit consent): your campaign and newsletter preference.

3. Purposes

• to receive your booking, pass it to the company providing the service, carry it out and manage it, and send confirmation, reminder and information messages;
• to create and manage your customer account and show your past bookings;
• to take payments and handle refunds and cancellations;
• to answer your requests and complaints and measure service quality (reviews);
• to meet legal obligations such as invoicing, accounting and tax, and requests of competent authorities;
• to keep our systems secure and prevent misuse;
• with your explicit consent, to send campaign and promotional messages and, with your consent, to measure and improve the website.

4. Legal grounds

We process your personal data to conclude and perform a contract with you (booking and account), to comply with our legal obligations, to establish, exercise or defend legal claims, and for our legitimate interests provided your fundamental rights are not overridden (KVKK Article 5(2)(c), (ç), (e), (f); GDPR Article 6(1)(b), (c), (f)). Marketing messages and analytics cookies rely only on your explicit consent (KVKK Article 5(1); GDPR Article 6(1)(a)), which you can withdraw at any time. [Corresponding UAE / DIFC grounds to be added by the lawyer.]

5. How we collect data

Electronically, through our website, mobile app, booking and sign-up forms, Google / Apple sign-in, partner agencies and websites, e-mail, phone and messaging channels. If you do not provide the information needed for a booking, we cannot accept the booking.

6. Recipients and purposes

• The transfer or tour company providing your service (mostly in Türkiye, sometimes in other countries): only what the service needs (name, phone, pick-up details, flight and passenger details).
• The agency or partner through which you booked, if any.
• Payment institutions (iyzico, PayPal): for payments and refunds.
• Our service providers: hosting, e-mail delivery, mobile notifications (Google Firebase), Google / Apple sign-in and, with your consent, Google Analytics.
• Competent public authorities: where required by law.

International transfers: as the data controller is in the UAE, most service providers are in Türkiye and some of our service providers (e.g. Google, Apple, PayPal) have servers in other countries, your data is transferred between these countries. Transfers from Türkiye follow KVKK Article 9 and transfers from the EU follow Chapter V of the GDPR (e.g. standard contractual clauses). [Transfer safeguards and server locations to be determined by the lawyer.]

7. Retention

Booking, invoice and payment records are kept for the periods required by law. Account data is deleted or anonymised after you delete your account, except where the law requires us to keep it. Technical logs are deleted automatically after a limited period.

8. Your rights

You have the right to know whether your personal data is processed, to obtain information about it and a copy of it, to learn the purpose of processing and whether it is used accordingly, to know the recipients, to have inaccurate or incomplete data corrected, to have your data erased or destroyed and these actions notified to recipients, to restrict processing, to object to processing, to receive your data in a structured format and have it transmitted to another controller (data portability), to object to a decision against you based solely on automated processing, to withdraw your consent, and to claim compensation for damage caused by unlawful processing (KVKK Article 11; GDPR Articles 15–22).

9. How to apply and complain

Send your requests to [privacy@tranigo.com] from the e-mail address registered with us, or in writing to the addresses above; individuals in Türkiye may also contact our representative in Türkiye and individuals in the EU our EU representative. Requests are answered free of charge within 30 days at the latest.

You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK), with the data protection authority of your EU country [and with the competent data protection authority in the UAE].