KVKK information notice
How we process your personal data (KVKK)
KVKK Information Notice
Information Notice on the Processing of Personal Data · Effective date: 22 October 2026
This notice explains how we process the personal data of customers who request or make a car rental booking in Türkiye through Kezdura, of additional drivers, and of visitors to our website. It is issued under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
1. Data controller
• Legal name: Professional Travel Group Turizm Otomotiv Ticaret Limited Şirketi (“Kezdura” or the “Company”)
• MERSİS number: 0733092403100001
• Address: Zafer Mah. Doğan Araslı Bul. No: 95/1 İç Kapı No: 114, Esenyurt/İstanbul
• Email: [email protected]
• KEP (registered email) address: [email protected]
2. Personal data we process
• Identity: full name; passport or identity card and driving licence information (such as date of birth, nationality, document number, licence category and expiry date). You may share this information in whichever way you prefer.
• Contact: phone number (WhatsApp) and email address (optional).
• Booking and transaction: pickup and return dates and locations, vehicle category, extra requests (such as a child seat or an additional driver), reservation reference, rental supplier details, and records of requests, complaints and correspondence.
• Travel: flight number, arrival time and flight ticket.
• Marketing: your preferences for promotional messages and records of your consent.
• Security and digital data: IP address, browser and device information, website usage data, and data collected through cookies and similar technologies.
We do not aim to process special categories of personal data (such as blood type or religion). You do not need to share such information with us. If you send us an additional driver’s details, please share this notice with that driver.
3. How we collect data
We collect personal data partly by automated means and partly by non-automated means as part of a data filing system, through:
• the booking form on our website,
• our correspondence with you by WhatsApp, phone and email, and the information you send us,
• cookies and similar technologies used on our website.
4. Purposes and legal bases
| Purpose | Data involved | Legal basis |
| Receiving your booking request, preparing an offer and creating the reservation | Identity, contact, booking, travel | Establishing or performing a contract (Art. 5/2-c) |
| Passing details to the rental supplier and checking driver requirements | Identity, contact, booking, travel | Establishing or performing a contract (Art. 5/2-c) |
| Coordinating pickup, tracking flights, supporting you during and after the rental, following up deposits and complaints | Identity, contact, booking, travel | Performing a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Meeting legal obligations and responding to requests from competent authorities | All relevant data | Legal obligation (Art. 5/2-ç) |
| Establishing, exercising or defending legal claims in a dispute | Identity, contact, booking | Establishing, exercising or protecting a right (Art. 5/2-e) |
| Keeping the website secure and working properly | Security data | Legitimate interest (Art. 5/2-f) |
| Analysing website use and measuring advertising | Digital data (analytics and advertising cookies) | Explicit consent (Art. 5/1) |
| Sending promotional messages about offers by WhatsApp and email | Contact, marketing, past booking details | Explicit consent (Art. 5/1) and approval under Law No. 6563 |
We ask for your consent separately for anything based on explicit consent. Declining does not stop you from booking, and you may withdraw your consent at any time.
5. Who we share personal data with
| Recipient | Purpose | Legal basis |
| The independent car rental supplier providing your reservation | Creating the reservation and providing the rental service. Details are sent by email or entered by our staff into the supplier’s online reservation system. | Establishing or performing a contract (Art. 5/2-c) |
| Our service providers: customer relationship management (CRM) and cloud services, the WhatsApp Business messaging service, email and hosting services, website infrastructure and security services, analytics and advertising services | Providing the infrastructure needed to run our services | Art. 5/2-c and Art. 5/2-f; explicit consent for analytics, advertising and promotional messages |
| Competent public authorities, judicial and administrative bodies | Meeting legal obligations | Legal obligation (Art. 5/2-ç) |
These transfers are made in line with Articles 8 and 9 of KVKK.
6. Transfers outside Türkiye
Some of our service providers (CRM and cloud, messaging, email and hosting, website infrastructure, analytics and advertising services) have servers outside Türkiye. In addition, Company employees who handle reservations and customer service may access these systems from outside Türkiye as part of their duties.
Your personal data may therefore be transferred abroad. Such transfers are limited to the purposes in this notice and are carried out with the necessary data security measures.
7. Retention periods
We keep personal data for as long as needed for the purposes it is processed for and for the periods required by applicable law. After that, it is deleted, destroyed or anonymised.
8. Your rights
Under Article 11 of KVKK, you may apply to us to:
Find out whether your personal data is processed.
Request information if it has been processed.
Find out the purpose of processing and whether data is used for that purpose.
Know the third parties in Türkiye or abroad to whom data is transferred.
Request correction of incomplete or inaccurate data.
Request deletion or destruction under the conditions in Article 7 of KVKK.
Request that corrections, deletions or destructions be notified to third parties who received the data.
Object to a result against you that arises solely from analysis by automated systems.
Claim compensation for damage caused by unlawful processing.
9. How to apply
Under the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send your request in one of these ways:
• A signed letter to our address above, delivered in person, by post or through a notary.
• By registered electronic mail (KEP) to [email protected].
• To [email protected], signed with a secure electronic signature or mobile signature, or from an email address you have previously given us and that is registered in our system.
Your application must include your full name, your signature for written applications, your Turkish ID number (for foreign nationals: nationality and passport or ID number), your address for notifications, your email address and phone number if any, and the subject of your request.
We will resolve your request free of charge within 30 days at the latest, depending on its nature. If the action involves an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. If your application is rejected, you find our answer insufficient, or we do not respond in time, you may file a complaint with the Board under Article 14 of KVKK.
This notice may be updated. The current version is always published on this page.