This is an English translation provided for convenience. The Turkish version of this text is the legally binding one. Read the Turkish original
Last updated: 20 October 2026
1. Data controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Waygo Transfer ("Waygo") as data controller, within the scope described below.
| Data controller | Waygo Transfer |
|---|---|
| Address | A. Pazarcı Mah. 1017 Sk. No: 14 C, Manavgat / Antalya, Türkiye |
| Tax office / tax ID | Manavgat Tax Office · 7341017563 |
| info@waygotransfer.com |
This notice applies to riders, drivers and driver candidates and website visitors who use the Waygo rider app, the Waygo driver app, and the services on waygotransfer.com and its subdomains.
2. Personal data we process
2.1 Riders
| Category | Data |
|---|---|
| Identity | First name, last name |
| Contact | Mobile phone number, email address |
| Location | Current location (while the app is in use), pickup and drop-off addresses, saved favourite addresses, location during the ride |
| Customer transactions | Ride history, vehicle class, fare, cancellation reason, ratings given and received, comments, support requests, lost item reports |
| Financial | Payment method (currently cash), the amount paid and the driver's collection confirmation. Once card payment is available: payment transaction records, the last 4 digits and brand of your card (the full card number is not stored by Waygo; it is processed by the payment institution) |
| Communication content | In-app messages, photos you send, voice call log details (time and duration of the call; calls are not recorded) |
| Security | IP address, device and app information, session logs, SOS and safety incident records, risk flags |
| Marketing | Only with your explicit consent: campaign and notification preferences |
2.2 Drivers and driver candidates
In addition to the categories listed for riders:
| Category | Data |
|---|---|
| Identity | Turkish ID number, date of birth, profile photo |
| Professional | Driving licence details and class, SRC certificate, service areas, performance indicators (time online, acceptance and cancellation rates, average rating) |
| Vehicle | Licence plate, make, model, year, colour, registration details, vehicle owner details, inspection date |
| Location | Continuous location for as long as you are online (including while the app is in the background or closed), ride route |
| Visual records | Live selfie photos taken for identity verification |
| Special categories | Criminal record; psychotechnical assessment report (which may qualify as health data) |
Selfie photos are compared visually, by authorised staff only. No automated facial recognition is performed and no biometric template is created.
2.3 Website visitors
IP address, browser information, and the information you enter in the contact or driver application forms.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5/2 and 6) |
|---|---|
| Creating an account, verifying phone and email | Establishing and performing a contract (Art. 5/2-c) |
| Booking a car, matching with a driver, calculating the fare, carrying out the ride | Performing a contract (Art. 5/2-c) |
| Sharing live location with the other party during the ride | Performing a contract (Art. 5/2-c) |
| Collecting payment, refunds, receipts | Performing a contract; legal obligation (Art. 5/2-c, ç) |
| Messaging and calls between rider and driver without sharing numbers | Performing a contract (Art. 5/2-c) |
| Reviewing driver applications, checking documents | Provided for by law; establishing a contract (Art. 5/2-a, c; Art. 6/3 for special categories) |
| Selfie identity verification, suspension, risk and fraud checks | Legitimate interest (Art. 5/2-f); establishing and protecting a right (Art. 5/2-e) |
| SOS, route deviation alerts, handling safety incidents | Vital interest; legitimate interest (Art. 5/2-b, f) |
| Handling support requests, complaints and lost item reports | Performing a contract; legitimate interest (Art. 5/2-c, f) |
| Ratings, measuring service quality and driver performance | Legitimate interest (Art. 5/2-f) |
| Statutory record-keeping and reporting (tax, commercial books, requests from competent authorities, U-ETDS where applicable) | Legal obligation; provided for by law (Art. 5/2-a, ç) |
| Information security, logs, system audits | Legal obligation; legitimate interest (Art. 5/2-ç, f) |
| Sending campaigns, promotions and commercial electronic messages | Explicit consent (Art. 5/1) and approval under Law No. 6563 |
Processing based on explicit consent is optional. Not giving or withdrawing your consent does not prevent you from using the core service.
4. Transfers of personal data
| Recipient | Data transferred and purpose |
|---|---|
| The other party to the ride | To the rider: the driver's name, profile photo, rating, vehicle details, licence plate and live location. To the driver: the rider's name, pickup and drop-off point. Phone numbers are not shared. |
| People you share your ride with | Via the share link: driver name, plate, vehicle and live location (the link closes when the ride ends) |
| Licensed payment institution (iyzico) — once card payment is available | Card payment and refund transactions |
| Hosting providers in Türkiye and abroad | Server, database and backup services |
| Notification service (Google Firebase Cloud Messaging) | Device identifier and notification content for sending push notifications |
| SMS and email service providers | Delivering verification codes and information messages |
| Competent public authorities and courts | Where there is a legal request or obligation |
| Legal, accounting and audit service providers | Fulfilling legal obligations |
Transfers abroad
Because of the notification service (Google Firebase) and hosting providers located abroad, some data may be transferred to servers outside Türkiye. These transfers are carried out under KVKK Art. 9 by signing the standard contracts published by the Board and notifying the Authority.
5. How we collect data
Your personal data is collected electronically, by automated or partly automated means, through the mobile apps, the website and its forms, your device's location services, in-app messaging, support channels and the payment institution.
6. Retention periods
| Data | Period |
|---|---|
| Account information | While the account is open; after a deletion request, see the Account Deletion Policy |
| In-app messages and photos | 1 year from sending |
| Voice call log details (not audio) | 1 year |
| Ride, fare and payment records | 10 years, as required by tax and commercial law |
| Driver live location data (raw) | 180 days |
| Selfie verification photos | 1 year |
| Driver application documents | For the duration of the working relationship and 10 years after it ends |
| Rejected driver applications | 6 months |
| Security and access logs | 2 years |
| Audit records (administrator actions) | 10 years |
When the period expires, the data is deleted, destroyed or anonymised.
7. Your rights (KVKK Art. 11)
By applying to Waygo, you have the right to:
- find out whether your personal data is processed,
- request information about it if it has been processed,
- find out the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under KVKK Art. 7,
- request that corrections and deletions be notified to the third parties it was transferred to,
- object to an outcome against you that arises exclusively from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
8. How to apply
You can submit your request:
- in the app via Account → Support,
- by email from your registered address to info@waygotransfer.com,
- or in writing to A. Pazarcı Mah. 1017 Sk. No: 14 C, Manavgat / Antalya, Türkiye.
Requests are concluded free of charge within 30 days at the latest. If the process involves an additional cost, the fee schedule set by the Board may apply.