Data Protection Notice (KVKK & GDPR)

This notice explains how Antalion processes the personal data of

customers and drivers who use the platform, in line with Turkey's

Personal Data Protection Law No. 6698 ("KVKK") and, for visitors from

the EU/EEA and UK, the equivalent standards of the General Data

Protection Regulation ("GDPR"). (Template text — the final legal text

should not be published before review by qualified counsel.)

1. Data Controller

Antalion is the data controller responsible for the personal data

processed through this platform. You can reach us at the contact

details in Section 9 for any question about this notice.

2. Personal Data We Collect

Full name, phone number, email address, location data (pickup/drop-off

points), passenger and luggage counts, preferred language, payment and

transaction records, and — for drivers — driving licence, vehicle

registration and transport-permit documents. In-app messages between

customers and drivers are also stored for safety and moderation

purposes.

3. Purposes of Processing

Creating and matching transfer requests with drivers, verifying your

identity by SMS/email/WhatsApp, enabling driver-customer communication

through the in-app messaging system, processing payments through our

payment provider (iyzico) and keeping the related commission/accounting

records, measuring service quality (reviews/ratings), preventing fraud

and abuse, and complying with applicable legal obligations.

4. Legal Basis

We process your data on the basis of: performance of the transfer

contract you enter into with a driver through the platform, your

explicit consent where required (e.g. marketing communications),

compliance with legal obligations (e.g. accounting records), and our

legitimate interest in operating a safe and reliable marketplace

(e.g. fraud prevention, content moderation).

5. Who We Share Data With

Customer and driver contact details (phone, email) are never shared

with each other; all communication runs through the in-app messaging

system only. Payment data is processed by our licensed payment

provider (iyzico) under the iyzico Pazaryeri/Marketplace escrow model;

Antalion does not store your full card details. We also use licensed

processors for transactional email (Resend) and messaging

(WhatsApp Cloud API, Telegram Bot API) strictly to deliver the

notifications you would expect from using the service.

6. International Transfers

Some of our processors (email/messaging/payment infrastructure) may

process data outside Turkey, including within the EU/EEA. Where this

occurs, we rely on the safeguards required by KVKK and, where

applicable, GDPR-standard contractual clauses with those processors.

7. Retention

We keep personal data only for as long as necessary for the purposes

above, or as required by applicable tax, accounting and consumer-

protection law, after which it is deleted or anonymised.

8. Your Rights

Under KVKK Article 11 and, where applicable, the GDPR, you have the

right to: find out whether your data is being processed; request

access to, correction, or deletion of your data; object to processing

and request restriction of it; request data portability; and, where

processing is based on consent, withdraw that consent at any time. You

may also lodge a complaint with Turkey's Personal Data Protection

Authority (KVKK Kurumu) or, if the GDPR applies to your situation, your

local data protection supervisory authority.

9. Contact

For any request regarding your personal data, contact us at

info@antalion.com.