Personal Data Protection Notice

1. Identity of the Controller

The party defined as the "Controller" under Law No. 89/2007 on the Protection of Personal Data is Alican Arslan Nakliyat ve Tic. Ltd., trading as "Duru Rent a Car" (Tax No: 16045, Lefkoşa Tax Office; registered address: Gönyeli Mah. Tatlısu Sok. No: 18, Gönyeli, Lefkoşa, TRNC; service office: Ecevit Cd. No: 18/A, Yukarı Girne, Girne, TRNC). Contact: +90 548 826 99 99 (phone/WhatsApp).

2. Personal Data Processed

• Identity and contact information: the name and phone number you share when submitting a reservation request via WhatsApp.
• Reservation information: pick-up and return points and dates, vehicle preference and delivery address (if provided).
• Online identifiers and usage data: anonymised IP address and on-site interaction data collected through Google Analytics.

3. Purposes of Processing Personal Data

Your personal data is processed for the purposes of fulfilling your reservation requests, conducting customer relations, following up on requests and complaints, measuring site usage and service quality, and complying with legal obligations.

4. Legal Basis

Your personal data is processed under Article 6 of Law No. 89/2007, on the legal grounds that "processing is necessary for the performance of a contract to which the data subject is party" and that "processing is necessary for the purposes of the legitimate interests pursued by the controller".

5. Method of Collecting Personal Data

Your personal data is collected electronically when you fill in the reservation form on the Site and are directed to WhatsApp to contact us through that channel, and also by Google Analytics during your visit to the Site.

6. Transfer of Personal Data

To the extent necessary to provide the service, your personal data may be transferred to the following parties:

• Meta Platforms Ireland Ltd. (WhatsApp): to relay your reservation request through the messaging infrastructure.
• Google LLC (Google Analytics): to measure site usage statistics, using anonymised data.

These providers are based outside the TRNC; Article 11 of Law No. 89/2007 makes transfers of data abroad subject to certain conditions (explicit consent, necessity for the performance of a contract, or a Transfer Permit from the Board). These transfers are made on the basis of these conditions, since the reservation request is initiated by you personally and is limited to the stated purposes.

7. Your Rights as a Data Subject

Under Part Four ("Rights of the Data Subject") of Law No. 89/2007, you have the following rights, which you may exercise by applying to the controller:

• Right of Access (Article 14): to learn whether your personal data is being processed; if so, to learn the data itself, its source, the purpose of processing, and the recipients or categories of recipients to whom the data is disclosed.
• To request correction, erasure or blocking of your data where it has been processed incorrectly or incompletely, and to request that such actions be notified to third parties to whom the data has been transferred.
• Right to Object (Article 15): to object to the processing of your data on legitimate grounds relating to your particular situation.
• Right to Compensation (Article 18): to seek compensation for damage suffered as a result of processing contrary to the Law.

8. How to Apply and Timeframes

To exercise the rights above, you may apply by phone/WhatsApp on +90 548 826 99 99 or in writing at our office at Ecevit Cd. No: 18/A, Yukarı Girne, Girne, TRNC. We respond to access requests in writing under Article 14 of the Law; we respond to objection requests in writing within 15 working days under Article 15. If you believe your request has not been answered in time or satisfactorily, you may apply to the Personal Data Protection Board (kvkk.gov.ct.tr).