1. Data Controller
Under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Moto Poyraz Motosiklet Servisi ("MotoPoyraz") as data controller within the scope described below. The Turkish version of this notice prevails.
Address: Cumhuriyet Mah. İsmail Ogan Sk. No:5, 07425 Alanya/Antalya · Phone: +90 552 597 56 21 · Email: info@motopoyraz.com
2. Categories of Personal Data Processed
- Identity: first name, last name.
- Contact: phone number, email address, address.
- Vehicle data: motorcycle make, model, model year, licence plate, chassis and engine number, mileage.
- Customer transactions: appointments, service requests, work orders, work performed and parts used, quote approvals, invoices and payment records (card details are not stored by us).
- Visual and audio records: photos and videos of the motorcycle taken at intake and during service, damage documentation.
- Digital signature: image of the electronic signature on intake and delivery forms.
- Transaction security: account data, one-way hash of your password, session and access logs, IP address, browser/device information.
- Device data: device/browser push notification token.
- Cookies and similar technologies: strictly necessary cookies and local storage for keeping you signed in and remembering your language and cookie choice; only with your explicit consent, advertising and analytics cookies collecting pages visited, appointment/phone/WhatsApp clicks, device and browser information and online identifiers.
- Requests and communication: messages and complaints sent via the contact form, email, phone or WhatsApp.
3. Purposes of Processing
- Creating, managing and reminding you of online and on-site appointments,
- Intake, diagnosis, repair, maintenance tracking and delivery of your motorcycle; running work order processes,
- Providing cost estimates, obtaining your approval and handling warranty processes,
- Invoicing, collection and accounting,
- Informing you about service status, appointments and account actions via SMS, email, WhatsApp and push notifications,
- Creating and managing your customer panel and mobile app account,
- Receiving and resolving requests and complaints,
- Ensuring information security, preventing misuse and keeping audit logs,
- Fulfilling legal obligations and responding to competent authorities,
- With your explicit consent, measuring the effectiveness of our advertising campaigns and showing you relevant ads,
- Measuring and improving service quality.
4. Legal Grounds and Collection Method
Your personal data is collected via our website, customer panel, mobile app, contact forms, phone, email and WhatsApp, and at our service location, physically and electronically, by automated or partly automated means.
The data is processed on the following legal grounds under Article 5(2) KVKK:
- Necessity for the conclusion or performance of a contract (Art. 5/2-c) — appointments, service, work orders, delivery and invoicing,
- Compliance with a legal obligation of the controller (Art. 5/2-ç) — obligations under tax, commercial and consumer law,
- Establishment, exercise or protection of a right (Art. 5/2-e) — warranty and potential disputes,
- Legitimate interests of the controller, provided your fundamental rights are not harmed (Art. 5/2-f) — information security, service quality, damage documentation at intake,
- Your explicit consent where none of the above applies (Art. 5/1) — e.g. promotional messages, non-essential notifications and advertising and analytics cookies (Google Analytics, Google Ads, Meta Pixel). You may withdraw your consent at any time.
5. Transfer of Personal Data
Limited to the purposes above and in line with Articles 8 and 9 KVKK, your personal data may be shared with the following recipients:
- SMS, email and WhatsApp messaging providers (to deliver notifications and verification messages),
- Push notification infrastructure (Apple Push Notification Service, Google Firebase Cloud Messaging, Expo and browser vendors’ web push services),
- Hosting, server, storage and backup providers,
- Payment institutions and banks (for payments),
- Accountants, auditors and legal advisers,
- Advertising and analytics providers (Google LLC / Google Ireland Ltd., Meta Platforms Ireland Ltd.), only with your explicit consent — their servers are located outside Türkiye and the transfer relies on your explicit consent,
- Competent public authorities and courts (upon request).
Some of these providers may operate servers outside Türkiye. Cross-border transfers are carried out with one of the appropriate safeguards set out in Article 9 KVKK (e.g. standard contractual clauses notified to the Board) or, where this is not possible, based on your explicit consent.
6. Retention Periods
- Service, work order, invoice and accounting records: for the periods required by law (10 years for commercial books and documents, at least 5 years for tax records),
- Account and profile data: as long as your account is active; after deletion, data not subject to a statutory retention duty is deleted or anonymised within 30 days at the latest,
- Vehicle photos, videos and signatures: together with the related service record, for warranty and potential dispute periods,
- Transaction security and access logs: 2 years,
- Contact form and request records: 2 years after the request is closed,
- Advertising and analytics cookies: until you withdraw consent, at most for the cookie’s lifetime (up to 2 years),
- Push notification tokens: immediately upon sign-out, withdrawal of notification permission or token invalidation.
Expired data is deleted, destroyed or anonymised in periodic disposal cycles.
7. Your Rights as a Data Subject (Art. 11 KVKK)
Under Article 11 KVKK you may apply to the data controller to:
- learn whether your personal data is processed,
- request information if it has been processed,
- learn the purpose of processing and whether data is used accordingly,
- know the third parties in Türkiye or abroad to whom data is transferred,
- request rectification of incomplete or inaccurate data,
- request erasure or destruction under the conditions of Article 7 KVKK,
- request that rectification, erasure or destruction be notified to third parties to whom data was transferred,
- object to a result against you arising exclusively from automated analysis,
- claim compensation for damage arising from unlawful processing.
8. How to Apply
You can submit your requests, together with information identifying you, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller:
- by a wet-signed letter delivered in person or via notary to Cumhuriyet Mah. İsmail Ogan Sk. No:5, 07425 Alanya/Antalya,
- by email to kvkk@motopoyraz.com from the email address registered with us,
- via registered electronic mail (KEP), secure electronic signature or mobile signature.
Requests are answered free of charge within 30 days at the latest; if the process requires an additional cost, the tariff set by the Board may apply. If your request is rejected, the answer is insufficient or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board.
9. Account Deletion
You can delete your account at any time in the mobile app via Profile > "Delete my account", or request deletion by writing to kvkk@motopoyraz.com from your registered email address. Records subject to a statutory retention duty (e.g. invoices and service records) are kept for the legally required period; all other data is deleted or anonymised.
For details of our privacy practices, see the Privacy Policy: https://motopoyraz.com/en/gizlilik