Privacy policy

IST11 is a private transfer service in Istanbul. This policy explains which personal data we collect when you visit ist11.com or book a transfer, why we use it and what your rights are.

Who is responsible

The data controller is Whitelotus Turizm Seyahat Acentası (TÜRSAB licence 16075), Dumlupınar Mah. Malatya Cad. No:41/B, Ümraniye / İstanbul, Türkiye, operating the IST11 brand. You can reach us at the email address and phone number on our contact page.

What we collect

• Booking details: name, email address, mobile phone number, pickup and drop-off addresses, date and time, flight number, number of passengers and suitcases, notes and your chosen payment method.
• Account details (only if you create an account): email address, name and a securely hashed password.
• Messages: what you send us by email, phone or WhatsApp.
• Technical data: IP address, browser type and pages visited, used to run, protect and fix the website.
• Analytics (only with your consent): how visitors use the site, through Google Analytics.

We do not store card numbers. If you pay online, the payment is handled by our licensed payment provider.

Why we use it

• To quote, book, carry out and manage your transfer, and to send you the confirmation and updates (performance of a contract).
• To meet legal obligations, for example tax records and the trip and passenger reporting required for licensed passenger transport in Türkiye (UETDS).
• To keep the website secure and prevent misuse (legitimate interest).
• To understand and improve the website, only if you accept analytics cookies (consent).

We never sell your personal data.

Who we share it with

• Our drivers, who receive only what they need for your trip.
• Service providers that run the site for us: hosting and email (Amazon Web Services), database (MongoDB Atlas, EU region), address search and distances (Google Maps Platform), analytics with your consent (Google), and our payment provider.
• Authorities, where the law requires it.

Some of these providers may process data outside Türkiye or the EU. Where they do, we rely on the safeguards the law requires.

Cookies and similar technologies

We use strictly necessary cookies, for example to keep you signed in to your account. Your cookie choice itself is saved in your browser. Analytics cookies (Google Tag Manager / Google Analytics) are only loaded after you click “Accept all” in the cookie banner. You can change your mind at any time by clearing this site’s data in your browser.

How long we keep it

We keep booking records for as long as the law requires for accounting and transport records. Account data is kept until you delete your account or ask us to delete it. Analytics data is kept according to the settings of our analytics account.

Your rights

Under the Turkish Personal Data Protection Law (KVKK, No. 6698) and, where it applies, the EU General Data Protection Regulation (GDPR), you can ask us to tell you what data we hold about you, correct it, delete it, restrict or object to its use, and receive a copy. Where we rely on your consent, you can withdraw it at any time. Contact us using the details on our contact page. You can also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.

Changes

We may update this policy. The date at the top shows the latest version.