Controller and scope
Fabay Technology is the controller for taşıyıcı.com web, iOS and Android services. Website: fabaytechnology.com. Privacy requests: info@fabaytechnology.com; brand contact: info@taşıyıcı.com. This notice provides information and is not an explicit consent statement.
Data and collection
Electronic forms and APIs collect email, password, account ID and phone for SMS access; profile name, city and contact details; company and authorization information; request, proposal, listing, rental and job-application content; messages/support and files you select. Manual bookkeeping stores contact/tax reference, account names, amounts, currency, dates and attachments. Bank login credentials and card numbers are not requested.
Location, camera and handover
Nearby features request location on your action. When an asset owner starts sharing, only a point rounded to two decimal places and its sharing time are shown to signed-in users for up to 15 minutes. Expiry hides the point; it does not erase it. The last coarse point remains in the owner record until refreshed or sharing is stopped; stopping removes this field. This feature stores no precise GPS history. A shipment you start may record coordinates, accuracy and time in the background approximately every two hours; operating systems do not guarantee continuous tracking. QR handover processes a token, transaction ID, time and location if permitted. The camera scans QR only; images/video are not uploaded. Only selected files are uploaded. Stop sharing or revoke device permissions at any time.
Purposes and legal bases
Accounts, requests, proposals, listings, rentals, messaging, handover and support rely on KVKK Article 5(2)(c), performance/formation of a contract. Security and abuse prevention rely on proportionate legitimate interests, Article 5(2)(f); dispute evidence on establishment/exercise/defence of rights, Article 5(2)(e); applicable legal duties on Article 5(2)(ç). Additional purposes require separate optional explicit consent under Article 5(1). OS permission alone is neither explicit consent nor an international-transfer safeguard.
Recipients and international transfers
Published listings and storefront details are public. Private requests, proposals, messages and transaction location are restricted to relevant parties and authorized company members; customs documents to authorized firms; bookkeeping to owners/admins/accountants. Supabase authentication, database and files use Frankfurt, Germany. Map keys are not configured; Google Maps also requires the functional choice. When enabled, Google may process IP, device and map data abroad. Authorities receive only legally required data. A lawful KVKK Article 9 mechanism and provider agreements are required before new international transfers; these code changes do not establish that a standard contract has been signed or notified.
Retention and erasure
Device sessions last until logout, drafts for the tab session, preferences for 12 months. Consent evidence is subject to a three-year retention policy after the last event. Account/transaction records remain for the service and relevant dispute needs; deletion requests are assessed within 30 days. The target for unnecessary active location records is 90 days; dispute evidence is restricted while needed. Backups follow the provider cycle. The app never claims automatic deletion when it has only received a request. Legally required records are restricted. Manual bookkeeping is not an official invoice or money transfer.
Your rights
Under KVKK Article 11 you may learn whether data is processed, request information, learn its purpose and proper use and domestic/foreign recipients, request correction and erasure/destruction where applicable and notification to recipients, object to adverse results based solely on automated analysis, and seek compensation for unlawful processing. Use account support/export/deletion or info@fabaytechnology.com. Identity checks are limited to what is necessary; requests receive a response within 30 days.
Optional purposes
Behaviour analytics, marketing/advertising and personalization services are inactive. Each purpose is separate and off by default; rejection does not prevent registration or service. Operational notifications, location/camera permission and marketing consent are distinct. You can withdraw explicit consent at any time.