Privacy Policy

About this notice

This notice is the privacy information notice required by Türkiye's Personal Data Protection Law No. 6698 (KVKK). It explains for what purposes, on what legal grounds and how RentOkey processes your personal data, and what your rights are.

1. Data controller

The data controller is Faik Üretürk, a sole proprietorship trading as "RentOkey". Address: İstanbul. Email: hello@rentokey.com.

2. Scope of this notice

This notice covers visitors to www.rentokey.com, people who fill in the free-trial and contact forms, companies that subscribe to RentOkey and their employees who use the app.

For the data that car rental companies enter into the app about their own customers, drivers and rentals (for example identity, licence, contact and contract details), the rental company is the data controller. RentOkey acts as a data processor, processing that data only on the company's instructions and to provide the service. Requests about that data should first be sent to the rental company concerned.

3. Personal data processed

• Identity and contact: first and last name, email address, phone number.
• Company and account details: company name, country, tax and billing details, role and branch, subscription and plan details.
• Financial transactions: invoices, payment notifications and uploaded receipts. Card details are not collected.
• Transaction security: session details, IP address, activity and audit logs, app error reports (form contents, payment details and access keys excluded).
• Support and communication: the contents of contact forms and support correspondence.
• Depending on your choice: analytics data with cookie consent; your WhatsApp number if you turn on WhatsApp notifications.

4. Purposes and legal grounds

• Opening the account, providing the service, subscription and billing: entering into and performing a contract (KVKK Art. 5/2-c).
• Invoicing, accounting and other legal duties: compliance with a legal obligation (Art. 5/2-ç).
• Service and account security, preventing misuse, fixing errors, handling support requests and improving the service: legitimate interest (Art. 5/2-f).
• Establishing, exercising and defending legal claims: Art. 5/2-e.
• Analytics cookies and WhatsApp notifications: your explicit consent, which you can withdraw at any time.

5. How data is collected

Data is collected electronically through website forms, sign-up and use of the app, email and support correspondence and, if you allow it, cookies.

6. Recipients and transfers abroad

Personal data is shared with the following service providers we work with to provide the service, only for the relevant purpose and to the extent necessary:

• Supabase: app database and authentication; data is stored in the AWS Ireland (European Union) region.
• Vercel: hosting and server functions for the website and the app.
• Cloudflare: storage of file attachments and bot verification on forms.
• Resend: sending account, invitation, notification and reminder emails.
• Google (Google Analytics 4): visit statistics, only if you consent to cookies.
• Meta (WhatsApp Business): notification messages, only if you turn on WhatsApp notifications.
• Anthropic (Claude): only in the smart Excel import, to understand what each sheet and column contains; not the whole file but the sheet and column headings and a few sample rows are sent, with customer names, phone numbers, email addresses and ID numbers masked.

Because these providers' servers are outside Türkiye, your data is transferred abroad; transfers are made in line with the safeguards set out in Article 9 of the KVKK. Integrations that a rental company connects itself (such as a vehicle tracking system or bank toll data) operate on that company's instructions. Data may also be disclosed to legally authorised public bodies and to parties required by legal obligations, such as accountants. Your data is not sold or shared with third parties for advertising.

7. Analytics and traffic-source measurement

With your consent, Google Analytics 4 is used to measure which channels bring visits, the pages viewed and steps in the free-trial journey. First-touch source, campaign parameters, referring domain and landing page may be kept in first-party browser storage. Your name, email address, phone number and password are not sent to analytics. You can change your choice at any time through Cookie preferences in the footer.

8. WhatsApp notifications

If you turn on WhatsApp notifications in the app, the phone number you enter and the content of the summary sent to you (company or branch name, daily handover and return counts, open balance) are delivered through Meta Platforms’ WhatsApp Business service and may be processed on Meta’s servers outside Türkiye. Your number is used only to send you notifications. You can turn notifications off or delete your number at any time in the app under Ayarlar > Hesabım > Bildirimler (Settings > My account > Notifications).

9. Retention

• Account and company data is kept for the duration of the subscription. When the subscription ends the account stays read-only and data can be exported; after you request deletion, data is deleted from the live system within 30 days at the latest.
• Backups: daily copies are kept for 30 days and monthly copies for 12 months; deleted data disappears from backups when these periods end.
• Invoices and accounting records are kept for the periods required by law (for example the Tax Procedure Law).
• Contact forms and support correspondence are kept for a reasonable period after the request is resolved.
• Rental companies' customer identity, licence and passport images are destroyed automatically 5 years after the end of the last rental.

10. Data security

Your data is transmitted over encrypted connections, encrypted at rest and protected against unauthorised access through technical and organisational measures. Companies cannot see each other's data, and users only access the records their role allows. See the Security and data page (/en/security-and-data) for details.

11. Your rights

Under Article 11 of the KVKK you may apply to the data controller to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether data is used accordingly,
• know the third parties in Türkiye or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under Article 7 of the KVKK,
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
• object to an outcome against you arising exclusively from automated analysis,
• claim compensation if you suffer damage from unlawful processing.

12. How to apply

Send your request to hello@rentokey.com from the email address registered with RentOkey; if you prefer to apply in writing by post, you can request our postal address at the same email. State your name, contact details and request in your application. Requests are answered free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your request is rejected, you find the answer insufficient or it is not answered in time, you may complain to the Personal Data Protection Board.

13. Users in Northern Cyprus

For companies and users operating in the Turkish Republic of Northern Cyprus, rights under the Personal Data Protection Law No. 89/2007 are also reserved; requests about these rights can be made in the same way.

14. Changes

This notice may be updated to reflect changes in law or in the service. The current version is always published on this page, and material changes are announced to subscribers by email.

15. Contact

For questions about this Privacy Policy, contact hello@rentokey.com.