Privacy Policy
This policy explains how Ridoza VIP Transfer processes your personal data. It is written to meet the transparency rules of the UK General Data Protection Regulation (UK GDPR), the EU GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK, Art. 10). It covers the ridoza.com website, booking and payment pages, WhatsApp and e-mail communication, and the customer and driver mobile apps.
1. Who is responsible for your data
P2PTRANSFER LTD (company no. 14995238), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact: service@ridoza.com · +44 7400 400110
2. What we process
- Identity and contact: name, phone (WhatsApp) number, e-mail address.
- Booking details: pick-up and drop-off address, date and time, flight number, number and names of passengers, luggage, child seats and your notes, price and payment status.
- Payment: your card details are not stored on our servers; card payments go directly through the payment institution Stripe. We only see the result (paid or not, amount, transaction ID).
- Messages: your WhatsApp, e-mail and on-site assistant conversations.
- Location: your device location, only at that moment and only if you allow it, to pick an address. On the transfer day, the tracking link we send you shows the vehicle's location.
- Technical data: IP address, browser and device information, security and error logs; analytics and advertising cookies only if you allow them (see the Cookie Policy).
- Drivers and partners: identity, driving licence, SRC/psychotechnical and vehicle documents, vehicle photos, IBAN, job and earnings history; the vehicle's GPS location while the driver app is in use (foreground and background).
- Agencies and business clients: company name, tax details, contact person, invoices and account movements.
3. Purposes and legal bases
| Purpose | UK/EU GDPR Art. 6 | KVKK Art. 5 / 6 |
|---|---|---|
| Taking and confirming your booking, assigning a driver and vehicle, performing the transfer, keeping you informed (e-ticket, driver details, reminders) | Contract (6(1)(b)) | Contract (5/2-c) |
| Taking payment, invoicing and accounting | Contract, legal obligation (6(1)(b), (c)) | Contract, legal obligation (5/2-c, ç) |
| Notifications required by Turkish passenger-transport rules (e.g. U-ETDS) | Legal obligation (6(1)(c)) | Required by law (5/2-a, ç) |
| Flight tracking (adjusting the pick-up time for delays or early arrivals) | Contract (6(1)(b)) | Contract (5/2-c) |
| Customer support, complaints and service quality | Legitimate interests (6(1)(f)) | Legitimate interest (5/2-f) |
| Security, fraud and abuse prevention, system logs | Legitimate interests (6(1)(f)) | Legitimate interest, legal obligation (5/2-f, ç) |
| Establishing or defending legal claims | Legitimate interests (6(1)(f)) | Establishment and protection of a right (5/2-e) |
| Visit statistics and ad measurement (cookies) | Consent (6(1)(a)) | Explicit consent (5/1) |
| Marketing messages | Consent (6(1)(a)) / PECR | Explicit consent and commercial message approval (Law 6563) |
You can withdraw consent at any time: for cookies via “Cookie Settings” at the bottom of the page, for messages via the opt-out in the message or by writing to us.
4. How we collect data
Electronically, by automated or partly automated means: from booking and application forms on the site, WhatsApp and e-mail conversations, the mobile apps, cookies, and from partners who pass your booking to us (for example the agency or platform you booked through).
5. Who we share data with
We do not sell your data. We share only what is needed to provide the service, with:
- The driver and fleet partner performing your transfer: name, phone, address, time, flight and passenger details.
- The agency or platform that sent us your booking: the status of the transfer (e.g. driver assigned, completed, passenger did not show).
- Service providers (processors):
- Server and e-mail hosting: Hostinger
- WhatsApp messaging: Twilio and Meta (WhatsApp Business)
- Card payments: Stripe
- Maps and addresses: Google Maps Platform, OpenStreetMap (Nominatim, OSRM)
- Flight tracking (flight number only): FlightAware
- Notifications: Google Firebase Cloud Messaging (driver app)
- AI reply assistant: DeepSeek. Only the conversation content needed to produce a reply is sent to the assistant.
- Measurement, only with your consent: Google Analytics / Google Ads, Meta
- Public authorities where the law requires it (e.g. the Turkish Ministry of Transport U-ETDS system, tax offices, courts).
6. International transfers
The service is performed in Türkiye, but the controller and some of our providers are abroad. Your data may be processed on servers in the United Kingdom, the European Union, the United States and (for the AI assistant) the People's Republic of China. These transfers rely on the transfer mechanisms provided by the UK GDPR / EU GDPR and KVKK Art. 9 (standard contractual clauses and the other cases the law allows).
7. How long we keep data
| Data | Period |
|---|---|
| Booking, payment, invoice and accounting records | As long as tax and commercial law requires (up to 10 years) |
| WhatsApp and e-mail conversations | 24 months after the last message |
| Driver and vehicle location records | 6 months (longer only while a dispute is open) |
| Rejected partner applications and their documents | 12 months |
| Security and system logs | 12 months |
| Analytics cookie data | Up to 14 months in Google Analytics |
When the period ends, data is deleted, destroyed or anonymised.
8. Your rights
You have the right to: access your data and get a copy; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing based on legitimate interests; withdraw consent at any time; and not be subject to a decision based solely on automated processing that significantly affects you. Under KVKK Art. 11 you may also learn whether your data is processed, its purpose, the third parties it is transferred to, ask that corrections or deletions be notified to them, and claim compensation for unlawful processing.
How to make a request: write to service@ridoza.com with enough information for us to verify you (name, the phone or e-mail used for the booking, PNR). We reply free of charge within 30 days. You can also delete your account at /hesap-sil.
Complaints: you can complain to the UK Information Commissioner's Office (ico.org.uk), the data protection authority of your EU country, or the Turkish Personal Data Protection Authority (kvkk.gov.tr). We would appreciate the chance to solve the issue with you first.
9. AI-assisted replies
We use an AI-assisted assistant to answer questions quickly on WhatsApp and on the site. It can quote prices, create a booking at your request and take a change request. Cancellations and decisions that affect your rights are reviewed by our team; bookings made through an agency or platform can only be cancelled on that platform. If you would like to speak to a person, just say so in the conversation.
10. Mobile apps
- Driver app (Ridoza Driver): collects the vehicle's location while the app is in use, in the foreground and background, for job assignment, live tracking and driver/passenger safety. Location is never used for advertising or profiling.
- Customer app: uses location only while open, to pick an address.
- Permissions: location, camera/gallery (optional profile photo), notifications. Fingerprint/face login happens entirely on your device; biometric data is never sent to our servers.
- Account deletion: in the app or at /hesap-sil. Records we must keep by law (e.g. invoices) are kept in anonymised form.
11. Security
Connections are encrypted with HTTPS. Passwords are stored as one-way hashes. Documents such as IDs and licences are accessible only to authorised users. Login and verification attempts are rate-limited, and backups are taken regularly. If a personal data breach occurs, we notify the relevant authority and, where required, you, within the legal deadlines.
12. Children
The person making a booking must be 18 or over. Names and ages of child passengers are provided by the booking adult, only for safe transport (e.g. child seats) and legal notifications.
13. Changes
We may update this policy. The current version is always on this page, and we announce important changes on the site or by e-mail.