KVKK Personal Data Disclosure

1. Data Controller

The data controller is: Valo Teknoloji Anonim Şirketi ("Valo", "the Company"). MERSIS No: 0922151006600001. Registered office: Esentepe Mah. Büyükdere Cad. Ferko Signature No:175/6 Şişli 34394 Istanbul. KEP address: [email protected]. Contact: [email protected] · +90 212 909 82 56.

2. Personal Data We Process

We process the following categories of personal data to operate the Valo service:

• Identity data: first name, last name, date of birth
• Contact data: mobile phone number, email address
• Location data: pickup, drop-off, real-time position (only while the app is open)
• Ride data: date, time, distance, fare, ratings, cancellation reason
• Payment data: last 4 digits of the card (we do not store the full PAN; payments are processed via PCI-DSS compliant providers)
• Device and technical data: device model, OS, IP address, app version, cookie identifiers
• Support communications: voice and text-based support interactions

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Taxi match and ride operation
• Fare calculation and payment processing
• Driver-passenger communication (phone calls via number masking)
• Safety, fraud prevention and dispute resolution
• Fulfilment of legal obligations (taxes, invoicing, lawful requests from authorities)
• Service quality improvement through anonymised analytics and reporting
• With your explicit consent: marketing, promotions and special offers

4. Legal Grounds for Processing

We rely on the following legal grounds under KVKK Articles 5 and 6: (a) performance of a contract (the ride-hailing service agreement), (b) compliance with legal obligations (tax, invoicing, law-enforcement requests), (c) establishment and defence of legal claims (dispute resolution), (d) legitimate interest (fraud prevention, service quality). For marketing processing we additionally collect your explicit consent.

5. Sharing with Third Parties

Your data may be shared with the following parties only to the extent necessary to operate the service:

• Matched drivers (name and phone only, plus pickup/drop-off location)
• Payment service providers (iyzico and similar PCI-DSS compliant payment infrastructure)
• Cloud infrastructure and storage providers (under contract)
• Authorised public institutions (upon lawful request)
• Legal advisors, auditors and accountants (under confidentiality obligations)

6. International Data Transfers

Some data may be transferred to servers abroad as part of cloud infrastructure or push notification services. Such transfers are only carried out when the conditions of KVKK Article 9 are met: transfer to a country with adequate protection, explicit consent, or written undertakings with KVKK Board approval. We obtain GDPR compliance undertakings from providers where applicable.

7. Retention Periods

Personal data is retained only for as long as the processing purpose requires. Once the relevant statutory retention period ends, data is deleted, destroyed or anonymised. Examples:

• Account data: while your account is active + 10 years after closure (Turkish Commercial Code)
• Ride and invoice records: 10 years (Tax Procedure Law)
• Location history: 12 months (analytics and dispute resolution)
• Support call recordings: 2 years
• Marketing communications data: until consent is withdrawn

8. Rights of Data Subjects (KVKK Article 11)

As a data subject, you have the right to:

• Learn whether your personal data is being processed
• Request information about your processed data
• Learn the purpose of processing and whether the data is being used in accordance with that purpose
• Know any third parties to whom the data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction within KVKK rules
• Request that correction or deletion be communicated to third parties to whom the data was transferred
• Object to a result that disadvantages you arising from the analysis of your data exclusively through automated systems
• Demand compensation for damages arising from unlawful processing

9. How to Submit a Request

To exercise your rights you may apply in writing to [email protected], to our KEP address [email protected], or to our registered office. Your application must include verifiable identity details and clearly state which right you wish to exercise. We evaluate and respond within 30 days at the latest, free of charge (except for fees that may be set by the KVKK Board). If your application is rejected or you find the response inadequate, you may file a complaint with the Personal Data Protection Board within 30 days of learning the response and in any case within 60 days of the application date.