Navigo Sürücü KVKK Notice

Last updated: 5 November 2026

This notice is given under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles of the Duty to Inform, to drivers who use the Navigo Sürücü mobile app.

1. Controller

For the app account: Selman EROL – Mest Yazılım ve Bilişim Teknolojileri (Navigo), Hürriyet Mah. Atatürk Blv. Altan İş Merkezi No:48/9 Altınova / Yalova, Türkiye, info@navigo.com.tr, 0850 532 6378.
For the company driver record: the transport company you work for. Navigo processes that record on the company’s behalf. When you delete your account, this record, including name, phone, email if you entered one, card, licence and vehicle assignment, is deleted from Navigo immediately.

2. Personal data processed

Identity: first name, last name. Updated on the profile.
Contact: mobile number. An optional email, if you enter one on the profile.
Application and account: plate applied for, company, approval and access status, registration date, selected vehicle and route.
Transaction security: SMS verification record, session ID, session start, end and revocation time, IP address, request and error logs.
Device: push token and platform, if notifications are allowed; for app updates, a random installation ID generated on the phone, the platform and the app version.
Operations: trip messages, whether the app is open for the selected vehicle and last seen, departure alerts (vehicle, stop template, departure time, departure stop coordinates).
Message reports: if you report a message, your email address, your vehicle’s plate, and the reported message’s sender name, text and time.
Read from the company record: role, card number, licence details, vehicle assignment. The app never asks you for these; it only shows them on your profile.

Location: if you grant foreground location permission, your phone’s location is used only on your phone, for trip navigation and the departure alert; it is not sent to our servers. Background location is not requested. The vehicle position on the map comes from the company’s tracking device. This location is not sent to OpenAI or Google Places. The map area the phone requests goes to the map provider only as data, without any notice of which driver it belongs to.

No special categories of data are processed. Face ID and fingerprint checks are done by the phone’s operating system; biometric data never reaches the app or the server.

3. How data is collected

Data is collected electronically and by automated means: from the registration and sign-in forms, SMS verification, records created while you use the app, and the driver record in your company’s fleet tracking system.

4. Purposes and legal grounds

Account creation, company application, SMS verification and sign-in: establishing or performing a contract (Art. 5/2-c). Your mobile number is processed on this ground.
Route, trip order, navigation, stop board, trip messages, online status, departure alerts and waiting-passenger alerts: Art. 5/2-c.
Preventing abuse through session and SMS records, transaction security and fault fixing: legitimate interest (Art. 5/2-f), provided it does not harm your fundamental rights and freedoms.
Reviewing reported messages and removing unlawful content: Art. 5/2-ç and Art. 5/2-f.
Requests from authorities and statutory retention: legal obligation (Art. 5/2-ç).
Establishing, exercising or defending a right (for example a dispute): Art. 5/2-e.

This page is a notice, not an explicit consent form. No explicit consent is requested and no consent checkbox is used for the purposes above. Data is not processed for marketing, advertising or profiling. If such a purpose is added later, it will rely on separate, optional explicit consent that is not a condition of the service.

Location and notification permissions are the phone’s own permission prompts. If you decline, only that feature stops working; your account does not depend on them.

5. Transfers

Your company: application and account details, approval and access status, online status; to perform the service (Art. 8, Art. 5/2-c).
Drivers in the same operation: trip messages, sender name and last seen; to perform the service.
Suppliers in Türkiye: SMS provider (phone number and code) and hosting.
Abroad (from Navigo’s server): for notification delivery, Expo (650 Industries, USA), Apple Push Notification service and Google Firebase Cloud Messaging. What is sent is the push token and the notification text. The text does not contain your name, phone number or account number, and the recipient is not told which driver the token belongs to. This transfer is made under KVKK Article 9.
Services abroad your phone connects to directly: Navigo’s server does not send your name, phone number or account number to these services. App updates: on launch the app connects to Expo’s update server (EAS Update, USA); the platform, app version and installation ID are sent. Navigo does not link this ID to your account and does not tell Expo which driver it belongs to. Maps: the area shown is requested by your phone directly from the provider, only as data, without any notice of which driver it belongs to. Google Maps on Android, Apple Maps on iOS, or Google Maps if the Google Maps app is installed and you choose Google as your map. Because the phone opens the connection, the provider sees the IP address; it receives nothing that ties that IP to a driver account. Your phone number is not transferred abroad. OpenAI and Google Places are not used.
Public authorities: only where the law requires it.

6. Retention and disposal

App account, session, notification, presence and departure alert records: until your account is deleted. A session is valid for up to 180 days.
Trip messages: messages you send, until your account is deleted; messages other drivers send you, until the sender’s account is deleted.
SMS verification record (number, code, time, attempt count): the code expires after 5 minutes; the record is kept to prevent abuse until your account is deleted.
IP address, request and error logs: 30 days, then deleted automatically.
Message report emails: until the report is resolved and any dispute period has ended.
Application and driver record (name, phone, email if you entered one, plate, role, card, licence, vehicle assignment): deleted immediately when your account is deleted.
Records the law requires us to keep: only for that period, with restricted access.

Data whose period has ended or whose purpose no longer exists is deleted, destroyed or anonymised under KVKK Article 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

7. Security

Traffic is encrypted with HTTPS (TLS). The session token is kept in the phone’s secure store; the server records each session and can end it individually. SMS codes are single-use, and attempts and resends are limited. Company staff only see their own drivers. In case of a data breach, the Board and affected persons are notified under KVKK Article 12.

8. Account and data deletion

In the app, Menu → Legal → Delete my account and data deletes your account. This is how you exercise your right to erasure under KVKK Article 11/1-e from inside the app. Deletion finishes in this step.

Your driver record is deleted immediately: name, phone, email if you entered one, plate, role, card number, licence and vehicle assignment. The card link on the vehicle is removed.
Data held by the app is deleted immediately as well: sessions, push token, trip messages you sent, presence and departure alert records, app permissions and SMS verification records. The session and biometric setting on your phone are removed, and sign-in is closed.

If you cannot open the app, use the application route below; the same records are deleted. Details: Privacy policy, account and data deletion.

9. Your rights (KVKK Article 11)

To learn whether your personal data is processed.
To request information if it is processed.
To learn the purpose of processing and whether data is used for that purpose.
To know the third parties in Türkiye or abroad to whom data is transferred.
To request rectification of incomplete or inaccurate data.
To request deletion or destruction under the conditions of KVKK Article 7.
To request that rectification, deletion or destruction be notified to recipients.
To object to a result against you arising solely from automated analysis.
To claim compensation for damage caused by unlawful processing.

10. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Controller, send your request in Turkish with your full name, signature, Turkish ID number (for foreigners, nationality and passport number), address for notification, and email and phone if any, by one of these routes:

In-app account deletion (Menu → Legal → Delete my account and data). Deletion finishes in this step.
Email to info@navigo.com.tr stating your registered mobile number; or with a secure electronic or mobile signature, or by registered electronic mail (KEP).
A signed letter, in person or through a notary: Hürriyet Mah. Atatürk Blv. Altan İş Merkezi No:48/9 Altınova / Yalova, Türkiye.

Account deletion is completed immediately in the app. Other requests are resolved free of charge within 30 days at the latest; if a request involves extra cost, the Board’s fee schedule may apply. For a record the company keeps in its own systems, you can also apply to the company. If you are not satisfied with the answer or get no answer in time, you can complain to the Personal Data Protection Board under KVKK Article 14.