1. Data controller
Your personal data is processed by Bikaravan Bilgi Teknolojileri Otomotiv Turizm Ticaret Limited Şirketi (the “Company”) as data controller. The services are offered under the BiCar Solution brand. As the Company is established in Türkiye, no data controller representative needs to be appointed.
Company name: Bikaravan Bilgi Teknolojileri Otomotiv Turizm Ticaret Limited Şirketi
Address: İnönü Mahallesi, Fatih Sultan Mehmet Bulvarı No: 412, B Blok, Ofis: 73, 06370 Yenimahalle / Ankara, Türkiye
MERSİS No: 0069047375400001
Email: bilgi@bicarsolution.com
Registered electronic mail (KEP): bikaravan@hs01.kep.tr
Phone (for information): +90 312 552 20 80
Website: bicarsolution.com
2. Definitions
- Personal data: Any information relating to an identified or identifiable natural person.
- Data subject: The natural person whose personal data is processed (visitor, member, customer, authorised representative or employee of a corporate customer, etc.).
- Processing: Any operation performed on data, such as obtaining, recording, storing, changing, transferring, classifying or erasing personal data.
- Data processor: A person or organisation that processes personal data on the Company’s behalf under its authority (e.g. hosting and email service providers).
- Law / KVKK: Personal Data Protection Law No. 6698. Board: Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
3. Whose data is processed?
- Website visitors: People who visit our website without registering.
- Individual members and customers: People who create an account or submit a request to sell/value their vehicle or to buy a vehicle.
- Authorised representatives and employees of corporate customers: Natural persons who open an account on behalf of their company, submit a fleet/vehicle request or are named as a contact person.
- People who contact us directly: People who request information or an appointment by email, phone or office visit, and people who fill in the “Call me back” form on the website.
- Third parties named in a request: People who appear in documents or information shared by a customer (see section 18).
Data of Company employees and job applicants is outside the scope of this notice; they are informed separately.
4. Categories of personal data processed
| Category | Data | Data subject |
|---|---|---|
| Identity | First name, surname | Member, customer, corporate representative, person contacting us |
| Contact | Email address (not required if you signed up with your mobile phone and an SMS code), phone number, (for corporate accounts) company name; the content of communications when you write to or call us | Member, customer, corporate representative, person contacting us |
| Customer transaction | Vehicle sale/valuation request details (make, model, trim/package, model year, mileage, fuel, transmission, colour, city, damage/paint/replaced parts, insurance damage record and amount, additional notes), file number, process status, price studies and offers, decisions on offers, vehicle purchase request (vehicle sought, budget range, fuel/transmission preference, expectations), vehicle search preferences (make/model, body type, price range and currency, maximum mileage, model year range or maximum age, fuel, transmission, preferred and unwanted colours, limits on painted/replaced parts and damage records, equipment wishes; which of these are must-haves), panel messages | Member, customer, corporate representative |
| Vehicle identifier | Number plate and the vehicle photos and documents you upload (e.g. registration certificate, inspection report). The number plate may constitute personal data when the vehicle owner is a natural person. | Customer |
| Transaction security | Irreversible hash of the password (the password itself is not stored), hashes of email verification and password reset codes, hashes of one-time sign-in and verification codes (the code itself is not stored; the hash is calculated together with the request, purpose, channel and recipient for which the code was sent), code delivery records (channel, purpose, masked recipient — e.g. +90 5** *** ** 33 —, delivery status, provider transaction number and error code), hash, validity and last authentication time of the session key, sign-in/activity logs (which user created or changed which record and when), hashed values used to limit failed sign-in attempts, IP address, date/time, browser information and server access logs | Visitor, member, customer |
| Verified sign-in details | The mobile phone number and email address you verified with a code, and the verification date; for account recovery: the reason for the request and how you contacted us, the type of ownership evidence checked by our team (e.g. “photo ID issued by an authority” and “original registration certificate of the vehicle in the account”) with a short check note, the administrator who opened the request and the one who verified the evidence, dates and outcome (completed, rejected, cancelled, expired). Identity or document numbers and copies of documents are not taken or recorded. | Member, customer, corporate representative and employee |
| Corporate membership | Trade name, tax identification number, tax office, province, fleet size, the applicant’s position and declaration of authority, the fact that the authority document (signature circular/power of attorney) was checked, the administrator who checked it and the date, any note; the business email or mobile phone number and position of an invited employee | Corporate representative and employee |
| Call and request follow-up records | Short notes written by our team about phone calls with you (the employee who wrote the note and the time are recorded automatically), the status of the request, the employee responsible for it and the planned next call date; the purchase-potential assessment our team selects manually to prioritise the request (Not assessed, Hot, Warm, Cold), the employee who changed it and the date; and, when the request is concluded or abandoned, the closing date and an optional closing reason. This assessment is not an automated decision or profiling; it does not by itself change the service or price offered to you. These notes are internal team records and are not shown in the customer panel. Our website system does not keep audio recordings of calls. | Customer, person who calls us or asks to be called back |
| Legal transaction | Your KVKK applications and our replies, the record that this notice was presented to you (date and version), the record of your acceptance of the membership terms (date and version), correspondence in case of a dispute | Member, customer, applicant |
| Website usage statistics | Only if you allow on-site measurement: the section viewed, the type of contact link clicked, the application form step, page language and a defined campaign code; only as daily totals. No IP address, form content or user identity is written to these records, and they are not linked to user accounts. | Visitor, member |
| Marketing | Your email and phone/SMS preferences for campaign and promotional messages, the date they were given or withdrawn and the text version | Member, customer (only when the choice is offered) |
| Finance | Information required for invoices, payments and accounting records when a sale or service relationship is established | Customer |
5. Purposes and legal grounds
Your personal data is processed only for the purposes below and in line with the general principles in Article 4 KVKK (lawfulness and fairness, accuracy and being up to date, specified, explicit and legitimate purposes, being relevant, limited and proportionate, and retention only for as long as necessary).
| Purpose | Data categories processed | Legal ground (Art. 5 KVKK) |
|---|---|---|
| Creating the membership account (with a code sent by SMS to your mobile phone, or with an email address and password), enabling sign-in, verifying the email address, resetting the password | Identity, contact, transaction security, legal transaction | Art. 5/2(c) – Directly related to the conclusion or performance of a contract |
| Password-free sign-in with a code: sending a one-time code by SMS to your verified mobile phone (sending codes by email is currently not enabled) and verifying the code; confirming with a code that the phone and email belong to you (accuracy of contact details — Art. 4 KVKK and Board Principle Decision No. 2020/966) | Identity, contact, verified sign-in details, transaction security | Art. 5/2(c) – Conclusion and performance of the membership contract; Art. 5/2(f) – Legitimate interest in ensuring the account is used only by its owner |
| Account security: re-verifying identity before sign-in details are changed, notifying the old email address of a change, code attempt and sending limits, preventing SMS abuse and cost misuse | Contact, verified sign-in details, transaction security | Art. 5/2(ç) – Legal obligation regarding data security (Art. 12 KVKK); Art. 5/2(f) – Legitimate interest |
| Account recovery: when you cannot access your phone or email, our team first checks that the account belongs to you (with an ID document and the original of a document linking you to the account), after which you confirm with the code sent to the new detail; recording the reason, the person who performed the check and the outcome. A code received at the new detail alone does not prove that you own the account | Identity, contact, verified sign-in details, transaction security | Art. 5/2(c); Art. 5/2(f) |
| Corporate membership: receiving the company application, checking the applicant’s authority to act for the company against a document, the representative inviting employees by business email or mobile phone number and managing their access. For an email invitation, an information email is sent to the employee; for a phone invitation no SMS is sent, and the invitation appears in the employee’s panel once they verify that number with a code and sign in | Identity, contact, corporate membership | Art. 5/2(c) – Conclusion and performance of the contract with the corporate customer; for employee details Art. 5/2(f) – Legitimate interest in the business relationship with the corporate customer |
| Receiving and reviewing vehicle sale/valuation requests, preparing price studies and offers, carrying out the sale process | Identity, contact, customer transaction, vehicle identifier | Art. 5/2(c) |
| Receiving vehicle purchase consultancy requests, researching suitable vehicles and offers | Identity, contact, customer transaction | Art. 5/2(c) |
| Vehicle search follow-up: recording the features of the vehicle sought by a person who calls us, asks to be called back or creates a purchase request in the panel, researching suitable vehicles, and following up calls and the next call within the team. No membership is created for a person who calls us, and their number is not treated as verified. No automatic SMS is sent on the basis of this record | Identity, contact, customer transaction, call and request follow-up records | Art. 5/2(c) – Pre-contractual discussions and consultancy service at your request; where no contract is concluded, Art. 5/2(f) – Legitimate interest in following up your request |
| Contacting you about your request, answering panel messages, sending process and security notifications by email | Identity, contact, customer transaction | Art. 5/2(c); for security notifications Art. 5/2(f) – Legitimate interest |
| Communicating with representatives and employees acting on behalf of a corporate customer | Identity, contact, customer transaction | Art. 5/2(f) – Legitimate interest in the business relationship with the corporate customer, provided this does not harm your fundamental rights and freedoms |
| Calling you back following a request sent through the “Call me back” form and following up your request | Identity (name), contact (phone), subject of the request, preferred call time and optional note; call and request follow-up records | Art. 5/2(c) – Pre-contractual discussion at your request; for requests that do not lead to a contract Art. 5/2(f) |
| Answering information and appointment requests made by email or phone | Identity, contact | Art. 5/2(c) – Pre-contractual discussion; for requests that do not lead to a contract Art. 5/2(f) |
| Measuring, as totals, how many people visit the website, which pages are viewed and where visitors come from (e.g. Google) | Transaction security (IP address, browser information, referring site); only momentarily | Art. 5/2(f) – Legitimate interest in improving the service. No cookie is used for this count; the IP address and browser information are not stored for this purpose but are converted into an irreversible code with a random key that changes every day, and this code is deleted at the end of the day. Web server access logs are separate from this count (section 10). |
| On-site measurement: measuring, as totals, which sections are viewed and how much contact links and application steps are used (only if you allow it; when enabled) | Website usage statistics | Art. 5/1 – Explicit consent (cookie and measurement preferences window). Not allowing it does not affect your use of the website and our services; you can withdraw your permission at any time through the “Cookie preferences” link. |
| Analysing website usage with Google Analytics (only when this service is enabled and you consent to analytics cookies) | Online identifiers (cookie ID), IP address (used by Google to estimate location), device and browser information, pages visited and on-site interactions | Art. 5/1 – Explicit consent (cookie consent window). Not consenting does not affect your use of the website; you can withdraw your consent at any time through the “Cookie preferences” link. |
| Ensuring account and system security, preventing unauthorised access and misuse, keeping activity logs | Transaction security | Art. 5/2(ç) – Legal obligation regarding data security (Art. 12 KVKK); Art. 5/2(f) |
| Meeting invoicing, accounting and tax obligations when a sale or service relationship is established | Identity, contact, finance, customer transaction | Art. 5/2(a) – Expressly provided for by law; Art. 5/2(ç) – Legal obligation (Turkish Commercial Code, Tax Procedure Law) |
| Responding to information requests from competent public authorities and courts | The data requested in the relevant request | Art. 5/2(a) and (ç) |
| Establishing, exercising and protecting rights in possible disputes | Data related to the dispute concerned | Art. 5/2(e) – Necessary for the establishment, exercise or protection of a right |
| Receiving and concluding KVKK applications and keeping the record of information provided | Identity, contact, legal transaction | Art. 5/2(ç) |
| Sending commercial electronic messages about campaigns, promotions and offers | Identity, contact, marketing | Art. 5/1 – Explicit consent and approval under Law No. 6563; only through the channel you have separately approved. Consent to campaign SMS is requested in the sign-up form with a separate, optional box; not giving it does not affect membership. Until registration with the Message Management System (İYS) is completed, this box is not shown, no consent is collected and no campaign SMS is sent. |
About verification codes: A code sent to you is used only for the step you are in (sign-in, registration, phone/email verification or security verification). Entering the code does not replace, and is not recorded as, approval of commercial electronic messages, explicit consent, acceptance of the membership terms or any other approval (Board Principle Decision No. 2025/1072). Acceptance of the membership terms, presentation of this notice and the optional commercial message preference are each obtained and recorded separately. No advertising or campaign content is added to code messages. Automatic filling of the code by your browser or phone is not recorded as any permission or approval.
For processing based on legitimate interest, a balance is struck between the Company’s interest and your fundamental rights and freedoms; only the minimum data necessary for the purpose is processed.
6. Method of collection
Your personal data is collected:
- electronically and by automated means through the registration, sign-in, vehicle sale and vehicle purchase forms on our website, the “Call me back” form, the customer panel, panel messages and the file upload area,
- by automated means through server and security logs when you visit the website,
- only if you allow it, by automated means through the on-site measurement code running in your browser while the page is open (totals only),
- by non-automated means directly from you by email, phone or during an office visit,
- during sign-in and verification with a code, electronically and by automated means when the code is sent to you by SMS or email and you enter it; if you use the automatic code-fill feature of your phone or browser (WebOTP on Android, AutoFill on iPhone), the code is placed in the input field on your device and, like a code typed by hand, is sent to our server for verification,
- for corporate customers, when the details of a representative/employee are provided by the company you belong to (e.g. a representative inviting an employee by business email; the invitation email contains a link to this notice),
- during account recovery, by non-automated means from you to our team while the ownership evidence is checked (documents are only shown; no copy is taken)
If data is obtained from a source other than you, you are informed within a reasonable time after the data is obtained, at the first communication with you or at the first transfer of the data, and in any case no later than these moments.
7. Transfer of personal data
Your personal data may be transferred to the recipient groups below in accordance with the conditions in Article 8 KVKK and only to the extent necessary for the purposes stated. Your personal data is not sold, rented or shared with third parties for advertising.
| Recipient group | Purpose of transfer | Legal ground |
|---|---|---|
| Server hosting and backup service provider (established in Türkiye; Çizgi Telekomünikasyon A.Ş. – Natro) | Hosting and backing up the website, customer panel and database on the server in Türkiye | Art. 5/2(c) and (f); as data processor, on the Company’s instructions |
| Corporate email service provider (established in Türkiye; Türk Telekomünikasyon A.Ş. – Türk Telekom E-Posta) | Sending email verification and password reset codes and process and security notifications; receiving requests sent by email (sign-in codes are currently not sent by email) | Art. 5/2(c) and (f); as data processor |
| SMS service provider: Verimor Telekomünikasyon A.Ş. (MERSİS 0924048475300001) | Sending the one-time sign-in/verification code message to your mobile phone. Only your mobile phone number and the message text (code, purpose and information link) are passed to the provider; your name, email and account details are not. | Art. 5/2(c) and (f); as data processor, on the Company’s instructions (for the provider’s written statement see section 8) |
| Vehicle inspection firms, authorised services, notaries, towing/logistics firms | Organising the inspection, maintenance/repair, transfer of ownership and transport of the vehicle at your request | Art. 5/2(c) |
| Vehicle buyers, dealers, auction and listing platforms | Collecting offers for the sale of your vehicle. As a rule only information and photos about the vehicle are shared; your identity and contact details such as name and phone are shared only when necessary to complete the sale and with your approval. | Art. 5/2(c) |
| Google LLC / Google Ireland Ltd. (Google Analytics; only when enabled and with your consent) | Statistical analysis of website usage | Art. 5/1 explicit consent; for the transfer abroad Art. 9 KVKK (see section 8) |
| Financial adviser, independent auditor, legal adviser/lawyer | Accounting and tax obligations, audit, legal advice and management of disputes | Art. 5/2(a), (ç) and (e) |
| Competent public authorities, courts, the Personal Data Protection Authority | Fulfilling legal obligations and requests of competent authorities | Art. 5/2(a) and (ç) |
When working with data processors, it is ensured that data is processed only for the service and in line with the Company’s instructions, that confidentiality is protected and that the necessary security measures are taken. Within the Company, only authorised staff who need access for their duties can access the data, through role-based authorisation.
8. Transfers abroad
Our website, customer panel and database run on a server rented from Natro (Çizgi Telekomünikasyon A.Ş.) with Türkiye selected as the location; the server’s IP address is registered to Türkiye in the RIPE records. Our encrypted backups are kept on this server and at our office in Ankara. For our corporate email service, Türk Telekom’s official product page states that “Türk Telekom E-Posta” is hosted in a data centre within the borders of Türkiye (kurumsal.turktelekom.com.tr, 12 November 2026).
Making data accessible from abroad counts as a transfer abroad just as sending it to someone abroad does (Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, Art. 4/1-e). We have not yet received written confirmation from our hosting and email providers regarding access from abroad for support, maintenance and backup purposes or regarding their sub-providers; the information above and general product statements are not a contractual guarantee on these points. The Company therefore does not make a definitive statement that no transfer abroad takes place for these services. If a transfer is identified, the conditions of Art. 9 KVKK will be met and this section will be updated without delay.
Codes by SMS: Sign-in with a code is done by SMS to your verified mobile phone. In its written reply dated 12 November 2026, our SMS service provider Verimor Telekomünikasyon A.Ş. stated that the data processed for sending SMS (recipient number, message text, sending and delivery records) is processed only on systems in Türkiye, that there is no access to this data from abroad, including for support, maintenance and backup, that no sub-provider established abroad is used, and that messages are delivered through domestic operators (Turkcell, Vodafone, Türk Telekom Mobil). The provider also stated that its commitments as data processor and its breach notification obligations are set out in the “Privacy & Security” section of its website. This information is based on the provider’s written statement; the Company has not audited it separately. Automatic suggestion of the code on your phone (Android WebOTP / iPhone AutoFill) is a feature of your phone’s operating system; a code filled in automatically is, like a code typed by hand, sent to our server for verification. The Company does not send any additional data to Google or Apple for this feature.
Codes and notifications by email: Sign-in codes are currently not sent by email; password-free registration with an email code, linking an email address to the account with this new code method and account recovery to an email address are also currently not enabled. If you signed up with your mobile phone and an SMS code, you do not need to provide an email address. The email verification code for email-and-password registration, password reset codes, the code sent to the new address and the notice to the old address when you change your email in your profile, the information email for corporate employee invitations and process and security notifications continue to be sent by email. Our emails are delivered from our corporate email service to the email provider you use. The provider you use (e.g. Gmail, Outlook) may store the message on systems abroad or have support access to it from abroad; there the message is processed under your relationship with that provider. The Company does not choose your provider. If you do not want an email provider located abroad to access your messages, you can use, in your account, an email address with a provider operating in Türkiye.
Google Analytics: When Google Analytics is enabled on the website and only if you consent to analytics cookies, the cookie ID, IP address, device/browser information and page interactions may be transferred to servers of Google LLC abroad, including the USA. Google Analytics is currently not enabled. A signed contract and the required transfer safeguards for this service have not been verified; it will not be enabled until the conditions in Article 9 KVKK (e.g. the standard contract set by the Board and timely notification to the Authority) are met, and this notice will be updated before it is enabled. Because it concerns a continuous service, your consent to analytics cookies is not used on its own as the basis for a transfer abroad (Regulation Art. 16: exceptional cases apply only to incidental transfers). If you do not consent, no data is sent to Google.
If a service located abroad (e.g. a cloud, communication or software service) needs to be used in the future, the transfer will only be made when the conditions in Article 9 KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad are met: together with one of the processing conditions in Art. 5 or 6 KVKK, regular transfers require an adequacy decision or one of the appropriate safeguards (e.g. signing the standard contract announced by the Board without changes and notifying the Authority within five business days of the signatures being completed). Exceptional cases such as explicit consent may be used only for non-regular, one-off or occasional transfers (Regulation Arts. 6, 14 and 16). Onward transfers by a service provider to its sub-providers abroad are subject to the same conditions (Regulation Art. 5/2). This notice will be updated before the transfer begins.
If you click the “Get Directions” link or the social media (Instagram, X) icons on the website, you are redirected to the page of the relevant service; as this content is not embedded on our website, no data is sent to these services unless you click. After the redirection, your data is processed not by the Company but directly by the relevant service provider at your choice and under its terms.
9. Special categories of personal data
Within our services, data on health, biometric and genetic data, race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance and dress, membership of associations/foundations/trade unions, sex life, criminal convictions and security measures is not requested and not processed. Please do not include such data, or identity document details not needed for the transaction, in the documents and photos you upload; if necessary, cover them before sharing. If it is noticed that such data has been sent by mistake, it is deleted without delay if it is not needed for the service.
10. Retention periods and destruction
Personal data is kept for as long as necessary for the purpose for which it is processed and for the period provided for in the relevant legislation. When the period expires or the processing conditions cease to exist, the data is erased, destroyed or anonymised ex officio or at your request.
| Data | Retention period |
|---|---|
| Session key | At most 12 hours; invalidated immediately when you sign out |
| Email verification code / password reset code | Validity: 15 minutes / 10 minutes; only an irreversible hash is stored, not the code itself |
| One-time sign-in/verification code | Validity: SMS 5 minutes, email 10 minutes; single use. The code itself is not stored; its hash is deleted automatically 1 day after it is created. |
| Code delivery records (masked recipient, channel, purpose, status, provider transaction number) | 13 months, so that SMS costs, provider invoices and abuse complaints can be examined. Deleted automatically at the end of the period. |
| Code request and attempt limit records (hashed IP address and hashed recipient) | For the duration of the relevant limit (at most 24 hours); in any case deleted automatically after 3 days at the latest. |
| Verified phone and email | Same as the account details; when you change a detail, the old detail immediately stops being a sign-in method. |
| Account recovery records (new detail, reason, type of evidence and check note, administrator who opened the request and the one who verified the evidence, outcome) | A request with verified evidence is valid for 24 hours, a request awaiting evidence for 7 days; the record is deleted automatically after 13 months. The activity audit log is kept separately for 2 years. |
| Corporate membership and authority check records | Same as the account details |
| Delivery records at the SMS service provider | According to the provider’s (Verimor) written statement dated 12 November 2026: sending and delivery records can be accessed in the provider’s online transaction centre (OİM) for the last 1 year. Records older than 1 year are archived by the provider for periods ranging from 5 to 10 years, which the provider states are required by Electronic Communications Law No. 5809 and related legislation. These periods and their legal basis are the provider’s statement and have not been independently verified by the Company. |
| Account and sign-in details (name, verified email/phone, password hash, account preferences) | For the duration of the membership; after the account is closed, at most 1 year for possible complaints, account security reviews and responding to KVKK applications, then deleted. The account itself is not kept on the grounds of the general limitation period. |
| Identity and contact details contained in the documents of a completed transaction | Only together with the documents of that transaction and for the transaction period below; this period does not apply to the other data of the account. |
| Applications, offers, decisions, messages and documents of completed vehicle sale/purchase transactions | 10 years from the end of the year in which the transaction was completed: obligation to keep commercial books and documents (Turkish Commercial Code Art. 82) |
| Call-back requests, call notes added to them and the linked vehicle search record | 1 year from the date the request is closed; when the period ends, they are all erased automatically together and a record of the erasure is kept. If a call note was added or the linked vehicle search record was updated within the last year, erasure waits until there has been no activity for 1 year. If the request turns into a sale or purchase transaction, the applications, offers, contracts, invoices and documents of that transaction are kept as transaction records for their own period (see the relevant rows); this erasure does not affect them. |
| Vehicle search requests, vehicle preferences and call notes (person who calls us) | 1 year from the last action (call, status or detail change); erased automatically when the period ends, and a record of the erasure is kept. A record opened from a call-back request is erased together with that request (row above). A follow-up record linked to a purchase request a member opened in the panel follows the period of that request. |
| Applications that are not concluded or are withdrawn, and their photos/documents | 2 years from the date of the last action |
| Invoice, payment and accounting records | 10 years from the end of the relevant calendar year (Turkish Commercial Code Art. 82; Tax Procedure Law) |
| Visit statistics and on-site measurement | The irreversible code used to count a visitor once for the day and the daily key are deleted at the end of the day. Daily totals not linked to user accounts are kept in the database for 2 years; expired totals are deleted automatically even if the site is not visited. They may remain in backup copies for the backup period below; when a backup is restored, expired records are deleted again when the application starts. |
| Google Analytics data (if consent was given) | Analytics cookies remain in your browser for at most 2 years; event data in Google Analytics is kept for at most 14 months. When you withdraw your consent, analytics cookies are deleted from your browser. |
| Web server access logs (IP address, date/time, requested address, referring site, browser information) | Size-limited rotating log: at most about 50 MB is kept and the oldest entries are deleted when it is full; all of it is deleted when the server component is reinstalled. These logs are not backed up and are separate from the on-site measurement records. |
| Application activity (audit) and security logs | 2 years |
| Destruction records (date, record type, method, number of records deleted; no personal data) | At least 3 years; deleted automatically at the end of the period (Regulation on Erasure Art. 7/3) |
| KVKK applications and replies, records of presenting this notice | 10 years from the date the application is concluded or the relationship ends |
| Records of approval and refusal of commercial messages | For the period provided for in the relevant legislation after the approval ceases to be valid |
| Backups | Database and file backups on the server are kept for 14 days and deleted automatically. Encrypted backup copies are kept on the server, at our office and on the network storage device at the office as the latest 14 packages, and older ones are deleted automatically; as one package is usually produced per day, this covers about two weeks, and additional packages taken manually may shorten this period. There are also encrypted archive copies for October–November 2026; these will be deleted on 3 May 2027 at the latest. |
In case of a legal dispute, investigation or request by a competent authority, the relevant data may be kept until that process is concluded. Data whose retention period has expired, or for which all processing conditions have ceased to exist, is erased, destroyed or anonymised ex officio within three months at the latest after this occurs; if the Company becomes obliged to prepare a personal data retention and destruction policy and prepares one, this is done in the first of the periodic destruction cycles set in the policy, which may not exceed six months (Regulation on the Erasure, Destruction or Anonymisation of Personal Data, Art. 11). Your request for erasure or destruction is concluded within 30 days at the latest; if your data has been transferred to third parties, they are also notified (same Regulation, Art. 12). All destruction operations are recorded, and these records are kept for at least three years (same Regulation, Art. 7/3).
11. Data security
Under Article 12 KVKK, technical and organisational measures are taken to prevent unlawful processing of and unlawful access to personal data and to ensure its safekeeping, including:
- HTTPS encryption on all connections,
- storing passwords irreversibly hashed with a strong algorithm; a strong password rule,
- role-based authorisation (customer, staff, administrator); multi-factor authentication for administrator accounts,
- a secure, time-limited session cookie and limiting failed sign-in attempts,
- type and size checks on uploaded files; files accessible only to their owner and authorised staff,
- keeping activity and access logs, regular backups and storing backups in access-restricted environments,
- key-based access only to the server, security updates and periodic review of permissions,
- confidentiality obligations for staff and informing them about personal data protection,
- secure random generation of verification codes, short validity and single use, storing only a keyed hash rather than the code itself; an attempt limit per code and sending limits for the same number/address and the same IP; only Turkish mobile numbers accepted for sign-in with a code,
- a customer can change a phone or email detail only after re-verifying identity (with the password, or with a code within the last 15 minutes) and with a code sent to the new detail, and the old address is notified when the email changes; in account recovery, ownership evidence is checked by an administrator before any code is sent to the new detail; a password or email change made in the administration panel is written to the activity log, and the changed detail is not used for sign-in with a code until the customer verifies it again with a code; account details are never merged automatically; the same reply, which does not reveal whether an account exists, is given for an unregistered number/address,
- no automatic resending of a message when the SMS provider times out, and a daily/monthly sending cap for SMS.
If processed personal data is obtained by others unlawfully, under the Board’s decision dated 24 January 2019 No. 2019/10 the Board is notified without delay and within 72 hours at the latest of the breach becoming known; affected data subjects are notified within the shortest reasonable time after they are identified, directly if your contact address can be reached, otherwise by an appropriate method such as publication on our website. Our service providers (data processors) are obliged to notify the Company without delay of a breach occurring with them.
12. Automated decision-making
Price studies and offers for your vehicle are prepared after evaluation by our expert staff. No decision producing legal effects concerning you is taken solely through analysis by automated systems. Software tools may be used for analysis and reporting; however, the final assessment is made by a human.
13. Commercial electronic messages
Commercial electronic messages about campaigns, promotions and offers are sent only through a channel you have separately approved (email and/or phone/SMS) under Law No. 6563 on the Regulation of Electronic Commerce and related legislation, and where required only after registration in the Message Management System (İYS). Giving approval is not a condition of membership or of the service. You can withdraw your approval free of charge at any time from the Privacy and permissions screen in your account, through the opt-out link in messages or by writing to bilgi@bicarsolution.com.
Notifications required to provide the service, such as verification codes, password resets and application and offer status, are not commercial messages and do not require approval. No campaign or promotional content is added to verification code messages; entering a code does not count as approval of commercial messages.
14. Cookies and external links
No cookies for advertising or profiling are used on our website; fonts, maps or similar external resources are not embedded in the pages. When you sign in to your account, a strictly necessary session cookie is used. When Google Analytics or on-site measurement is enabled, your choice in the consent window (accept or reject) is remembered in a strictly necessary preference cookie. Your language preference is stored in your browser’s local storage only when you press the TR/EN button. On-site measurement uses no cookies or browser storage and runs only if you allow it; Google Analytics is currently not enabled. The “Reject” option is presented equally with “Accept”, and you can change your preference at any time through the “Cookie preferences” link at the bottom of the page. The number of visitors is also measured without cookies, only as totals, as explained in section 5. The full list of cookies and browser storage used is in the Cookie Policy.
15. Your rights under Article 11 KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data is processed,
- request information if your personal data has been processed,
- learn the purpose of processing your personal data and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your personal data is transferred,
- request correction of your personal data if it is incomplete or inaccurate,
- request erasure or destruction of your personal data under the conditions in Article 7 KVKK,
- request that the third parties to whom your personal data has been transferred be notified of the actions taken on your correction, erasure or destruction requests,
- object to a result against you arising from the analysis of processed data exclusively through automated systems,
- claim compensation for damage if you suffer damage due to unlawful processing of your personal data.
For processing based on explicit consent, you can withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing.
16. How to apply
You can send requests concerning your rights, under the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of the following methods:
- Customer panel: by signing in to your account and using the application form on the Privacy and permissions screen,
- Email: to bilgi@bicarsolution.com from the email address registered in our system, or signed with a secure electronic signature or mobile signature,
- Registered electronic mail (KEP): to bikaravan@hs01.kep.tr from your own KEP address (a KEP address can only receive messages from another KEP address; ordinary email does not reach it),
- In writing: by a petition with a wet signature, in person (your identity is verified only by showing an ID; no copy is taken), by registered post with return receipt or through a notary, to our address above.
Our phone number (+90 312 552 20 80) is for information only; applications concerning your rights are not accepted by phone and must be sent by one of the methods above.
Your application must contain: your name, surname and, for written applications, your signature; for Turkish citizens the T.R. identity number, for foreign nationals nationality and passport number or identity number if any; the residential or business address for notifications; if any, the email address, phone and fax number for notifications; the subject of the request. Information and documents relating to the subject are attached to the application. A copy of an identity document is not mandatory and is not requested for every application. If your identity cannot be verified with the information in the application, additional information may be requested to prevent your data being disclosed to unauthorised persons; in that case methods that do not require a copy are used first (e.g. confirmation from the email address registered in our system or showing your ID at the office).
Your application is concluded as soon as possible depending on the nature of the request and within 30 days at the latest, free of charge. If the reply is given in writing, no fee is charged for up to ten pages; a processing fee of 1 Turkish lira may be charged for each page above ten. If the reply is given on a recording medium such as a CD or flash drive, the fee may not exceed the cost of the medium. If the application arises from an error by the Company, any fee charged is refunded. The application may be accepted or rejected with reasons; the reply is notified in writing or electronically.
17. Right to complain to the Board
If your application is rejected, you find the reply insufficient or no reply is given in time, you may complain to the Personal Data Protection Board within 30 days of learning of the reply and in any case within 60 days of the application date (Art. 14 KVKK). Before complaining to the Board, you must first apply to the data controller.
18. Data of third parties
If you share personal data of another person in an application, message or document (e.g. a different registered owner of the vehicle, another employee of a corporate customer), the Company is also the data controller of that data and the obligation to inform that person lies with the Company. The Company informs that person by referring them to this notice within a reasonable time after the data is obtained, at the first communication with the person or at the first transfer of the data, whichever comes first. Third-party data not needed for the transaction is not kept and is deleted when noticed.
We ask you not to share third-party data that is not needed for the transaction and, where possible, to pass on the link to this notice to the person concerned. This request does not remove the Company’s own obligation to inform.
19. Changes
This notice is updated before the change takes effect when the categories of data processed, purposes, legal grounds, service providers or transfer conditions change, and the current version is published on this page. Which version of the notice was presented to you and when is recorded; earlier versions are kept as evidence.
Changes in version 3.6: the purchase-potential assessment that our team sets manually to prioritise vehicle search requests, and the closing date and reason of a request, were added to the “Call and request follow-up records” category; following up the request was added to the call-back purpose. Earlier versions are kept as evidence.
Changes in version 3.5: password-free sign-in with a code (by SMS to a verified mobile phone; codes by email currently not enabled); verified sign-in details, two-step account recovery and corporate membership data categories and purposes; the SMS service provider; use of verification codes only for verification; record of acceptance of the Membership Terms; related retention periods and security measures; application by KEP; the statement on providers in Türkiye made subject to confirmation; clarification of transfers abroad and destruction periods according to the current texts of the relevant regulations; reference to the Board decision on breach notification; an explicit statement that an automatically filled code is also sent to the server for verification; no definitive statement on transfers abroad until provider confirmation, and consideration of the recipient’s email provider; the Company’s own obligation to inform third parties; a copy of an ID not being mandatory for applications; retention periods of account data separated by data type and purpose (the general limitation period no longer used as a reason); Verimor’s MERSİS number; the Company’s KEP address; the provider’s official product statement on where the email service is hosted; the server’s Türkiye location; processing location, access from abroad, sub-providers and retention for SMS based on the provider’s written statement of 12 November 2026 (1-year access in the panel and 5–10-year archiving stated separately); reference to rights under Art. 11 by name rather than by letter.
For questions, contact us at bilgi@bicarsolution.com or by writing to our address above.