Navigo Yolcu Privacy Notice (KVKK)

Version: 1 November 2026

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) to people who use the Navigo Yolcu mobile app (“passenger”, “you”). It explains which data we process, why and how. It is an information notice, not a consent form. The only processing based on optional explicit consent is described separately in the Explicit Consent Notice. The Turkish version prevails.

1. Data controller

Name: Mest Yazılım ve Bilişim Teknolojileri (Navigo brand)
Address: Hürriyet Mah. Atatürk Blv. Altan İş Merkezi No:48/9 Altınova / Yalova, Türkiye
Email: info@navigo.com.tr
Phone: +90 850 532 6378

Navigo Yolcu shows passengers the routes, stops, trips and live vehicle positions of public transport operators (“operator”). Navigo is the controller of your passenger account. The operator is a separate company that provides the ride; it receives the data in section 6 only when you tap “I’m waiting”.

2. Personal data we process

Identity: first and last name; optional username.
Contact: mobile phone number; optional email address.
Account and security: a one-way hash of your password (the password itself is never stored), SMS verification code and attempt count, sign-up and last sign-in time, account status, the version and time of the notices you read, the time of optional explicit consent, session key.
Location: if you allow it, your device location while the app is open. The app does not collect location in the background.
Trip data: destinations you search, chosen route and stop, “I’m waiting” records (stop, your location at that moment, destination summary, start and end time), notes to the driver.
Requests and complaints: requests, suggestions, complaints and bug reports sent through “Contact us”, attached photos or screenshots, and our replies.
Device and technical data: push notification token and platform, device brand and model, OS and app version, IP address, request time, error and crash logs (recent screens, route name, error message).
Kept only on your device: recent searches, favourite places, city/operator selection and theme stay on your phone and are not sent to our servers.

No special categories of data are processed. Face ID or fingerprint works through your phone’s own lock; biometric data never reaches Navigo.

3. Purposes and legal bases

Account creation, sign-in, SMS verification, password reset, profile: establishment and performance of a contract (KVKK Art. 5/2-c).
Showing nearby stops, routes, timetables, live vehicle positions and arrival times; finding a route to your destination: performance of a contract (Art. 5/2-c). Location is used for this purpose and only with your permission.
Passing your “I’m waiting” record to the route’s driver and operator, notifying you when the vehicle approaches and asking whether you are still waiting: performance of a contract (Art. 5/2-c).
Notifying route announcements (delay, cancellation, last trip) and replies to your messages: performance of a contract (Art. 5/2-c).
Receiving, answering and recording requests and complaints: performance of a contract (Art. 5/2-c) and establishing, exercising or defending legal claims (Art. 5/2-e).
Information security, preventing abuse and excessive requests, fixing errors and crashes, service continuity: legitimate interest, provided it does not harm your fundamental rights (Art. 5/2-f).
Requests of competent authorities and courts and legal obligations: legal obligation (Art. 5/2-ç).
AI route search (OpenAI) when no route is found: only with your separate explicit consent for that search (Art. 5/1 and Art. 9). The location and place text Navigo received are sent only as data, without any notice that they belong to you; OpenAI does not process them as tied to a person.
Google place search when no place is found: only with your separate explicit consent for that search (Art. 5/1 and Art. 9). Identity is not sent the same way; Google does not process the query as tied to a person. Each consent is optional; one does not enable the other; refusing or withdrawing either does not affect any other feature.

Your data is not used for advertising, marketing or profiling, and is never sold or rented.

4. How data is collected

Electronically: from what you enter in the app, automatically from your device when you grant location and notification permissions, during SMS verification, and during communication between the app and our servers.

5. Where data is processed

Account, trip and message data is stored on our servers in Türkiye. Address and place search, routing and technical monitoring also run on software hosted on our own servers. When an AI search runs, the location at that moment, the destination coordinates, the place name and your internal account number are written only to this monitoring log. Your name, phone number and email are not written there. The log and your account number do not leave Türkiye. The message sent to OpenAI and Google has no account number; only the location and place text go, without any notice of who they belong to. The log’s purpose is to see errors and the cost of the call.

6. Recipients

Operator and its drivers: only when you tap “I’m waiting” and while the wait lasts; the initials of your first and last name (e.g. “A**** Y****”), stop, your location at that moment, destination summary, waiting time and your note. Your phone number, email and other account data are not shared.
SMS provider (Türkiye): phone number and code, to send the verification code.
Notification infrastructure (abroad): push token and notification text are sent via Expo (650 Industries, Inc., USA) to Google Firebase Cloud Messaging (Android) or Apple Push Notification Service (iOS).
Map infrastructure (abroad): on Android the map is drawn with Google Maps. On iOS the default is Apple Maps; if the Google Maps app is installed you can also select Google from the menu. When map tiles load, the selected provider sees your IP address and the visible area. When you choose walking directions, the destination coordinates and place name go to the map app you pick: Apple Maps or Google Maps on iOS, Google Maps or another map app on Android.
App update infrastructure (abroad): updates are downloaded via Expo, which receives IP address, platform and app version.
AI search (abroad, only with OpenAI consent): OpenAI, L.L.C. (USA). The location Navigo received from you is sent only as data, without any notice that it belongs to you. See the Explicit Consent Notice.
Google place search (abroad, only with Google consent): Google LLC (USA). The same location is sent only as data, without any notice that it belongs to you. See the same notice.
Competent public authorities and courts: where legally required, to the extent requested.

The adequacy sentence below is only about notifications, maps and updates. The AI and Google place searches are not part of it; identity is not sent there. Those transfers are the two items above.

Notification, map and update transfers repeat on every use, because the app needs them to work. They therefore do not rely on the occasional-transfer exception in KVKK Art. 9/6. They are not a condition of explicit consent either; without this infrastructure the account, map and notifications cannot work and they cannot be turned off separately in the app. You can turn off location and notification permission in your phone settings. These transfers can include the device IP address or the push token. The United States has no adequacy decision from the Board; this technical data may not be protected to the same level as in Türkiye and may be accessible to that country’s public authorities. The legal basis for the transfer abroad is an appropriate safeguard under KVKK Art. 9/4. The type of safeguard is the standard contract published by the Board. This notice does not say the transfer is already covered by that safeguard until the contract has been notified to the Board. Transfers are limited to the purpose.

7. Retention

SMS verification codes: 24 hours.
“I’m waiting” records and driver notes: at most 30 days after the wait ends.
AI search counters: 30 days.
AI monitoring log (location, destination, place name, internal account number): 30 days.
Server, error and website access logs (IP address, request time, page requested): 30 days.
Requests, complaints, bug reports and attachments: 2 years after the last action, or until your account is deleted, whichever is earlier.
Account data and push token: while your account is open. If you do not open the app for 2 years, your account and related data are deleted automatically.
On-device data: on your phone until you delete the app or sign out.

Expired data is deleted automatically every night in line with the Turkish Regulation on Deletion, Destruction or Anonymisation of Personal Data.

8. Deleting my account

You can delete your account and personal data at any time, without giving a reason and free of charge.

In the app:

Tap Hesabımı sil (Delete my account) in the menu or under Profile.
Read what will be deleted and tick “I understand my account and data will be permanently deleted”.
Tap Hesabımı kalıcı olarak sil (Delete permanently) and confirm. Deletion is immediate and you are signed out.

If you cannot access the app: email info@navigo.com.tr with the subject “Account deletion” and your registered phone number. We may send a code to that number to confirm your identity; the request is completed within 30 days at the latest.

What is deleted:

your account, phone number, name, email, username and password hash,
“I’m waiting” records and notes to drivers,
“Contact us” messages, attached photos and screenshots, and our replies,
push token, verification codes, AI search counter, AI and Google search consent choices; your AI monitoring log is removed when the account is deleted, any remainder is deleted within 30 days at the latest,
recent searches, favourite places and session data on that phone.

Good to know: deletion cannot be undone. An ongoing wait is cancelled. You can sign up again with the same number, but old records will not come back. Server security logs are deleted on their own within 30 days. Uninstalling the app does not delete your account.

9. Your rights (KVKK Art. 11)

You may ask Navigo to:

tell you whether your data is processed and, if so, give information about it,
tell you the purpose of processing and whether data is used accordingly,
name the third parties in Türkiye or abroad to whom data is transferred,
correct incomplete or inaccurate data,
delete or destroy data under the conditions of KVKK Art. 7,
notify corrections and deletions to third parties who received the data,
object to a result against you arising solely from automated analysis,
compensate damage caused by unlawful processing.

You can also withdraw explicit consent at any time in the Profile screen or by the means below.

10. How to apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, send your request in writing, stating your name, your phone number registered in the app, your request and a contact detail:

by a wet-signed letter delivered in person or via a notary to Hürriyet Mah. Atatürk Blv. Altan İş Merkezi No:48/9 Altınova / Yalova, Türkiye,
with a secure electronic or mobile signature, or from the email address registered in the app, to info@navigo.com.tr.

We may send a verification code to your registered phone number to confirm your identity. We answer free of charge within 30 days at the latest; if the action has an extra cost, the tariff set by the Board may apply. If your request is rejected, the answer is insufficient or we do not answer in time, you may complain to the Turkish Personal Data Protection Board.

11. Children

The app is not designed for children under 13. If you notice that a child under 13 has created an account, contact us and we will delete it.

12. User content

The app has no public profile, post or community. A “Contact us” message and photo go only to Navigo support. A note to the driver goes only to that driver and the operator, and only while you are waiting. This is not a publication space.

If a work is yours and you see it in the app, email info@navigo.com.tr with the subject “Copyright notice”. Describe the work, where it appeared in the app, and how we can reach you. When the notice arrives, Navigo deletes that “Contact us” message and its files from the server. A note to the driver is deleted with the waiting record within 30 days; you can ask for earlier deletion at the same address.

For unlawful content, use the same address with the subject “Unlawful content”. The same removal applies.

Notice under Law No. 5651: Hosting provider Mest Yazılım ve Bilişim Teknolojileri (Navigo), Hürriyet Mah. Atatürk Blv. Altan İş Merkezi No:48/9 Altınova / Yalova, info@navigo.com.tr, +90 850 532 6378. Unlawful content and copyright notices are received through these channels.

13. Changes

When this notice changes, the version date is updated. For material changes the app shows the new notice again at start-up.