Last Updated: 30 August 2026
1. Data Controller
Within the scope of the Personal Data Protection Law No. 6698 ("KVKK"), in its capacity as data controller in the course of operating the TripsControl platform:
SAS Grup Yazılım Reklam Ltd. Şti.
VKN: 7521063650
Address: Kızılırmak Mah. 1443 Cad. No: 25 B, İç Kapı No: 8, Çankaya / Ankara
Phone: 0532 688 42 95
E-mail: [email protected]
(the "Company" or "TripsControl") processes your personal data within the scope and for the purposes explained below.
This Information Notice is addressed to natural persons who visit the TripsControl website, create an account, start a free trial, use a paid subscription, are authorised as users under a company account, or contact TripsControl.
2. Categories of Personal Data Processed
Depending on the nature of your relationship with TripsControl, the following personal data may be processed.
Identity Data
Name, surname, position/title and information showing your relationship with the company account.
In sole proprietorships, or where required by legislation, tax identification data may also be associated with a natural person.
Contact Data
Telephone number, e-mail address and support or correspondence records maintained with the Company.
Customer and Company Data
Company title, tax number, tax office, company address, business and subscription information, and information regarding authorised persons.
Although information belonging to a legal entity does not in itself constitute personal data, it may be processed as personal data to the extent that it can be associated with natural persons.
Account and Transaction Security Data
User account, user identifier, authorisation/role information, session information, IP address, login and logout records, transaction records, security records and similar technical records.
Subscription and Payment Data
Subscription plan, payment status, invoicing and collection information, payment transaction references, the number of chargeable vehicles and subscription movements.
Where the processing of credit/debit card information is necessary, payment transactions may be carried out through the infrastructure of authorised banks or payment institutions.
TripsControl does not store sensitive payment verification data such as the card security code (CVV/CVC) in its own systems to the extent that this is not necessary for the provision of the service.
Request and Support Data
Support requests, error reports, information transmitted to TripsControl via e-mail or other communication channels, and the transaction records relating thereto.
Legal Transaction Data
Contract acceptance records, records showing that the KVKK information notice was presented, date/time, the version of the relevant text, technical verification records and, in the event of a legal dispute, the relevant records.
3. Purposes of Processing Personal Data
Your personal data may be processed;
- for the creation and management of the TripsControl account,
- for the verification of identity and company information,
- for the provision of the SaaS service,
- for carrying out subscription and charging transactions,
- for conducting payment and collection processes,
- for invoicing and the creation of financial records,
- for the provision of customer support services,
- for the management of user authorisations and account security,
- for the prevention of unauthorised access and misuse,
- for ensuring system security and detecting technical errors,
- for the operation of TripsControl features,
- for carrying out requested integrations,
- for the fulfilment of legal obligations,
- for responding to lawful requests from authorised public institutions and organisations,
- for the exercise and protection of rights in legal disputes,
- for improving the performance, security and availability of the service
for the purposes set out above.
It is essential that the purposes of processing be specific, explicit and legitimate; vague or forward-looking general purposes have not been included in this text.
4. Legal Grounds for the Processing of Personal Data
Your personal data may be processed on the basis of the legal grounds set out in Article 5 of the KVKK that are applicable to the relevant processing activity, namely;
- that the processing is directly related to the conclusion or performance of a contract,
- that the processing is mandatory in order for the data controller to fulfil its legal obligation,
- that the processing is mandatory for the establishment, exercise or protection of a right,
- and that the processing is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed
the legal grounds set out above.
In specific cases where a processing activity must be based on explicit consent, such explicit consent is requested separately from this Information Notice.
The fulfilment of the obligation to inform is not dependent on the data subject giving explicit consent.
5. Method of Collecting Personal Data
Personal data may be obtained;
- through the TripsControl website and web application,
- registration and subscription forms,
- the user account and management panel,
- payment and subscription transactions,
- e-mail, telephone and customer support channels,
- integrations,
- cookies and similar technical mechanisms,
- system, server, security and transaction records
by wholly or partly automated means, or by non-automated means provided that they form part of a data recording system.
6. Groups of Recipients to Whom Personal Data May Be Transferred
Your personal data may be transferred to the following groups of recipients only to the extent necessary for the provision of the relevant service and in accordance with the conditions laid down in Articles 8 and 9 of the KVKK.
Banks and payment institutions: For the purpose of collecting subscription fees, carrying out payment transactions, and conducting refund and payment security processes.
Electronic communication and SMS service providers: For the purpose of providing verification, operational notification, system notification and the communication services requested by the Customer.
Hosting, server, data centre and IT infrastructure providers: For the purpose of operating TripsControl systems, hosting and backing up data, and ensuring their security and continuity.
Map, location, flight and other integration providers: For the purpose of operating the relevant TripsControl function used by the Customer, and limited to the data that is necessary.
Authorised public institutions and organisations: For the purpose of fulfilling legal obligations or responding to lawful requests from competent authorities.
Legal, financial and technical service providers: For the purpose of carrying out accounting, legal, audit, information security and technical support activities, and to the extent necessary.
7. Transfer of Personal Data Abroad
Where the infrastructure of certain IT, cloud, communication, security, map, flight or other technology services used by TripsControl is located abroad, or where service providers process data abroad, personal data may be transferred abroad.
In such cases, personal data are transferred in accordance with Article 9 of the KVKK and the legislation in force regarding the transfer of personal data abroad.
Depending on the nature of the transfer, whichever is appropriate of the legal mechanisms provided for in the KVKK, such as adequacy decisions or appropriate safeguards, and in particular the standard contracts published by the Board, may be used.
In exceptional cases where the required legal transfer mechanism is not available but the KVKK permits the transfer, the transfer is carried out only within the framework of the conditions provided for in the legislation.
8. Passenger, Driver and Operation Data Entered by TripsControl Customers
TripsControl customers may enter into the platform, within the scope of their own commercial activities;
- passenger name and surname,
- telephone and contact details,
- flight and reservation information,
- pick-up and drop-off points,
- driver information,
- vehicle information,
- operation information
and similar data.
In respect of such data, where the TripsControl customer determines the purposes and means of the processing, the relevant Customer acts as data controller, while SAS Grup Yazılım Reklam Ltd. Şti. may act as data processor providing services on behalf of the Customer and in accordance with its instructions.
The TripsControl Customer is responsible for obtaining the personal data it transfers to the system lawfully, for duly informing the relevant data subjects, and for ensuring that the necessary data processing conditions are met.
TripsControl, for its part, processes such data on behalf of the Customer for the purposes of providing the SaaS service, storing the data, ensuring its security, backing it up, and performing the functions requested by the Customer.
The status of data controller/data processor arises not from the designation used by the parties in the contract, but from who in fact determines the purposes and means of the specific data processing activity.
For this reason, SAS Grup may separately act as data controller in respect of the account management, invoicing, security or legal compliance operations that TripsControl carries out for its own purposes.
9. Retention of Data
Personal data are retained for the period necessary for the relevant processing purpose, taking into account the statutes of limitation, preservation periods and statutory retention periods provided for in the applicable legislation.
When the processing purpose and the legal retention obligation cease to exist, personal data are deleted, destroyed or anonymised in accordance with the relevant legislation.
The termination of a subscription does not in itself mean that all records which must be kept for legal, financial or security purposes will be deleted at the same time.
10. Data Security
TripsControl takes technical and administrative measures appropriate to the nature of the processing activity in order to prevent the unlawful processing of and unlawful access to personal data, and to ensure that personal data are kept securely.
In this context, security measures such as access authorisation, record/log mechanisms, secure communication methods, backup, access controls and similar measures may be applied.
11. Your Rights under the KVKK
Data subjects have the rights set out in Article 11 of the KVKK.
In this context, you may exercise your rights to learn whether your personal data are being processed, to request information if they have been processed, to learn the purpose of the processing and whether the data are used in accordance with that purpose, to request rectification or erasure under the conditions provided for in the legislation, and to exercise your other rights under the Law.
You may submit your applications:
SAS Grup Yazılım Reklam Ltd. Şti.
Kızılırmak Mah. 1443 Cad. No: 25 B, İç Kapı No: 8
Çankaya / Ankara
to the address above, or
to the e-mail address above, by the methods provided for in the relevant legislation.
Applications are assessed within the periods and in accordance with the procedures provided for in the KVKK and the relevant legislation.
12. Changes to the Information Notice
In the event of a change in TripsControl's personal data processing activities, this Information Notice may be updated.
In the event that the purpose of processing personal data changes or a new processing activity is commenced, the necessary information is provided before the relevant data processing activity takes place.
The current text is published on the TripsControl website and/or application.