Privacy Policy and Data Protection (KVKK) Notice

Data controller: [Legal Title] (“bagaj”), [Address], [MERSİS/Tax No]. Contact: destek@bagaj.app, [Registered e-mail (KEP)].

We process only the data needed for the service, following the data-minimization principle:

• Customer: full name, phone, e-mail and booking details (spot, date/time, number of bags, booking code).
• Business representatives: full name, phone, e-mail and business details.
• The photo of the sealed bag taken by the Business at drop-off.

Because payment is made at the shop, bagaj does not process credit-card or bank-account data. No special-category personal data (health, religion, biometric data, etc.) is processed.

Your personal data is processed for the following purposes on the legal bases indicated:

• Creating the booking and matching you with the Business — performance of a contract (KVKK Art. 5/2-c).
• Booking confirmation, reminders and service-related notification e-mails — performance of a contract and legitimate interest (Art. 5/2-c and f).
• Commission invoicing to the Business and accounting/tax obligations — legal obligation and performance of a contract (Art. 5/2-ç and c).
• Security, fraud prevention and keeping the drop-off photo record — legitimate interest (Art. 5/2-f).
• Responding to legal requests and resolving disputes — legal obligation and establishment/protection of a right (Art. 5/2-ç and e).
• Only where you separately give explicit consent: marketing and commercial electronic messages — explicit consent (Art. 5/1).

Your personal data is collected through the booking form on our website and app, by wholly automated means and in electronic form.

Your personal data may be shared, limited to the purpose, with:

• the BUSINESS that actually provides the service — to perform the storage service;
• Supabase (USA) for hosting/infrastructure and Resend (USA) for transactional e-mail;
• competent public authorities where legally required.

Because Supabase and Resend are located abroad, your personal data is transferred abroad. Under KVKK Art. 9 — as there is no adequacy decision — this transfer relies on appropriate safeguards, primarily the standard contract published by the Board; other legal grounds under the Law may be relied on where necessary.

Your data is retained for as long as the processing purposes require and as prescribed by applicable law (e.g. tax and contract law); at the end of that period it is deleted, destroyed or anonymized. bagaj applies a Retention and Destruction Policy.

Under KVKK Art. 11 you have the right to: learn whether your data is processed and request information about it; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred at home or abroad; request correction of incomplete or inaccurate data; request erasure or destruction where the conditions are met; request that these actions be notified to third parties to whom the data was transferred; object to results arising against you from automated analysis; and claim compensation for any damage suffered.

You may submit requests regarding your rights to destek@bagaj.app or [Registered e-mail (KEP)]. Your request will be concluded within 30 days at the latest and, as a rule, free of charge.

For information about the cookies used on our website, please see the Cookie Policy.

This notice may be updated; the current version is published on the Platform and takes effect on its effective date.