Privacy Policy

Most of this fits in three sentences. We never see a driving licence, a passport or a card number, because those are typed into a supplier's checkout rather than into any page we control. What does travel through drivecappadocia.com is a handful of dates and place names, a server record, and whatever anybody chooses to put in an email to us. The section that genuinely repays attention, for a visitor living in the European Union who intends to collect a car in Turkey, is the one on transfers further down.

The controller, and the one address that reaches us

Drive Cappadocia, registered in Nevşehir, decides why and how everything described below is handled, which makes it the controller of it. Correspondence has exactly one route, [email protected]. No telephone line has ever existed for this brand and no postal desk is staffed. The moment a visitor crosses onto a supplier or booking partner checkout, that company takes over as controller for everything entered there, and its policy replaces this one from that point.

The short list of what passes through this site

First, a search. Picking a collection point, a return point and two dates produces a request to our booking technology partner carrying those values and nothing more, with no name and no identifier for the person asking. The reply is parked briefly inside the visitor's own browser so that stepping between pages of this site does not repeat an identical lookup a second and a third time. Second, a server record of the kind any web server keeps: the originating address, the browser and device, the referring page, the pages opened. Third, email, which stays in the thread it arrived in, along with whatever the sender decided to include.

What stays with the supplier and never arrives here

Licence numbers, International Driving Permit details, passport and identity card data, dates of birth, home addresses and card numbers are collected on the supplier or partner checkout, running on their infrastructure. None of it reaches Drive Cappadocia at any stage, which means we could not produce a copy however the request were worded. There is a practical consequence worth spelling out: a renter who wants to know what a rental company in Nevşehir or Kayseri is holding on them has to ask that company, and the most we can do is work out which company it is.

The legal ground under each of those

A search runs because a visitor asked for it, which is at once a step taken at their request ahead of any contract and our own legitimate interest in operating a service that works. A reply to an email rests on the same pair. Server records exist to keep the site standing and to notice abuse, a security interest weighed against the very limited detail involved. We run no advertising, assemble no profiles and operate no visitor-level measurement product, so nothing here depends on a consent that would have to be gathered behind a banner first.

An EU resident renting in Turkey: where the data goes

Turkey lies outside the European Economic Area and carries no adequacy decision from the European Commission, so anything reaching a Cappadocia supplier has left the territorial protection of EU law. Two different movements deserve separating. The first is ours and it is small: hosting and content delivery providers act as processors on our instructions, and where their equipment stands beyond the EEA that arrangement runs on the European Commission's standard contractual clauses under Article 46 of the GDPR.

The second is the movement a renter should actually think about. No supplier in Göreme or Ürgüp can release a car without receiving the booking details, which puts that transfer under the derogation at Article 49(1)(b) of the GDPR, covering a transfer necessary for a contract entered into at the request of the individual concerned. From the moment those details land, Turkish data protection law governs them, with its own rights of access and correction that are exercised against the supplier rather than against us. Reading these pages triggers none of that. The transfer happens at the booking step, so a visitor determined to keep their details inside the EEA should stop before it.

The parties that see anything at all

The list runs to three. Our booking technology partner, which is the source of live cars and live prices. The supplier a visitor chooses, because somebody has to put a key in a hand. The hosting provider and content delivery network that carry the traffic and absorb attacks. Nobody on that list may reuse what we send for their own marketing. Nothing is sold, nothing is traded, and no advertising network is embedded in any page here, so there is no quiet fourth party collecting alongside us.

Retention, in plain numbers

A cached search expires five minutes after it is written, and no more than four exist at once, the oldest being dropped as a new one arrives. Server records rotate on an operational cycle counted in days. An email exchange lasts while the trip it concerns is live and for a short stretch afterwards, in case the same person writes again about the same booking, and then it goes. Nothing is retained on the theory that it might turn out interesting later.

Rights you can exercise against us

Anyone protected by the GDPR, or by a law of equivalent reach, holds every right below. Send the request to [email protected]. We aim to reply inside a calendar month, at no charge, and we will not ask what prompted it.

The limit of what we can do for you

A right only reaches records that exist, and ours are thin. A licence scan, a signed agreement, a photograph of a scratch or the trace of a deposit sits with the supplier that ran the hire, and the request has to be addressed there. What we can do is read a confirmation, identify the supplier and the booking partner behind it and send their contact details back, which is usually the part that takes a renter longest to establish alone. We cannot compel another company to answer and we cannot answer in its place.

Security, and who these pages are not for

Traffic to and from this site is encrypted throughout, and the handful of records in existence can be opened only by the people who keep the service running. Nobody can honestly call anything on the internet perfectly safe, so read that as a standard of care rather than a promise of invulnerability. Since nobody hires a car here without a full licence, this site has no reason to attract or to hold anything concerning a child. If something of that kind reached us regardless, say so and the record will be taken out.

When this page is rewritten

A new tool that touches visitor data, a change of partner, or a shift in the law covering transfers to Turkey each cause this page to be rewritten and the date at the top to move with it, before the change goes live. Individual notice is not sent to anybody, so the text published at the moment of a visit is the text that applies to that visit.

Ask about your own records at [email protected]. For browser storage see the Cookie Policy, and for who is party to what see the Terms and Conditions.