Privacy policy

Who we are

gokarvan.com ("gokarvan", "we") is operated by RATE EXTRA TOURISM L.L.C, Commercial Licence 1253634, Dubai, United Arab Emirates. We are the data controller for the personal data described in this policy. You can reach us at support@gokarvan.com or on WhatsApp at the number shown in the footer.

What we collect

• Booking data: names of all passengers, contact email and phone, flight numbers, pickup and drop-off addresses, dates and times, vehicle choice, notes you add, and the booking reference.
• Payment data: payments are processed by Stripe. We receive the payment status, the last four digits of the card and the card brand. We never store full card numbers.
• Agency data: for partner agencies, company details, contact persons, bank details for payouts, commission and ledger records.
• Technical data: IP address, browser and device information, pages visited and the language you chose, collected through server logs and the cookies described in our Cookie Policy.

Why we process it

• To price, book, operate and support your transfer (performance of a contract). Passenger names are required by Turkish transport regulations.
• To send booking confirmations, vouchers, invoices, changes and cancellations (contract).
• To pass the details the operator needs — names, phone, flight number, addresses, times — to the licensed transfer supplier operating your journey and to our distribution partner that connects us to suppliers (contract).
• To detect and prevent fraud and to protect our service (legitimate interest).
• To comply with tax, accounting and legal obligations (legal obligation).
• To improve the website using aggregated statistics (legitimate interest), and, where you consent, analytics cookies.

Who receives your data

• The licensed transfer operator assigned to your booking and the operations staff who coordinate it, including contact by WhatsApp when you choose to use it.
• Our distribution partner through whose system transfers and eSIM packages are booked.
• Stripe (payments), our hosting provider, our email delivery provider and Google Maps (address search and route display).
• Authorities where required by law.

Some recipients are outside the European Economic Area, including in Türkiye and the United Arab Emirates. Where EU/UK data protection law applies, we rely on standard contractual clauses or the recipient's adequacy status.

How long we keep it

Booking, invoice and ledger records are kept for 10 years to meet accounting and tax obligations. Search sessions are deleted within 24 hours. Server logs are kept for up to 90 days. Agency application data is deleted 12 months after a decision if no account is opened.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, to restrict or object to processing, and to withdraw consent. See our GDPR page for how to exercise these rights. You may complain to your local supervisory authority.

Security

Data is transmitted over TLS, stored on access-controlled infrastructure, and card details never touch our servers. Access to booking data is limited to staff who need it to operate your transfer.

Children

Our services are booked by adults. We process children's names only as passenger details supplied by the adult making the booking.

Changes

We may update this policy. The date of the latest version is shown at the top of the page.