1. Scope and responsible parties
This policy applies to the Güventur Veli Bilgilendirme mobile app (the “App”) and to this website. The App supports the school bus (student transport) service that Güven Turizm provides in Istanbul.
- Data controller: Cem Berke Akpınar, trading as Güven Turizm (a sole trader; “Güven Turizm” in this policy). Güven Turizm decides which data is processed and for what purpose.
- Data processor: Webinen. Webinen develops the App and operates it on behalf of Güven Turizm, processing personal data only on Güven Turizm’s instructions and only to provide the service.
Yeşilbağlar Mah. Eğitim Sk. No:43/1, Pendik, İstanbul, Türkiye
Email: serhatcelikyazilim@gmail.com
This policy also serves as the English version of our information notice under Turkish Personal Data Protection Law No. 6698 (“KVKK”). The Turkish KVKK Aydınlatma Metni is the authoritative text.
2. How accounts are created
There is no public sign-up. Parent, driver, attendant and manager accounts are created by Güven Turizm’s transport management team. You sign in with the username or phone number you were given and your password. The App never asks for your email address.
3. Data we process
| Whose data | Data |
|---|---|
| Parents | Full name and phone number; notification preferences; notes you leave for the attendant and messages you send to the bus team; absence marks (which mornings or afternoons your child won’t ride, plus any note you add). |
| Students | Provided by the parent or the school: full name, school, bus stop address and its map coordinates, an optional photo, bus assignment, and boarding, drop-off and “didn’t board” records with their times (including a short explanation written by staff for “didn’t board”). |
| Drivers and attendants | Full name, phone number, an optional photo, whether they work as a subcontractor, and device location during a trip. |
| All users | User ID and username; password (never stored in plain text — only as an irreversible hash); a device notification token (push token) used to deliver notifications; in-app notifications sent to you; in-app activity records (for example, which user marked which student as “boarded”), kept for security and accountability. |
Most of this data is entered by the management team when your account is created; the rest is generated as you and the bus team use the App.
4. Location data
- Location is collected only from drivers’ and attendants’ devices, only while a trip is active, roughly every 5 seconds. Sharing continues while the App is in the background during a trip, which is why staff are asked for background location permission. On Android, a “Güventur servis takibi” notification is shown for as long as this is happening.
- Location sharing stops when the trip ends.
- Parents’ location is never collected. The map on the parent screen shows the bus position and the student’s stop.
- The live bus location can be seen only by parents of students assigned to that bus, the staff assigned to it and authorised managers.
- When a manager picks the school location or a stop address on the map, the device location may be used once, with permission, to centre the map. It is not stored as a personal location history.
5. Data we don’t collect
The App uses no advertising identifiers, no analytics or user-tracking tools and no crash-reporting SDKs. It does not collect contacts, health or financial data. There are no ads in the App; your data is never sold or used for advertising, and the App does not track you across apps or websites owned by other companies.
6. Why we process data
- To show parents the live bus location and estimated arrival time;
- to send trip start, approaching, boarding, drop-off and arrival notifications;
- to plan bus routes;
- to let the bus team and management know about absences;
- to keep accounts secure and maintain activity records;
- to answer support requests and data protection requests.
7. Legal bases
Personal data is processed on the following grounds under Article 5 of the KVKK:
- it is necessary for entering into or performing the contract for the school bus service (Art. 5(2)(c));
- it is necessary for the controller to comply with a legal obligation (Art. 5(2)(ç));
- it is necessary for the controller’s legitimate interests — security, accountability and record-keeping — provided your fundamental rights and freedoms are not harmed (Art. 5(2)(f));
- your explicit consent where consent is required, such as for an optional photo (Art. 5(1)). You can withdraw consent at any time, and the related data will then be deleted.
8. Children’s data
The App is not designed for use by children and there are no student accounts. Students’ data is provided by a parent or legal guardian, or by the school, and is processed only to provide the school bus service. A student’s data can be seen only by their parent, the driver and attendant assigned to their bus and authorised managers.
9. Storage and service providers
The main database and servers are hosted in Türkiye (Istanbul). To make the service work, limited data is shared with the providers below. Because their servers may be located outside Türkiye, these disclosures count as international transfers under Article 9 of the KVKK and are carried out in line with the conditions set out in the law.
| Provider | Purpose | Data shared |
|---|---|---|
| TomTom | Map imagery; route and arrival-time calculation using traffic data | Bus location and stop coordinates. No names are sent. Map imagery is fetched through our own server. |
| OpenStreetMap-based services (OSRM, Nominatim) | Route calculation; converting between addresses and coordinates | Coordinates and address text, plus technical connection details such as the IP address. No names are sent. |
| Expo (Expo Push Service), Apple (APNs), Google (Firebase Cloud Messaging) | Delivering push notifications to your device; Expo also delivers app updates | Notification title and text (which may include the student’s name) and the device notification token; for updates, technical details such as the app version and device platform |
| Apple App Store, Google Play | Distributing the App | Downloading and installing the App is subject to the store’s own privacy policy. |
Data is never sold to third parties or used for advertising. Where the law requires it, data may be disclosed to competent public authorities, and only to the extent required.
10. Retention
Personal data is kept for as long as the school bus service relationship lasts and for any periods required by applicable law. When the relationship ends, or once your deletion request has been completed, data is deleted or anonymised. Records that the law requires us to keep are held with restricted access for that period and then deleted or anonymised. See Account and Data Deletion for details.
11. Security
- All communication between the App and our servers is encrypted with HTTPS.
- Access is role-based: every user sees only the data they are authorised to see. A parent sees only their own child’s bus; drivers and attendants see only the bus they are assigned to.
- Session tokens are kept in the device’s secure storage (iOS Keychain, Android Keystore).
- Photos are not public and can be viewed only by authorised users.
- Passwords are stored as irreversible hashes; nobody, including the management team, can see your password.
12. Device permissions
- Notifications (all users): to receive bus-related notifications. You can change the permission in your device settings and the notification types in the App’s notification preferences at any time.
- Location, including background (drivers and attendants): only to share the bus position during a trip. Managers may allow a one-off use when picking a point on the map (see Location data). Parent accounts do not use location.
- Photos and camera (only when adding a photo): to add a student or staff photo; used only when a photo is picked or taken, and only with permission.
13. Your rights under KVKK
Under Article 11 of the KVKK, you have the right to:
- find out whether your personal data is processed and, if so, request information about it;
- learn the purpose of the processing and whether the data is used accordingly;
- know the third parties, in Türkiye or abroad, to whom the data is transferred;
- ask for incomplete or inaccurate data to be corrected;
- ask for the data to be deleted or destroyed under the conditions in Article 7 of the KVKK;
- ask for corrections, deletions or destruction to be notified to the third parties the data was transferred to;
- object to an outcome against you that results solely from automated analysis of your data;
- claim compensation if you suffer damage because of unlawful processing.
Send your request by email to serhatcelikyazilim@gmail.com or in writing to the address in section 1. Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, your request should include your full name, your Turkish ID number (for Turkish citizens) or your nationality and passport or ID number (for foreign nationals), an address for correspondence, your email address or phone number if available, and what you are asking for. We may ask for additional information to verify your identity.
Requests are answered free of charge as soon as possible and within 30 days at the latest. If handling the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.
If your request is rejected, you find the answer insufficient or you receive no answer in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning the answer, and in any case within 60 days of your request.
14. This website
This website uses no cookies, analytics or tracking tools, and does not collect data through forms. Fonts are loaded from Google Fonts, so technical details such as your browser’s IP address may be sent to Google. The hosting infrastructure may keep standard server logs for security and operation.
15. Changes
We may update this policy to reflect changes in the App or the law. The current version is always published on this page, and significant changes will also be announced in the App when appropriate. The date at the top of the page shows when it was last updated.
16. Contact
For privacy questions, email serhatcelikyazilim@gmail.com.