Data Processing Agreement

Versão 2.0 · Em vigor desde 26 October 2026

Processor: Transfer Runner Ltd (registered in England and Wales under company number 17488928), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, [email protected] ("TransferRunner")
Controller: ("Company")

This agreement forms part of the TransferRunner Subscription Agreement. It governs the relationship between the controller and the processor under Article 28 of the UK GDPR, Article 28 of the EU General Data Protection Regulation (GDPR) and Article 12 of the Turkish Personal Data Protection Law No. 6698 (KVKK), and under any other data protection law that applies to the Company (together, "Data Protection Law"). TransferRunner is a company established in the United Kingdom.

1. Roles

For the data of guests, drivers and Company staff processed in the Service, the Company is the controller and TransferRunner is the processor. TransferRunner processes this data only on the Company's behalf and to provide the Service.

2. Subject matter, duration and purpose

Subject matter and purpose: receiving and managing bookings, publishing the Company's booking site, assigning drivers, sending notifications to guests, tracking flights, passing guests to the payment provider, reporting, and the hosting and backups these need.
Duration: for the term of the Subscription Agreement and until the deletion period in section 8 has ended.
Data subjects: guests and passengers, the people who make bookings, invoice recipients, the Company's drivers and panel users.
Categories of data: name, email and phone number; pick-up and drop-off addresses, date and time, flight number, number of passengers and notes; amount and payment status (no card details); billing details; reviews; the driver's location during a trip; driving licence and vehicle document details of drivers; IP addresses and technical logs.
Special category data: not intended to be processed. The Company takes care that special category data such as health information is not entered in note fields.

3. TransferRunner's obligations

To process the data only on the Company's documented instructions. This agreement, the Subscription Agreement and the Company's settings in the panel are its instructions. If TransferRunner believes an instruction is unlawful, it tells the Company at once.
To make sure that the staff who can access the data are bound by confidentiality.
To take and keep up to date the technical and organisational security measures in Annex 1.
To help the Company, through the panel tools and to a reasonable extent, answer requests from data subjects (such as access, correction or deletion), and to pass on without delay any request it receives directly.
To tell the Company without undue delay, and no later than 48 hours after becoming aware of it, about a personal data breach, with the details known at the time, and to help the Company notify the supervisory authority, such as the ICO, an EU authority or the Turkish Personal Data Protection Board.
To give reasonable information where a data protection impact assessment or prior consultation with an authority is needed.
To provide the information needed to show compliance with this agreement, and to allow one reasonable audit a year, announced at least 30 days in advance and carried out without disrupting operations.

4. Sub-processors

The Company gives general authorisation for TransferRunner to use sub-processors of the types below. TransferRunner makes written agreements with them that protect the data at least as well as this agreement and remains responsible to the Company for their processing. A new sub-processor is announced in the panel at least 30 days before it is added; the Company may object on reasonable grounds, and if the objection cannot be resolved it may end its subscription with the refund described in the Subscription Agreement.

Server hosting and backups
Email delivery
SMS and WhatsApp messaging (for example Meta WhatsApp Business)
Maps and address suggestions (Google Maps)
Flight information provider (flight number and date only)

The payment provider the Company connects with its own account (such as Stripe or iyzico) and the measurement and advertising tags it adds to its own site (such as Google or Meta) are not TransferRunner's sub-processors. The relationship with those services is directly between the Company and the provider.

5. International transfers

Companies in Türkiye: sending data to TransferRunner in the United Kingdom is a transfer abroad under Article 9 of KVKK. For this transfer the parties sign, without changes, the "controller to processor" standard contract published by the Turkish Personal Data Protection Board, and the Company notifies the Board within 5 business days of signing. TransferRunner provides the information and documents needed to sign it.
Companies in the European Economic Area: the transfer relies on the European Commission's adequacy decision for the United Kingdom. If that decision ends, the parties use the standard contractual clauses under Article 46 GDPR.
Companies elsewhere: where the Company's Data Protection Law requires a specific safeguard for transfers to the United Kingdom, the parties put it in place, and TransferRunner provides the information needed.
Sub-processors: for sub-processors that process data outside the United Kingdom, the European Economic Area or Türkiye, safeguards such as adequacy decisions, the UK International Data Transfer Agreement (IDTA) or the EU standard contractual clauses are used.

6. The Company's obligations

To have a valid legal basis for processing the data and to inform data subjects. TransferRunner provides ready-made texts for the booking site; the Company is responsible for checking that they suit its business and filling them in correctly.
To register with the authority where required (for example VERBİS in Türkiye or the ICO fee in the United Kingdom).
To give TransferRunner only lawful instructions and to manage the access rights of panel users correctly.

7. Confidentiality

TransferRunner does not disclose the data to third parties. It passes data only to sub-processors in line with this agreement, or to competent authorities where the law requires it, and tells the Company about such a request where the law allows.

8. End of processing, return and deletion

When the Subscription Agreement ends, the Company can export its data from the panel for 30 days. At the end of that period TransferRunner deletes the data from its live systems; copies in backups are deleted automatically within 90 days at the latest. Data that must be kept by law (such as TransferRunner's own invoice records) is kept for the required period.

9. Liability and order of precedence

Liability under this agreement is subject to the limits in the Subscription Agreement, except liability that cannot be limited by law. On matters of personal data, this agreement prevails over the Subscription Agreement if they conflict.

10. Language and law

This agreement is made in English, and translations are provided for convenience; if a translation differs, the English text prevails. The law and courts named in the Subscription Agreement apply, without affecting the mandatory Data Protection Law of the Company's country.

Annex 1: Technical and organisational security measures

Encryption of all connections (HTTPS / TLS)
Passwords stored only as one-way hashes; two-step sign-in for the panel
Payment provider secret keys stored encrypted (AES-256) in the database; card data never stored
Role-based access: drivers see only the jobs assigned to them
Separation of data between companies: each company sees only its own data
Regular backups and test restores
Server access limited to authorised people, with access logs
Security updates applied regularly