This is an English translation provided for convenience. In case of any discrepancy, the Turkish version prevails. · Türkçe

Privacy Policy

Last updated: 26 September 2026

This Privacy Policy explains how we process your personal data in connection with car rental searches, bookings, account sign-in and support provided through the WRS Car website and mobile application (the "service").

1. Data controller

2. Data processed

• Account and sign-in: when you sign in with Google or Apple, your name, your email address and the sign-in method.
• Sign-in security log: at each sign-in, your email address, the time of sign-in, your IP address, the approximate location derived from your IP address (country/city) and device/browser information.
• Booking: pick-up/drop-off location, date and time, driver name, email, phone, driver age and nationality, and the driving licence/identity information requested by the supplier.
• Membership details: if, after signing in, you enter them yourself in the "My account details" section: first name, surname, Turkish identity number (T.C. kimlik numarası) or passport number, and phone; for invoicing purposes, company name, tax office, tax number and billing address. When you select a corporate (company) invoice during booking and enter billing details, these details are also saved to your membership details. This information is used only for the purpose of issuing invoices and filling in the booking form for you.
• Payment: payment amount, currency and the transaction result returned by the bank. Your card number and security code are not seen or stored by us.
• Communications: the messages you write to the live assistant, to our WhatsApp line or to our email addresses, and the record of the booking emails we send you.
• Usage: search preferences, and language and currency selection.
• Price alert: when you set up a price alert, your email address, the search details (pick-up/drop-off location, date and time, currency, optional vehicle class) and the lowest total price found for that search.

3. Purposes of processing and legal grounds

• To display vehicle availability and prices, and to create and manage bookings (conclusion and performance of a contract).
• To initiate payment securely and to send confirmation and cancellation emails (performance of a contract).
• To provide secure sign-in to your account and to detect unauthorised access and fraud (legitimate interest).
• To answer your questions and provide support (legitimate interest).
• To fulfil obligations arising from accounting, tax and consumer legislation (legal obligation).
• To send price alert emails (explicit consent). Alerts set up without signing in do not become active until they are confirmed via the confirmation link sent to your email address; unconfirmed requests are deleted within 48 hours. You may withdraw your consent at any time via the "Turn off this alert" link in every email.

4. Transfers and service providers

Your data is not sold. In order to provide the service, it is shared only to the extent necessary with the parties listed below; transfer to Meta and Google for advertising measurement takes place only with your explicit consent (see Section 8):

• Car rental suppliers (e.g. WRS Turkey, Yolcu360) — to create the booking.
• Ziraat Bankası — for 3D Secure payment processing.
• Google and Apple — for account sign-in (authentication).
• Railway — server and database hosting.
• Zoho Mail — sending and receiving email.
• OpenRouter / OpenAI — generating live assistant and WhatsApp replies (the message you write).
• Twilio — delivery of WhatsApp messages.
• TypeSafe AI — vehicle recommendations and sign-in security risk assessment (email, approximate location, sign-in time).
• ipwho.is — determining approximate location from the IP address.
• Meta Platforms Ireland Ltd. — only if you give cookie consent, for advertising measurement (Meta Pixel and Meta Conversions API).
• Google Ireland Ltd. — website usage analytics and advertising measurement (Google Analytics, Google Ads); cookies and advertising identifiers are used only if you give cookie consent.

The servers of some of these service providers are located outside Türkiye. Transfers abroad are carried out in accordance with the safeguards set out in Article 9 of the Personal Data Protection Law No. 6698 (KVKK).

5. Retention period

Your personal data is retained for as long as necessary for the purpose for which it is processed. Booking, payment and invoice records are kept for the statutory periods set out in the relevant legislation. At the end of the period, the data is deleted or anonymised. Sign-in security records (sign-in time, IP address, approximate location, device information) are deleted automatically after 180 days. In price alert records, your email address is deleted when the alert is turned off or the pick-up date has passed; the records are deleted entirely within 30 days at the latest. Live assistant and WhatsApp chat records are retained for a maximum of 30 days so that we can follow up on your requests, are viewed only by authorised personnel and are automatically deleted at the end of that period; information such as card and identity numbers is masked before it is recorded.

6. Account and data deletion

If you wish your account and data to be deleted, it is sufficient to send an email with the subject "Account and data deletion request" from the email address you sign in with to customer@wrscar.com. Signed-in users can also delete their account directly using the "Delete my account" option on the My bookings page. Your account information, your membership details (personal and billing information) and your sign-in records are deleted. Booking and payment records that must be retained by law are kept solely for that purpose until the statutory period expires and are not used for any other purpose.

7. Your rights

Under Article 11 of the KVKK and, to the extent applicable, the GDPR, you have the right to learn whether your data is being processed, to request information, to learn the purpose of the processing, to know the parties to whom it has been transferred, to request its rectification if it has been processed incompletely or inaccurately, to request its erasure or destruction under the conditions of Article 7 of the KVKK, to request that such rectification, erasure or destruction be notified to third parties to whom the data has been transferred, to object to a result to your detriment arising from analysis by automated systems, and to claim compensation if you suffer damage. You can submit your requests to info@wrscar.com or to the postal address above; requests are concluded within 30 days at the latest.

8. Cookies and local storage

Necessary cookies: the secure session cookie that keeps you signed in and the verification cookie used briefly during sign-in. Your language, currency and cookie preferences are stored in your device's local storage; your cookie preference is also kept in the "wrs_consent" cookie (1 year) so that our server can read it. These are strictly necessary for the service to function.

Campaign source: if you arrive on the site via an advertisement or a link, the campaign information in that link (parameters such as utm_source, utm_medium, utm_campaign and the ad click identifiers fbclid/gclid) and the landing page are kept in your device's local storage for 30 days and, if you make a booking, added to your booking record. We use this information only ourselves, to see which campaign brought a booking.

Favourites: the vehicles you add to your favourites (vehicle, price at the time of saving, date and location) are stored only in your device's local storage and are not sent to our servers.

Advertising measurement (Meta Pixel and Meta Conversions API) — only with your consent: We ask you on your first visit. If you choose "Accept", the Meta Pixel is loaded to measure the effectiveness of our advertisements, and events such as page views, searches, vehicle detail views, booking initiation, setting a price alert, clicking a WhatsApp/email link, opening the live assistant and the amount/currency of a completed booking are transmitted to Meta together with device and browser information and Meta cookies. Of these events, payment initiation, completed bookings and price alerts are also reported to Meta from our server so that measurement is not affected by browser blocking (Meta Conversions API); this report contains your IP address, browser information and Meta cookie identifiers, and your email address, phone number, first and last name and nationality only in irreversibly hashed form (SHA-256). Your identity and card details are never sent. Meta may process this data under its own privacy policy and outside Türkiye. If you choose "Decline", the Pixel is not loaded at all and our server does not report to Meta either.

Google Analytics and Google Ads: We use the Google tag to analyse how the site is used and to measure the results of our Google advertisements (e.g. completed bookings, price alerts, contact clicks). With Google's "Consent Mode" the default setting is "denied": unless you give consent, Google does not set analytics or advertising cookies, no ad personalisation takes place and only limited, cookieless signals (e.g. page and event type, browser information) are sent to Google. If you choose "Accept", Google Analytics and Google Ads cookies are used and events are transmitted to Google. Your name, email, phone number, identity or card details are not sent to Google. Google may process this data under its own privacy policy and outside Türkiye.

You can change or withdraw your choice at any time via the "Cookie preferences" link at the bottom of the home page.

9. Children

The service is intended for adults who meet the age requirement for renting a vehicle. We do not knowingly process the data of persons under the age of 18.

10. Changes

When this policy is updated, the new version is published on this page and the date at the top is changed.

For questions: info@wrscar.com · Support: wrscar.com/destek