Privacy & Data Protection Notice

This notice explains how RoamBebe ("we", "us") collects and processes personal data when you use the marketplace to rent or list baby equipment. It is provided to satisfy the transparency and disclosure duties under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR). We act as the data controller for the data described below.

1. Who we are (data controller)

The data controller is RoamBebe, Antalya, Türkiye. For any privacy or data-protection matter, including exercising your rights, contact us at [email protected].

2. What we collect

• Account data: name, email, password (hashed), your language preference and, if you sign in with Google, your Google account identifier and avatar.
• Booking and contact data: the name, email and phone number you provide for a booking (including as a guest, without an account), delivery address, and flight number where given.
• Identity checks: we do not collect or store your ID/passport number. The provider may check your ID in person at handover, especially where a deposit is collected. ID numbers submitted with older bookings, before this change, remain stored encrypted and are shown only in masked form to the provider until deleted in line with our retention periods.
• Provider data: store details, contact phone number, address and location, identity/address verification status, and uploaded verification documents (stored privately and visible only to our administrators).
• Reviews and messages: the ratings, reviews and replies you write, and messages exchanged about a booking.
• Payment data: payment status, references and amounts. At launch payment is cash-on-delivery, so we do not receive card details; where online card payment is later enabled it is processed by Stripe and we do not store full card numbers.
• Technical data: IP address, device/browser information, and cookies needed to run the site and keep it secure.

3. Why we process it, and our legal basis

Under KVKK Article 5 we rely on the following grounds (the GDPR equivalent is given in brackets):

• To create and run your account, provide bookings, reviews and messaging: processing is necessary for the establishment or performance of a contract to which you are a party, KVKK Art. 5/2(c) (GDPR Art. 6/1(b)).
• To send transactional emails (verification, password reset, booking requests, confirmations, declines, refunds, review reminders): KVKK Art. 5/2(c) (GDPR Art. 6/1(b)).
• To keep financial and tax records: processing is expressly required by law, KVKK Art. 5/2(a) and 5/2(ç) (GDPR Art. 6/1(c)).
• To prevent fraud and abuse, verify providers, secure and improve the service: our legitimate interests, provided they do not override your fundamental rights, KVKK Art. 5/2(f) (GDPR Art. 6/1(f)).
• To send you offers and news by email or SMS: only with your explicit, separately given consent, KVKK Art. 5/1 and Law No. 6563 Art. 6 (GDPR Art. 6/1(a)). You can withdraw it at any time; withdrawal does not affect your account.

4. Sign-up acknowledgements and consent records

When you create an account (with a password or with Google) you confirm that you have read this notice and accept the Terms of Use. Reading this notice is an acknowledgement of information under KVKK Article 10, not a consent. Marketing permission is a separate, optional box that is never pre-ticked. To be able to demonstrate compliance we keep a record of each acknowledgement and each marketing decision: the date and time, the version of the legal texts in force, your IP address and browser identifier. These records are kept for as long as your account exists and for the limitation period that follows (see the retention section below).

5. Sharing with the provider

To fulfil a booking we share your contact details, including your name, email and phone number, with the relevant provider, who may contact you via WhatsApp. Providers are independent and act as their own controllers for the data they receive to perform the rental.

6. Other recipients

We share personal data only with service providers that help us run the marketplace, and only to the extent needed:

• Our hosting provider (where the site and database run) and our email delivery provider (for the emails described above).
• Cloudflare, whose Turnstile service protects the sign-up form against automated abuse; it processes your IP address and technical browser signals when you register.
• Google, only if you choose to sign in with Google; Google then shares your name, email and avatar with us under its own privacy policy.
• Stripe, only once online card payment is enabled, as the payment processor.

We do not sell personal data. Public authorities receive data only where the law requires it.

7. International transfers

RoamBebe operates in a single market, Türkiye, and your data is primarily processed there. A limited number of technical service providers (for example hosting, email delivery or bot protection) may process data outside Türkiye; where that occurs we rely on the safeguards required by the KVKK and, where relevant, the GDPR.

8. How long we keep it

Booking and financial records are retained for the periods required by Turkish tax and commercial law (generally up to ten years). Account data is kept while your account is active; on erasure, personal data is anonymized while non-personal financial records required by law are preserved. Provider verification documents are deleted once verification is complete or the store is closed, except where we must keep them to defend a legal claim.

9. Your rights (KVKK Article 11)

Under Article 11 of the KVKK you have the right to:

• learn whether your personal data is processed;
• request information about the processing if it is;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data is transferred;
• request correction of incomplete or inaccurate data;
• request erasure or destruction of your data where the grounds for processing no longer exist (KVKK Art. 7);
• request that corrections, erasure or destruction be notified to the third parties to whom the data was transferred;
• object to a result that is to your detriment and arises from analysis of your data exclusively by automated systems;
• claim compensation for damage suffered because of unlawful processing.

Where the GDPR applies you additionally have the rights of access, rectification, erasure, restriction, objection and data portability. A self-service copy of your account and booking data is available from your profile page ("Download my data").

10. How to apply, and how we respond

In line with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in writing to RoamBebe, Antalya, Türkiye, or by email to [email protected] from the email address registered to your account. Please include your name, contact details and the subject of your request so we can verify your identity. We answer free of charge as soon as possible and at the latest within thirty (30) days. If your request is refused, or you consider our answer insufficient, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within thirty days of our reply or, if we do not reply, within sixty days of your application.

11. Data Controllers' Registry (VERBİS)

Registration with the Data Controllers' Registry Information System (VERBİS) is determined by the thresholds set by the Personal Data Protection Board. RoamBebe monitors these thresholds and completes registration before it becomes mandatory; the registry status of the controller named above can be checked on the Board's public VERBİS query page.

12. Cookies

We use strictly necessary cookies only: the session cookie, the security (CSRF) token, your currency and language preferences, and the bot-protection token set by Cloudflare Turnstile on the sign-up page. No advertising or tracking cookies are used; if analytics or consent tools are later added, this notice will be updated first.

13. Children

The service is intended for adults (18+) arranging rentals; we do not knowingly collect data directly from children.

14. Changes

We may update this notice and will revise the date above. Material changes will be communicated where appropriate.

15. Contact

Data-protection enquiries and rights requests: [email protected], addressed to RoamBebe, Antalya, Türkiye.