English summary · Neocar Wash

This is a short summary of the Turkish text of this Privacy Policy. It is not binding; the Turkish text prevails.

Who we are: Neocar Wash is provided by MEY Endüstriyel Makine Sistemleri A.Ş. ("Neocar"), the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK), MERSİS No. 0649133183700001. Contact: destek@neocarwash.com.tr · +90 850 347 56 74 · İnönü Mah. Muammer Aksoy Cad. TO Petrol No: 37/1 İç Kapı No: 1 Küçükçekmece / İstanbul.
What we collect: your mobile number and name (and your email address if you give it to us); optional vehicle details (plate, make and model, colour); top-ups, packages, wash rights, wash history and refunds; loyalty points, tier and stamp card; your preferences, favourite stations and consent records; the IBAN of a bank account in your name if a refund cannot go back to your card; support tickets; security logs such as IP address and session records.
Cards: card details pass through our server only to be sent to the licensed payment institution that takes our payments: iyzico or N Kolay. We do not store card numbers or security codes. If you choose to save a card (at checkout or with "Kart ekle"), that institution stores it and we keep only a token, which institution holds it, the last four digits and the card type. If N Kolay stores it, the card is linked to a customer number we assign to you, which is not derived from your personal details. With N Kolay, "Kart ekle" verifies the card with a 1.00 TL pre-authorisation that is cancelled at once; you are not charged.
Location: used only with your permission and while the app is open, to sort stations by distance. It is sent to our server for that calculation only. It is not put in the web address (URL), not written to logs and not stored. We keep no location history.
Camera: used only to scan the QR code on the wash machine. The image is processed on your phone and is never stored or uploaded. Only the machine identifier in the QR code reaches our server.
Maps: on iOS the station map uses Apple Maps, a service of the operating system. On Android this version shows stations as a list. "Yol tarifi" (directions) opens your own map app with the station's location only; we do not send your location to it.
Support tickets: messages you send with "Bize yaz" in the app, with the topic, any linked wash or payment, the date and the ticket number. Your name and phone number are added so we can reply. Withdrawal notices and data-protection requests can also be sent this way.
Not collected: no contacts, photos or microphone; no advertising ID; no location history. The app has no ads, analytics, crash reporting or tracking tools. This version sends no push notifications and processes no push token.
Our web pages use no cookies, analytics tools or third-party scripts. The phone number you enter in the account deletion form is used only to send the verification code and to process the deletion request.
Why we use it: to create, verify and secure your account; to run washes, top-ups, packages, payments and refunds; to show nearby stations; to show service notifications in the app's Notifications list; to handle support tickets, withdrawal notices and data-protection requests; to send SMS about account deletion; to keep invoices and legal records; to prevent fraud and protect our rights. Campaign messages are shown in the app only if you opt in, and you can switch them off at any time.
Shared with: the payment institutions İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) and N Kolay Ödeme ve Elektronik Para Kuruluşu A.Ş. (payments, refunds, card verification, saved cards; each payment and saved card stays with the institution that handled it), banks (3D Secure and bank refunds), our SMS provider Mutlucell İletişim Hizmetleri A.Ş., our hosting provider DigitalOcean, LLC, and public authorities when the law requires it. We do not sell your personal data or share it for advertising.
Transfers abroad: our servers and database are hosted by DigitalOcean, LLC (United States) in its data centre in Frankfurt, Germany. Your data is therefore transferred to Germany, and the provider may access it from the United States or from other countries where it or its sub-processors operate, to run the service and give technical support. This is a transfer abroad under KVKK art. 9. We are in the process of signing the standard contract published by the Turkish Personal Data Protection Board with the provider and notifying the Authority; we will update this policy when it is signed. The systems of our payment institutions (iyzico and N Kolay) are in Türkiye, and our SMS provider is based in Türkiye. If we use another provider abroad, we will update this policy first.
How long we keep it: account data while you are a member. Location: not stored. Saved-card token: until you delete the card or close the account. Payment, invoice and transaction records: 5 years (Tax Procedure Law art. 253) or 10 years (Commercial Code art. 82). Contract acceptance records: generally 10 years (Code of Obligations art. 146). Marketing consent records: 3 years after the consent ends. A one-way hash of the phone number: 10 years after deletion. Support-ticket records: 2 years after the ticket is closed, 10 years for withdrawal notices and data-protection requests, and longer while a dispute is pending. Security logs (IP address, session records, application logs): at most 1 year, or until an investigation or dispute about them is closed.
Deleting your account: in the app (Profil → "Hesabımı sil") or on our account deletion page with an SMS code. The account closes at once and saved cards are deleted at the payment institution that holds them. After 14 days the account is permanently deleted and your personal data is anonymised; you can cancel before then by signing in again. We send an SMS when deletion is complete. Remaining balance and unused package rights are refunded automatically to your card, or only to a bank account in your name if that is not possible. Free rewards are not refunded.
Your rights (KVKK art. 11): apply in the app (Profil → KVKK & Sözleşmeler → "KVKK başvurusu yap"), in writing to İnönü Mah. Muammer Aksoy Cad. TO Petrol No: 37/1 İç Kapı No: 1 Küçükçekmece / İstanbul, with an application signed by secure electronic or mobile signature sent to destek@neocarwash.com.tr, or from an email address registered to your account to destek@neocarwash.com.tr. We reply within 30 days, free of charge, in writing or electronically (KVKK art. 13). You can complain to the Personal Data Protection Board (KVKK art. 14). We never ask for your SMS code.
Withdrawing consent: delete a saved card in Profil → Ödeme yöntemlerim, switch off "Kampanyalar" in Profil → Bildirim ayarları, or turn off location permission in your device settings.
Security: all traffic is encrypted (HTTPS/TLS). Card data is not stored or logged. Verification codes are single-use and kept only as one-way hashes. Only authorised staff can access data. We report a data breach to the Board within 72 hours and tell the people affected as soon as possible (KVKK art. 12/5).
Age: the app is for people aged 18 or over.

App: Neocar Wash · Developer: MEY Endüstriyel Makine Sistemleri A.Ş. · App Store seller: MEY Endustriyel Makine Sistemleri Anonim Sirketi (the same company, written without Turkish characters)

In the app: go to Profil and tap "Hesabımı sil" (below "Çıkış yap"). Confirm with the SMS code.
Without the app: on our account deletion page (in Turkish), https://app.neocarwash.com.tr/hesap-silme, enter your registered mobile number, tap "Doğrulama kodu gönder", enter the account-deletion code we send by SMS, tick the box and tap "Hesabımı sil". For your security the page gives the same answer for every number, so it never reveals whether a number has an account. Never share the code; our staff will never ask for it.
No access to your number any more: send a signed letter to İnönü Mah. Muammer Aksoy Cad. TO Petrol No: 37/1 İç Kapı No: 1 Küçükçekmece / İstanbul, or an application signed with a secure electronic or mobile signature to destek@neocarwash.com.tr, with your name and registered number.
What happens: the account is closed immediately: sessions end and saved cards are deleted at our payment provider. The account and personal data are permanently deleted/anonymized automatically after 14 days. You can cancel within that time by signing in again. We send an SMS when deletion is complete.
Deleted: name, phone number, email, vehicles, loyalty data, favourites and notification settings.
Kept, as required by Turkish law: payment, transaction and invoice records, for 5 years (Tax Procedure Law art. 253) or 10 years (Commercial Code art. 82), separated from your name and contact details. Consent records are kept for up to 10 years. A one-way hash of the phone number is kept for 10 years for dispute handling. Support-ticket records are kept for 2 years, and withdrawal notices and data-protection requests for 10 years, after the ticket is closed.
Remaining prepaid balance is refunded to the original card within 14 days.
Partial deletion (vehicles, saved cards, favourites, marketing consent) is available in the app without deleting the account.

Neocar Wash: English summary

Privacy policy

Account and data deletion

Support and contact