Privacy policy
Taslak: bu metin yayından önce hukukçu tarafından gözden geçirilecek. Sarı işaretli alanlar şirket bilgileri girilince dolacak.
1. Controller
Openway LLC (ОсОО «Опенвэй»), 62 Ankara St., 50, Oktyabrsky district, Bishkek, Kyrgyz Republic. Contact: info@openwaycars.com.
Openway is established in the Kyrgyz Republic, for which there is no EU adequacy decision. We collect your data directly from you and protect it as described in this policy, in line with the GDPR rules that apply to us.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone, country; flight number, hotel or address, your note to the company; the car, dates, locations and price breakdown you chose | Creating the booking, passing it to the company, sending confirmations and updates, resolving complaints | Conclusion and performance of a contract (GDPR 6(1)(b)) |
| Time at which you ticked the consent boxes | Proving that you accepted the terms and the data sharing | Legal obligation and legitimate interest (GDPR 6(1)(c), (f)) |
| Consent to marketing emails (optional) | Sending you offers and discounts | Consent (GDPR 6(1)(a)); you can withdraw it at any time |
| One-way hash of your IP address (cannot be reversed) | Preventing abuse (at most 5 form submissions per hour) | Legitimate interest (GDPR 6(1)(f)); deleted after 1 hour |
| One-way hash of the IP address of failed sign-in attempts | Protecting accounts against password guessing (at most 5 failed attempts in 15 minutes) | Legitimate interest (GDPR 6(1)(f)); deleted after 15 minutes |
| Company application details (company, contact person, contact details, tax number) | Reviewing the application and opening a company account | Pre-contractual steps (GDPR 6(1)(b)) |
| Server logs of our hosting provider (IP address, time, requested page) | Security and operation of the service | Legitimate interest (GDPR 6(1)(f)) |
At the moment the site uses no advertising or analytics cookies or tracking tools (see the cookie policy).
3. Who we share data with
- The rental company: so that it can fulfil your booking, your name, contact details, flight and address information and the booking details are passed to the company you chose (mostly in Türkiye). The company processes this data for its own rental contract, legal notifications (e.g. KABİS) and invoice as an independent controller and is responsible for its copy. This transfer is necessary for the performance of the contract (GDPR 49(1)(b)).
- Hosting and email infrastructure: Hostinger International Ltd. (website and email servers), on our behalf and on our instructions.
- Fonts: pages currently load the font from Google Fonts, which passes your IP address to Google. We will move the font to our own server.
- Competent authorities where required by law.
We do not sell your data or share it for advertising.
4. How long we keep data
| Data | Period |
|---|---|
| Contact details in a booking (name, email, phone, flight, address, note) | 12 months after the end of the rental, then automatically anonymised |
| Invoices and accounting records | 6 years from the end of the financial year (statutory retention) |
| Rejected company applications | 12 months |
| Marketing consent | Until you withdraw it |
| IP hash (abuse limit) | 1 hour |
| IP hash (failed sign-ins) | 15 minutes |
5. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object, and you can withdraw consent at any time. Send your request from the email address used in your booking to info@openwaycars.com. After verifying your identity we reply within 30 days. We cannot delete records we are legally required to keep (e.g. invoices); we restrict their use and tell you why.
Right to complain: if you live in the EU, to the data protection authority of your country; if you live in Türkiye, to the Personal Data Protection Board (KVKK); and to the State Agency for Personal Data Protection of the Kyrgyz Republic.
6. Security
Connections are encrypted (HTTPS). Your booking page only opens with the secret link sent to you. Company panels are password-protected and each company only sees its own bookings. Sign-in attempts are limited, passwords must be at least 12 characters long, and administrator accounts can use two-step verification.
7. Changes
We update this policy when new services are added (e.g. online payment, analytics); the current version is always on this page.