Personal Data Protection

Our company, in accordance with the "Personal Data Protection Law" No. 6698, published in the Official Gazette on 07.04.2016, acts as the "Data Controller." At Kayseri Altunel Rent a Car (hereafter referred to as "Altunel Rent a Car"), we prioritize the security of your personal data. With this awareness, we attach great importance to processing and storing all personal data related to individuals benefiting from our products and services, as well as anyone associated with our company, in accordance with the Personal Data Protection Law No. 6698. As the "Data Controller" defined in the law, we process your personal data as described below, within the limits specified by the law.

Definitions

• Text: Refers to this informative text.

• Data: Refers to information stored electronically in computer systems or in paper-based filing systems.

• Personal Data: Refers to any information related to an identified or identifiable natural person. The company may collect personal data through its websites, such as "web log data" (information related to users’ web browsers, mobile devices, operating systems, pages visited, the websites accessed, the date and time of visits, specific pages visited, and similar data), and may use cookies when visitors access pages on the website. In cases where personal data is collected or such data is processed together with other data, and if they refer to a specific individual, cookies and web log data will also be subject to this text.

• Sensitive / Special Category Personal Data: Refers to data related to race, ethnicity, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, membership in associations, foundations or trade unions, health, sexual life, criminal convictions, security measures, and biometric data. Sensitive data can only be processed under strict conditions and typically requires the explicit consent of the data subject.

• Data Subject or Owner: Refers to all natural persons whose personal data is processed by Kayseri Altunel Rent a Car, including employees. The data subject does not need to be a Turkish citizen or reside in Turkey. All data subjects have legal rights regarding their personal data.

• Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. These individuals are responsible for setting practices and principles in accordance with the law. The data controller for all personal data used in Kayseri Altunel Rent a Car's business processes is Kayseri Altunel Rent a Car.

• Data Processor: Refers to any person authorized by a data controller to process data on their behalf. Employees of the data controller are not included in this definition, but suppliers, business partners, and other third parties who process personal data on behalf of Kayseri Altunel Rent a Car may be included, if applicable.

• Data Processing / Processing: Refers to all activities related to the use of data. This includes obtaining, recording, storing, organizing, altering, retrieving, using, disclosing, erasing, or destroying data. Transferring data to third parties also constitutes data processing.

Method

As Altunel Rent a Car, in our role as the data controller, we may collect, record, store, retain, modify, update, periodically review, reorganize, classify, and store your personal and/or sensitive personal data that we collect with your consent through various communication channels such as our call centers, written communication, social media pages, mobile communication channels, and in-store communication channels. Your data may be shared or transferred with other individuals or entities, whether located in Turkey or abroad, including our collaborators, third-party individuals, legal authorities, and institutions as required by law or service-related operational needs. In all circumstances, we will process your personal data in accordance with the Personal Data Protection Law No. 6698 and related legislation. This processing may include informing you about our campaigns, recording your feedback and complaints, improving our service standards, and determining and implementing Kayseri Altunel Rent a Car’s business strategies.

Collection, Processing, and Purposes of Personal Data

As Kayseri Altunel Rent a Car, in our capacity as the data controller, we collect your personal data in accordance with legal obligations arising from the legislation. We collect personal data through various channels, including verbal, website, social media platforms, mobile applications, and similar means, with your consent, for the purposes of providing services such as short- and long-term car rentals, sales, transfers, registration, loss, license renewal, license plate renewal, traffic consultancy services, second-hand car sales, after-sales services, wholesale spare parts and accessories sales, insurance and financial services, and similar services. In addition, we collect personal data to inform you about our campaigns with your consent, to record your feedback and complaints, to improve our service standards, and to define and implement Kayseri Altunel Rent a Car’s commercial and business strategies.

Personal Data collected by Kayseri Altunel Rent a Car will be processed in accordance with the principles outlined in this document and in compliance with the law. Kayseri Altunel Rent a Car will adhere to the following principles when processing personal data:

• Personal data will be processed in accordance with applicable laws and the principle of fairness.

• We ensure that personal data is accurate and up to date. This includes verifying the sources from which data is obtained, confirming its accuracy, and evaluating whether updates are necessary.

• Personal data will be processed for specific, legitimate, and clear purposes. The purpose must be legitimate, meaning that the personal data processed by Kayseri Altunel Rent a Car is necessary and related to the business or service being provided.

• Personal data will be limited to what is necessary for the purposes for which it is processed. We avoid processing personal data that is unrelated or unnecessary for achieving the specified purpose. Therefore, the processed data will be relevant, limited, and adequate for its intended use.

• If a retention period is defined by relevant legislation, we will comply with these periods. In the absence of such a period, personal data will be retained only for as long as necessary to fulfill the purpose for which it was processed. If there is no valid reason to retain the data further, it will be deleted, destroyed, or anonymized.

Conditions for Processing Personal Data

Kayseri Altunel Rent a Car does not process personal data without the explicit consent of the data subject, unless one of the following conditions applies:

Kayseri Altunel Rent a Car may process personal data without explicit consent in cases explicitly provided for by law. For example, under Article 230 of the Turkish Tax Procedure Law, it is not necessary to obtain explicit consent from the individual for their name to appear on an invoice.

In cases of physical impossibility where the data subject cannot provide consent, or if the consent cannot be considered valid, personal data may be processed without consent to protect the life or physical integrity of the data subject or another person. For example, if a person is unconscious or unable to give valid consent due to mental illness, personal data may be processed to carry out medical interventions, such as processing health-related data (blood type, medical history, medications used) within the healthcare system.

Kayseri Altunel Rent a Car may process personal data directly related to the establishment or performance of a contract. For example, to process a payment under a contract, personal data such as a creditor’s account number may be collected.

Kayseri Altunel Rent a Car may process personal data to fulfill its legal obligations as the data controller, if necessary.

Personal data that has been publicly disclosed by the data subject may be processed by Kayseri Altunel Rent a Car, as the legal need to protect the individual's privacy is no longer applicable.

Kayseri Altunel Rent a Car may process personal data without explicit consent if it is necessary for the establishment or protection of a legal right.

Kayseri Altunel Rent a Car may process personal data without explicit consent if it is necessary for the legitimate interests of Kayseri Altunel Rent a Car, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject. Kayseri Altunel Rent a Car will ensure that the basic principles for the protection of personal data are adhered to and that the balance of interests of the data subjects is carefully considered.

 Conditions for Processing Sensitive Personal Data

Kayseri Altunel Rent a Car does not process sensitive personal data without the explicit consent of the individual concerned. However, personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases provided for by law. Health and sexual life-related personal data may be processed by Kayseri Altunel Rent a Car without explicit consent, under conditions where we are legally bound by confidentiality obligations, for the purposes of public health protection, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and financing.
Kayseri Altunel Rent a Car takes the necessary measures as defined by the Personal Data Protection Board (KVK Kurulu) to ensure the processing of sensitive personal data is secure.

Instances Where Consent is Not Required for the Collection and Processing of Personal Data
According to Article 5, Paragraph 2 of the Turkish Personal Data Protection Law (KVKK), personal data may be processed without explicit consent in the following cases:

• When expressly required by law.

• When it is necessary for the establishment or performance of a contract directly related to the data subject.

• When processing personal data is mandatory for fulfilling legal obligations as the data controller.

• When personal data has been made public by the data subject.

• When data processing is required for the establishment, use, or protection of a legal right.

• When processing personal data is necessary for the legitimate interests of Kayseri Altunel Rent a Car, provided that it does not infringe upon the fundamental rights and freedoms of the data subject.

Publicly disclosed or legally required data, such as information disclosed in official records or financial reports, can also be processed and transferred without consent, as these data are not subject to confidentiality obligations. In such cases, Kayseri Altunel Rent a Car is authorized to disclose, process, and transfer such data without the need for additional consent.

Conditions for Transferring Personal Data

Kayseri Altunel Rent a Car may transfer personal data to third parties, ensuring that confidentiality and security measures are in place, and in compliance with the law. The company will process and transfer personal data to third parties only in the following cases:

• If the data subject gives explicit consent.

• If there is a legal provision that explicitly regulates the transfer of personal data.

• If it is necessary to protect the life or physical integrity of the data subject or another person.

• If the data subject cannot provide consent due to physical impossibility or lack of legal validity of consent.

• If the transfer of personal data is directly related to the establishment or performance of a contract.

• If Kayseri Altunel Rent a Car needs to transfer personal data to fulfill its legal obligations.

Conditions for Transferring Sensitive Personal Data
Kayseri Altunel Rent a Car will ensure the required security measures and follow the guidelines set by the KVK Kurulu while transferring sensitive personal data to third parties. Sensitive personal data (excluding health and sexual life data) can be transferred without explicit consent under the following conditions:

• If the data subject’s explicit consent is obtained.

• For health and sexual life-related sensitive data, transfer is only allowed under conditions related to public health protection, preventive medicine, medical diagnosis, treatment, and care services, and if the data is processed by persons or institutions legally bound to maintain confidentiality.

Purposes for Processing Personal Data

Personal data will be processed by Kayseri Altunel Rent a Car for the following purposes, in compliance with the legal framework:

• To plan and implement human resources policies.

• To manage commercial partnerships and strategies.

• To ensure legal, commercial, and physical security for the company and its partners.

• To manage corporate operations and communication activities.

• To provide services tailored to the needs and requests of data subjects.

• To ensure data security.

• To maintain and improve databases.

• To develop services on the company’s website and resolve issues.

• To manage requests and complaints from data subjects.

• For event management.

• To manage relationships with business partners and suppliers.

• To manage recruitment processes and provide support for compliance with relevant legislation.

• For auditing activities to ensure compliance with relevant laws.

• For financial reporting and risk management.

• For legal affairs management.

• To protect the company’s reputation.

• To manage investor relations.

• To comply with legal obligations by providing information to relevant authorities.

• To track and manage visitor registrations.

All processing of personal data will be carried out in accordance with the conditions specified in Articles 5 and 6 of the KVKK. If any of the processing activities do not meet the conditions outlined by the law, explicit consent from the data subject will be sought by Kayseri Altunel Rent a Car.

Method of Personal Data Collection, Legal Basis, Deletion, Destruction, and Retention Period

Method of Personal Data Collection and Legal Basis

In accordance with the objectives outlined in Article 1 and the scope defined in Article 2 of the Law, personal data is collected using various methods including oral, written, and electronic means, such as call centers, the Kayseri Altunel Rent a Car website, mobile applications, and other channels. These data are collected to fulfill legal obligations, contracts, and requests in compliance with applicable laws, so that the company or its designated data processors can perform their duties accurately and completely.

Deletion, Destruction, or Anonymization of Personal Data

In accordance with other relevant laws, Kayseri Altunel Rent a Car will delete, destroy, or anonymize personal data once the reasons for processing the data no longer apply, either proactively or upon the request of the data subject. Deletion involves completely erasing the data in such a way that it cannot be recovered. Destruction refers to physically destroying the media (e.g., documents, disks, hard drives) on which the data is stored. Anonymization involves altering personal data so that it cannot be associated with any identifiable person, even if it is combined with other data.

Retention Period of Personal Data

Kayseri Altunel Rent a Car retains personal data for the period specified by law. If no specific retention period is established by law, personal data will be stored as long as it is necessary for the company's operations and in accordance with industry practices and principles of good faith. Once the data's purpose for processing has ended, and in the absence of any legal obligations, personal data may be retained only for the duration necessary for resolving potential legal disputes, establishing or defending a legal claim, or fulfilling related legal rights. Once the retention period expires, the data will be deleted, destroyed, or anonymized.

Obligations Regarding Information Disclosure (Clarification Obligation)

• The identity of the data controller and any representative.

• The purpose for processing the personal data.

• The recipients or categories of recipients to whom the personal data may be disclosed, and the purpose of such disclosure.

• The management and legal basis for collecting the personal data, along with the rights of the data subject.

Kayseri Altunel Rent a Car will ensure that third parties from whom data is collected will be provided with necessary information and that consent is obtained as required by law. Data will be collected through various channels, including electronic commerce platforms, retail stores, websites, call centers, and other methods, either automatically or manually.

Written Collection of Personal Data

When personal data is collected in writing, Kayseri Altunel Rent a Car will ensure that the data collection process complies with the Clarification Obligation outlined in this Policy. Relevant forms and documents will be revised to ensure that data processing is done in compliance with the Law. Even if data processing falls within an exception under the law, forms or contracts that involve customer relationships will be revised to demonstrate the explicit consent of the data subject. All personnel involved in customer relations will be trained to provide sufficient information to the individuals involved, ensuring that they are fully informed.

Oral Collection of Personal Data

When personal data is collected orally, including via call centers, individuals will be informed about the data collection process and the Clarification Obligation. The individual will be reminded that the conversation may be recorded, and explicit consent will be obtained to process their personal data according to the Policy and any applicable consent forms.

Electronic Collection of Personal Data

Personal data collected through electronic channels (such as e-commerce platforms, websites, and other online services) will comply with the Clarification Obligation. All relevant contracts, documents, and web pages will be updated to ensure that individuals are fully informed. Personal data will only be collected if explicit consent is obtained through an electronic system, and any unapproved information will not be recorded or processed in any system without consent.

By adhering to these procedures, Kayseri Altunel Rent a Car ensures that personal data collection and processing are conducted transparently and in accordance with legal requirements.