JavaScript is requiredZiraatFİLO | Gpdr
ziraat-filo-logo

Protection of Personal Data

Our Company holds the title of “Data Controller” pursuant to the Law on the Protection of Personal Data No. 6698, published in the Official Gazette on 07.04.2016. As ZİRAAT FİLO YÖNETİMİ VE MOBİLİTE ÇÖZÜMLER ANONİM ŞİRKETİ (ZiraatFİLO), we attach the utmost importance to the security of your personal data. With this awareness, we place great importance on ensuring that all personal data belonging to all persons related to the Company, including those who benefit from our products and services, are processed and stored in compliance with the Law on the Protection of Personal Data No. 6698. With full awareness of this responsibility, in our capacity as a “Data Controller” as defined in the Law, we process your personal data as explained herein and within the limits set by the legislation.

Definitions

Text: Refers to this disclosure text.

Data: Refers to information stored electronically on computers or in certain paper-based filing systems.

Personal Data: Refers to any information relating to an identified or identifiable natural person. For the purposes of understanding customer preferences and providing better service and for similar purposes, the Company may collect, via its websites, data generally referred to as “web log information” (information on users’ internet browsers, mobile devices, operating systems, pages visited, other websites from which the relevant site was accessed, the date and time of visits to the relevant website, specific pages visited, and more) and may use cookies when pages on the website are visited. In cases where Personal Data are obtained within this scope, or where the data collected in this way are processed together and point to a specific person, cookies and web log information shall also be subject to this Text. The Company also collects location information and records images through tracking devices integrated into vehicles and through cameras located inside and outside the vehicles for the purpose of ensuring vehicle and customer safety. Such personal data are processed automatically on the legal grounds set out in Article 5 of the Law, namely “it is necessary for the data controller to fulfill its legal obligation” and “processing of data is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.” Such personal data may be transferred to judicial authorities or relevant law-enforcement agencies upon request in accordance with the applicable legislation. In cases where Personal Data are obtained within this scope, or where the data collected in this way are processed together and point to a specific person, image recordings and location information shall also be subject to this Text.

Special Categories / Sensitive Personal Data: Refers to data relating to race, ethnic origin, political opinions, philosophical belief, religion, sect or other beliefs, clothing and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric data. Sensitive data may be processed only under strict conditions and generally require the explicit consent of the data subject.

Data Subject(s): Includes all natural persons whose Personal Data are processed by ZiraatFİLO, including employees. The data subject does not need to be a Turkish citizen or reside in Turkey. All data subjects have legal rights regarding their personal data.

Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. Such persons have responsibilities to set practices and principles in accordance with the Law. With respect to all personal data used in its business processes, the relevant ZiraatFİLO entity is the data controller.

Data Processor: Refers to any person who processes personal data on behalf of a data controller based on the authority granted by the controller. Employees of the data controller are excluded from this definition; however, where applicable, suppliers, business partners and other third parties processing personal data on behalf of ZiraatFİLO fall within this definition.

Processing / Processing of Data: Encompasses all activities related to the use of data. It includes obtaining, recording or retaining data, or carrying out one or more operations on the data such as organizing, altering, retrieving, using, disclosing, deleting or destroying it. Transfer of data to third parties also constitutes processing.

METHOD

As ZiraatFİLO, in our capacity as data controller, through our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels, in-vehicle/external cameras, vehicle location tracking devices and/or, without limitation, through any and all channels, the personal and/or special categories of personal data that we obtain with your consent may be obtained in whole or in part; recorded, kept, stored, altered, updated, periodically checked, reorganized; classified; retained for the period required for the purpose for which they are processed or for the period stipulated in the relevant laws; shared/transferred with private-law/legal persons with whom ZiraatFİLO collaborates or with public institutions and organizations to which it is legally liable and/or with relevant third-party natural/legal persons resident in Turkey or abroad due to legal or service-related factual requirements; and may be transferred abroad due to legal or service-related factual requirements. ZiraatFİLO informs you that, for purposes such as enabling our customers to benefit from our services, informing you—subject to your consent—about our campaigns, recording your suggestions and complaints, establishing better service standards for you, and determining and implementing ZiraatFİLO’s commercial and business strategies, and in any case in compliance with the Law on the Protection of Personal Data No. 6698 and the relevant legislation, we may process your personal data.

COLLECTION AND PROCESSING OF PERSONAL DATA AND PURPOSES

As ZiraatFİLO, in our capacity as data controller and within the scope of our legal obligations arising from the legislation, we collect your personal data by verbal, written or electronic means—via our website, social media platforms, mobile applications and similar channels—for the proper performance of our services such as long- and short-term vehicle rental, sale, transfer, registration, loss (zayi) procedures, renewal and issuance of registration documents, renewal and issuance of license plates, traffic consultancy services, second-hand vehicle sales and after-sales services, wholesale spare parts and accessory sales, customer and vehicle safety, provision of insurance and financing services; for enabling you to benefit from our services; for informing you—subject to your consent—about our campaigns; for recording your suggestions and complaints; for establishing better service standards for you; and for determining and implementing ZiraatFİLO’s commercial and business strategies. Personal Data are processed by ZiraatFİLO in accordance with the procedures and principles set out in the Law and in this Text. When processing Personal Data, ZiraatFİLO acts in line with the following principles:

  • Personal Data are processed in compliance with applicable legal rules and the rule of good faith.

  • Personal Data are ensured to be accurate and up-to-date. In this context, issues such as the identifiability of the sources from which data are obtained, confirmation of their accuracy, and assessment of whether they need to be updated are carefully taken into consideration.

  • Personal Data are processed for specific, explicit and legitimate purposes. A legitimate purpose means that the Personal Data processed by ZiraatFİLO are connected with and necessary for the business it conducts or the services it provides.

  • Personal Data are connected with and limited to the achievement of the purposes determined by ZiraatFİLO; processing of Personal Data that are not related to or not needed for the realization of the purpose is avoided. The processed data are limited to what is necessary for achieving the purpose. In this context, Personal Data processed are relevant, limited and proportionate to the purpose for which they are processed.

  • If a retention period for the data is stipulated in the relevant legislation, those periods are observed; otherwise, Personal Data are retained only for the period necessary for the purpose for which they are processed. If there is no valid reason to retain the Personal Data for a longer period, such data are deleted, destroyed or anonymized.

Conditions for Processing Personal Data

ZiraatFİLO does not process Personal Data without the explicit consent of the data subject. If one of the following conditions is present, Personal Data may be processed without seeking the data subject’s explicit consent:

  • ZiraatFİLO may process the Personal Data of Personal Data Subjects even without explicit consent where it is explicitly provided for by laws. For example, under Article 230 of the Tax Procedure Law, the explicit consent of the relevant person shall not be sought to include that person’s name on the invoice.

  • Personal Data may be processed without explicit consent for the protection of the life or physical integrity of the person who is unable to disclose consent due to actual impossibility or whose consent is not deemed legally valid, or of another person. For example, in a situation where a person’s consciousness is impaired or consent is invalid due to mental illness, Personal Data of the Personal Data Subject may be processed during a medical intervention to protect life or physical integrity. In this context, data such as blood type, past diseases and surgeries, and medications used may be processed through the relevant health system.

  • Provided that it is directly related to the establishment or performance of a contract by ZiraatFİLO, Personal Data of the parties to the contract may be processed. For example, under a contract, the creditor’s account number information may be obtained in order to make a payment.

  • ZiraatFİLO, as a data controller, may process Personal Data of Personal Data Subjects if it is necessary for fulfilling its legal obligations.

  • Personal Data that have been made public by the Personal Data Subjects themselves, in other words, disclosed to the public in any manner, may be processed by ZiraatFİLO since the legal interest that needs to be protected has disappeared.

  • ZiraatFİLO may process Personal Data of Personal Data Subjects without seeking explicit consent where processing is mandatory for the establishment, exercise or protection of a legal right.

  • ZiraatFİLO may process Personal Data of Personal Data Subjects where processing is mandatory for ZiraatFİLO’s legitimate interests, provided that the fundamental rights and freedoms of the Personal Data Subjects protected under the Law and this Policy are not harmed. The Company shows the necessary sensitivity to comply with the fundamental principles regarding the protection of Personal Data and to observe the balance of interests of the Personal Data Subjects.

Conditions for Processing Special Categories of Personal Data

ZiraatFİLO does not process Special Categories of Personal Data without the explicit consent of the data subject. However, Special Categories of Personal Data other than those relating to health and sexual life may be processed without the explicit consent of the relevant person in cases stipulated by laws. Special Categories of Personal Data relating to health and sexual life may be processed by ZiraatFİLO without seeking the explicit consent of the relevant person only for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing, by persons under an obligation of confidentiality. ZiraatFİLO carries out the necessary procedures to take the adequate measures determined by the Board with respect to the processing of Special Categories of Personal Data.

CASES WHERE CONSENT IS NOT REQUIRED FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA

Pursuant to Article 5(2) of the Law on the Protection of Personal Data No. 6698, ZiraatFİLO has the right to process personal data without obtaining explicit consent if any of the following conditions apply: where it is explicitly provided for by laws; where it is necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract; where it is mandatory for ZiraatFİLO, in its capacity as data controller, to fulfill its legal obligation; where personal data have been made public by the data subject; where processing is mandatory for the establishment, exercise or protection of a right; and where processing is mandatory for the legitimate interests of the Company as data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person. Disclosures, uses and transfers of Data that are published or made public, or that are included in official registers or in balance sheets and annual reports pursuant to the principle of openness set out in laws, or that are required to be disclosed in order to inform the public under statutory provisions, as well as disclosures made by ZiraatFİLO to persons entitled by laws to request secrets for the fulfillment of ZiraatFİLO’s legal obligations arising from the legislation to which it is subject and/or due to legal obligations, are not subject to ZiraatFİLO’s duty of confidentiality, and ZiraatFİLO is authorized to disclose, provide, process and transfer such Data to the relevant persons without the need to obtain a separate consent statement for these Data.

TRANSFER OF PERSONAL DATA AND CONDITIONS

ZiraatFİLO may, in line with the purposes of processing Personal Data, transfer the Personal Data and Special Categories of Personal Data of Personal Data Subjects to third parties in compliance with the Law, by creating the necessary confidentiality conditions and taking security measures. ZiraatFİLO acts in accordance with the regulations stipulated in the Law during the transfer of Personal Data. In this context, in line with the legitimate and lawful purposes of processing Personal Data, ZiraatFİLO may transfer Personal Data to third parties based on and limited to one or more of the conditions for processing Personal Data specified in Article 5 of the Law, namely: if the Personal Data subject has given explicit consent; if there is an explicit provision in laws regarding the transfer of Personal Data; if it is mandatory for the protection of the life or physical integrity of the Personal Data subject or another person, and the Personal Data subject is unable to disclose consent due to actual impossibility or their consent is not deemed legally valid; if it is necessary to transfer Personal Data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract; if the transfer of Personal Data is mandatory for ZiraatFİLO to fulfill its legal obligation; if Personal Data have been made public by the Personal Data subject; if the transfer of Personal Data is mandatory for the establishment, exercise or protection of a right; and if the transfer of Personal Data is mandatory for the legitimate interests of ZiraatFİLO, provided that it does not harm the fundamental rights and freedoms of the Personal Data subject.

Conditions for the Transfer of Special Categories of Personal Data

By exercising due care, taking necessary security measures, and taking the adequate measures stipulated by the Personal Data Protection Board (KVK Kurulu), ZiraatFİLO may transfer the Special Categories of Personal Data of the Personal Data Subject to third parties in line with legitimate and lawful purposes of processing Personal Data in the following cases: (i) if the Personal Data Subject has given explicit consent; or (ii) without seeking explicit consent of the Personal Data Subject in the presence of the following conditions:

  • Special Categories of Personal Data of the Personal Data Subject other than those relating to health and sexual life (i.e., data concerning race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data) may be transferred in cases stipulated by laws;

  • Special Categories of Personal Data of the Personal Data Subject relating to health and sexual life may be transferred only for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing, by persons under an obligation of confidentiality or by authorized institutions and organizations.

Purposes of Processing and Transferring Personal Data

Personal Data are processed, in accordance with the Law and its purpose, for the following purposes, limited to the conditions for processing personal data specified in Articles 5 and 6 of the Law: planning and implementing ZiraatFİLO’s human resources policies in the best manner; correctly planning, executing and managing commercial partnerships and strategies; ensuring the legal, commercial and physical security of itself, its business partners and its customers; ensuring corporate functioning, and planning and execution of management and communication activities; enabling Personal Data Subjects to benefit from its products and services in the best way and offering them customized according to their demands, needs and wishes; ensuring the highest level of data security; creating databases; improving the services provided on the website and remedying errors occurring on the site; communicating with Personal Data Subjects who submit requests and complaints and ensuring the management of requests and complaints; event management; management of relations with business partners or suppliers; conducting personnel procurement processes; supporting Group Companies in personnel procurement processes and compliance with the relevant legislation; planning and execution of audit activities to ensure that the activities of Group Companies are carried out in accordance with the relevant legislation; supporting Group Companies in carrying out company and partnership law transactions; execution/monitoring of financial reporting and risk management processes; execution/monitoring of the Company’s legal affairs; carrying out activities aimed at protecting its reputation; management of investor relations; providing information to authorized bodies as required by legislation; creating and tracking visitor records. If any processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the Law, ZiraatFİLO obtains your explicit consent for the relevant processing activity.

METHOD AND LEGAL GROUNDS FOR COLLECTING PERSONAL DATA; DELETION/DESTRUCTION; RETENTION PERIOD

Method and Legal Grounds for Collecting Personal Data

For the purpose of verifying compliance with Article 1 (purpose of the Law) and Article 2 (scope of the Law), Personal Data are collected in all verbal, written and electronic environments; through technical and other methods; via various channels such as the call center, ZiraatFİLO website and mobile application; within the framework of legal grounds based on legislation, contracts, requests and demands, in order to fully and accurately fulfill responsibilities arising from the law; and are processed by the Company or by data processors assigned by the Company.

Deletion, Destruction or Anonymization of Personal Data

Without prejudice to the provisions contained in other laws regarding the deletion, destruction or anonymization of Personal Data, ZiraatFİLO shall, despite having processed Personal Data in compliance with this Law and other laws, delete, destroy or anonymize Personal Data ex officio or upon the request of the data subject when the reasons requiring processing cease to exist. Deletion of Personal Data means destroying such data so that they can no longer be used or recovered in any way. Accordingly, Personal Data are deleted from media such as documents, files, CDs, diskettes and hard disks in a manner that cannot be restored. Destruction of Personal Data means destroying materials suitable for storing data, such as documents, files, CDs, diskettes and hard disks, so that the information cannot be restored or used again. Anonymization of data means rendering Personal Data impossible to associate with an identified or identifiable natural person, even when matched with other data.

Retention Period of Personal Data

ZiraatFİLO retains Personal Data for the period stipulated in the relevant legislation, if specified therein. If no period is stipulated in the legislation regarding how long personal data should be retained, Personal Data are processed by ZiraatFİLO for the period required by the activity carried out while processing that data, in accordance with ZiraatFİLO’s practices and commercial customs of its business life and the rule of good faith, and are then deleted, destroyed or anonymized. If the purpose of processing personal data has ended and the retention periods stipulated in the relevant legislation and determined by ZiraatFİLO have also expired, personal data may be retained solely for the purpose of constituting evidence in possible legal disputes or for the establishment, exercise or defense of a right dependent on personal data. In determining these periods, statutes of limitation applicable to the assertion of the aforementioned right and examples of previous requests addressed to ZiraatFİLO on the same matters despite the lapse of the statute of limitation are taken as a basis. In this case, the retained personal data are not accessed for any other purpose and are accessed only when it is necessary to use the relevant personal data in the relevant legal dispute. After the aforementioned period expires, personal data are deleted, destroyed or anonymized.

INFORMATION OBLIGATION (DUTY TO INFORM)

ZiraatFİLO is obliged to inform the natural persons whose data will be processed at the time of obtaining Personal Data. The scope of this information obligation is as follows:

  • The identity of the data controller and, if any, its representative,

  • The purposes for which Personal Data will be processed,

  • To whom and for what purposes the processed Personal Data may be transferred,

  • The method and legal grounds for collecting Personal Data, and the rights of the data subject.

In this regard, ZiraatFİLO will provide the necessary information via tools for obtaining data from Third Parties for processing in its systems and will obtain informed consents from Data Subjects regarding data processing in order to prove that the information obligation has been fulfilled. Personal Data may be collected by ZiraatFİLO through all sales channels including electronic commerce and sales stores, branches, websites, call centers and other channels from which services may be received from third parties, by automatic or non-automatic means, verbally, in writing or electronically.

  • Obtaining Personal Data in Writing: When obtaining Personal Data in writing, ZiraatFİLO will fulfill the Information Obligation regarding the processing of data, based on this Text, provided that new relevant forms and information to be revised are used. In addition, all forms and contracts, including Permission-Based Communication Forms to be received from persons with whom a customer relationship is established, will be revised to reflect the explicit consent of the Data Subject to the processing of Personal Data, even if the processing of the relevant data group may be considered an exception under the Law. In customer relations, new forms, documents and notices that prove compliance with the Law will be used; all relevant employees will be trained to provide sufficient detailed information to the natural person and to show references in this regard. Personal Data will necessarily be obtained by means of written forms containing informed consents.

  • Obtaining Personal Data Verbally: In the event that any new data are obtained in any way regarding existing customers processed under the current Permission-Based Communication Forms or that data are obtained via the Call Center, information will be provided regarding the information obligation concerning the processing of Personal Data. During verbal data collection, provided that prior information is given, it will be reminded that the conversation is recorded and consent will be confirmed that Personal Data will be processed in accordance with this Policy and, if any, existing Permission-Based Communication Forms. Employee and Call Center business processes will be reassessed and applied within this framework.

  • Obtaining Personal Data in Electronic Environment: Data obtained via e-commerce channels and other internet channels of ZiraatFİLO are also subject to this Information Text; all contracts and documents / link addresses / web pages requiring the obtaining and processing of Personal Data have been revised to fulfill the information obligation regarding the processing of Personal Data. This Text will be accessible from all web pages on ZiraatFİLO’s websites, and systems requiring approval for data processing by ZiraatFİLO will be established at every link address that may require data collection. Unless it is clearly indicated that consent has been given for the processing of Personal Data, no information or document entered will be automatically recorded in any ZiraatFİLO system nor processed in any way.

  • Obtaining Personal Data in In-Vehicle/External Environments: When obtaining Personal Data in the form of image recordings and location information, ZiraatFİLO will fulfill the Information Obligation regarding the processing of data, based on this Text, provided that new image recordings and location information to be revised are used. In addition, all types of image recordings and location information to be received from persons with whom a customer relationship is established will be revised to fulfill the information obligation towards the Data Subject concerning the processing of Personal Data, even if the processing of the relevant data group may be considered an exception under the Law. In customer relations, informative notices proving compliance with the Law will be used; all relevant employees will be trained to provide sufficient detailed information to the natural person and to show references. It will be ensured that Personal Data are obtained through stickers directing to the information texts.

YOUR RIGHTS REGARDING THE PROTECTION OF PERSONAL DATA

ZiraatFİLO will respond to the following requests submitted by relevant persons in writing, verbally, or via electronic mail:

a) To learn whether ZiraatFİLO processes personal data concerning them and which personal data are processed,
b) To obtain information regarding the purposes of the processing activity,
c) To know the third parties to whom ZiraatFİLO transfers personal data domestically or abroad,
d) To request correction of personal data if they are processed incompletely or inaccurately,
e) To request deletion or destruction of personal data in accordance with the Law,
f) In case of a request for the correction, deletion or destruction of personal data, to request that the actions taken be notified to third parties to whom personal data have been transferred,
g) To object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems, and
h) To receive copies of their personal data.

You may contact us regarding your opinions and questions. Pursuant to Article 13(1) of the Law on the Protection of Personal Data (KVKK), you may submit your request to exercise your above-mentioned rights to our Company in writing or by other methods determined by the Personal Data Protection Board.

Method of Application by the Personal Data Subject

You may submit your requests regarding your rights stated above by using the “Application Form.”

You may submit your applications regarding your requests:

  • In person,

  • By registered mail with return receipt,

  • Through a notary public,

  • By delivering a wet-ink signed copy to the address Sanayi Mahallesi, E80 Bağlantı Yolu Bulvarı No:20/227, 34906 Pendik/İstanbul, or

  • By any other method stipulated by the Personal Data Protection Board.

Your request will be evaluated and concluded as soon as possible and, in any case, within the period specified in the Law on the Protection of Personal Data (KVKK). However, if the written response to your application exceeds 10 pages and/or needs to be provided on a recording medium such as a CD or flash memory, a fee determined by the Personal Data Protection Board within the provisions of the “Communiqué on the Principles and Procedures for the Application to the Data Controller” will be charged.

For third parties to make an application on your behalf, a special power of attorney issued through a notary public in the name of the person who will apply must be available.

If the examination and conclusion of your application require a cost, the fee in the tariff determined by the Board may be charged by our Company.