Personal Data Protection

Personal Data Protection

Our Company has the capacity of "Data Controller" pursuant to "Personal Data Protection Law" No 6998 promulgated on Official Journal of 07.04.2016. As CENTRAL OTO KİRALAMA ANONİM ŞİRKETİ, we exercise outmost care to security and privacy of your personal data. With this awareness, we place a great importance to processing and storage of any kind of personal data of all persons having a relation with our Company, including persons benefiting from our services and products, in accordance with Personal Data Protection Law No 6698. As being fully cognized of this responsibility of us, and with the title of "Data Controller" as further defined in the Law, we are processing our personal data as further detailed below and within the limitations as set out by the legislation.

Definitions

Text: This information text.

Data: Data stored electronically or in several paper-based filing systems.

Personal Data: Any of kind data pertaining to identified or identifiable natural person. Company can collect data, generally called "web record data" (including but not limited to date and time of users access to their web browsers, mobile devices, operating systems, web sites, other websites, related webpage, specific pages visited, and others) via websites, and use cookies if the pages within website is visited by users in order to understand the customer preferences and to provide better services and for similar purposes. In this context, if Personal Data are collected, or co-processing of data collected by this way indicates an identifiable person, then cookies and web record data will also be subject to this Text.

Sensitive Personal Data: data related to race, ethnicity, political opinions, philosophical belief, religion, sect or other beliefs, dressing, charity, association or union membership, health, sexual life, criminal conviction and security measures as well as biometric and genetic data. Sensitive data can only be processed under strict conditions, and their processing generally requires explicit consent of the data subject.

Data Subjects: Includes all natural persons including personnel, whose personal data have been processed by CENTRAL RENT A CAR. Data Subject is not necessarily be a citizen or resident of Turkey. All data subjects have legal rights with respect to their own personal data.

Data Controller: the natural or legal person which identifies the purposes and means of processing of personal data, and is responsible for setting up and management of the data recording system. These persons have responsibilities in determining applications and principles in line with the Law. Data Controller is relevant CENTRAL RENT A CAR with respect to all personal data used in business processes of CENTRAL RENT A CAR.

Data Processor: Any person who processes data in reliance upon the authority granted by a data controller, and on behalf of such data controller. Personnel of data processor are excluded from this definition, however, if practicable, vendors, business partners and other third parties that process personal data on behalf of CENTRAL RENT A CAR may be included in this definition.

Data Processing / Processing: Includes all activities relating to data use. It includes one or several processes executed on the data, including but not limited to data collection, storage or retention, or data organization, modification, retrieval, use, explanation, erasure or destruction. Transfer of data to third parties also mean a data processing.

METHOD

As CENTRAL RENT A CAR, we, acting as a "data controller", can perform following activities with regard to your personal and/or sensitive data, partially or as a whole, we collected with your consent via any kind of channels including but not limited to our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels: collection, recording, saving, storage, modification, update, periodical checks, reorganization, reclassification, retention for a period of time as required by laws or for the purpose of processing, or sharing/transferring, when legally or practically required, to natural and/or legal persons with whom CENTRAL RENT A CAR works or, when legally required, public authorities and bodies, and/or related 3rd natural/legal persons residing in Turkey or at abroad, and/or, when legally or practically required, transferring them to abroad. We would like to inform you that we can process your personal data for the purposes such as to facilitate customers of CENTRAL RENT A CAR benefit from our services, to inform you about our campaigns with your consent, record your suggestions and complaints, to create better service standards in favor of you, to determine and apply the commercial and business strategies of CENTRAL RENT A CAR, and in any case in accordance with Personal Data Protection Law No 6698, and applicable legislation.

COLLECTING AND PROCESSING PERSONAL DATA AND PURPOSES

As CENTRAL RENT A CAR, we, acting as a "data controller", collect your personal data through verbal, written or electronic methods, via verbal, website, social media platforms, mobile apps and similar means for the purposes such as to duly perform long and short-term car rental, sales, transfer, registration, loss, license renewal and issuance, license plate renewal and issuance, traffic consultancy services, second-hand vehicle sales, and aftersales services, to facilitate you benefit from our services such as insurance and financing services, wholesale spare-part and accessory sales, to inform you about our campaigns with your consent, record your suggestions and complaints, to create better service standards in favor of you, to determine and apply the commercial and business strategies of CENTRAL RENT A CAR, under our legal obligations. Personal Data shall be processed by CENTRAL RENT A CAR in accordance with the principles and procedures as stipulated in the Law as well as in this Text. While processing Personal Data, CENTRAL RENT A CAR acts in line with the following principles: - Personal Data are processed in accordance with the requirements of applicable law rules and rule of integrity.

- Personal Data are kept accurately and up-to-date. In this context, outmost care is applied to ensure that data are collected from a known origin, are confirmed in respect of accuracy, and if data need to be updated.

- Personal data shall only be processed for specified, explicit and legitimate purposes. Legitimacy of purpose means that Personal Data processed by CENTRAL RENT A CAR is relevant to and necessary for its business or services.

- Personal Data shall be relevant to the purposes defined by CENTRAL RENT A CAR, and processing of Personal Data that are irrelevant or not needed for the realization of the purposes shall be avoided. Data to be processed shall be limited to those absolutely needed for the realization of the purpose. In this context, Personal Data processed are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

- If applicable legislation stipulates a data retention period, these periods shall be observed; otherwise, Personal Data shall only be retained for the period required for the purpose for which they are processed. If there is no longer a valid reason for the retention of Personal Data for a longer period of time, said data shall be erased, destroyed or anonymized.

Conditions for Processing of Personal Data

CENTRAL RENT A CAR shall not process Personal Data without explicit consent of data subject. Personal Data can be processed without requiring explicit consent of data subject, in any of the following conditions.

- CENTRAL RENT A CAR can process Personal Data of Data Subjects if the laws require to do so, even without explicit consent of Personal Data. For instance, no explicit consent will be required from data subject to enter the name of data subject in the invoice pursuant to Article 230 of Tax Procedures Law.

- Personal data can be processed if it is necessary to process your personal data in order to protect the life or physical integrity of a person or another person who are unable to give explicit consent due to physical disability or whose consent cannot be deemed valid. For instance, Personal Data of Data Subject can be processed during a medical intervention in order to protect life or physical integrity, in the event where the said person is unconscious, or his/her consent is invalid because of his/her mental disability. In this context, data such as blood type, disease and surgery history, medications can be processed via relevant health system.

- Personal Data of the contract parties can be processed provided that they are directly related to the establishment or performance of a contract by CENTRAL RENT A CAR. For instance, bank account number of payer can be obtained for the payment as required under a contract.

- CENTRAL RENT A CAR can process Personal Data of Data Subject if it is necessary for it, as a data controller, to fulfill its legal obligations.

- CENTRAL RENT A CAR can process the Personal Data which are made publicly available by Data Subjects as the legal interest that require protection has ceased to exist.

- CENTRAL RENT A CAR can process Personal Data of Data Subjects without requiring explicit consent where it is necessary to process data for exercising or protecting legally legitimate right.

- CENTRAL RENT A CAR can process Personal Data of Data Subjects where processing of Personal Data is mandatory for securing legitimate interests provided that it does not infringe the basic rights and freedoms of Data Subjects protected under the Laws and Policy. Company exercises due care in adherence to basic principles of protection of Personal Data and observing the interest balance of Data Subjects.

Conditions for Processing of Sensitive Personal Data

CENTRAL RENT A CAR may not process Sensitive Personal Data without explicit consent of data subject. However, Personal Data, other than health and sexual life, as listed in the first paragraph may be processed without seeking explicit consent of data subjects in the events as prescribed in the laws. Personal Data regarding the health and sexual life may only be processed by CENTRAL RENT A CAR, without seeking explicit consent of the data subject for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing, where we are subject to the non-disclosure obligation. In processing of the Sensitive Personal Data, CENTRAL RENT A CAR applies the instructions of the Board in terms of taking adequate measures.

EVENTS WHERE CONSENT IS REQUIRED FOR COLLECTING AND PROCESSING PERSONAL DATA

CENTRAL RENT A CAR has right to process personal data without seeking explicit consent if processing of personal data to the parties of a contract is necessary provided that it is directly related to the conclusion or fulfilment of that contract; processing of data is mandatory for CENTRAL RENT A CAR, as a data controller, to fulfill its legal obligations; processing of data is mandatory for the establishment, exercise or protection of any right; personal data has already been made publicly available by data subject; processing of data is mandatory for the legitimate interests of Company, being a data controller, provided that it does not infringe basic rights and freedoms of data subject. CENTRAL RENT A CAR is not subject to non-disclosure obligation with respect to the Data which are contained in the public registries or balance sheets and activity reports which are publish or publicly made available or pursuant to principle of clarity as prescribed by the laws, or such data which must be made available publicly for the purposes of informing the public pursuant to the provisions of legislation, and data disclosure, use and transfers of CENTRAL RENT A CAR required to fulfill the legal obligations, and/or due to the legal requirements, and/or to fulfill the obligation to transfer personal data to the persons who are authorized by laws to request such secrets, and CENTRAL RENT A CAR is authorized to disclose, provide, process and transfer said Personal Data to said persons without requiring further letter of consent.

CONDITIONS FOR PERSONAL DATA TRANSFER

CENTRAL RENT A CAR can transfer Personal Data and Sensitive Personal Data of the Data Subjects to third parties in accordance with the law by creating necessary privacy conditions and taking security measures in line with the purposes of Personal Data Processing. During transfer of Personal Data, CENTRAL RENT A CAR acts in line with the regulations prescribed in the Law. In this context, CENTRAL RENT A CAR may transfer Personal Data to third parties in line with the legitimate and legal purposes of Personal Data processing, on the basis of and limited to one or several of the Personal Data processing conditions, stipulated in the Article 5 of the Law, as listed below: If there is explicit consent of Data Subject; there is an explicit provisions of Laws which permit transfer of Personal Data, if it is mandatory for protection of life or physical integrity of Data subject or another person and if Data subject is unable to give its consent due to the physical disability, or whose consent cannot held legally valid, if it is necessary for transferring Personal Data of the contract parties provided that it is directly relevant to establishment or performance of a contract, and Personal Data transfer is mandatory for CENTRAL RENT A CAR to fulfill its legal obligation, if Personal Data have already been made publicly available by Data Subject, or transfer of Personal Data is mandatory for establishment, exercise or protection of a right, and Personal Data transfer is mandatory for legitimate interests of CENTRAL RENT A CAR.

Conditions for Sensitive Personal Data Transfer

CENTRAL RENT A CAR can transfer Sensitive Personal Data of Data Subject to third parties, by exercising due care, by taking necessary security measures, and by taking adequate measures as prescribed by Personal Data Protection Board, in line with the legitimate and legal purposes of Personal Data process if: (i) if there is explicit consent of Data Subject, or (ii) without explicit consent of Data Subject in the event that;

it is prescribed by the laws, for the sensitive personal data other than health and sexual life, (data regarding the race, ethnicity, political ideas, philosophical belief, religion, sect or other beliefs, dressing, membership in foundation, association or union, criminal conviction and security measurements as well as biometrics and genetics),

they are required by any person or authorized public institutions and organizations that are under confidentiality obligation, for the Sensitive Personal data relating to health and sexual life, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

Purposes of Personal Data Processing and Transfer

Personal Data are processed in line with the law and purpose of the Legislation, subject to the conditions for personal data processing set forth in Articles 5 and 6, limited to the following purposes of CENTRAL RENT A CAR: to plan and apply human resources policies in the best manner; to plan, execute and manage the business partners and strategies accurately; to maintain legal, commercial and physical security of itself and its business partners; to maintain corporate operations, to plan and carry out management and communication activities; to facilitate Data Subject to benefit its products and services in the best way and to tailor and suggest them to the customers in accordance with their demands, needs and requests; to maintain the highest level of Data security; to create databases; to develop services made available through its website; and to eliminate the errors occurred in the website; to contact with Data Subjects whom have provided requests and complaints to him, and to facilitate request and compliant management; to carry out Event management, relations with Business Partners or vendors, to carry out personnel recruitment processes; to Support Group Companies in their personnel recruitment processes and compliance with relevant legislation, to plan and implement audit activities to ensure Group Companies manage the activities in line with the applicable legislation; to support Group Companies in performance of their companies and partnership law activities; to implement/follow up financial reporting and risk management activities; to carry out/follow up Company's law activities; to implement activities for protection of its reputation, to manage the investor relations, to provide public authorities information as required by the laws, to create and follow up visitor records. If data processing does not meet any of the conditions as prescribed by the Law, then CENTRAL RENT A CAR seeks your explicit consent with respect to the said processing.

METHOD AND LEGAL GROUND OF PERSONAL DATA COLLECTION, ERASURE, DESTRUCTION, RETENTION PERIOD

Method and Legal Ground of Personal Data Collection

Personal data are collected in any kind of verbal, written and electronic environment, via technical and other methods, through means such as call center, CENTRAL RENT A CAR website, mobile app, within the legislative, contract, request and demand-based legal grounds in order to fulfill the legal obligations completely and accurately and are processed by Company or the data processors designated by Company, in accordance with Articles 1 and 2 of the Law.

Erasure, Destruction or Anonymization of Personal Data

CENTRAL RENT A CAR will erase, destroy or anonymize Personal Data ex-officio or at the request of the data subject when the legal grounds of the personal data processing ceases to exist, provided that other provisions in other laws regarding the erasure, destruction or anonymization of personal data are reserved. With erasure of the Personal Data, these data are destroyed such that they will never be reused and retrieved again. Accordingly, Personal Data will be erased irrecoverably from the media where they are stored such as document, file, CD, diskette, hard disk. Destruction of the personal data means destruction of the data storage media such as document, file, CD, diskette, hard disk so that data will never be retrieved and reused. Anonymization of personal data is the process of rendering personal data impossible to link with an identified or identifiable real person, including mapping them with other data.

Retention Period of Personal Data

CENTRAL RENT A CAR retains Personal Data for the period of time, if any, prescribed by the legislation, If there is no period of time defined by the legislation for the retention of the personal data, then Personal Data are retained by CENTRAL RENT A CAR for a period of time, which is defined according to the nature of the activity, applications of CENTRAL RENT A CAR, and business customs, under the rules of integrity, after which they are erased, destroyed or anonymized. When purpose of processing personal data ceased to exit, and retention periods, as defined by the legislation and CENTRAL RENT A CAR has also ended, personal data may only be retained in order to produce an evidence in case of a potential legal dispute, or seek or defend rights in connection with personal data. In this case, determination of retention periods are based on the lapse of time applicable for seeking said right, and previous cases involving claims against CENTRAL RENT A CAR despite of such lapse of time. In this case, further, personal data so retained remains inaccessible for any other purposes, and is accessible only if they are needed for related legal dispute. Personal data are erased, destroyed or anonymized after expiry of said period of time.

OBLIGATION TO INFORM

CENTRAL RENT A CAR is obliged to inform natural persons whose data will be processed during the collection of the personal data. This obligation to inform include:

- Identity information of the data controller and, if any, its representative.

- Purposes for which personal data will be processed,

- To whom and for what purposes personal data processed can be transferred,

- Method of and the legal grounds for collecting personal data, and rights.

In this respect, CENTRAL RENT A CAR will provide necessary information via Third Party data collection means to process them in its own systems, and obtain the informed consent from Data Subjects on the data processing to prove that he fulfilled its obligation to inform. Personal Data can be collected verbally, in writing or electronically via automatic or non-automatic means, through all sales channels including electronic commerce, sales shops, as well as branches, websites, outsourced Call Centers and all other similar channels available to CENTRAL RENT A CAR.

- Personal Data Collection in Writing: During Personal Data Collection in writing, CENTRAL RENT A CAR will fulfill his obligation to inform on data processing by using new related forms and information to be revised on the basis of this Text. Also, any kind of forms and agreements, including Consented Contact Forms to be obtained from persons with whom customer relation is established will be revised so that they will show the explicit consent of Data Subject on the Personal Data processing, even if they are considered as exception pursuant to Law. In the customer relations, new forms, documents and information texts which will confirm the compliance with the Law, and all relevant personnel will be trained so as to ensure they provide natural person information in adequate detail as well as references. Personal Data collection shall absolutely be carried out via written forms which contain informed consent.

- Personal Data Collection Verbally: Information on the obligation to inform regarding Personal Data processing will be provided during the collection of new data relating to the existing customers, whose personal was already processed via Consented Contact Form, or data collection through Call Center. During data collection verbally, customer will be reminded that call is being recorded via a prior information, and it will be confirmed that they have given their consent on that their personal data will be processed under this Policy and, if any, existing Consented Contact Form. Personnel and Call Center processes will be re-evaluated and implemented in this context.

- Personal Data Collection Electronically: All contracts and documents / websites / webpages, including this Information Text, which require collection and processing of Personal Data including those collected via electronic commerce channels and other Internet channels of CENTRAL RENT A CAR as well as all contracts is revised so as to fulfill our obligation to inform regarding Personal Data processing. This Text will be included in the websites of CENTRAL RENT A CAR so that it can be accessible via all websites, and the systems will be established which require approval of data processing by CENTRAL RENT A CAR for data collection in every link address which will require data collection. No information and document entered will automatically be recorded in the CENTRAL RENT A CAR system and will never be processed by any means unless it is clearly marked that consent is given to the processing of Personal Data,

YOUR RIGHTS REGARDING THE PERSONAL DATA PROTECTION

CENTRAL RENT A CAR will process following requests of Data Subject submitted in written, verbally or via electronic mail:

a) learn if their personal data has been processed by CENTRAL RENT A CAR, and if any, which personal data

b) get information about the purposes of processing,

c) get information about third parties, foreign or local, to which their personal data is transferred by CENTRAL RENT A CAR,

d) if their personal data are processed in part or inaccurately, then submit a request to correct them,

e) request erasure and destruction of the personal data in accordance with Law,

f) if your personal data is corrected, erased or destroyed, then request to inform these actions to the third parties to which your personal data has been transferred,

g) object against occurrence of any results that are against their interests after their data processed are analyzed via exclusive automatic systems, and

h) obtain a copy of their personal data.

For your questions and opinions, you can contact us. By virtue of the Article 13(1) of the Law, you can submit your request for exercising your aforementioned rights to our Company in writing or by means of other methods to be determined by Personal Data Protection Board

Data Subject Application Procedure

To submit your requests regarding your aforementioned rights, you can use "Application Form".

You can submit your wet-signed applications;

By hand

With registered mail with return request

Via a notary public

to the address of Koşuyolu Mahallesi Koşuyolu Caddesi Onko Koçsel Blok No:34-38, İç Kapı No: 4 Kadıköy / İstanbul, or via such other methods prescribed by Personal Data Protection Board. Your request will be evaluated and concluded in the shortest time or in any case, at latest, within the period as defined in the Law. However, if the written answer to be provided by us is longer than 10 pages, and/or must be submitted in a storage medium such as CD, flash disk, then it will be subject to the fees set by Personal Data Protection Board in accordance with provisions of "Communique on Principles and Procedures of Application to Data Controller".

For applications by 3rd parties on behalf of you, said persons must have a power of attorney issued to their name by a notary public.

If any process for evaluation and conclusion of your application require costs, our Company may charge the fee indicated in the list determined by Board.