Personal Data Protection

Personal Data: Refers to any information relating to an identified or identifiable natural person. To understand customer preferences and provide better service and for similar purposes, the Company may collect, through its websites, data generally referred to as “web log information” (information relating to users’ internet browsers, mobile devices, operating systems, pages visited, other internet pages from which those pages were accessed, the date and time the relevant website was visited, specific pages visited, and more) and may use cookies when pages on the website are visited. In this context, if Personal Data are obtained or if data collected in this way are processed together and thereby point to a specific person, cookies and web log information shall also be subject to this Text. The Company collects location data and makes video recordings via location tracking devices integrated into vehicles and cameras placed inside and outside the vehicles, for the purpose of ensuring vehicle–customer security. These personal data are processed automatically on the legal grounds set out in Article 5 of the Law, namely “it is necessary for the data controller to fulfil its legal obligation” and “data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.” Such personal data may be transferred to judicial authorities or the relevant law enforcement authorities for the resolution of legal disputes or upon request as required by the relevant legislation. In this context, if Personal Data are obtained or if data collected in this way are processed together and thereby point to a specific person, video recordings and location data shall also be subject to this Text.

Special Category / Sensitive Personal Data: Refers to data relating to race, ethnic origin, political opinions, philosophical belief, religion, sect or other beliefs, clothing and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric data. Sensitive data may only be processed under strict conditions and generally require the explicit consent of the data subject.

Data Subject or Data Owner: Includes all natural persons, including employees, whose Personal Data are processed by ZiraatFİLO. The data subject does not have to be a Turkish citizen or reside in Türkiye. All data subjects have legal rights regarding their personal data.

Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. These persons are responsible for setting practices and principles in compliance with the Law. For all personal data used in ZiraatFİLO’s business processes, the relevant ZiraatFİLO is the data controller.

Data Processor: Refers to any person who processes data on behalf of a data controller based on the authority granted by the data controller. Employees of the data controller are excluded from this definition; however, where applicable, suppliers, business partners and other third parties that process personal data on behalf of ZiraatFİLO may be included within this definition.

Data Processing / Processing: Encompasses any activity related to the use of data. It includes one or several operations performed on the data such as obtaining, recording or retaining the data, or organizing, altering, retrieving, using, disclosing, deleting or destroying the data. Transferring data to third parties also constitutes processing.

Method

As ZiraatFİLO, in our capacity as data controller, and via our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels, in-vehicle and out-of-vehicle cameras, vehicle location tracking devices, and any other channels without limitation, your personal and/or special category personal data that we obtain with your consent may be obtained in whole or in part, recorded, retained, stored, altered, updated, periodically checked, rearranged, classified, preserved for the period required for the purpose of processing or as stipulated by the relevant law, and—where legally or practically necessary for the service—shared/transferred with private or legal persons with whom ZiraatFİLO cooperates or with public institutions and organizations to which it is legally obliged to disclose, and/or with the relevant third-party natural or legal persons resident in Türkiye or abroad; and where legally or practically necessary for the service, may be transferred abroad. ZiraatFİLO informs you that it may process your personal data, in any case in compliance with Law No. 6698 and the relevant legislation, for purposes such as enabling customers to benefit from our services, informing you about our campaigns subject to your consent, recording your suggestions and complaints, establishing better service standards for you, and determining and implementing ZiraatFİLO’s commercial and business strategies.

Collection, Processing and Purposes of Personal Data

As ZiraatFİLO, in our capacity as data controller, within the scope of our legal obligations arising from the legislation, we collect your personal data verbally, via website, social media platforms, mobile applications and similar means, by verbal, written or electronic methods for the purposes of duly performing our services such as long- and short-term vehicle rental, sale, transfer, registration, loss procedures, license renewal and issuance, plate renewal and issuance, traffic consultancy services, second-hand vehicle sales and after-sales services, wholesale spare parts and accessory sales, customer and vehicle security, provision of insurance and financing services; informing you about our campaigns subject to your consent; recording your suggestions and complaints; establishing better service standards for you; and determining and implementing ZiraatFİLO’s commercial and business strategies. Personal Data are processed by ZiraatFİLO in accordance with the procedures and principles stipulated in the Law and in this Text. When processing Personal Data, ZiraatFİLO adheres to the following principles:

Personal Data are processed in accordance with the relevant legal rules and the principles of good faith.

The accuracy and up-to-dateness of Personal Data are ensured. In this context, issues such as the determinability of the sources from which the data are obtained, verification of their accuracy, and evaluation of whether they need to be updated are carefully considered.

Personal Data are processed for specific, explicit and legitimate purposes. The legitimacy of the purpose means that the Personal Data processed by ZiraatFİLO are related to and necessary for the work it performs or the service it provides.

Personal Data are related to the realization of the purposes determined by ZiraatFİLO; processing of Personal Data that are not related to or not needed for the realization of the purpose is avoided. The processed data are limited to what is necessary for the realization of the purpose. In this context, Personal Data processed are relevant, limited and proportionate to the purpose for which they are processed.

If a period is stipulated in the relevant legislation for the retention of data, these periods are complied with; otherwise, Personal Data are retained only for the period necessary for the purpose for which they are processed. If there is no longer a valid reason to retain the Personal Data longer, such data are deleted, destroyed or anonymized.

Conditions for Processing Personal Data

ZiraatFİLO does not process Personal Data without the explicit consent of the data subject. If one of the conditions below exists, Personal Data may be processed without seeking the explicit consent of the data subject.

ZiraatFİLO may process the Personal Data of Data Subjects even without explicit consent in cases clearly stipulated by laws. For example, under Article 230 of the Tax Procedure Law, the explicit consent of the relevant person will not be sought in order to include that person’s name on an invoice.

Personal Data may be processed without explicit consent to protect the life or physical integrity of the person who is unable to express his/her consent due to actual impossibility or whose consent is not legally valid. For example, in a situation where a person’s consciousness is not clear or where consent is invalid due to mental illness, Personal Data of the Data Subject may be processed during a medical intervention in order to protect life or physical integrity. In this context, data such as blood type, past illnesses and surgeries, and medications used may be processed via the relevant health system.

Provided that it is directly related to the establishment or performance of a contract by ZiraatFİLO, Personal Data of the parties to the contract may be processed. For example, the account number of the creditor may be obtained in order to make a payment under a contract.

If it is necessary for ZiraatFİLO, as data controller, to fulfil its legal obligations, it may process the Personal Data of Data Subjects.

Personal Data that have been made public by the Data Subjects themselves, in other words disclosed to the public in any way, may be processed by ZiraatFİLO because the legal interest requiring protection has disappeared.

ZiraatFİLO may process Personal Data without seeking explicit consent where processing is necessary for the establishment, exercise or protection of a legal right.

ZiraatFİLO may process Personal Data of Data Subjects where processing is necessary for the legitimate interests of ZiraatFİLO, provided that it does not harm the fundamental rights and freedoms of the Data Subjects under the Law and the Policy. The Company shows due diligence in complying with the fundamental principles related to the protection of Personal Data and in observing the balance of interests of Data Subjects.

Conditions for Processing Special Category Personal Data

ZiraatFİLO does not process Special Category Personal Data without the explicit consent of the data subject. However, Personal Data other than those relating to health and sexual life may be processed without seeking the explicit consent of the relevant person in cases stipulated by laws. Personal Data relating to health and sexual life may be processed by ZiraatFİLO without the explicit consent of the relevant person only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing, under conditions where we are subject to a duty of confidentiality. ZiraatFİLO carries out the necessary procedures to take the adequate measures determined by the Board regarding the processing of Special Category Personal Data.

Cases Where Consent Is Not Required for Collecting and Processing Personal Data

Pursuant to Article 5/2 of the Law No. 6698, ZiraatFİLO has the right to process personal data without obtaining explicit consent in cases where it is clearly stipulated in laws; where it is necessary for the processing of personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract; where it is necessary for ZiraatFİLO, as data controller, to fulfil its legal obligation; where the data have been made public by the relevant person; where processing is necessary for the establishment, exercise or protection of a right; and where processing is necessary for the legitimate interests of the Company as data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person. Disclosures, uses and transfers of Data to be made for the fulfilment of ZiraatFİLO’s legal obligations arising from the legislation to which it is subject and/or due to legal obligations and/or for the fulfilment of the obligation to transfer Data to persons who may request secrets under the laws, and Data included in official registries or in balance sheets and annual reports in accordance with the principle of transparency in the laws, or Data required to be disclosed to inform the public under the provisions of the laws, are not subject to ZiraatFİLO’s confidentiality obligation, and ZiraatFİLO is authorized to disclose, provide, process and transfer such Data to the relevant persons without the need to obtain an additional consent form for such Data.

Transfer of Personal Data and Conditions

ZiraatFİLO may transfer the Personal Data and Special Category Personal Data of Data Subjects to third parties in accordance with the Law by establishing the necessary confidentiality conditions and taking security measures, in line with the purposes of processing Personal Data. ZiraatFİLO acts in accordance with the regulations stipulated in the Law during the transfer of Personal Data. In this context, ZiraatFİLO may transfer Personal Data to third parties, on the basis of one or more of the Personal Data processing conditions set out in Article 5 of the Law and limited to legitimate and lawful Personal Data processing purposes, namely: if the Data Subject has given explicit consent; if there is an explicit regulation in the laws that Personal Data will be transferred; if it is necessary for the protection of the life or physical integrity of the Data Subject or another person and the Data Subject is unable to express his/her consent due to actual impossibility or his/her consent is not legally valid; if it is necessary to transfer Personal Data of the parties to a contract, provided that it is directly related to the establishment or performance of a contract; if the transfer of Personal Data is mandatory for ZiraatFİLO to fulfil its legal obligations; if the Personal Data have been made public by the Data Subject; if the transfer of Personal Data is necessary for the establishment, exercise or protection of a right; if the transfer of Personal Data is necessary for the legitimate interests of ZiraatFİLO, provided that it does not harm the fundamental rights and freedoms of the Data Subject.

Conditions for Transfer of Special Category Personal Data

By exercising due care, taking necessary security measures and taking the adequate measures stipulated by the Personal Data Protection Board, ZiraatFİLO may transfer the Special Category Personal Data of the Data Subject to third parties, in line with legitimate and lawful Personal Data processing purposes, in the following cases: (i) if the Data Subject has given explicit consent, or (ii) without seeking explicit consent of the Data Subject if the following conditions exist;
Special Category Personal Data of the Data Subject other than those relating to health and sexual life (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership of association, foundation or trade union, data relating to criminal convictions and security measures, and biometric and genetic data) may be processed in cases stipulated by laws;
Special Category Personal Data of the Data Subject relating to health and sexual life may be processed only by persons under the obligation of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing.

Purposes of Processing and Transferring Personal Data

Personal Data are processed, in accordance with the Law and its purposes, for the following purposes and limited to the conditions for processing personal data specified in Articles 5 and 6 of the Law: best planning and implementation of ZiraatFİLO’s human resources policies; proper planning, execution and management of its business partnerships and strategies; ensuring the legal, commercial and physical security of itself, its business partners and customers; ensuring corporate functioning, planning and execution of management and communication activities; enabling Data Subjects to best benefit from its products and services and customizing and recommending them according to their requests, needs and demands; ensuring the highest level of data security; creation of databases; development of the services offered on the website and elimination of errors occurring on the site; contacting Data Subjects who submit requests and complaints and managing request and complaint processes; event management; management of relations with business partners or suppliers; execution of personnel supply processes; supporting Group Companies in personnel supply processes and compliance with the relevant legislation; planning and execution of audit activities to ensure that the activities of Group Companies are carried out in accordance with the relevant legislation; supporting Group Companies in the realization of company and partnership law transactions; execution/monitoring of financial reporting and risk management processes; execution/monitoring of the Company’s legal affairs; carrying out activities aimed at protecting its reputation; management of investor relations; providing information to authorized organizations arising from the legislation; creation and tracking of visitor records. If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the Law, your explicit consent is obtained by ZiraatFİLO for the relevant processing activity.

Method and Legal Basis for Collecting Personal Data; Deletion, Destruction, Retention Period

Method and Legal Basis for Collecting Personal Data

For the purpose of auditing compliance with Article 1 regulating the purpose of the Law and Article 2 regulating the scope of the Law, Personal Data are collected in any verbal, written or electronic environment; by technical and other methods; through various channels such as call center, ZiraatFİLO website and mobile application; within the framework of legal reasons based on legislation, contracts, requests and demands, in order to fully and correctly fulfil responsibilities arising from the law, and are processed by the Company or by data processors assigned by the Company.

Deletion, Destruction or Anonymization of Personal Data

Without prejudice to the provisions contained in other laws regarding the deletion, destruction or anonymization of Personal Data, ZiraatFİLO deletes, destroys or anonymizes Personal Data ex officio or upon the request of the data subject if the reasons requiring processing cease to exist, even though it has processed them in accordance with this Law and other laws. Deletion of Personal Data means that these data are destroyed in such a way that they can no longer be used and cannot be recovered. Accordingly, Personal Data are deleted in an irreversible manner from media such as documents, files, CDs, diskettes and hard disks where they are recorded. Destruction of Personal Data means the destruction of data-storing media such as documents, files, CDs, diskettes and hard disks so that the information cannot be retrieved and used again. By anonymization of data, it is meant that Personal Data are rendered in a way that they cannot be associated with an identified or identifiable natural person, even if matched with other data.

Retention Period of Personal Data

ZiraatFİLO retains Personal Data for the period specified in the legislation, if stipulated by the legislation. If no period is regulated in the legislation regarding how long personal data should be retained, Personal Data are processed for as long as required by the activity conducted while ZiraatFİLO processes such data, in accordance with ZiraatFİLO practices and commercial customs, within the framework of the rules of good faith, and then deleted, destroyed or anonymized. If the purpose of processing personal data has ceased and the end of the retention periods stipulated by the relevant legislation and determined by ZiraatFİLO has been reached, personal data may be retained only for the purpose of constituting evidence in possible legal disputes or for the exercise of a right related to personal data or for the establishment of a defense. In determining these periods, the statute of limitations for the exercise of the said right and examples of previous requests submitted to ZiraatFİLO on the same issues are taken as a basis. In this case, the personal data retained are not accessed for any other purpose and are accessed only when it is necessary to use the relevant personal data in the relevant legal dispute. After the period mentioned here expires, personal data are deleted, destroyed or anonymized.

Information Obligation

ZiraatFİLO is obliged to inform natural persons whose data will be processed at the time Personal Data are obtained. The scope of this information obligation is as follows:

Identity of the data controller and, if any, its representative,

The purposes for which Personal Data will be processed,

To whom and for what purpose the processed Personal Data may be transferred,

The method and legal reason for collecting Personal Data and the rights of the data subject.

In this regard, ZiraatFİLO will provide the necessary information through means of obtaining data from Third Parties for processing in its systems and will obtain informed consent from Data Subjects regarding data processing to prove that the information obligation has been fulfilled. Personal Data may be collected by ZiraatFİLO through all sales channels including electronic commerce and retail stores, its branches, websites, call centers from which services may be obtained from third parties, and all other channels, by automatic or non-automatic means, verbally, in writing or electronically.

Obtaining Personal Data in Writing: When obtaining Personal Data in writing, ZiraatFİLO will fulfil the Information Obligation regarding data processing, provided that the new relevant forms and information to be revised based on this Text are used. In addition, all forms and contracts, including Permission-Based Communication Forms to be obtained from persons with whom a customer relationship is established, will be revised to show the explicit consent of the Data Subject regarding the processing of Personal Data, even if the processing of the relevant data group may be considered an exception under the Law. In customer relations, new forms, documents and information that demonstrate compliance with the Law will be used; all relevant employees will be trained to provide the natural person with sufficiently detailed information and to indicate references. Personal Data will absolutely be obtained with written forms containing informed consents.

Obtaining Personal Data Orally: During the obtaining of any new data regarding existing customers processed pursuant to the Permission-Based Communication Forms already obtained or during the obtaining of data via the Call Center, information will be provided regarding the information obligation for the processing of Personal Data. During oral data collection, it will be reminded in advance that the call is recorded and it will be confirmed that consent has been given to process the Personal Data in accordance with this Policy and, if any, the existing Permission-Based Communication Forms. The work processes of employees and the Call Center will be re-evaluated and implemented within this framework.

Obtaining Personal Data Electronically: Data obtained through electronic commerce channels and other internet channels of ZiraatFİLO are also subject to this Information Text, and all contracts and documents / link addresses / web pages requiring the obtaining and processing of Personal Data have been revised to fulfil the information obligation regarding the processing of Personal Data. This Text will be available on all internet pages, will be placed on ZiraatFİLO websites in a way that can be accessed from all pages, and systems requiring the approval of data processing by ZiraatFİLO for the collection of data will be established at every link address where data collection may be required. Unless it is explicitly indicated that consent has been given for the processing of Personal Data, no information or document entered will be automatically recorded in any ZiraatFİLO system and will not be processed in any way.

Obtaining Personal Data in In-Vehicle and Out-of-Vehicle Environments: When obtaining Personal Data in the form of video recording and location information, ZiraatFİLO will fulfil the Information Obligation regarding data processing, provided that new video recordings and location information to be revised based on this Text are used. In addition, all kinds of video recordings and location information to be obtained from persons with whom a customer relationship is established will be revised to fulfil the information obligation towards the Data Subject regarding the processing of Personal Data, even if the processing of the relevant data group may be considered an exception under the Law. In customer relations, information that demonstrates compliance with the Law will be used; all relevant employees will be trained to provide the natural person with sufficiently detailed information and to indicate references. It will be ensured that Personal Data are obtained with stickers directing to the information texts.

Your Rights Regarding the Protection of Personal Data

ZiraatFİLO will respond to the following requests submitted by the relevant persons in writing, verbally or by e-mail:
a) Learning whether ZiraatFİLO processes personal data relating to them and which personal data it processes,
b) Obtaining information regarding the purposes of processing,
c) Knowing the third parties to whom ZiraatFİLO transfers personal data domestically or abroad,
d) Requesting the correction of personal data if they are processed incompletely or inaccurately,
e) Requesting the deletion or destruction of personal data in accordance with the Law,
f) If a request is made for the correction, deletion or destruction of personal data; requesting that the transactions carried out be notified to third parties to whom personal data have been transferred,
g) Objecting to the occurrence of a result to the detriment of the person concerned by analyzing the processed data exclusively through automated systems, and
h) Receiving copies of their personal data.

You may contact us with your opinions and questions. Pursuant to Article 13/1 of the Law, you may submit your request regarding the exercise of your rights above to our Company in writing or by other methods determined by the Personal Data Protection Board.

Data Subject Application Procedure

You may use the “Application Form” to submit your requests regarding your rights stated above.

You may submit your applications regarding your requests:

In person,

By registered mail with return receipt,

Through a notary public,

With a wet-ink signed copy delivered to the address Sanayi Mahallesi, E80 Bağlantı Yolu Bulvarı No:20/227 34906 Pendik/İstanbul, or By another method stipulated by the Personal Data Protection Board.

Your request will be evaluated and concluded as soon as possible and, in any case, within the period specified in the KVKK. However, if the written response to be provided by us regarding your application exceeds 10 pages and/or requires delivery on a recording medium such as a CD or flash drive, a fee determined by the Personal Data Protection Board will be charged in accordance with the provisions of the “Communiqué on the Principles and Procedures of Application to the Data Controller.”

For third parties to submit an application request on your behalf, a special power of attorney issued through a notary public on behalf of the person who will apply is required.

If the processing related to the examination and conclusion of your application requires a cost, a fee in the tariff determined by the Board may be charged by our Company.