Kvkk

Personal Data Protection

Our Company is the "Data Controller" in accordance with the "Personal Data Protection Law" No. 6998, published in the Official Gazette dated April 7, 2016. As BRAND RENT A CAR, we are extremely sensitive to the security of your personal data. With this awareness, we attach great importance to the processing and storage of all personal data belonging to all individuals affiliated with the Company, including those who utilize our products and services, in accordance with Law No. 6698 on the Protection of Personal Data. With full understanding of this responsibility, as the "Data Controller" as defined in the Personal Data Protection Law, we process your personal data as explained and within the limits set by the legislation.

Definitions

Text: This disclosure text refers to:

Data: This refers to information stored electronically on a computer or in some paper-based filing systems.

Personal Data: This refers to any information relating to an identified or identifiable natural person. The Company may collect data, generally referred to as "web log information," through its websites for purposes such as understanding customer preferences and providing better service, and similar purposes. It may also collect data (information about users' internet browsers, mobile devices, operating systems, pages visited, other web pages accessed, the date and time of visiting the relevant website, specific pages visited, and more) and may use cookies when visiting pages on the website. In this context, if Personal Data is obtained or the data collected in this way is processed together, cookies and web log information will also be subject to this Text if they indicate a specific person.

Special Nature / Sensitive Personal Data: Race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, dress code, membership in associations, foundations, or unions, health, sexual life, criminal convictions, and security measures. and biometric data. Sensitive data can only be processed under strict conditions and generally requires the explicit consent of the data subject.

Data Subject(s): This includes all natural persons, including employees, whose Personal Data is processed by BRAND RENT A CAR. Data subjects do not have to be Turkish citizens or reside in Turkey. All data subjects have legal rights regarding their personal data.

Data Controller: refers to the natural or legal person responsible for determining the purposes and means of processing personal data and for establishing and managing the data recording system. These persons are responsible for establishing practices and principles in accordance with the Law. BRAND RENT A CAR is the data controller for all personal data used in BRAND RENT A CAR's business processes.

Data Processor: refers to any person who processes data on behalf of and based on the authority granted by a data controller. Employees of the data controller are excluded from this definition. However, if applicable, suppliers, business partners, and other third parties who process personal data on behalf of BRAND RENT A CAR may be included in this definition.

Data Processing / Processing: This includes all activities related to the use of data. It includes one or more operations performed on data, including obtaining, recording, or keeping data, or organizing, changing, retrieving, using, disclosing, deleting, or destroying data. Transferring data to third parties also constitutes data processing.

METHOD

As BRAND RENT A CAR, acting as the data controller, we carry out the following through our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels, and/or any other channels, including but not limited to: Your personal and/or special personal data that we obtain with your consent may be obtained, recorded, kept, stored, changed, updated, periodically checked, rearranged, classified, kept for the period required for the purpose for which they are processed or for the period stipulated in the relevant law, and in case of actual legal or service-related requirements, it may be shared/transferred with private-legal entities that BRAND RENT A CAR works with or with public institutions and organizations to which it is legally obliged and/or with relevant third-party real persons/legal entities residing in Turkey or abroad, and may be transferred abroad in case of actual legal or service-related requirements. We would like to inform you that we may process your personal data for purposes such as enabling BRAND RENT A CAR customers to benefit from our services, informing you about our campaigns with your consent, recording your suggestions and complaints, creating better service standards for you, and determining and implementing BRAND RENT A CAR commercial and business strategies. In all cases, we may process your personal data in accordance with Personal Data Protection Law No. 6698 and relevant legislation.

COLLECTION, PROCESSING, AND PURPOSES OF PERSONAL DATA

BRAND RENT A CAR, as the data controller, within the framework of our legal obligations arising from the legislation; We collect your personal data verbally, in writing or electronically through the website, social media channels, mobile applications and similar means for the purposes of allowing you to benefit from our services such as long and short-term vehicle rental, sale, transfer, registration, loss, license renewal and issuance, license plate renewal and issuance, traffic consultancy services, second-hand vehicle sales and proper after-sales services, wholesale spare parts and accessories sales, provision of insurance and financing services, etc., to inform you about our campaigns with your approval, to record your suggestions and complaints, to create better service standards for you, and to determine and implement BRAND RENT A CAR commercial and business strategies. Personal Data is processed by BRAND RENT A CAR in accordance with the procedures and principles stipulated in the Law and this Text. BRAND RENT A CAR acts with the following principles when processing Personal Data: - Personal Data is processed in accordance with the relevant legal rules and the requirements of the principle of good faith.

- Personal Data is ensured to be accurate and up-to-date. In this context, issues such as identifying the sources from which the data was obtained, verifying its accuracy, and assessing whether it needs to be updated are carefully considered.

- Personal Data is processed for specific, clear, and legitimate purposes. A legitimate purpose means that the Personal Data processed by BRAND RENT A CAR is related to and necessary for the business it performs or the service it offers.

- Personal Data is related to the achievement of the purposes determined by BRAND RENT A CAR, and the processing of Personal Data that is not relevant or needed for the achievement of the purpose is avoided. The data processed is limited to what is necessary for the achievement of the purpose. Personal Data processed within this scope is linked, limited, and proportionate to the purpose for which it is processed.

- If the relevant legislation specifies a retention period for data, it complies with this period; otherwise, it retains Personal Data only for the period necessary for the purpose for which it is processed. If there is no valid reason for further retention of Personal Data, the data in question is deleted, destroyed, or anonymized.

Conditions for Processing Personal Data

BRAND RENT A CAR does not process Personal Data without the explicit consent of the data subject. If one of the following conditions is met, Personal Data may be processed without the explicit consent of the data subject.

- BRAND RENT A CAR may process Personal Data of Data Subjects even without explicit consent, in cases clearly stipulated by law. For example, pursuant to Article 230 of the Tax Procedure Law, the explicit consent of the data subject will not be required for the inclusion of the data subject's name on the invoice.

- Personal Data may be processed without explicit consent for individuals who are unable to give their consent due to a physical impossibility or whose consent cannot be recognized as valid, or for the protection of the life or physical integrity of another person. For example, in cases where the data subject's consent is not valid due to unconsciousness or mental illness, the data subject's Personal Data may be processed during medical interventions to protect life or physical integrity. In this context, data such as blood type, past illnesses and surgeries, and medications used may be processed through the relevant healthcare system.

- BRAND RENT A CAR may process Personal Data belonging to the parties to a contract, provided that it is directly related to the establishment or execution of the contract. For example, the account number of the payee may be obtained for payment of money pursuant to a contract.

Conditions for Processing Personal Data

- BRAND RENT A CAR may process Personal Data of Personal Data Subjects if it is necessary to fulfill its legal obligations as a data controller.

- BRAND RENT A CAR may process Personal Data of Personal Data Subjects that has been made public by the data subject, in other words, disclosed to the public in any way, because the legal interest requiring protection has ceased to exist.

- BRAND RENT A CAR may process Personal Data of Personal Data Subjects without seeking explicit consent when data processing is necessary for the exercise or protection of a legitimate legal right.

- BRAND RENT A CAR may process Personal Data of Personal Data Subjects without seeking explicit consent if processing is necessary for the exercise or protection of a legitimate legal right.

In cases where processing Personal Data is necessary to ensure its legitimate interests, provided that it does not cause harm, the Company may process the Personal Data of Personal Data Subjects. The Company demonstrates due diligence in complying with the fundamental principles regarding the protection of Personal Data and observing the balance of interests of Personal Data Subjects.

Conditions for Processing Sensitive Personal Data

BRAND RENT A CAR does not process Sensitive Personal Data without the explicit consent of the data subject. However, Personal Data other than those related to health and sexual life may be processed without the explicit consent of the data subject in cases prescribed by law. Personal Data related to health and sexual life is processed by BRAND RENT A CAR only for the purposes of protecting public health, providing preventive medicine, medical diagnosis and treatment, and care services, and for planning and managing healthcare services and financing, and without the explicit consent of the data subject, under conditions where we are under a confidentiality obligation. BRAND RENT A CAR carries out the necessary procedures to take adequate measures determined by the Board in the processing of Special Personal Data.

CIRCUMSTANCES IN WHICH CONSENT IS NOT REQUIRED FOR COLLECTING AND PROCESSING PERSONAL DATA

In accordance with Article 5, Paragraph 2 of Law No. 6698 on the Protection of Personal Data, the processing of personal data belonging to the parties to the contract is necessary, provided that it is explicitly provided for by law, directly related to the establishment or performance of a contract, it is necessary for BRAND RENT A CAR to fulfill its legal obligations as the data controller, it has been made public by the data subject, the processing is necessary for the establishment, exercise, or protection of a right, and the processing is necessary for the legitimate interests of the Company, the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject. BRAND RENT A CAR has the right to process personal data without obtaining explicit consent. Data that is published or disclosed to the public, or included in official registries or balance sheets and activity reports in accordance with the principle of transparency stipulated in the law, or that is obliged to be disclosed for public disclosure purposes pursuant to the provisions of the law, as well as Data disclosure, use, and transfer to be made by BRAND RENT A CAR in order to fulfill its legal obligations arising from the legislation to which it is subject and/or due to legal obligations and/or to fulfill the obligation to transfer Data to persons who may request secrets by law, are not subject to BRAND RENT A CAR's confidentiality obligations, and BRAND RENT A CAR is authorized to disclose, provide, process, and transfer such Data to the relevant persons without the need for a separate consent for such Data.

PERSONAL DATA TRANSFER AND CONDITIONS

BRAND RENT A CAR may transfer Personal Data and Special Personal Data of Personal Data Owners to third parties in accordance with the Law by establishing the necessary confidentiality conditions and taking security measures in line with the purposes of processing Personal Data. BRAND RENT A CAR acts in accordance with the regulations stipulated in the Law during the transfer of Personal Data. In this context, BRAND RENT A CAR may transfer Personal Data to third parties based on and limited to one or more of the Personal Data processing conditions specified in Article 5 of the Law, in line with the legitimate and lawful Personal Data processing purposes: If the Personal Data Owner has given his/her explicit consent; If there is a clear regulation in the law regarding the transfer of Personal Data, if it is necessary to protect the life or physical integrity of the Personal Data owner or another person, and if the Personal Data owner is unable to give their consent due to a physical impossibility or if their consent is not legally valid, if the transfer of Personal Data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract, if the transfer of Personal Data is mandatory for BRAND RENT A CAR to fulfill its legal obligation, if the Personal Data has been made public by the Personal Data owner, if the transfer of Personal Data is mandatory for the establishment, exercise, or protection of a right, provided that it does not prejudice the fundamental rights and freedoms of the Personal Data owner, and if the transfer of Personal Data is mandatory for BRAND RENT A CAR's legitimate interests, the transfer may be made.

Conditions for Transfer of Sensitive Personal Data

BRAND RENT A CAR may transfer the Personal Data Owner’s Special Personal Data to third parties in the following cases, in line with legitimate and lawful Personal Data processing purposes, by showing due care, taking the necessary security measures and taking the adequate measures prescribed by the Personal Data Protection Board. (i) With the explicit consent of the Personal Data Owner, or (ii) Without the explicit consent of the Personal Data Owner, if the following conditions are met:

Special Personal Data (data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dress, membership in associations, foundations or unions, criminal convictions and security measures, as well as biometric and genetic data) other than the Personal Data Owner's health and sexual life, may be processed only by persons or authorized institutions and organizations under a confidentiality obligation for the purposes of protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, and planning and managing healthcare services and financing.

Purposes of Processing and Transfer of Personal Data

Personal Data; In accordance with the law and the purpose of the Law, planning and implementing BRAND RENT A CAR's Human Resources policies in the best way, planning, executing and managing its commercial partnerships and strategies correctly, ensuring the legal, commercial and physical security of itself and its business partners, ensuring corporate functioning, planning and executing management and communication activities, ensuring that Personal Data Owners benefit from its products and services in the best way and recommending them by customizing them according to their demands, needs and requests, ensuring the highest level of data security, creating databases, improving the services offered on the website and eliminating errors on the website, communicating with Personal Data Owners who submit their requests and complaints to it and ensuring request and complaint management, event management, management of relations with business partners or suppliers, carrying out personnel recruitment processes, supporting Group Companies in their personnel recruitment processes and compliance with the relevant legislation, planning and executing audit activities to ensure that the activities of Group Companies are carried out in accordance with the relevant legislation, It is processed within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law, limited to the purposes of supporting the companies in carrying out their corporate and partnership law transactions, executing/following up financial reporting and risk management transactions, executing/following up the company's legal affairs, carrying out activities to protect its reputation, managing investor relations, providing information to authorized institutions arising from the legislation, creating and following up visitor records. If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the Law, BRAND RENT A CAR obtains your explicit consent for the relevant processing process.

METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA, DELETION, DESTRUCTION, STORAGE PERIOD

Method and Legal Reason for Collecting Personal Data

For the purpose of verifying compliance with Article 1, which regulates the purpose of the Law, and Article 2, which regulates the scope of the Law, Personal Data may be processed in any verbal, written, or electronic medium; Personal Data is collected through various means, such as the call center, the BRAND RENT A CAR website, and mobile applications, in order to fully and accurately fulfill its legal responsibilities based on legislation, contracts, requests, and requests, and is processed by the Company or data processors assigned by the Company.

Deletion, Destruction, or Anonymization of Personal Data

Provided that the provisions of other laws regarding the deletion, destruction, or anonymization of Personal Data are reserved, BRAND RENT A CAR shall delete, destroy, or anonymize Personal Data ex officio or upon the request of the data owner, even if the reasons requiring processing cease to exist, despite processing it in accordance with the provisions of this Law and other laws. Deleting personal data means destroying it in a way that it cannot be used or recovered. Accordingly, personal data is irreversibly deleted from any media such as documents, files, CDs, floppy disks, or hard drives on which it is stored. Destroying personal data means destroying data-storage materials such as documents, files, CDs, floppy disks, or hard drives, so that the information cannot be retrieved or used again. Anonymizing data means making personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.

Personal Data Retention Period

BRAND RENT A CAR stores Personal Data, if stipulated by legislation, for the period specified in this legislation. If no period is stipulated in the legislation regarding how long personal data should be stored, Personal Data is processed for a period required to be processed in good faith, in accordance with BRAND RENT A CAR's practices and business practices, depending on the activity carried out while processing that data, and then deleted, destroyed or anonymized. If the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and BRAND RENT A CAR have expired, personal data may be stored only as evidence in possible legal disputes or to assert or defend the relevant rights related to personal data. In establishing these time periods, retention periods are determined based on the statute of limitations for asserting the aforementioned right, as well as examples of previous requests submitted to BRAND RENT A CAR regarding the same matters despite the expiration of the statute of limitations. In this case, stored personal data is not accessed for any other purpose and is only accessed when it is necessary to resolve a relevant legal dispute. After the aforementioned period expires, personal data is deleted, destroyed, or anonymized.

OBLIGATION TO INFORM

BRAND RENT A CAR is obligated to inform the natural persons whose data will be processed when collecting Personal Data. The scope of this information obligation is as follows:

- The identity of the data controller and, if applicable, their representative,

- The purpose for which the Personal Data will be processed,

- To whom and for what purpose the processed Personal Data may be transferred,

- The management of personal data collection and their legal rights.

BRAND RENT A CAR will provide the necessary information on this matter through data acquisition tools from Third Parties for processing in its systems and will obtain informed consent from Data Subjects for data processing to prove that the information obligation has been fulfilled. Personal Data may be collected verbally, in writing, or electronically, through automated or non-automated means, through BRAND RENT A CAR's e-commerce channels, including sales stores, branches, websites, call centers where services can be obtained from third parties, and all other similar channels.

- Obtaining Personal Data in Written Form: When obtaining Personal Data in written form, BRAND RENT A CAR will fulfill its Disclosure Obligation regarding data processing, provided that the new relevant forms and information revised based on this Text are used. Furthermore, all forms and agreements, including Permitted Communication Forms, obtained from customer relations, will be revised to reflect the Data Subject's explicit consent to the processing of Personal Data, even though the processing of the relevant data group may be considered an exception under the Law. In customer relations, new forms, documents, and information documenting compliance with the Law will be used; All relevant employees will be trained to provide sufficient detailed information and references to individuals on this matter. It will be ensured that Personal Data is obtained through written forms containing informed consent.

- Verbal Collection of Personal Data: When obtaining new data regarding existing customers processed in accordance with the Permitted Communication Forms, or when obtaining data through the Call Center, information will be provided regarding the obligation to inform the customer regarding the processing of Personal Data. During the collection of verbal data, a reminder will be provided that the conversation is being recorded, provided that prior notice is given, and consent will be given to the processing of the Personal Data within this Policy and, if applicable, existing Permitted Communication Forms. Employee and Call Center business processes will be reevaluated and implemented within this framework.

- Obtaining Personal Data Electronically: All agreements and documents / link addresses / web pages requiring the collection and processing of Personal Data, including this Disclosure Text, have been revised to fulfill the disclosure obligation regarding the processing of Personal Data. This Text will be accessible from all web pages and will be located on BRAND RENT A CAR's websites, and systems requiring the approval of BRAND RENT A CAR's data processing will be established for data acquisition at each link address that may require data acquisition. Unless consent to the processing of Personal Data is explicitly indicated, no information or documents entered will be automatically saved in any BRAND RENT A CAR system or processed in any way.

YOUR RIGHTS REGARDING THE PROTECTION OF PERSONAL DATA

BRAND RENT A CAR will respond to the following requests from data subjects, whether in writing, verbally, or electronically via email:

a) To learn whether BRAND RENT A CAR processes personal data relating to them and which personal data it processes,

b) To obtain information regarding the purposes of the processing,

c) BRAND To know the third parties to whom RENT A CAR transfers personal data, both domestically and internationally,

d) To request correction of personal data if it is processed incompletely or incorrectly,

e) To request the deletion or destruction of personal data in accordance with the law,

f) To request the correction, deletion, or destruction of personal data; to request notification of the actions taken to third parties to whom personal data has been transferred,

g) To object to the analysis of processed data exclusively through automated systems, leading to a detrimental result, and

h) To receive a copy of personal data.

You can contact us with your comments and questions. Pursuant to Article 13, Paragraph 1 of the Personal Data Protection Law, you may submit your request to exercise your rights specified above to our Company in writing or by other methods determined by the Personal Data Protection Board.

Personal Data Subject Application Procedure

You may use the "Application Form" to submit your requests regarding your rights specified above.

You may submit your applications regarding your requests;

By hand

By registered mail

By notary

Yalnızbağ Mah. Körkün Sanayi Blv. No: 6 /1 İç Kapı No:1 Oğuzeli/ Gaziantep

You can submit your request with a signed copy to the address,

or by another method prescribed by the Personal Data Protection Board. Your request will be evaluated and finalized as soon as possible and, in any case, within the period specified in the KVKK. However, if our written response to your application exceeds 10 pages and/or requires it to be submitted on a recording medium such as a CD or flash drive, it will be subject to a fee determined by the Personal Data Protection Board, in accordance with the provisions of the "Communiqué on the Procedures and Principles for Applications to the Data Controller."

For third parties to request an application on your behalf, a special power of attorney issued through a notary public must be present in the name of the applicant.

If the process of reviewing and finalizing your application incurs a cost, our Company may charge the fee set by the Board.