Customer Personal Data Protection and Processing Clarification Text

1. Data Controller

Your personal data may be processed by HNC Mobility (“the Company”) as data controller, within the scope described below, pursuant to the Personal Data Protection Law No. 6698 (“the Law”).

The natural person whose personal data is processed within the scope of concluding the general terms of the motor vehicle rental agreement (“the Agreement”) is the Data Subject.

Detailed information on the purposes for which the Company processes your personal data is set out in the HNC Mobility Personal Data Protection and Processing Policy (PDPL Policy) available at https://kiralama.hncotomotiv.com/en/legal/kvkk.

2. Purposes and Legal Bases for Processing Your Personal Data

Your collected personal data may be processed for the purposes (“Purposes”) and on the legal bases set out below, within the processing conditions and purposes under Articles 5 and 6 of the Law.

Processing is necessary for the personal data of the parties to a contract, provided it is directly related to the establishment or performance of the contract

• Identity, contact, financial, and customer transaction data for updating customer information,
• Identity, contact, financial, and customer transaction data for opening rental records in the system and carrying out rental-related invoicing (for example processing card details to fulfil automatic payment instructions; collecting debts such as HGS, OGS, or traffic fines),
• Identity, contact, financial, and customer transaction data for post-rental support services,
• Identity, contact, financial, customer transaction, and transaction security data for providing our services via the website,
• Identity, contact, financial, customer transaction, and transaction security data for creating and closing accounts / memberships.

Expressly provided for by law and necessary for the data controller to fulfil its legal obligation

• Identity, contact, financial, customer transaction, transaction security, and request / complaint data for fulfilling official authority requests,
• Identity, contact, financial, customer transaction, transaction security, and request / complaint data for providing information to authorised bodies as required by legislation,
• Identity, contact, financial, customer transaction, transaction security, and request / complaint data for complying with statutory retention obligations,
• Identity, contact, financial, customer transaction, transaction security, and request / complaint data for responding to data subject applications in accordance with legislation and carrying out necessary actions.

Processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject

• Identity, contact, financial, and customer transaction data for conducting customer relations,
• Identity, contact, financial, and customer transaction data for tracking financial transactions,
• Identity, contact, financial, customer transaction, and transaction security data for work needed by our business units so that data subjects can benefit from products and services offered by our Company, including rental activities, and for running related business processes,
• Identity, contact, financial, and customer transaction data for work needed by our business units to carry out commercial activities and related business processes,
• Identity, contact, financial, customer transaction, and transaction security data for ensuring the legal, technical, and commercial-business security of our Company and of data subjects in a business relationship with us,
• Identity, contact, financial, customer transaction, and transaction security data for determining and implementing our commercial and business strategies,
• Identity, contact, and location data for location tracking where a vehicle tracking system is in place,
• Identity, contact, and customer transaction data for planning organisation and event processes,
• Identity, contact, customer transaction, and transaction security data for work needed to improve services offered by our Company,
• Identity, contact, customer transaction, transaction security, and request / complaint data for managing requests and complaints.

Processing is necessary for the establishment, exercise, or protection of a right

• Identity, contact, customer transaction, and request / complaint data for receiving, assessing, and concluding your requests and complaints,
• Identity, contact, customer transaction, and request / complaint data for conducting processes aimed at resolving disputes and legal proceedings where applicable.

Where you have given explicit consent

• Processing of your identity, contact, customer transaction, financial, and marketing data for marketing processes for our Company’s products and services, including profiling and analysis, and for customising, recommending, and promoting products and services according to data subjects’ preferences, usage habits, and needs,
• Sending commercial electronic messages such as advertisements and promotions to the contact details you share via your preferred channel under your communication consent, and processing identity and contact data for that purpose.

3. Parties to Whom Your Personal Data Is Transferred and Transfer Purposes

Your processed personal data may be transferred, in accordance with the general principles under the Law and the personal data transfer conditions under Articles 8 and 9 of the Law, limited to the Purposes listed above, to Company business partners (call-centre service providers; roadside assistance providers where the vehicle receives roadside assistance; satisfaction survey providers; software and IT service providers; payment service providers / payment institutions; third parties from whom the Company receives marketing and customer relationship management services; and other business partners from whom we may receive services within the process), to legally authorised public institutions and organisations, administrative authorities, and the General Directorate of Security where expressly provided by law and for fulfilling our legal obligations, to persons and organisations permitted by applicable legislation, to business partners and suppliers whose servers are abroad based on standard contractual clauses published by the Personal Data Protection Board, and, based on your explicit consent, to parties from whom services are obtained for communication and promotional activities.

4. Method of Collecting Your Personal Data

Your personal data may be obtained by the Company for the purposes listed above, wholly or partly by automated means, or by non-automated means provided they form part of a data recording system. Accordingly, they may be collected in the physical environment through conclusion of the Agreement and printed forms, and in the electronic environment via the internet, email, online forms, SMS verification codes, and voice recording systems.

5. Your Rights as a Data Subject under Article 11 of the Law

As a Data Subject, we inform you that pursuant to Article 11 of the Law you have the following rights:

• to learn whether your personal data is being processed and, if processed, to request information about it,
• to learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• to know the third parties to whom your personal data is transferred domestically or abroad,
• to request correction of incomplete or inaccurate personal data and notification of such correction to third parties to whom your personal data was transferred,
• to request deletion or destruction of personal data when the reasons for processing no longer exist, even if processing was in accordance with the Law and other legislation, and notification of such action to third parties to whom your personal data was transferred,
• to object where a result against you arises from analysis of processed data exclusively through automated systems,
• to request compensation for damage if you suffer harm due to unlawful processing of your personal data.

Please submit applications regarding the rights listed above by email to info@hncmobility.com or in writing to Gayrettepe, Beyazdut Sk. No:6, 34349 Beşiktaş/İstanbul. Depending on the nature of your request, applications will be concluded free of charge as soon as possible and within thirty days at the latest; however, if the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

You can access our PDPL Policy at https://kiralama.hncotomotiv.com/en/legal/kvkk.