Personal Data Protection and Processing Policy

1. Introduction

1.1. Purpose and Scope of the Policy

The Law on the Protection of Personal Data No. 6698 (“the Law”) entered into force on 7 April 2016. This HNC Mobility Personal Data Processing and Protection Policy (“the Policy”) aims to ensure HNC Mobility’s (“the Company”) compliance with the Law and to set out the principles to be followed in fulfilling the Company’s obligations regarding the protection and processing of personal data.

The Policy determines the conditions for processing personal data and sets out the main principles adopted by the Company. It covers all personal data processing activities carried out by the Company under the Law, all data subjects whose data are processed by the Company, and all personal data processed.

Matters regarding the processing of personal data of Company employees are not included in this Policy and are regulated under a separate internal policy. Definitions of the terms used in the Policy are set out in Section 9.

1.2. Effective Date and Amendments

The Policy has been published on the Company’s website and made available to the public. In case of a conflict between this Policy and applicable legislation, especially the Law, the provisions of the legislation shall prevail.

The Company reserves the right to amend the Policy in line with legal developments. The current version is available at https://kiralama.hncotomotiv.com.

2. Data Subjects, Processing Purposes and Data Categories

2.1. Data Subjects

Data subjects under this Policy are all natural persons, excluding Company employees, whose personal data are processed by the Company. General categories include:

Category	Description
Customer	Natural persons who benefit from the Company’s car rental products and services.
Potential Customer	Natural persons who show interest in the Company’s products and services and may become customers.
Visitor	Natural persons who visit the Company’s premises or website.
Job Applicant	Natural persons who apply for a job by submitting a CV or through other means.
Third Parties	Natural persons other than the categories above and Company employees.

These categories are provided for general information. Not falling into one of them does not remove a person’s status as a data subject under the Law.

2.2. Personal Data Processing Purposes

Your personal data and special categories of personal data may be processed by the Company for the following purposes, in accordance with the conditions set forth in the Law and relevant legislation:

Main Purposes	Sub-Purposes
Internal Company Operations	Planning, auditing and execution of information security processes; IT infrastructure; finance and accounting; planning and execution of business activities; business continuity; corporate communication, sustainability and governance; logistics and operational processes.
Legal, Technical and Administrative Activities	Emergency management; occupational health and safety; damage/claims processes; legal affairs; providing information to authorized institutions; visitor records; security of operations and premises; audits; insurance processes; ensuring data accuracy and currency.
Customer-Facing Processes	Planning and execution of car rental sales; after-sales support; contract processes and legal claims; customer relationship management; payment and invoicing.
Financial Operations	Banking transactions; damage payments; collection and pricing of insurance policy premiums.
Strategy & Business Partner / Supplier Management	Management of relations with business partners and/or suppliers; strategic planning; external training activities.
Marketing Operations	Planning of marketing processes; market research; customer satisfaction activities.

2.3. Personal Data Categories

The Company processes the following categories of personal data in accordance with the Law and relevant legislation:

Category	Description
Identity Information	Identity-related information in documents such as driver’s licence, ID card, residence certificate or passport.
Contact Information	Phone number, address, e-mail and similar contact details.
Customer Information	Information obtained or generated about the data subject through commercial activities and business operations.
Family Members and Relatives	Information about family members and close relatives processed in connection with products/services or to protect legal interests.
Customer Transaction Information	Records of use of products and services, and related instructions and requests.
Physical Space Security	Security records such as camera footage taken at entry to or within physical premises.
Transaction Security	Data processed to ensure technical, administrative, legal and commercial security.
Financial Information	Information, documents and records showing financial outcomes of the legal relationship with the data subject.
Job Applicant Information	Data relating to persons who have applied for employment or are evaluated as candidates.
Legal Action and Compliance	Data processed to establish and pursue legal rights, fulfil obligations and ensure policy compliance.
Audit and Inspection	Data processed for legal obligations and company policy compliance.
Special Categories of Data	Data listed in Article 6 of the Law (e.g. health, criminal convictions, biometric data).
Marketing Information	Data processed to customise marketing according to usage habits, preferences and needs.
Request / Complaint Management	Data relating to the receipt and evaluation of requests or complaints.
Reputation Management	Information collected to protect the Company’s commercial reputation.
Incident Management	Data processed to take legal, technical and administrative measures in response to incidents.

3. Principles and Conditions for Processing Personal Data

3.1. Principles

Your personal data are processed in accordance with Article 4 of the Law:

• Lawfulness and fairness: Processing complies with laws, secondary regulations and general principles of law, limited to the processing purpose and respecting reasonable expectations.
• Accuracy and currency: The Company takes care that processed data are up to date; data subjects may request correction or deletion of inaccurate data.
• Specific, explicit and legitimate purposes: Purposes are determined before each processing activity and must not be unlawful.
• Relevance, limitation and proportionality: Processing is limited to data necessary for the collection purpose.
• Retention: When the purpose ceases or the statutory period expires, data are deleted, destroyed or anonymised.

3.2. Conditions for Processing

Personal data are processed if at least one of the conditions in Article 5 of the Law exists:

• Explicit consent of the data subject,
• Explicitly provided for by law,
• Processing is mandatory due to factual impossibility of obtaining consent (protection of life or physical integrity),
• Necessary for the establishment or performance of a contract,
• Mandatory for the data controller to fulfil a legal obligation,
• Data have been made public by the data subject,
• Mandatory for the establishment, exercise or protection of a right,
• Mandatory for the legitimate interests of the data controller, provided that fundamental rights and freedoms are not harmed.

3.3. Special Categories of Personal Data

Special categories of personal data under Article 6 of the Law include race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

The Company may process such data by taking additional measures determined by the Personal Data Protection Board where, among others, explicit consent exists, processing is provided for by law, data have been made public, processing is mandatory due to factual impossibility, it is mandatory for establishing/exercising/protecting a right, it is necessary for public health or healthcare services, or it is mandatory for employment, occupational health and safety, social security or related legal obligations.

4. Transfer of Personal Data

The Company may transfer personal data domestically or abroad in accordance with Articles 8 and 9 of the Law and additional Board regulations, where the conditions for transfer are met.

• Domestic transfer: Permitted if at least one processing condition under Articles 5 and 6 exists and the main principles are observed.
• International transfer: May be carried out under Article 9 based on an adequacy decision, appropriate safeguards, or exceptional circumstances, with technical and administrative measures in place.

Within the general principles and Articles 8 and 9, the Company may transfer data to:

Recipient	Scope	Purpose
Business Partner	Parties with whom the Company has a business partnership	Limited to fulfilling partnership objectives
Supplier	Parties providing services under the Company’s instructions and contract	Limited to obtaining outsourced services
Subsidiary	Companies that are subsidiaries of the Company (if any)	Limited to activities requiring subsidiary involvement
Authorised Public Institution	Public bodies legally authorised to request information	Limited to the scope of the information request
Authorised Private Institution	Private entities legally authorised to request information	Limited to their legal authority

5. Informing Data Subjects and Their Rights

Under Article 10 of the Law, data subjects must be informed before or at the latest when personal data are processed. As data controller, the Company has established the necessary structure to provide such information.

For processing purposes see Section 2.2; for recipients and transfer purposes see Section 4; for processing conditions see Sections 3.2 and 3.3.

Under Article 11 of the Law, you have the right to:

• Learn whether your personal data are processed,
• Request information if they have been processed,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom data are transferred domestically or abroad,
• Request correction of incomplete or inaccurate data and notification of such correction to recipients,
• Request deletion or destruction when the reasons for processing no longer exist, and notification to recipients,
• Object to a result against you arising from analysis exclusively by automated systems,
• Claim compensation for damage caused by unlawful processing.

You may submit requests regarding these rights by e-mailing info@hncmobility.com or via the contact page on https://kiralama.hncotomotiv.com, with identity verification. Requests will be concluded free of charge as soon as possible and within thirty days at the latest; if the process requires an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

The Company first verifies that the applicant is the rights holder and may request additional information. Responses are provided in writing or electronically; rejections are reasoned.

Data controller contact details: HNC Mobility, Gayrettepe, Beyazdut Sk. No:6, 34349 Beşiktaş/İstanbul, e-mail: info@hncmobility.com.

6. Deletion, Destruction and Anonymisation

Where the reasons for processing personal data processed in accordance with the Law and other legislation cease to exist, the Company deletes, destroys or anonymises such data ex officio or upon the data subject’s request, in line with Board guidance.

7. Limitations on the Scope and Application of the Law

Under Article 28 of the Law, certain processing activities fall outside the Law’s scope (e.g. purely personal/household activities, anonymised official statistics and research, certain artistic/scientific/expression purposes, authorised preventive/intelligence activities, and judicial/enforcement processing). Data subjects may not exercise their rights in those cases.

Furthermore, subject to proportionality with the Law’s purpose and principles, the obligation to inform and data subject rights (except the right to claim compensation) may not apply where processing is necessary for crime prevention or investigation, where data have been made public by the data subject, for authorised audit/regulatory/disciplinary processes, or for protecting the State’s economic and financial interests.

8. Technical and Administrative Measures

In accordance with Article 12 of the Law, the Company takes all necessary technical and administrative measures to ensure an appropriate level of security, maintains an internal audit system, and acts in line with the Law in case of unlawful disclosure.

8.1. Administrative Measures

• Employees are trained and made aware of personal data protection.
• Contracts with recipients and storage providers include data security provisions.
• Processing activities are reviewed for compliance with the Law’s conditions.
• Compliance practices are regulated through internal policies.

8.2. Technical Measures

• Technical measures aligned with technological developments are taken and updated.
• Expert personnel are employed for technical matters.
• Regular audits of implemented measures are conducted.
• Security software and systems are deployed.
• Access to personal data is limited to relevant employees according to the processing purpose.

8.3. Audit Activities

The functioning of technical and administrative measures is audited; results are reported internally and improvements are implemented as needed.

8.4. Unlawful Disclosure

If personal data are obtained unlawfully by others, the Company will notify the Personal Data Protection Board and the relevant data subjects without delay, pursuant to Article 12(5) of the Law.

9. Definitions

Term	Definition
Explicit Consent	Consent given freely, based on being informed about a specific matter.
Anonymisation	Making personal data impossible to associate with an identified or identifiable natural person, even by matching with other data.
Employee	Natural persons working at the Company.
Job Applicant	Natural persons who are candidates for employment at the Company.
Personal Data	Any information relating to an identified or identifiable natural person.
Data Subject	The natural person whose personal data are processed.
Processing of Personal Data	Any operation performed upon personal data, such as collection, recording, storage, retention, alteration, re-organisation, disclosure, transfer, acquisition, making available, classification or blocking its use, wholly or partly by automatic means or as part of a data recording system by non-automatic means.
Law	Law No. 6698 on the Protection of Personal Data, published in the Official Gazette No. 29677 on 7 April 2016.
Special Categories of Personal Data	Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
Policy	HNC Mobility Personal Data Processing and Protection Policy.
Company	HNC Mobility.
Business Partners	Persons with whom the Company has established a partnership within contractual relationships in its commercial activities.
Data Processor	Natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.
Data Controller	The person who determines the purposes and means of processing personal data and manages the place where data are systematically kept.