As DURUCAR Türkiye, we value your security. In this regard, we would like to inform you about our data processing activities within the scope of the Personal Data Protection Law No. 6698 ("KVKK"), which was enacted to protect fundamental rights and freedoms, particularly the privacy of private life, and to safeguard personal data.

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), any information relating to an identified or identifiable natural person is defined as personal data. Your personal data held by our company may be recorded, modified, reorganized, transferred within legal limits, classified, updated, and processed in compliance with the conditions specified in the KVKK, as explained below.

Who is the Data Controller?
The data controller refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. In this context, DURUCAR Türkiye (Duru Otomotiv Turizm Ticaret A.Ş.) acts as the data controller and processes your personal data within the scope of the KVKK.

What Personal Data Do We Collect?
The information we require may vary depending on the nature of the rental process, damage situations, use of customer loyalty programs, participation in campaigns, and requested services. Below, you can find this information categorized:

• Identity Information (Name-surname, signature, Turkish ID number, date of birth, driver's license, ID, passport copies, etc.)

• Contact Information (Phone number, email address, address, etc.)

• Customer Transaction Information (Vehicle delivery form, rental agreement, rental details (fuel, date, HGS/OGS usage, etc.), DURUCAR card information, policy details, replacement vehicle form, past rental information with our company, assistance service information, flight information for campaign-related companies, etc.)

• Financial Information (Credit card information, payment details, Findeks information)

• Physical Location Security (Camera recordings in our offices)

• Visual and Audio Recordings (Call center recordings)

• Personnel Information (Profession, title, workplace, etc., within the scope of DURUCAR card and other customer loyalty programs and campaigns)

• Transaction Security Information (Username and password information created for website or mobile app usage)

• Marketing Information (Survey, cookie records, rental history, preferences regarding campaigns and offers, etc.)

• Legal Proceedings, Criminal Convictions, and Security Measures (Traffic fines, information related to criminal investigation processes, correspondence with judicial authorities, reports)

• Vehicle Information (Damaged vehicle information in case of accidents, information about other vehicles involved in the accident, license plate information, other vehicle usage information)

• Damage Information (Damage details, accident report, damage photos, expert report)

• Health Information (Alcohol report, health reports, etc., in case of accidents, information related to personal health status, disability information)

What Are the Purposes of Processing Your Personal Data?
Your personal data is processed in accordance with the principles set forth in the KVKK for the following purposes:

a) Execution of rental offers, reservations, and sales processes, processing payments, handling delivery and return procedures, managing post-sales support processes (including damage and recourse processes), evaluating requests and complaints, verifying identity, managing insurance processes, managing relationships with business partners and/or suppliers, conducting customer relationship processes, providing necessary information to customers within the scope of rental services, creating and using your customer account.

b) Execution and follow-up of legal processes, sharing information with authorized public institutions and organizations within the framework of legislation, managing internet access records, and ensuring data security.

c) Recording call center calls, requesting Findeks information from customers, determining payment capacity and conducting financial background checks, preventing misuse, providing vehicle protection services, planning and executing risk management, conducting necessary audit and control processes within the scope of company activities, reporting and investigations, and making the website functional.

d) Contacting you within the scope of marketing activities related to our products and services, sending commercial electronic messages, offering personalized offers, conducting analysis, surveys, and satisfaction studies, planning and/or executing loyalty processes for products and/or services, conducting personalized marketing processes within the scope of cookie activities, managing DURUCAR card transfer processes.

For What Purposes and to Whom Can Your Personal Data Be Transferred?
Your personal data may be transferred, in a limited and measured manner, within the scope of commercial necessities, for the following purposes: execution of post-sales support processes, risk management, determining payment capacity and processing payments, managing damage and recourse processes, managing insurance processes, preventing misuse, providing assistance services, sending commercial messages, conducting customer satisfaction surveys, executing marketing activities, managing and following up legal processes, conducting audit activities, ensuring compliance with legislation, and sharing information with authorized public institutions and organizations. Your data may be transferred to the following persons/institutions only to the extent required by the service and within the processing conditions specified in Articles 8 and 9 of the KVKK:

• Dealers, service providers, and parking lots that are our business partners within the scope of rental activities

• Assistance service providers, including towing services

• Companies we work with in the case of corporate customers

• Experts and insurance companies

• Banks and financing companies

• Organizations providing consultancy on legal, financial, tax, and operational matters

• Agencies and marketing companies providing support

• Courier and other transportation companies

• Business partners and suppliers providing various services

• Authorized public institutions and organizations

What Are the Methods and Legal Reasons for Collecting Your Personal Data?
Your personal data is collected by our company through our website, mobile applications, email, call center, company officials, business partners, group companies, public institutions, and organizations, either directly from you or through these entities, in written/oral form through non-automated means or electronically through automated means.

We process your personal data based on the legal reasons specified in Articles 5 and 6 of the KVKK, depending on the nature of the processing. In connection with the processing purposes listed in the "What Are the Purposes of Processing Your Personal Data?" section, your personal data is processed based on the following legal grounds:

a) For the purposes specified in (a), "being directly related to the establishment and execution of the rental contract and necessary for this purpose"; in case of processing health data in damage processes, "explicit consent of the data subject."

b) For the purposes specified in (b), "being mandatory for the data controller to fulfill its legal obligations" and "being explicitly stipulated by law."

c) For the purposes specified in (c), "being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed."

d) For the purposes specified in (d), "explicit consent of the data subject."

What Are Your Rights Regarding Your Personal Data?
In relation to the processing of your personal data, you may submit your requests regarding the rights listed below within the scope of Article 11 of the KVKK, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

1. Learn whether your personal data is being processed,

2. Request information if your personal data has been processed,

3. Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,

4. Know the third parties to whom your personal data is transferred, domestically or abroad,

5. Request correction of your personal data if it is incomplete or inaccurate,

6. Request deletion or destruction of your personal data,

7. Request notification of the correction, deletion, or destruction of your personal data to third parties to whom your personal data has been transferred,

8. Object to the occurrence of a result against you by analyzing your processed data exclusively through automated systems,

9. Request compensation for damages if you suffer harm due to unlawful processing of your personal data.

Since our company is obliged to retain records and documents related to transactions with customers for a certain period under legal regulations, your request for the deletion, destruction, or anonymization of your personal data will be fulfilled by our company after the legal retention period expires. However, during this period, your personal data will not be processed by our company except in cases where it is legally required.

You can always submit your requests regarding your personal data to us through various methods, in accordance with the conditions set forth in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Due to changes in company policies and activities, this text may be updated periodically. To access the most up-to-date version of the text, you can visit our page regularly.