enREGARDING THE PROCESSING OF PERSONAL DATA CLARIFICATION TEXT
Guest Booking > Car Rental
This Clarification Text on the Processing of Personal Data applies to the data of the relevant group of persons specified in the upper right box held by the Company, which has the title of data controller.
1. WHY ARE WE SENDING THIS TEXT?
As YOLCU 360 BİLİŞİM ANONİM ŞİRKETİ (hereinafter referred to as “Yolcu360” or “Company”), in accordance with the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Disclosure Obligation published in the Official Gazette No. 30356 dated 10.03.2018, with this “Information” letter prepared in the capacity of Data Supervisor, we hereby inform you in accordance with Article 10 titled “Disclosure Obligation of the Data Supervisor” in the KVKK. Within the framework of Article 10 titled “Disclosure Obligation of the Data Controller”, Article 11 titled “Rights of the Data Subject” and Articles 4 and 5 of the Communiqué on the Procedures and Principles to be followed in the Fulfillment of the Disclosure Obligation; It has been arranged in order to provide information about the purpose for which your personal data will be processed, to whom and for what purpose your processed personal data can be transferred, the method and legal reason for the collection of your personal data and your other rights listed in Article 11 of the KVKK.
2. ON WHICH SUBJECTS DO WE PROVIDE DISCLOSURE?
|
|
3. WHAT PERSONAL DATA DO WE PROCESS?
Identity Information | Name, surname, Turkish National ID number, passport number, date of birth |
Contact Information | Email address, phone number, address information (address name, country/region, city, district, address details, postal code) |
Transaction Security | IP address, website login-logout log records, system/traffic log records, mobile phone verification information |
Customer Transaction Information | Customer profile information, car rental information, reservation details, vehicle pick-up location, vehicle drop-off location, vehicle pick-up date, vehicle drop-off date, vehicle pick-up time, vehicle drop-off time, rented vehicle details, added coverages, additional services purchased and rental terms, records of consent and rejection for electronic commercial messages, sending date and record of electronic commercial messages, search results within the customer profile, past reservation information |
Financial Information | Amount and payment-related information, invoice information |
Legal Procedures | Distance Sales Contract, Preliminary Information and Right of Withdrawal, records concerning information on Rental Terms |
Other Information | Date of driver’s license issuance |
4. WITH WHOM DO WE SHARE YOUR PERSONAL DATA AND FOR WHAT PURPOSE AND FOR WHAT LEGAL REASON?
Personal Data Category | Transfer Purpose | Recipient Group | Legal Grounds |
| The performance of car rental reservation transactions, | Car rental companies (Domestic and International) are shared with agencies / hosting companies (CarTrawler & Carnect) integrated into Yolcu360.com, both domestically and internationally. | For transfers abroad: “The transfer is mandatory for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken upon the request of the data subject.” regulated in subparagraph (b) of Article 9/6 of Law No. 6698, ‘The transfer is mandatory for the establishment or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject.’ regulated in subparagraph (c), ‘The transfer of personal data is mandatory for the establishment, exercise or protection of a right.’ regulated in subparagraph (d). For domestic transfers: “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698, ‘Data processing is mandatory for the establishment, exercise or protection of a right.’ regulated in subparagraph (e). |
| Fulfillment of our contractual obligation to the agency / hosting provider CarTrawler and Carnect companies from which we receive services for international reservations for car rental reservation transactions, fulfillment of the obligations of hosting providers CarTrawler and Carnect companies to keep traffic information as hosting providers, and to ensure information exchange with supplier car rental companies, Fulfillment of our contractual and legal obligations, Carrying out storage/archive activities, Follow-up of legal affairs, follow-up of financial affairs | Agencies/ hosting companies located in Turkey and abroad integrated to Yolcu360.com. | For transfers abroad: “It is mandatory to transfer personal data for the establishment, exercise or protection of a right” regulated in paragraph (d) of Article 9/6 of Law No. 6698. For domestic transfers: “It is mandatory for the data controller to fulfill its legal obligation.” regulated in subparagraph (ç) of Article 5/2 of Law No. 6698, ‘Data processing is mandatory for the establishment, exercise or protection of a right.’ regulated in subparagraph (e). |
| Due to the fact that the servers of the cloud server service provider companies that Yolcu360 Platform receives service from are located abroad (Amazon Web Services), Yolcu360 Platform is stored in the cloud environment in order to operate Yolcu360 Platform, to provide Yolcu360 Platform services, to carry out reservation processes, to store, backup and access your personal data securely, Ensuring business continuity of our company, preventing data loss and recovering data when necessary, Analyzing and reporting processes and improving service quality, Optimizing business processes and improving user experience, Ensuring data security during the provision of cloud services, Monitoring on systems, Ensuring the security of the data controller's operations. | Cloud service provider / solution partner based abroad (Amazon Web Services) | „Das Vorhandensein eines Standardvertrags, der vom Vorstand bekannt gegeben wird und Fragen wie Datenkategorien, Zwecke der Datenübermittlung, Empfänger und Empfängergruppen, vom Datenempfänger zu treffende technische und administrative Maßnahmen, zusätzliche Maßnahmen für besondere Kategorien personenbezogener Daten enthält“, geregelt in Unterabsatz (c) des Artikels 9/4 des Gesetzes Nr. 6698. |
| Google solutions (Google Cloud Platform, Google Workspace, Cloud ID, Looker (original), SecOps Service, Application Services and/or other Google Cloud services) used by Yolcu360 Platform while conducting its commercial and administrative activities are operated by Yolcu360 Platform due to the fact that the servers of the service provider are located abroad, Storing your personal data in the cloud environment for the purpose of providing Yolcu360 Platform commercial services, storing, backing up and accessing your personal data securely, Ensuring business continuity of our company, preventing data loss and recovering data when necessary, Analyzing and reporting processes and improving service quality, Optimizing business processes and improving user experience, Monitoring on systems, Ensuring the security of the data controller's operations. | Cloud service provider / solution partner based abroad (Google Cloud EMEA Limited) | “The existence of a standard contract, which is announced by the Board, containing issues such as data categories, purposes of data transfer, recipient and recipient groups, technical and administrative measures to be taken by the data recipient, additional measures taken for special categories of personal data.” regulated in subparagraph (c) of Article 9/4 of Law No. 6698. |
| Exercising our right to legal defense in the event of a possible legal dispute, investigation, judicial or administrative audit and other situations, responding to official or other legal requests for information and documents, The ability to submit expenditure objections to banks in the event of a possible suspicious or erroneous expenditure transaction, Carrying out storage/archive activities. | It is shared with our Company lawyer, judicial and administrative authorities requesting information, and Banks. | “Clearly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 6698 “It is mandatory for the data controller to fulfill its legal obligation” regulated in subparagraph (ç) of Article 5/2 of Law No. 6698. “Data processing is mandatory for the establishment, exercise or protection of a right.” regulated in subparagraph (e) of Article 5/2 of Law No. 6698. |
| Preparation of invoices for the reservation you have purchased, follow-up and execution of financial and accounting affairs, fulfillment of our legal obligations, execution of storage / archive activities. | E-invoice integrator / service provider supplier company | “It is mandatory for the data controller to fulfill its legal obligation” regulated in subparagraph (ç) of Article 5/2 of Law No. 6698. |
| Sharing information with the virtual pos / payment service provider in order to collect the reservation fee via virtual pos, carrying out financial and accounting affairs, carrying out storage / archive activities | Virtual POS / payment services supplier, which is a payment service provider company | “It is mandatory for the data controller to fulfill its legal obligation” regulated in subparagraph (ç) of Article 5/2 of Law No. 6698. “Data processing is mandatory for the establishment, exercise or protection of a right.” regulated in subparagraph (e) of Article 5/2 of Law No. 6698. |
| Providing e-mail & SMS notification to the guest regarding the confirmation, change or cancellation of the reservation, fulfillment of legal obligations, carrying out storage/archive activities, carrying out communication activities. | Supplier companies that receive commercial communication services via SMS and e-mail | “It is mandatory for the data controller to fulfill its legal obligation” regulated in subparagraph (ç) of Article 5/2 of Law No. 6698. “Data processing is mandatory for the establishment, exercise or protection of a right.” regulated in subparagraph (e) of Article 5/2 of Law No. 6698. |
5. WHAT IS THE METHOD AND LEGAL REASON FOR COLLECTING YOUR PERSONAL DATA?
As explained in section 6 below for each category of personal data, “It is clearly stipulated in the laws”, “It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract” regulated in Article 5/2 of Law No. 6698, “It is mandatory for the data controller to fulfill its legal obligation”, ‘Data processing is mandatory for the establishment, exercise or protection of a right’ and ‘Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject’; www. yolcu360.com website and mobile application or by making a car rental transaction through the 0850 360 5 360 customer service line.
6. WHAT ARE THE PURPOSES AND LEGAL REASONS FOR PROCESSING YOUR PERSONAL DATA?
Personal Data Category | Processing Purposes | Legal grounds |
Identity Information | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to carry out car reservation processes, to carry out communication activities, to provide support for the completion of the reservation by the Guest Center (customer service) regarding your incomplete reservations, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, to process cancellation requests, to carry out financial and billing processes, financial risk assessment of the customer, monitoring vehicle maintenance services, ensuring the security of the vehicles, reporting vehicle breakdowns, monitoring damage processes after car rental, providing car rental insurances, accident and damage management and additional services in line with your request, exchanging information with suppliers that carry out car rental transactions, monitoring and execution of legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, fulfilling legal obligations. | “Explicitly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 6698 “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of the Law No. 66982 “Data processing is mandatory for the establishment, exercise or protection of a right” regulated in paragraph (e) of Article 5/2 of Law No. 6698 “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Contact Information | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support by the Guest Center (customer service) to complete the reservation regarding your incomplete reservations, to carry out vehicle reservation processes, to carry out communication activities, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, to process cancellation requests, to carry out financial and billing processes, To be able to see vehicle maintenance services, to ensure the safety of vehicles, to make vehicle failure notifications, to follow up the damage processes after car rental, to provide car rental insurances, accident and damage management and additional services in line with your request, to exchange information with suppliers that carry out car rental transactions, The processing is carried out for the purposes of following and executing legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, and fulfilling legal obligations. | “Explicitly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 6698 “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 6698” “Data processing is mandatory for the establishment, exercise or protection of a right” regulated in paragraph (e) of Article 5/2 of Law No. 6698 “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Process Security | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support by the Guest Center (customer service) to complete the reservation regarding your incomplete reservations, to carry out vehicle reservation processes, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, processing of cancellation requests, execution of finance and invoicing processes, financial risk assessment of the customer, vehicle failure notifications, follow-up and execution of legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, and fulfilling legal obligations. | “Explicitly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 6698” “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Customer Transaction Information | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support by the Guest Center (customer service) to complete the reservation regarding your incomplete reservations, to carry out vehicle reservation processes, to carry out communication activities, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, to process cancellation requests, to carry out financial and billing processes, financial risk assessment of the customer, monitoring vehicle maintenance services, ensuring the safety of vehicles, reporting vehicle breakdowns, monitoring damage processes after car rental, providing car rental insurances, accident and damage management and additional services in line with your request, exchanging information with suppliers that carry out car rental transactions, monitoring and execution of legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, fulfilling legal obligations. | “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 6698” “Data processing is mandatory for the establishment, exercise or protection of a right” regulated in paragraph (e) of Article 5/2 of Law No. 6698 “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Finance Information | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support by the Guest Center (customer service) in order to complete the reservation regarding your incomplete reservations, to carry out vehicle reservation processes, to carry out the financial risk assessment of the customer, to view vehicle maintenance services, to ensure the security of the vehicles, to make vehicle failure notifications, to follow up the damage processes after car rental, In line with your request, car rental insurances are processed for the purposes of providing accident and damage management and additional services, exchanging information with suppliers carrying out car rental transactions, following and conducting legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, and fulfilling legal obligations. | “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 6698” “Data processing is mandatory for the establishment, exercise or protection of a right” regulated in paragraph (e) of Article 5/2 of Law No. 6698 “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Legal Action | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support by the Guest Center (customer service) to complete the reservation regarding your incomplete reservations, to carry out vehicle reservation processes, to carry out communication activities, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, to process cancellation requests, to carry out financial and billing processes, financial risk assessment of the customer, monitoring vehicle maintenance services, ensuring the security of the vehicles, reporting vehicle breakdowns, monitoring damage processes after car rental, providing car rental insurances, accident and damage management and additional services in line with your request, exchanging information with suppliers that carry out car rental transactions, monitoring and execution of legal affairs, planning, auditing and follow-up of marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, fulfilling legal obligations. | “Clearly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 6698” “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
Other Information | Your personal data may be used to carry out car rental transactions through the call center, website and mobile application, to provide support for the completion of the reservation by the Guest Center (customer service) regarding your incomplete reservations, to send electronic commercial messages within the scope of advertising / campaign / promotion processes and related communication activities, to carry out after-sales support services, to plan and execute customer satisfaction and corporate communication activities, to process cancellation requests, to carry out finance and invoicing processes, to make financial risk assessment of the customer, to see vehicle maintenance services, Ensuring the safety of the vehicles, making vehicle failure notifications, following the damage processes after car rental, providing car rental insurances, accident and damage management and additional services in line with your request, exchanging information with suppliers carrying out car rental transactions, following and conducting legal affairs, planning, auditing and monitoring marketing processes, receiving requests and complaints, ensuring the security of company operations, carrying out information security and audit processes, sharing car rental information with relevant public institutions and organizations, fulfilling legal obligations. | “Explicitly stipulated in the laws” regulated in subparagraph (a) of Article 5/2 of Law No. 66698 “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” regulated in subparagraph (c) of Article 5/2 of Law No. 6698 It is mandatory for the data controller to fulfill its legal obligation regulated in subparagraph (ç) of Article 5/2 of Law No. 66982 “Data processing is mandatory for the establishment, exercise or protection of a right” regulated in paragraph (e) of Article 5/2 of Law No. 6698 “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” regulated in paragraph (f) of Article 5/2 of Law No. 6698 |
7. YOUR RIGHTS UNDER THE KVKK
By applying to our company, your personal data;
a) find out whether it has been processed,
b) request information if processed,
c) to learn the purpose of processing and whether it is used in accordance with its purpose,
d) to know the third parties to whom it is transferred domestically / abroad,
e) request correction if incomplete / incorrectly processed,
f) To request deletion / destruction within the framework of the conditions stipulated in Article 7 of the KVKK,
g) to request notification of the transactions made pursuant to subparagraphs (d) and (e) above to third parties to whom it is transferred,
h) object to the occurrence of a result to your detriment due to analysis exclusively by automated systems,
j) you have the right to demand the compensation of the damage in case you suffer damage due to unlawful processing.
In accordance with paragraph 1 of Article 13 of the Law No. 6698 and the Communiqué on the Procedures and Principles of Application to the Data Controller No. 30356 and dated 10.03.2018, you can submit your request to exercise your rights mentioned above in Turkish and in writing or by using the registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address previously notified to our Company and registered in our system. In the applications, only information about the applicant will be provided and it will not be possible to obtain information about other family members and third parties. Our Company reserves the right to verify your identity before responding.
In your application
Your name, surname and signature if the application is in writing,
For citizens of the Republic of Turkey, your Turkish ID number; if you are a foreigner, your nationality, passport number or ID number, if any,
Your residential or workplace address for notification,
Your e-mail address, telephone and fax numbers, if any,
The subject of your request is mandatory and information and documents related to the subject, if any, must be attached to the application.
You can submit your applications that you want to make in writing by attaching the necessary documents to the address of Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R Interior Door No:13 Ataşehir / Istanbul as the data controller.
You can make your applications through your e-mail address previously notified to our Company and registered in our system through the communication channels on the website https://yolcu360.com.
Within the scope of the Electronic Signature Law No. 5070, you can make your applications that you want to make via your Registered Electronic Mail (KEP) address by signing with a secure electronic signature to our KEP address. KEP addresses can only be sent from addresses with KEP extension.
According to the nature of your request, the information and documents that will allow identification must be provided to us completely and accurately. If the requested information and documents are not provided as required, there may be problems in the full and qualified execution of the investigations to be carried out by our Company based on your request. In this case, our Company declares that it reserves its legal rights. For this reason, your application must be complete according to the nature of your request and must include the information and documents requested for identification purposes.
8. MEASURES TO PROTECT YOUR PERSONAL DATA
Protection of personal data is an important issue for our Company. Our Company takes the necessary technical and administrative measures to protect against unauthorized access to personal data or loss, misuse, disclosure, alteration or destruction of such information. Our Company undertakes to keep your personal data confidential, to take all necessary technical and administrative measures to ensure confidentiality and security and to exercise due diligence.
Despite the fact that our Company has taken the necessary information security measures, in the event that personal data is damaged or seized by third parties as a result of attacks on the website and system, our Company will immediately notify you and the Personal Data Protection Board of this situation.
9. KEEPING YOUR PERSONAL DATA ACCURATE AND UP-TO-DATE
Those who share their personal data with our Company acknowledge and declare that they are aware that it is important that this information is accurate and kept up-to-date, both in terms of the rights they have on their personal data in terms of the Personal Data Protection Law No. 6698 and other relevant legislation, and that the responsibilities arising from providing incorrect information will be entirely their own.
You can make the necessary notifications regarding the changes and/or updates regarding your personal data you have shared via physical mail to the notification address specified below or through the communication channels on the website https://yolcu360.com.
10. DELETION, DESTRUCTION OR ANONYMIZATION OF YOUR PERSONAL DATA
Your personal data processed for the purposes specified in this Information text; When the purpose requiring processing according to Article 7/1 of the KVKK disappears and, if any, the periods determined by the Laws expire; It will be deleted, destroyed or anonymized by us ex officio or upon your request in accordance with the Personal Data Retention and Destruction Policy prepared in accordance with the provisions of the Regulation on the Deletion, Destruction or Anonymization of Personal Data of our Company and will continue to be used.
11. IDENTITY OF THE DATA CONTROLLER
YOLCU 360 BİLİŞİM ANONİM ŞİRKETİ
Mersis No: 0981139899000001
Address: Atatürk Mahallesi Ertuğrul Gazi Sokak D2 Blok No:2 R Interior Door No:13 Ataşehir / Istanbul
KEP Address: yolcu360bilisim@hs01.kep.tr