Privacy Notice Under LPPD
As SIXT Türkiye (ARTI Seyahat Acentesi Tekstil Sanayi ve Ticaret Anonim Şirketi), we would like to inform you, in our capacity as the data controller, about our personal data processing activities within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”). For more detailed information, please refer to the full Clarification Text available on our website.
WHO IS THE DATA CONTROLLER?
The data controller refers to the natural or legal person who determines the purposes and means of processing personal data, and who is responsible for the establishment and management of the data recording system. In this respect, our Company, as the data controller, processes your personal data within the legal grounds and purposes explained in this text.
WHAT PERSONAL DATA DO WE PROCESS?
Pursuant to KVKK, any kind of information relating to an identified or identifiable natural person is defined as personal data. Within the scope of the services you receive from our company or your applications, we process your personal data required in various processes in order to carry out our activities in the most appropriate way. The information we require may vary depending on the nature of the rental process, damage situation, use of customer programs, services utilized, campaigns, and the content of requests.
You may find these categories generally listed below:
- Identity (Name-surname, Turkish ID number/Passport number, Copy of Driver’s License/ID/Passport, Date of birth, Gender, Nationality, Signature information, Identity data of additional drivers, Identity data of third parties involved in an accident)
- Contact (Contact details (e-mail/phone), Address information)
- Location (Location information (GPS), Accident location information, HGS Toll Information)
- Employment (Profession/title/position information collected within the scope of SIXT card and other customer loyalty programs and campaigns)
- Legal Transaction (Legal transaction records, Legal requests, Information regarding applications to competent authorities, Powers of attorney, Legal representative information)
- Customer Transaction (Vehicle Delivery Form, Rental Agreement, Detailed Information Regarding Rental Transaction (Fuel, Mileage, HGS/OGS Usage etc.), Vehicle delivery and return dates/locations, Vehicle preferences, Additional services, SIXT Card details, Policy information, Information regarding driver and third parties in the event of an accident, Damage records, Accident reports, Replacement vehicle form, Past rental history in our company, Assistance service information, Flight information, Accommodation information if shared, Request and complaint information)
- Vehicle (Vehicle information (License plate etc.), Damaged vehicle information in the event of accident/damage, other vehicle information involved in an accident, other information related to vehicle use, UTTS information, In-vehicle preferences and usage data stored in vehicle systems depending on vehicle features)
- Transaction Security (Website and mobile application transaction records, IP address, Username/Password, Device/Browser information, Cookie data, Session information, Form filling/click/transaction history, Permission and consent records)
- Risk Management (Driving risk assessment, Findeks information if shared)
- Finance (Credit card details, Bank account information required for refund transactions, Payment method information, Credit score/risk information, Collection and compensation information)
- Physical Security (Camera recordings at rental locations)
- Marketing (Communication preferences with consent, Survey information, Rental history information, Campaign and offer preferences, Cookie records)
- Visual and Audio Records (Call center call recordings, Visual data)
- Health (Health reports, Alcohol test result, Health data within the scope of rentals for disabled vehicles)
- Criminal Convictions and Security Measures (Traffic fines, Correspondence/Reports issued by judicial authorities)
FOR WHAT PURPOSES AND ON WHAT LEGAL GROUNDS DO WE PROCESS YOUR PERSONAL DATA?
We process your personal data in connection with, limited to, and proportionate to our activities. The purposes for which your personal data is processed and the legal grounds under the KVKK are explained below according to the relevant processes.
Vehicle Rental Processes
Your personal data in the categories of Identity, Contact, Customer Transaction, Vehicle, Finance, Location, Transaction Security, Visual and Audio Records are processed on the legal ground set forth in Article 5(2)(c) of the KVKK: 'It is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract. Purposes of processing include:
- Carrying out reservation and rental transactions
- Obtaining necessary information for establishing contractual relationships and filling out forms
- Carrying out necessary processes within the scope of subscription services
- Conducting identity verification processes
- Carrying out necessary actions to optimize vehicle use, ensuring security, and taking preventive measures
- Managing vehicle pick-up and return processes
- Carrying out communication activities
- Determining payment method, managing pre-authorization and payment processes
- Determining and paying rental-related charges such as traffic fines, toll fees, damages, fuel, additional services
- Compensating damages and managing insurance processes
- Managing damage and recourse processes
- Managing roadside assistance and support services
- Handling requests and complaints
- Managing call center operations
Your personal data in the categories of Identity, Finance, and Contact are processed on the legal grounds set forth in Articles 5(2)(a) and 5(2)(ç) of the KVKK: 'It is mandatory for the data controller to fulfill its legal obligations' and 'Explicitly stipulated by law.' Purposes of processing include:
- Managing invoicing processes
Your personal data in the categories of Identity, Contact, Location, and Customer Transaction are processed on the legal ground set forth in Article 5(2)(f) of the KVKK: 'It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Purposes of processing include:
- Preventing abuse
- Tracking vehicles and monitoring the fulfillment of obligations
Your personal data in the categories of Identity, Risk Management, and Finance are processed on the legal ground set forth in Article 5(1) of the KVKK: 'Explicit consent of the data subject.'
Purposes of processing include:
- Determining payment ability and obtaining credit score/risk information
- Monitoring and scoring driver behavior
In addition, special categories of personal data may also be processed during the rental processes. Health data processed within the scope of rentals of vehicles for disabled persons and within damage and recourse processes, as well as personal data in the category of Criminal Convictions and Security Measures processed within the scope of traffic fine payments, are processed on the legal ground set forth in Article 6(3)(b) of the KVKK: 'Explicitly stipulated by law.
Website Transactions
During your visit to our website, we process your personal data through cookies. For more detailed information on this matter, you can review the Cookie Clarification Text.
If a reservation and vehicle rental is made through the website, please review the explanations under the section 'Vehicle Rental Processes' regarding the personal data to be processed.
In addition, for the transactions you carry out on the website, your personal data in the categories of Identity, Contact, and Transaction Security are processed on the legal grounds set forth in Articles 5(2)(a) and 5(2)(ç) of the KVKK: 'It is mandatory for the data controller to fulfill its legal obligations' and 'Explicitly stipulated by law.' Purposes of processing include:
- Recording transactions
- Fulfilling regulatory obligations
Your personal data in the categories of Identity, Contact, Employment, Customer Transaction, Transaction Security, Vehicle, and Finance are processed on the legal ground set forth in Article 5(2)(c) of the KVKK. Purposes of processing include:
- Managing subscription processes through the website
- Carrying out membership transactions
- Managing SIXT Card transactions
- Managing dealership/rental point processes
Your personal data in the categories of Identity, Contact, and Customer Transaction are processed on the legal ground set forth in Article 5(2)(f) of the KVKK. Purposes of processing include:
- Carrying out communication activities
- Evaluating requests and complaints
Marketing and Advertising Activities
Your personal data in the categories of Identity, Contact, Customer Transaction, Employment, Marketing, and Finance are processed on the legal ground set forth in Article 5(2)(f) of the KVKK. Purposes of processing include:
- Conducting marketing strategy studies
- Carrying out research and analysis for the development of products and services
- Carrying out segmentation activities, identifying products/services addressing customers
- Ensuring customer satisfaction and improving user experience
Your personal data in the categories of Identity, Contact, Employment, Customer Transaction, Marketing, and Finance are processed on the legal ground set forth in Article 5(1) of the KVKK: 'Explicit consent of the data subject.' Purposes of processing include:
- Conducting processes within the scope of marketing, promotion, campaign, and customer loyalty activities
- Managing loyalty program processes
- Carrying out commercial electronic communication processes
- Conducting activities such as surveys, campaigns, lotteries, etc. within the scope of customer satisfaction studies
- Providing personalized offers and conducting profiling activities
Company Operations
Your personal data may be processed in order for the Company to fulfill its legal obligations, carry out operational processes, and determine company strategies.
In this context, your personal data related to the relevant activity are processed on the legal grounds set forth in Articles 5(2)(a), 5(2)(ç), and 6(3)(b) of the KVKK: 'It is mandatory for the data controller to fulfill its legal obligations' and 'Explicitly stipulated by law.' Purposes of processing include:
- Managing information security processes
- Carrying out retention and archiving activities
- Sharing information with authorized public institutions and organizations within the framework of legislation
- Conducting audit and internal control activities
- Conducting and monitoring legal affairs and proceedings
- Fulfilling rights and obligations arising from various legal regulations
In addition, your personal data related to the relevant activity are processed on the legal ground set forth in Article 5(2)(f) of the KVKK. Purposes of processing include:
- Developing company business processes
- Carrying out activities to prevent abuse practices
- Ensuring the security of company buildings, offices, vehicles, and facilities
- Managing customer relations and conducting customer evaluation studies
- Conducting reporting and examinations
- Training and developing artificial intelligence systems
Dealership and Agency Application Processes
Within the scope of dealership and agency applications of our Company, your personal data may also be processed.
Your personal data in the categories of Identity, Contact, and Customer Transaction are processed on the legal ground set forth in Article 5(2)(c) of the KVKK. Purposes of processing include:
- Obtaining necessary information for the establishment of a Dealership or Agency contractual relationship, evaluating applications, and ensuring communication.
HOW DO WE COLLECT AND TO WHOM DO WE TRANSFER YOUR PERSONAL DATA?
Your personal data may be collected through non-automated means (written/oral) or via automated systems through electronic channels by our Company.
In accordance with Articles 8 and 9 of KVKK, and as required by commercial operations, your data may be transferred domestically or internationally to the following entities:
- Dealerships, service providers, parking operators, vehicle towing and roadside assistance service providers,
- Corporate clients and business partners,
- Insurance companies and experts,
- Banks, payment and card storage institutions, financing companies,
- Legal, financial, tax, and operational consultants,
- Agencies and marketing companies we receive support from,
- Advertising companies and campaign partners,
- Auditing firms,
- Legal representatives and attorneys,
- Business partners and suppliers providing various services,
- Group companies under Bor Holding A.Ş.,
- Our international partner SIXT SE,
- Authorized public institutions and organizations,
- Courier and transport service providers,
- Professional associations and NGOs.
WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?
In accordance with Article 11 of KVKK, you have the following rights:
- To learn whether your personal data is being processed,
- To request information regarding the processing,
- To learn the purpose of processing and whether the data is used in accordance with that purpose,
- To know the third parties to whom your data is transferred domestically or abroad,
- To request correction if your data is incomplete or incorrectly processed,
- To request deletion or destruction of your personal data under certain conditions,
- To request notification of the correction/deletion/destruction to third parties to whom your data has been transferred,
- To object to results against you arising from the analysis of your data exclusively by automated systems,
- To demand compensation if you suffer damage due to unlawful processing.
You may submit your requests within the scope of these rights by using the “Personal Data Application Form” available on our website, or by using the methods stipulated in the Communiqué on the Principles and Procedures for the Request to the Data Controller. You can find more detailed information and contact addresses in the form available on our website.