Privacy Notice (KVKK)

1. Introduction

As DEMSOY TURİZM OTO KİRALAMA VE ALIM SATIM HİZ. SAN. VE TİC. LTD. ŞTİ. (the “Data Controller” or the “Company”), we approach this matter with care, because we value the privacy of your personal data and acknowledge that the information you share with us is personal and confidential.

The basic information on the protection of the personal data transferred to the Company is set out below. In order to fulfil its duty to inform arising from Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”), the Company presents the following explanations to its customers and to third parties using its website. The Company reserves the right to update this Information Notice on the Protection of Personal Data at any time in line with changes that may be made to the legislation in force.

As DEMSOY TURİZM OTO KİRALAMA VE ALIM SATIM HİZ. SAN. VE TİC. LTD. ŞTİ., registered with the İzmir Chamber of Commerce under registry number 83467, with MERSIS number 0291010385800018 and located at ATIFBEY MAH. 5 SOK. NO:86/D GAZİEMİR/İZMİR, we are deemed the Data Controller under the KVKK with regard to the personal information we receive from you in the course of our activities. As the Data Controller, your personal information may be recorded, stored, updated and classified as described below, disclosed and/or transferred to third parties and/or abroad where the legislation permits, and processed in the other ways listed in the KVKK. Within the framework of this Policy, your personal data will be used only to provide you with a better service.

The Data Controller Representative to be appointed by the Company will be announced in the Data Controllers’ Registry and at the web address where this document is published once the legal infrastructure is in place. Various laws regulate the use of our customers’ personal data. First and foremost, the KVKK sets out the principles for the protection of personal data. The Law No. 6563 on the Regulation of Electronic Commerce also contains provisions on the protection of personal data, and the provisions of the Turkish Penal Code No. 5237 provide for criminal sanctions in certain cases to protect personal data.

In addition, data must be collected and used in order to fulfil our obligations under the Consumer Protection Law No. 6502 and the Regulation on Distance Contracts.

We have prepared this Privacy Policy (the “Policy”) to inform users visiting our website, under the Personal Data Protection Law No. 6698 (“KVKK”), about the privacy and security of the personal data collected through the website operated by the Company (the “Platforms”). Within the framework of this Policy, your personal data will be used only to provide you with a better service.

2. Scope of the Policy

The privacy and security of the data we collect while you access the platforms operated by the Company fall within the scope of this Policy.

The presence of a logo, mark or similar visual belonging to the Company on a site not operated by the Company does not mean that this Policy applies to that site. To benefit from the safeguards in this Policy when sharing personal data with such sites, you need to make sure that the site in question belongs to the Company.

3. Protection of Personal Data

Under the KVKK, the processing of your personal data by the Company as data controller, your rights regarding your personal data and the technical and administrative measures we take to protect your personal data are safeguarded by the Company.

4. Data Collected on Our Website

4.1. Personal Data Collected Through Contact Forms

Through the contact forms that allow you to send us your requests and complaints, we collect your

• Name and surname
• E-mail address,
• Phone number,
• Message

information.

4.2. Device Information

When you use our services, information such as the IP address of the electronic devices you use (computers, tablets, smartphones, smart TVs, etc.) is collected.

We may also send you push notifications through our website(s). You can refuse to receive these messages by changing the settings in your device’s operating system.

4.3. Data Collected Through Cookies

Cookies are small text files that are stored on the visitor’s device (for example a computer or phone) when a website is visited and that may contain data in name-value format. In this way, various information can be obtained about the device used to visit the website(s) and the related user. Cookies are used on our website. For detailed information on the use of cookies on our website, please read our Cookie Policy at durayrentacar.com/en/cookie-policy.

4.4. Data We Collect Automatically When You Access Our Servers

When you use our website, we may collect personal data such as your device log records in order to meet our customers’ individual or corporate requests and needs, to develop and audit our technical infrastructure, to improve the hardware and software technologies we use and our other services, and to fulfil our legal obligations.

5. Links to Third-Party Websites

Our site may contain links to third-party websites, such as private employment agencies. In such cases, the collection, processing, sharing or transfer of data by third parties is outside our responsibility. Your use of third-party sites and your sharing of data with them are subject to the privacy policies and terms of use of those sites and fall outside the scope of this Policy. We recommend that you read the privacy policies of the websites you visit before sharing your personal data.

6. Personal Data Obtained Before the KVKK Entered into Force

Since the Company website did not go live before 7 April 2016, the date on which the KVKK entered into force, we do not hold any personal data stored before that date.

7. For what purposes does the COMPANY use personal data?

The COMPANY may record, store, update, disclose to third parties, transfer, classify and process your personal information in the cases and to the extent permitted by the legislation.

Your personal data is used for the following purposes:

• To verify the identity of the person making or arranging a purchase through the website,
• To record the address and other information required for communication,
• To contact our customers and provide the necessary information regarding the terms, current status and updates of the contracts we conclude under the distance sales contract and the relevant articles of the Consumer Protection Law,
• To prepare all records and documents that will form the basis of transactions in electronic (internet/mobile, etc.) or paper form,
• To fulfil the obligations undertaken under the contracts we conclude pursuant to the Distance Sales Contract and the relevant articles of the Consumer Protection Law,
• To provide information to public officials on matters of public security upon request and as required by law,
• To provide our customers with a better shopping experience, to inform them “taking their interests into account” about products they may be interested in, to communicate campaigns, to increase customer satisfaction, to get to know customers who shop on the website and use this in customer base analysis, to use it in various marketing and advertising activities and, in this context, to conduct surveys electronically and/or physically through contracted organisations,
• To enable our contracted institutions and solution partners to make offers to our customers and to inform our customers about our services,
• To evaluate customer complaints and suggestions regarding our services,
• To fulfil our legal obligations and exercise our rights arising from the legislation in force.

8. How does the COMPANY protect your personal data?

Personal data shared with the COMPANY is under the COMPANY’s supervision and control. As data controller, the COMPANY has assumed responsibility for establishing the necessary organisation and for taking and adapting technical measures to protect the confidentiality and integrity of information in accordance with the relevant legislation in force. Aware of this obligation, we have periodic security tests carried out in line with international and national technical standards on data privacy, and we hereby inform you that we always keep our data processing policies up to date accordingly.

9. Does the COMPANY share your personal data?

Personal data belonging to our customers is shared with third parties within the scope of our customers’ consent and, as a rule, personal data is not transferred to third parties without our customer’s approval.

However, personal data is shared with courts and other public institutions due to, and limited to, our legal obligations. In addition, personal data is transferred to contracted third parties in order to provide the services we have committed to and to carry out quality control of those services.

The necessary technical and legal measures are taken to prevent violations of rights during the transfer of data to third parties. However, the COMPANY is not responsible for violations arising from the data protection policies of the third party receiving the personal data or occurring within that third party’s area of responsibility.

Your personal data may be shared with the COMPANY’s shareholders, our direct/indirect domestic/foreign affiliates, the programme partner institutions and organisations we cooperate with to carry out our activities, the domestic/foreign persons and institutions from which we obtain cloud and/or server storage services, the domestic/foreign organisations we have contracted to send commercial electronic messages to our customers, the Interbank Card Center, the banks we have agreements with and, within the scope of various marketing activities aimed at serving you better and ensuring customer satisfaction, various domestic and foreign agencies, advertising companies and survey companies, other domestic/foreign third parties and our relevant business partners.

10. What are your rights under the Personal Data Protection Law?

We would like to remind you that, under the KVKK, you have the right to:

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of the processing and whether it is used in accordance with that purpose,
• Know the third parties in Türkiye or abroad to whom it has been transferred,
• Request its correction if it has been processed incompletely or incorrectly,
• Request its deletion or destruction under the conditions set out in Article 7 of the KVKK,
• Request that the operations carried out under items (d) and (e) above be notified to the third parties to whom it has been transferred,
• Object to any result against you arising from analysis exclusively by automated systems,
• Claim compensation for damages if you suffer loss due to processing in breach of the KVKK.

11. How long is personal data retained?

Even if processed in accordance with Law No. 6698 and other relevant provisions, personal data is deleted, destroyed or anonymised by the COMPANY or upon your request once the reasons requiring its processing no longer exist. However, under the Law No. 6563 on the Regulation of Electronic Commerce, records of the withdrawal of consent will be kept for 1 year from that date, and the content of commercial electronic messages and all other records relating to the sending will be kept for 3 years to be submitted to the relevant Ministry when necessary. After this period, your personal data is deleted, destroyed or anonymised by the COMPANY or upon your request.

12. How can I stay informed about legislative changes regarding personal data?

The rights you have under the KVKK are the COMPANY’s obligations. We would like to inform you that we process your personal data with this awareness and to the extent required by the legislation, that in the event of legal changes we will update the information on this page in line with the new legislation, and that you can always easily follow the updates on this page.

13. How can I be sure that the data is kept accurate and up to date?

Under Article 4 of the KVKK, the COMPANY is obliged to keep your personal data accurate and up to date. In this context, for the COMPANY to fulfil its obligations under the legislation in force, our customers need to share accurate and up-to-date data with the COMPANY. If your data changes in any way, please contact us through the communication channels below to update it.

14. To ask the COMPANY questions about your personal data

For any questions and opinions regarding your personal data, you can reach us at any time at the e-mail address [email protected].

The COMPANY may respond to requests positively or negatively, in writing or digitally, provided that the response is reasoned and given within 30 days. Processing of requests is free of charge as a rule. However, if the processing incurs a cost, the COMPANY reserves the right to charge a fee. These fees are determined according to the tariff set by the Personal Data Protection Board under Article 13 of the Personal Data Protection Law.

You can send your questions, reservations or complaints regarding the interpretation or application of this Policy to [email protected] by e-mail and/or to ATIFBEY MAH. 5 SOK. NO:86/D GAZİEMİR/İZMİR.

DEMSOY TURİZM OTO KİRALAMA VE ALIM SATIM HİZ. SAN. VE TİC. LTD. ŞTİ.