KVKK and Processing Policy
I. INTRODUCTION
1.1 Purpose of the Policy
The processing of personal data received from Oğuz Rent A Car in accordance with the Article 20 of the Constitution titled “Privacy of Personal Life” and the Law on Protection of Personal Data No. 6698 (“Law”), employee candidates, customers, potential customers, suppliers , shareholders/partners, company representatives, visitors, business partners and other third parties), protecting fundamental rights and freedoms, especially privacy, and processing the data of the data controller who processes personal data. In accordance with the purpose of this policy, to establish the principles of protection, storage and destruction of personal data received, in appropriate cases.
1.2. Scope of the Policy
Obtaining, recording, storing, storing, changing, rearranging all kinds of information regarding an identified or identifiable natural person as personal data, automatically or not, automatically or in part, as personal data, in the capacity of data controller. Since all kinds of transactions such as disclosure, transfer, acquisition, provision, classification or prevention of use are considered as data processing activities, the scope of this activity policy is determined by the company's determination of the procedures and principles regarding data processing activity.
1.3. Implementation of the Directive and related legislation
This Policy has been prepared in accordance with the relevant legislation and the rules specified in the regulations, communiqués, decisions and guides published by the Board of Directors, in particular the Law No. 6698. If there is a change in the law or other relevant laws after the policy is published and the policy is no longer consistent with that change, the changed terms and rules will apply. All communications, decisions and policies made by the Board of Directors will be followed by our company and the rules specified in the policy will be kept up to date.
1.4. implementation of the policy
The policy was published on the company's website at www.oguzrentacar.com.tr and entered into force on the date of its publication.
II. PERSONAL DATA PROTECTION ISSUES
2.1. Ensuring the security of personal data
In accordance with Article 12 of Law No. 6698, Data Controller;
● To prevent the unlawful processing of personal data,
● To prevent unlawful access to personal data,
● To ensure the protection of personal data
It is obliged to take all necessary administrative and technical measures to ensure the level of security suitable for the purpose.
For the reasons explained, the company takes security measures to prevent unlawful processing, transfer and disclosure of personal data to third parties, unauthorized access and other security breaches that may arise. Explanations on the administrative and technical measures taken VI. It is included in the ADMINISTRATIVE AND TECHNICAL MEASURES ON THE PROTECTION OF PERSONAL DATA.
2.2. Protection of private personal data
Data that are sensitive in nature and that may harass or discriminate against the data owner while in the hands of third parties are considered as special personal data by law. Special Personal Data Categories include data on race, ethnicity, political opinion, belief, religion, sect or other beliefs, disguise, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. . data. Special categories of personal data cannot be processed without the explicit consent of the person concerned.
The Company takes all necessary measures to protect sensitive personal data and it is important that this data is collected and processed as little as possible.
III. ISSUES OF PROCESSING PERSONAL DATA
3.1. Processing of personal data in accordance with the principles determined by law
Pursuant to Article 4 of the Law, the principles regarding the processing of your personal data are as follows:
● compliance with the law and integrity rules
● be accurate and up-to-date when necessary,
● processing for specific, explicit and legitimate purposes,
● for the purpose for which they are processed, give
3.2. Personal Data Processing Conditions
Personal data obtained by the company cannot be processed without the explicit consent of the person concerned, with the exception of the exceptions stipulated in the Law. Your personal data may be processed without express consent in the following cases:
● It is clearly stipulated in the laws,
● It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid,
● It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
● It is mandatory for the data controller to fulfill its legal obligation,
● The person concerned has been made public by himself,
● Data processing is mandatory for the establishment, exercise or protection of a right,
● It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
3.3. Exceptions to Obligation to Obtain Explicit Consent
a) It is clearly stipulated in the laws
One of the data processing conditions is that it is expressly stipulated in the law. The provisions in the laws regarding the processing of personal data may create a data processing condition. In such a case, the explicit consent of the person concerned is not sought.
b) Actual impossibility
The personal data of the person concerned can be processed without his explicit consent in cases where it is necessary to protect the life or physical integrity of himself or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid.
c) Being directly related to the establishment or performance of the contract
In the event that data processing is deemed necessary during the conclusion of a contract to which the data owner is a party or during the performance of the contract, the processing of personal data may come to the fore without obtaining explicit consent.
d) The company's fulfillment of its legal obligations
Personal data can be processed without express consent for the purpose of fulfilling the legal obligations that our Company, as the data controller, must fulfill.
e) It has been made public by the person concerned
Personal data made public by the data subject, in other words, personal data disclosed to the public in any way, can be processed without express consent. Even in this case, the publicized personal data cannot be used for purposes other than its intended use.
f) Being compulsory for the establishment, use and protection of a right
In cases where it is necessary for the establishment, exercise or protection of a right, it is possible to process the personal data of the person concerned without his explicit consent.
g) Obligatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
If the processing of personal data is obligatory for the data controller and the data processing will not harm the fundamental rights and freedoms of the data subject, personal data may be processed without obtaining explicit consent.
The legitimate interest of the data controller is the interest and benefit to be obtained as a result of the processing to be carried out. Benefit of the data controller; It must relate to a legitimate, sufficiently effective, specific and already existing interest to compete with the fundamental rights and freedoms of the person concerned. It should be a process that is related to the current activities of the data controller and will benefit him in the near future.
3.4. Processing of Private Personal Data
The processing of sensitive personal data is subject to Article 6 of the Law and it is prohibited to be processed without the explicit consent of the person concerned.
Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, disguise and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are of special nature. is personal data. The data included in this scope is limited and cannot be expanded through interpretation.
Due to its nature, special quality personal data is data that, if learned, may cause discrimination and victimization of the person concerned. Therefore, they need to be protected much more strictly than other personal data
a) Special categories of personal data other than health and sexual life
Special categories of personal data other than personal data related to health and sexual life can be processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws.
b) Personal data of special nature regarding health and sexual life
Special categories of personal data related to health and sexual life can only be processed by persons or authorized institutions and organizations that are under the obligation of confidentiality for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
3.5. Clarifying and Informing the Personal Data Owner
During the acquisition of personal data, data owners are informed in the capacity of data controller or by persons authorized by our Company. The procedures and principles regarding the information provided are specified in the Disclosure Text on the Protection of Personal Data published by the Company, and the information briefly includes the following elements:
● Identity of the data controller and its representative, if any,
● For what purpose personal data will be processed,
● To whom and for what purpose personal data can be transferred,
● Method and legal reason for collecting personal data,
● Rights of the person concerned, as indicated in Article 11 of the Law.
a) Identity of the data controller and its representative
According to Article 10 of the Law, personal data obtained from data owners (customers, employee candidates, business partners, suppliers, shareholders, company officials, visitors and other third parties) are processed by the Company, Oğuz rent a car, in the capacity of data controller, and the contact info of the relevant unit It can be obtained from @oguzrentacar.com.tr e-mail address or www.oguzrentacar.com.tr.
b) Purposes of processing personal data
The processing of personal data is carried out for specific, clear and legitimate purposes and is based on informing the data owners. The purposes for which your obtained data are processed are included in the V. CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND THE PURPOSE OF PROCESSING of the Policy.
c) Persons to whom personal data are transferred and the purposes for which they are transferred
Within the framework of the data controller's obligation to inform the data owner, the persons to whom personal data are transferred and the purposes for which they are transferred should be clearly stated. Personal data cannot be transferred to third parties without the explicit consent of the data owner. Recipient groups to whom personal data are transferred by our company and the purposes for which they are transferred IV. It is shown in the section TRANSFERRING PERSONAL DATA.
d) Method and legal reason for collecting personal data
In accordance with Articles 5 and 6 of the Law, the data controller must clearly state on which of the personal data processing conditions it is processed. Data collection method and mediation are determined by the data controller. The processing conditions of personal data, that is, the conditions of compliance with the law, are listed in a limited number in the Law (art. 5-6) and these conditions cannot be extended.
The Data Controller Company evaluates whether the purpose of the personal data processing activity is primarily based on one of the processing conditions other than express consent, and if this purpose does not meet at least one of the conditions other than the express consent specified in the Law, in this case, the explicit consent of the person is sought for the continuation of the data processing activity.
IV. TRANSFERRING PERSONAL DATA
4.1. Domestic Transfer
Personal data cannot be transferred without the explicit consent of the person concerned. However:
● In the second paragraph of Article 5,
● Provided that adequate measures are taken, in the third paragraph of Article 6
If one of the conditions specified is present, it can be transferred without seeking the explicit consent of the person concerned.
Accordingly, provided that it is clearly stipulated in the law (1), is compulsory for the protection of the life or bodily integrity of the person or another person whose consent is not legally valid or who is unable to express his consent due to actual impossibility (2), and is directly related to the establishment or performance of a contract. It is necessary to process the personal data of the parties (3), it is necessary for the data controller to fulfill its legal obligation (4), the data subject has been made public by himself (5), the data processing is mandatory for the establishment, exercise or protection of a right (6), Provided that it does not harm the fundamental rights and freedoms of the data subject, personal data of the data subject may be transferred to third parties without obtaining their explicit consent, if data processing is necessary for the legitimate interests of the data controller.
At the same time, personal data other than health and sexual life, which are among the sensitive personal data belonging to the persons concerned, in cases stipulated by the laws; Personal data related to health and sexual life can only be provided with the express consent of the person concerned, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, care services, planning and management of health services and financing, by persons under the obligation of keeping confidentiality or by authorized institutions and organizations. It can be transferred to 3rd parties without being called.
Information on the recipient groups, to which your personal data processed by the company is transferred, is included in the Annex 4 - Third Parties to which Personal Data are Transferred and the Purposes of Transfer of this Policy.
4.2. International Transfer
Personal data cannot be transferred abroad without the explicit consent of the person concerned. In so far, the existence of one of the conditions specified in the second paragraph of Article 5 and the third paragraph of Article 6 of the Law and in the foreign country to which the personal data will be transferred;
● Availability of adequate protection,
● In the absence of adequate protection, data controllers in Turkey and in the relevant foreign country must undertake in writing to provide adequate protection and have the permission of the Board,
can be transferred abroad without seeking the explicit consent of the person concerned, provided that the
