KVKK privacy notice · Alpina Car

ÖZDAĞLAR İNŞAAT OTOMOTİV VE TURİZM SAN.TİC.LTD.ŞTİ. INFORMATION AND PRIVACY NOTICE UNDER PERSONAL DATA PROTECTION LAW NO. 6698 (KVKK)

With our success-driven approach to work, and with staff who embrace ethical values and share a sense of belonging, our company, while ensuring continuity in its sales and service activities with a focus on complete customer satisfaction, attaches great importance to the processing and protection of your personal data in accordance with Personal Data Protection Law No. 6698 (the “KVKK”) and the related legislation.

Our company, as the data controller, takes the necessary technical and administrative measures to prevent the unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the safekeeping of personal data.

Pursuant to Article 10 of the Law, we inform you, within the scope of our company’s activities, by means of the policies we have established and this privacy notice, which cover customers, potential customers, suppliers, service providers and their employees and representatives, business partners, company shareholders, employees, job applicants, visitors, public institutions and organisations, employees of private-law legal entities and related third parties.

This privacy notice has been prepared by the data controller ÖZDAĞLAR İNŞAAT OTOMOTİV VE TURİZM SAN.TİC.LTD.ŞTİ. (the “Company”) within the scope of Article 10 of Personal Data Protection Law No. 6698 (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

1. Data Controller

ÖZDAĞLAR İNŞAAT OTOMOTİV VE TURİZM SAN.TİC.LTD.ŞTİ. Our head office address: (Ergenekon Mah. Dolapdere Cad. No: 180/A Pangaltı / Şişli / Istanbul TÜRKİYE, Tax Office: Şişli, Tax Number: 6740441515); processes your personal data in its capacity as “data controller” as defined in Article 3 of Personal Data Protection Law No. 6698. (This also covers our existing branches and any branches that may be opened in the future.)

2. Purposes for Which Personal Data Are Processed

Your personal data collected under Personal Data Protection Law No. 6698 are processed in accordance with the principles laid down in the Law by being obtained, recorded, stored, altered and reorganised, wholly or partly by automated means, or by non-automated means provided that they form part of a data recording system. Your personal data are processed in accordance with the relevant legislation for the following purposes within the scope of the Company’s activities.

Accordingly:

carrying out vehicle rental transactions, rental reservations and vehicle delivery services within the scope of our Company’s rent-a-car activities,
providing after-sales support services as a rent-a-car company; carrying out individual and fleet vehicle rental services,
vehicle insurance and comprehensive motor insurance (kasko) services; monitoring damage processes following vehicle rental,
carrying out credit financing and roadside assistance services in connection with vehicle sales,
carrying out second-hand vehicle sales transactions,
developing the Company’s services, and continuing corporate development activities and advertising and marketing activities,
conducting customer-related processes and vehicle warranty processes,
conducting the Company’s finance and accounting, administrative, legal and technical business processes,
carrying out vehicle registration procedures, sharing vehicle rental information with the relevant public institutions and organisations, and fulfilling legal obligations, as required by statutory regulations,
ensuring customer satisfaction and handling customer requests and complaints,
planning and executing human resources processes, handling job application processes, creating personnel files for employees, fulfilling financial obligations and determining the Company’s remuneration policy,
concluding, and ensuring the performance of, contracts and protocols that the Company has concluded or will conclude with its customers, dealers, potential customers, suppliers, employees and related third parties with whom it has a legal relationship,
conducting work, transactions and processes before the Personal Data Protection Authority under the KVKK,
discharging the Company’s burden of proof by way of evidence in legal disputes with third parties,
maintaining the processes necessary for your use of our website relating to the Company’s activities, for communication through the Company’s contact details and for your completion of the forms on our website,
carrying out sales of products and services to the relevant persons and organisations, monitoring sales transactions, and carrying out banking transactions and payment processes involving credit cards, cheques, promissory notes and other commercial payment instruments,
ensuring the physical security of the Company’s buildings and their annexes, monitoring staff attendance and controlling entry to and exit from the Company’s buildings,

For the above purposes, your personal data are processed in line with the conditions and purposes determined in accordance with Articles 4, 5 and 6 of the KVKK. Your personal data are not used for any purpose other than our Company’s activities. In line with the purposes stated above, and limited to the Company’s activities, the following personal data of yours are processed.

Identity information (Turkish ID number/foreign national ID number, your name and surname, place and date of birth, mother’s and father’s names, marital status, gender, the information on your passport and driving licence, and your identity card or other civil registry identity information held on the identity sharing system)
Contact information (your telephone numbers, contact address and e-mail address)
Location information (vehicle licence plate information, address, location data of where you are)
Personnel file information (employment contract, education, diploma information, certificate information, Social Security Institution (SGK) employment start and termination notifications, General Health Insurance (GSS) enrolment information, identity information on the family status declaration, persons for whom the employee is responsible as dependants, spouse and children/kinship information, civil registry records of family members, equipment custody (handover) records issued depending on the nature of the job, certificate of employment, resignation, termination, severance pay and notice pay statements, payroll information, disciplinary investigation information, SGK registration number, service record, CV information, leave information, staff performance appraisal reports, occupational accident information, information on the job application form, references, bank account details and IBAN information)
Legal transaction information (personal information in correspondence with judicial authorities, and information in court and enforcement files)
Customer transaction information (the vehicle registration document of the rented vehicle; the vehicle’s make, model, colour, engine and chassis numbers and licence plate information; invoices; sales price; personal information on insurance and comprehensive motor insurance (kasko) policies; disability (invalidity) reports; disability status documents; decisions and information on the appointment of a guardian; powers of attorney; documents of representation; signature circulars; traffic registration and tracking documents; forms completed in connection with vehicle maintenance and servicing; and the identity, contact, location, vehicle registration, insurance, expert appraisal, damage, bank and payment information obtained)
Information shared via social media and online sales websites (information shared by customers using our social media accounts; information whose sharing has been approved via websites acting as intermediaries in vehicle rental transactions; vehicle licence plate, registration, contact, location, bank, payment and financial information)
Physical premises security information (entry and exit records of employees, customers, potential customers, suppliers and visitors; camera recordings of you if you visit our workplace and its annexes, showroom or offices; your vehicle licence plate information if you use our car park; information contained in forms you have completed)
Professional experience information (education information, diploma information, employment history, references, courses attended, in-service training information, certificates, driving licence, other information in submitted forms)
Visual records (photographs on completed printed forms, documents and your official identity documents; photographs taken where necessary in connection with job applications and the Company’s activities; your photographs used or shared on our website, our social media accounts or third-party social media platforms in advertising, marketing and Company campaigns; your images in camera recordings)
Health information (health reports, blood group information, personal health and physical disability information)
Information on criminal convictions and security measures (criminal record, conviction and judicial status information)
Identity, contact, location and financial information, bank account numbers, IBAN numbers, credit card information, invoice information, credit, contract, cheque and promissory note information, purchase and sale information, powers of attorney, signature circulars, and other personal data obtained by reason of our rental services, as required for vehicle rental,
Identity, contact, location, bank and financial information, signature circulars and contract information contained in real estate lease agreements,
Information obtained through corporate call services, and your personal information obtained by e-mail, letter or other means of communication.

3. To Whom and for What Purposes Processed Personal Data May Be Transferred

Your personal data processed by our Company are transferred to the relevant natural and legal persons for the purposes set out below, in accordance with Articles 8 and 9 of the KVKK (Law No. 6698).

Accordingly:

to our authorised suppliers, within the scope of our Company’s activities as an authorised Hyundai and Kia vehicle sales and service dealer,
limited to the Company’s activities, to our customers, business partners, service providers, suppliers, persons assisting in performance and subcontractors, and to our group companies for the purpose of cooperation,
to the relevant public institutions and organisations, including the relevant Police Directorates, the Revenue Administration, tax offices, the Ministry of Finance and the Social Security Institution (SGK), for the purpose of fulfilling the legal obligations laid down in the relevant legislation and ensuring security,
to Traffic Registration Directorates for the purpose of carrying out vehicle sales and registration procedures,
employees’ health information, to the persons and organisations from which health services are obtained and to insurance companies, within the scope of occupational health and safety measures, for the purpose of carrying out the occupational health and safety processes of the persons concerned,
to banks, financial institutions, public and private-law legal entities and public officials for the purpose of carrying out the financial transactions of the persons concerned,
to public prosecutors’ offices, courts, enforcement offices and the relevant statutory institutions and organisations, in matters relating to public security and in legal disputes, upon request and as required by legislation, limited to the purpose of the request,
to software, hardware, IT and technology companies located in Türkiye and abroad, for the purpose of installing the computer operating systems and computer programs used within our Company and carrying out the maintenance and repair of those programs,
to IT and technology companies, for the purpose of ensuring the security of the Company’s electronic data.
As regards the transfer of special categories of personal data within Türkiye, your personal data may be transferred subject to the explicit consent of the data subject, or, in respect of special categories of personal data other than data concerning health and sexual life, in the cases provided for by law.
Your personal data are transferred, limited to and in connection with the purposes of carrying out the Company’s new and second-hand vehicle sales transactions, providing vehicle maintenance, repair and servicing and after-sales support services, and carrying out roadside assistance, insurance and comprehensive motor insurance (kasko) services, individual and fleet vehicle rental, and credit and financing services, to automotive companies, to third-party websites that carry out online sales and marketing and act as intermediaries in vehicle purchase and sale transactions (such as sahibinden.com and arabam.com), and to insurance companies, notaries public, banks and financial institutions.
to judicial authorities, municipalities, tax offices, banks and land registry and cadastre directorates for the purpose of managing and monitoring immovable property transactions,
Your personal data are transferred to advertising and marketing companies and related third parties for sales, marketing and advertising purposes, in line with the Company’s interests.

In addition to the groups of persons listed above, your personal data are transferred, in accordance with the legislation and limited to the purpose of the transfer, to experts and appraisers, consultants, agencies, intermediary firms, our Company’s employees, Company shareholders, legal, financial and tax advisers, auditors, service providers within the scope of the Company’s activities, public institutions, authorised public institutions and organisations such as ministries and judicial authorities, and persons, institutions and organisations permitted by the provisions of the payment services legislation.

4. Transfer of Personal Data Abroad

In accordance with the principles set out in Article 4(2) of the KVKK, personal data may be transferred abroad, either by obtaining explicit consent forms relating to the processed personal data, collected separately from each data subject whose personal data we have processed, or, in the cases provided for in Articles 5(2) and 6(3) of the Law, without seeking explicit consent, in accordance with the rules in Article 9 of the Law: only to persons and organisations established in foreign countries having adequate protection, once such countries have been determined and announced by the Personal Data Protection Board (the “Board”); and, in the case of countries determined and announced as not having adequate protection, only on a limited basis, where the data controllers in Türkiye and in the relevant foreign country have undertaken in writing to provide adequate protection and the necessary permission for the relevant transfer has been obtained from the Board.

5. Method of Collecting Personal Data and Legal Bases

Your personal data are processed and collected within the scope of the Company’s activities and limited to the stated purposes, wholly or partly by automated means, or by non-automated means provided that they form part of a data recording system, through: the completion of application forms; contracts; the preparation of printed forms; in the electronic environment, the creation of memberships via the technological software programs used, e-mail and the completion of application forms; the creation of personnel files; the drawing up and performance of contracts; the processing of financial information for the establishment and maintenance of accounting, financial and social rights; the carrying out of sales transactions; the processing of personal data obtained for the purpose of corporate development; visits to the Company’s buildings and annexes and to the website; the use of mobile applications; calls to our call services; complaint management systems; the use of market research companies and reference methods; on the grounds of the explicit consent you have given, the use of a fingerprint system as the staff attendance control system for the purpose of evaluating the performance of Company employees; and the use of a video camera recording system to ensure indoor and outdoor security in the Company’s buildings and annexes.

In accordance with the statutory regulations to which our Company is subject, and so that our Company can offer products and services and, in this context, fulfil its obligations arising from contracts and legislation completely and accurately, your personal data and special categories of personal data are, as a rule, processed on the basis of the explicit consent of the data subject.

In addition, in the context of your dealings with our Company, your personal data are processed without seeking explicit consent in the following cases:

where it is necessary to process the personal data of the parties to a contract, provided that this is directly related to the conclusion or performance of contracts between our Company and third-party natural and legal persons,
where it is mandatory for the Company to fulfil its legal obligation,
where the personal data have been made public by the data subject himself or herself,
where data processing is mandatory for the establishment, exercise or protection of a right,
where data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
where it is expressly provided for by law,

Your personal data are processed, collected and transferred, limited to the stated purposes, in accordance with Articles 5 and 6 of Personal Data Protection Law No. 6698 and Article 5(1)(h) of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

6. Rights of the Data Subject (Right to Apply)

Your requests under Article 11 of Personal Data Protection Law No. 6698, “which governs the rights of the data subject”, may be submitted, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (3), to the address of ÖZDAĞLAR İNŞAAT OTOMOTİV VE TURİZM SAN.TİC.LTD.ŞTİ. as the data controller, by the data subject completing the attached APPLICATION FORM and delivering a signed copy of the form by hand, in person, to the Company’s address together with documents establishing his or her identity.

Pursuant to Article 11 of the Law, everyone has the right, by applying to the data controller, in respect of himself or herself:

to learn whether personal data are being processed,
to request information if personal data have been processed,
to learn the purpose of the processing of personal data and whether they are used in line with that purpose,
to know the third parties in Türkiye or abroad to whom personal data are transferred,
to request the rectification of personal data if they have been processed incompletely or inaccurately,
to request the erasure or destruction of personal data within the framework of the conditions laid down in Article 7 of the KVKK,
to request that the rectification, erasure or destruction of personal data be notified to the third parties to whom the personal data have been transferred,
to object to the occurrence of a result to his or her detriment by means of the analysis of the processed data exclusively through automated systems,
to claim compensation for damage incurred as a result of the unlawful processing of personal data.

Pursuant to Article 13(1) of the KVKK (Law No. 6698), you must submit your applications to exercise the rights set out above to our Company in writing or by the other methods determined by the Personal Data Protection Authority, as described above. Our Company will conclude the requests in your application

free of charge as soon as possible, depending on the nature of the request, and within thirty days at the latest. However, if the transaction entails an additional cost, the fee set out in the tariff determined by the Board will be charged. In this context, where the data subject’s application is answered in writing, no fee will be charged for up to ten pages, and a processing fee of ₺1 will be charged for each page in excess of ten. Where the response to the application is provided on an electronic recording medium such as a CD or flash drive, the fee that may be charged by our Company will not exceed the cost of the recording medium.