KVKK Information Text

Information on Personal Data Protection

In the scope of the Personal Data Protection Law No. 6698 ("PDPL"), we are identified as the data controller (Goblincar). We would like to inform you about how we process and transfer your personal data.

1. How Do We Collect Information?

We may collect your personal data related to the transactions you conduct with us, interactions with our websites, from our physical locations, your mobile device, or, to the extent legally permissible, from third parties.

2. Information Collected About You

The personal data collected from you (including but not limited to your name, age, gender, contact details, place of residence, previous rental information, and credit card details) are proportionate to the processing purposes outlined in Section 3 below.

3. How Do We Use Your Personal Data?

3.1 According to Article 5 of the PDPL, the legal reasons for processing your personal data are as follows:

a) Your explicit consent for the processing of your personal data,

b) Clear provisions in the laws,

c) Necessity to protect the life or bodily integrity of the data subject or another person in cases where the data subject is unable to express consent due to actual impossibility or where their consent is not legally valid,

d) Necessity in relation to the establishment or performance of a contract,

e) Necessity to fulfill our legal obligations,

f) The data subject's disclosure of their own personal data,

g) Necessity for the establishment, exercise, or protection of a right,

h) Necessity for the legitimate interests pursued by us provided that it does not harm your fundamental rights and freedoms.

3.2 Subject to the conditions specified in the PDPL, we may use the information we collect for the following purposes (based on your explicit consent and/or where legally permitted):

• Managing car rentals and commercial relationships, contacting you regarding car rentals, and assisting you in these matters
• Carrying out customer service activities and conducting telephone calls related to customer satisfaction
• Verifying driving and credit information provided by you (including personal data) through credit institutions, licensing institutions, fraud prevention agencies/databases, and other sources for the purposes of fraud prevention
• Contacting you regarding incomplete membership forms or your reservation on the internet
• Providing information to relevant insurance databases about the accidents you are involved in. In this context, processing of personal data may be necessary in cases where it is required for the creation, enforcement, or defense of legal claims.
• Communicating with you via commercial electronic communications such as email, SMS, telephone, or other means (including customer satisfaction surveys, discounts, special offers and/or services, marketing promotional materials, invitations, advertisements, celebrations, and survey applications).
• Providing you with better products and services
• Compiling statistics and analyses regarding the use of our websites, products, and services by our customers
• Protecting our rights and property
• Providing more personalized and better services to you
• Planning and conducting corporate sustainability activities
• Planning and implementing marketing processes for goods or services
• Planning and implementing processes necessary to ensure and increase customer loyalty
• Providing your personal data to government agencies overseeing traffic regulations during your rental to assist in the application of traffic regulations
• Providing your personal data to the relevant tax office or authority, persons engaged in debt collection, credit institutions, and other relevant institutions
• Processing/storing your personal data in cases where it is considered that any event arising from your relationship with us or with an additional authorized driver may pose a risk for future rentals.
• We may combine the information you provide us with, such as information related to your transactions with us, such as rental location and vehicle type, with data we acquire about you from third parties that assist us in fulfilling requests, maintaining our data, and optimizing our services.

4. How Your Personal Information Can Be Shared and Sharing Purposes

Your personal data can be shared with the following parties for the purposes stated in Section 3 above, based on your explicit consent and/or where legally permitted:

• We may transfer/share your personal data with Goblincar Holding Group companies (including EAN Data Services UK Limited as the data controller) and our business partners (including our agents in Turkey), suppliers, and other service providers (including information technology service providers and other consultants) in Turkey or abroad. Companies within the Goblincar Holding Group may use your personal data for the purposes stated in Section 3 and may transfer your personal data to third-party service providers (within or outside Turkey).
• We may transfer/share your information to other third parties such as our business partners, service providers, public institutions, and/or legally authorized private individuals to protect your rights and those of third parties, provide administrative or technical support, and conduct your transactions outside Turkey.
• Your personal data may be transferred if there is a partial or complete transfer, change of ownership, or restructuring of Goblincar Holding's affiliates or assets.

If the location of the recipient of your personal data is considered to be a country that does not provide a sufficient level of protection under the law, we would like to state that we if the location of the recipient of your personal data is considered to be a country that does not provide a sufficient level of protection under the law, we would like to state that we will ensure the required levels of protection and/or obtain your explicit consent for the transfer if legally necessary.

5. Your Rights under the PDPL

Under the PDPL, by contacting us, you have the right to:

a) Learn whether your personal data is being processed,

b) Request information if your data has been processed,

c) Learn the purpose of processing and whether it's used for its intended purpose,

d) Learn the third parties to whom your data is transferred, whether domestically or internationally,

e) Request correction if your data is incomplete or incorrect,

f) Request deletion or destruction of your data within the framework of the conditions set forth in Article 7 of the PDPL,

g) Request notification to third parties about the processes specified in items (e) and (f) above,

h) Object to the occurrence of a result against you due to exclusively automated systems,

i) Demand compensation in case of damages due to unlawful processing.

You can exercise these rights by directing your written request to Emek, Barış Blv. No:33, 01000 Seyhan/Adana / Turkey, or by using other methods specified by the Personal Data Protection Board. Our company will evaluate and conclude your request in accordance with the PDPL. To provide an accurate response to your request, please clearly specify which of your personal data your request relates to. According to the PDPL, we will respond to your requests within thirty days (free of charge if there is no cost). However, if there is an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. If the response to the applications exceeds 10 (ten) pages, a processing fee of 1.00 (one) TL will be charged for each page. If a response in a recording medium such as a CD or flash drive is requested, the cost will be based on the requested recording medium.