Protection of Personal Data
PROTECTION OF PERSONAL DATA
Our company bears the title of "Data Controller" in accordance with the "Personal Data Protection Law" numbered 6998 published in the Official Gazette dated 07.04.2016. As Day Fleet Araç Ekipman Kiralama A.Ş. (hereinafter referred to as "Day Fleet"), we show maximum sensitivity to the security of your personal data. With this awareness, we attach great importance to the processing and preservation of all kinds of personal data belonging to all persons associated with the Company, including those who benefit from our products and services as a Company, in accordance with the Personal Data Protection Law No. 6698. With the full realization of this responsibility, we process your personal data in the capacity of "Data Controller" as defined in the KVK Law, as explained and within the limits determined by the legislation.
Text: This refers to this clarification text.
Data: Refers to information stored electronically on a computer or in some paper-based filing systems.
Special Categories / Sensitive Personal Data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, association, foundation or union memberships, health, sexual life, criminal convictions and security measures and biometric data. Sensitive data may only be processed under strict conditions and processing generally requires the explicit consent of the data subject.
Data Subjects or Owners: This includes all natural persons, including employees, whose Personal Data is processed by Day Fleet. The data subject does not have to be a Turkish citizen or reside in Turkey. All data subjects have legal rights regarding their personal data.
Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. These persons have the responsibility to determine practices and principles in accordance with the Law. The data controller for all personal data used in Day Fleet's business processes is the relevant Day Fleet.
Data Processor: Any person who processes data based on the authorization granted by and on behalf of a data controller. Employees of the data controller are excluded from this definition, but where applicable, suppliers, business partners and other third parties who process personal data on behalf of Day Fleet may be included in this definition.
Data Processing / Handling: This includes any activity related to the use of data. It includes the acquisition, recording or retention of data, or one or a number of operations performed on the data, including editing, modifying, retrieving, retrieving, using, disclosing, erasing or destroying the data. Transferring data to third parties also constitutes processing.
As @firmShortName, in the capacity of data controller, through our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels and / or all kinds of channels, including but not limited to; Your personal and/or special categories of personal data that we obtain within the scope of your consent may be fully or partially obtained, recorded, stored, stored, modified, updated, periodically checked, rearranged, classified, retained for the period required for the purpose for which they are processed or stipulated in the relevant law, and in case of legal or service-related actual requirements, shared with private-legal entities that Day Fleet works with or with public institutions and organizations that Day Fleet is legally obliged to work with and/or with the relevant third party real person/legal entities residing in Turkey or abroad. real persons/legal entities residing in Turkey or abroad, and may be transferred abroad in case of legal or service-related actual requirements. We would like to inform you that we may process your personal data in order for Day Fleet customers to benefit from our services, to inform you about our campaigns with your approval, to record your suggestions and complaints, to create better service standards for you, to determine and implement Day Fleet commercial and business strategies, and in any case in accordance with the Personal Data Protection Law No. 6698 and the relevant legislation.
COLLECTION, PROCESSING AND PURPOSES OF PERSONAL DATA
As Day Fleet, as the data controller, within the framework of our legal obligations arising from the legislation; long and short-term vehicle rental, sale, transfer, registration, registration, loss, license renewal and removal, license plate renewal and removal, traffic consultancy services, second-hand vehicle sales and proper fulfillment of after-sales services, wholesale spare parts and accessories sales, provision of insurance and financing services, etc. We collect your personal data verbally, in writing or electronically through verbal, website, social media channels, mobile applications and similar means for purposes such as benefiting from our services, informing you about our campaigns with your approval, recording your suggestions and complaints, creating better service standards for you, determining and implementing Day Fleet commercial and business strategies. Personal Data is processed by Day Fleet in accordance with the procedures and principles stipulated in the Law and this Text. Day Fleet acts with the following principles when processing Personal Data:
- Personal Data is processed in accordance with the relevant rules of law and the requirements of good faith.
- It is ensured that Personal Data is accurate and up-to-date. In this context, issues such as determining the sources from which the data is obtained, confirming its accuracy, and evaluating whether it needs to be updated are carefully considered.
- Personal Data is processed for specific, explicit and legitimate purposes. The legitimate purpose means that the Personal Data processed by Day Fleet is related to and necessary for the work it has done or the service it provides.
- Personal Data is linked to the realization of the purposes determined by Day Fleet, and the processing of Personal Data that is not related to the realization of the purpose or is not needed is avoided. It limits the processed data only to what is necessary for the realization of the purpose. Personal Data processed within this scope are relevant, limited and proportionate to the purpose for which they are processed.
- If there is a period stipulated in the relevant legislation for the storage of data, it complies with these periods; otherwise, it retains Personal Data only for the period required for the purpose for which they are processed. In the event that there is no valid reason for further retention of Personal Data, such data shall be deleted, destroyed or anonymized.
Terms of Processing of Personal Data
Day Fleet does not process Personal Data without the explicit consent of the data subject. In the presence of one of the following conditions, Personal Data may be processed without the explicit consent of the data subject.
- Day Fleet may process Personal Data of Personal Data Owners even without explicit consent in cases expressly stipulated in the laws. For example; In accordance with Article 230 of the Tax Procedure Law, the explicit consent of the relevant person will not be sought in order to place the name of the relevant person on the invoice.
- Personal Data may be processed without explicit consent in order to protect the life or physical integrity of persons who are unable to disclose their consent due to actual impossibility or whose consent cannot be recognized as valid, or of another person. For example, in a situation where the person is unconscious or mentally ill and his/her consent is not valid, the Personal Data of the Personal Data Owner may be processed during medical intervention in order to protect his/her life or body integrity. In this context, data such as blood type, previous diseases and surgeries, medications used may be processed through the relevant health system.
- Provided that it is directly related to the establishment or performance of a contract by Day Fleet, Personal Data of the parties to the contract may be processed. For example, the account number information of the creditor party may be obtained for the payment of money pursuant to a contract concluded.
- Day Fleet may process Personal Data of Personal Data Owners if it is mandatory in order to fulfill its legal obligations as a data controller.
- Personal Data of Personal Data Owners made public by Day Fleet, in other words, Personal Data disclosed to the public in any way, may be processed by Day Fleet since the legal benefit to be protected has disappeared.
- Day Fleet may process the Personal Data of Personal Data Owners without seeking explicit consent in cases where data processing is mandatory for the exercise or protection of a legitimate right.
- Day Fleet may process the Personal Data of Personal Data Owners in cases where the processing of Personal Data is mandatory for the provision of legitimate interests, provided that it does not harm the fundamental rights and freedoms of Personal Data Owners protected under the Law and Policy. The Company shows the necessary sensitivity to comply with the basic principles regarding the protection of Personal Data and to observe the balance of interests of Personal Data Owners.
Conditions for Processing Special Categories of Personal Data
Day Fleet does not process Sensitive Personal Data without the explicit consent of the data subject. However, Personal Data other than health and sexual life may be processed without the explicit consent of the person concerned in cases stipulated by law. Personal Data related to health and sexual life are processed by Day Fleet only for the protection of public health, preventive medicine, medical diagnosis and treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the person concerned under the conditions that we are under the obligation of confidentiality. Day Fleet carries out the necessary procedures to take adequate measures determined by the Board in the processing of Special Categories of Personal Data.
SITUATIONS WHERE CONSENT IS NOT SOUGHT IN THE COLLECTION AND PROCESSING OF PERSONAL DATA
Pursuant to paragraph 2 of Article 5 of the Law No. 6698 on the Protection of Personal Data Pursuant to paragraph 2 of Article 5 of the Personal Data Protection Law No. 6698, provided that it is clearly stipulated in the laws, it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract, it is mandatory for Day Fleet to fulfill its legal obligation as the data controller, and it has been made public by the person concerned, Day Fleet has the right to process personal data without obtaining explicit consent in cases where data processing is mandatory for the establishment, exercise or protection of a right, and data processing is mandatory for the legitimate interests of the Company, which is the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned. Data disclosure to be made by Day Fleet for the fulfillment of its legal obligations arising from the legislation to which it is subject and/or due to legal obligations and/or for the fulfillment of the obligation to transfer Data to persons who may request secrets in accordance with the provisions of the laws and the Data published or disclosed to the public or included in the official registers or balance sheets and annual reports in accordance with the principle of openness in the laws, Day Fleet is authorized to disclose, give, process and transfer such Data to the relevant persons without the need to obtain a separate consent for such Data and that their use and transfer is not subject to Day Fleet's confidentiality obligation.
TRANSFER OF PERSONAL DATA AND CONDITIONS
Day Fleet may transfer Personal Data and Sensitive Personal Data of Personal Data Owners to third parties in accordance with the Law by establishing the necessary confidentiality conditions and taking security measures in line with the purposes of processing Personal Data. Day Fleet acts in accordance with the regulations stipulated in the Law during the transfer of Personal Data. In this context, Day Fleet may transfer Personal Data to third parties based on and limited to one or more of the Personal Data processing conditions specified in Article 5 of the Law, listed below, in line with legitimate and lawful Personal Data processing purposes:
If the Personal Data owner has explicit consent;
If there is a clear regulation in the laws regarding the transfer of Personal Data, if it is mandatory for the protection of the life or physical integrity of the Personal Data owner or someone else, and
If the Personal Data owner is unable to disclose his/her consent due to actual impossibility or if his/her consent is not legally valid,
If it is necessary to transfer Personal Data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
If the transfer of Personal Data is mandatory for Day Fleet to fulfill its legal obligation,
If the Personal Data has been made public by the Personal Data owner,
If the transfer of Personal Data is mandatory for the establishment, exercise or protection of a right,
Provided that it does not harm the fundamental rights and freedoms of the Personal Data owner, it may transfer Personal Data if it is mandatory for the legitimate interests of Day Fleet.
Conditions for Transfer of Special Categories of Personal Data
Day Fleet, by taking due care, taking the necessary security measures and taking adequate measures stipulated by the KVK Board; In line with legitimate and lawful Personal Data processing purposes, it may transfer the Personal Data Owner's Special Qualified Personal Data to third parties in the following cases. (i) In case of the explicit consent of the Personal Data Owner or (ii) In the presence of the following conditions, without seeking the explicit consent of the Personal Data Owner;
Personal Data of Special Nature other than the health and sexual life of the Personal Data Owner (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, criminal conviction and security measures, and biometric and genetic data), in cases stipulated by law,
Personal Data of Special Nature related to the health and sexual life of the Personal Data Owner can only be processed by persons or authorized institutions and organizations under the obligation of confidentiality for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
Purposes of Processing and Transferring Personal Data
Personal Data; Day Fleet in accordance with the law and the purpose of the Law,
Optimal planning and implementation of human resources policies,
Proper planning, execution and management of commercial partnerships and strategies,
Ensuring the legal, commercial and physical security of itself and its business partners,
Ensuring corporate functioning, planning and execution of management and communication activities,
Ensuring that the Personal Data Subjects benefit from the products and services in the best way possible and recommending them by customizing them according to their demands, needs and requests,
Ensuring the highest level of data security,
Creation of databases,
Improvement of the services offered on the website and elimination of errors on the website,
Contacting the Personal Data Subjects who submit their requests and complaints to it and ensuring the management of requests and complaints,
Management of relationships with business partners or suppliers,
Execution of personnel recruitment processes,
Supporting the personnel recruitment processes of Group Companies and compliance with relevant legislation,
Planning and execution of audit activities to ensure that the activities of Group Companies are carried out in accordance with the relevant legislation,
Supporting Group Companies in the realization of corporate and partnership law transactions,
Execution/follow-up of financial reporting and risk management processes,
Execution/follow-up of company legal affairs,
Carrying out activities to protect its reputation,
Managing investor relations,
Providing information to authorized institutions due to legislation,
Creation and tracking of visitor records.
Limited to the purposes of processing personal data within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law. If the processing activity carried out for the aforementioned purposes does not meet any of the conditions stipulated under the Law, your explicit consent is obtained by Day Fleet regarding the relevant processing process.
METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA, DELETION, DESTRUCTION, STORAGE PERIOD
Method and Legal Grounds for Collecting Personal Data
For the purpose of auditing compliance with Article 1 regulating the purpose of the Law and Article 2 regulating the scope of the Law, Personal Data is collected in all kinds of verbal, written, electronic media; by technical and other methods, through various means such as call center, Day Fleet website, mobile application, within the framework of legal reasons based on legislation, contract, request and request, in order to fulfill the responsibilities arising from the law completely and accurately and processed by the Company or data processors assigned by the Company.
Deletion, Destruction or Anonymization of Personal Data
Without prejudice to the provisions of other laws regarding the deletion, destruction or anonymization of Personal Data, Day Fleet deletes, destroys or anonymizes Personal Data ex officio or upon the request of the data owner in the event that the reasons requiring its processing disappear, although it has processed it in accordance with the provisions of this Law and other laws. With the deletion of Personal Data, this data is destroyed in such a way that it cannot be used and recovered in any way again. Accordingly, Personal Data shall be irreversibly deleted from the documents, files, CDs, diskettes, hard disks, etc. in which they are stored. Destruction of Personal Data, on the other hand, refers to the destruction of materials suitable for storing data such as documents, files, CDs, diskettes, hard disks, etc. in which the data is recorded in such a way that the information cannot be recovered and used again. Anonymization of data means making Personal Data impossible to be associated with an identified or identifiable natural person even if it is matched with other data.
Retention Period of Personal Data
Day Fleet stores Personal Data for the period specified in this legislation, if stipulated in the legislation. If a period of time is not regulated in the legislation regarding how long personal data should be kept, Personal Data is processed for the period required to be processed within the framework of the rules of honesty in accordance with the practices and customs of Day Fleet's practices and commercial life, depending on the activity carried out by Day Fleet while processing that data, and then deletes, destroys or anonymizes it. If the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and Day Fleet have come to an end; personal data can only be stored for the purpose of constituting evidence in possible legal disputes or to assert the relevant right related to personal data or to establish a defense. In the establishment of the periods here, the retention periods are determined based on the statute of limitations for the assertion of the right in question and the examples in the requests previously addressed to Day Fleet on the same issues despite the expiration of the statute of limitations. In this case, the stored personal data is not accessed for any other purpose and access to the relevant personal data is provided only when it is required to be used in the relevant legal dispute. After the aforementioned period expires, personal data are deleted, destroyed or anonymized.
Day Fleet is obliged to inform the natural persons whose data will be processed during the acquisition of Personal Data. The scope of this information obligation is as follows:
- Identity of the data controller and its representative, if any,
- The purpose for which Personal Data will be processed,
- To whom and for what purpose the processed Personal Data may be transferred,
- The management and legal reason for collecting Personal Data and their rights.
Day Fleet will make the necessary information on this subject through the means of obtaining data from Third Parties for processing in its systems and will obtain informed consent from Data Subjects regarding data processing in order to prove that the disclosure obligation has been realized. Personal Data may be collected verbally, in writing or electronically by automatic or non-automatic means through all sales channels of Day Fleet, including electronic commerce, sales stores, branches, websites, call center and all other similar channels where services can be obtained from third parties.
- Obtaining Personal Data in Written Form: During the acquisition of Personal Data in writing, Day Fleet will fulfill its Disclosure Obligation regarding the processing of data, provided that new relevant forms and information to be revised based on this Text are used. In addition, all forms and agreements, including Consented Contact Forms to be received from persons with whom a customer relationship is established, will be revised to show the explicit consent of the Data Subject regarding the processing of Personal Data, although the processing of the relevant data group may be considered within the scope of the exception in accordance with the Law. New forms, documents and information certifying compliance with the Law will be used in customer relations; all relevant employees will be trained to provide the data subject with sufficiently detailed information and references in this regard. In absolute terms, it will be ensured that Personal Data is obtained through written forms containing informed consents.
- Obtaining Personal Data Verbally: Information on the obligation to inform regarding the processing of Personal Data will be provided in any way regarding existing customers already processed in accordance with the Consented Contact Forms received, or when obtaining new data that does not already exist, and when obtaining data through the Call Center. During verbal data acquisition, it will be reminded that the conversation is recorded, provided that prior information is given, and it will be confirmed that consent is given that Personal Data will be processed within this Policy and, if any, within the existing Authorized Communication Forms. Employee and Call Center business processes will be re-evaluated and implemented within this framework.
- Obtaining Personal Data in Electronic Environment: All agreements and documents / link addresses / web pages that require the acquisition and processing of Personal Data, including the data obtained through electronic commerce channels and Day Fleet's other internet channels, including this Clarification Text, have been revised to fulfill the disclosure obligation regarding the processing of Personal Data. This Text will be available on Day Fleet's websites so that it can be accessed from all websites, and systems requiring the approval of data processing by Day Fleet will be established in order to obtain data at each link address that may require data acquisition. Unless it is clearly marked that consent is given to the processing of Personal Data, no information and documents entered will be automatically recorded in any Day Fleet system and will not be processed in any way whatsoever.