PERSONAL DATA PROTECTION NOTICE
In accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), Borlease Otomotiv Anonim Şirketi (“the Company”) acts as the data controller and processes your personal data. Within this scope, we would like to inform you about our personal data processing activities. This notice may be updated periodically in line with changes in legal regulations or our corporate policies. You can always access the most recent version via our website.
PERSONAL DATA WE PROCESS
Pursuant to KVKK, any information relating to an identified or identifiable natural person is defined as personal data. In order to conduct our operations in the best possible manner within the scope of the services you receive from our Company, we process the personal data required for various processes. The type of information we need may vary depending on the nature of the rental process, damage situation, use of customer programs, services or campaigns utilized, and the content of your requests. These data are generally categorized as follows:
- Identity
- Contact
- Location
- Personnel
- Legal Transaction
- Customer Transaction
- Vehicle
- Risk Management
- Financial
- Marketing
- Visual and Audio Records
- Health
- Criminal Conviction and Security Measures
PURPOSE AND LEGAL BASIS OF PROCESSING YOUR PERSONAL DATA
Your personal data are processed in connection with, limited to, and proportionate to the activities carried out. Within this scope, your personal data are processed for the purposes listed below based on the legal grounds specified in Article 5 of KVKK.
Your personal data are processed based on the legal ground of “necessity for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract” for the following purposes:
- Conducting reservation and rental transactions
- Obtaining the information and completing forms necessary to establish a contractual relationship
- Managing vehicle pick-up and return processes
- Carrying out identity verification processes
- Determining payment methods and processing payments
- Determining and collecting amounts related to traffic fines, tolls, damages, fuel, and additional services
- Ensuring security and taking preventive measures
- Compensation for damages and execution of insurance procedures
- Managing fuel operations
- Conducting maintenance support activities
- Managing roadside assistance and support services
- Performing processes to optimize vehicle usage
- Managing communication activities
- Managing damage and recourse processes
- Handling customer requests and complaints
- Managing call center operations
Your personal data are processed based on the legal grounds of “explicitly stipulated by law,” “necessity for compliance with a legal obligation,” and “necessity for the establishment, exercise, or protection of a right” for the following purposes:
- Sharing information with authorized public institutions and organizations as required by law
- Conducting storage and archiving activities
- Managing invoicing processes
- Fulfilling legal rights and obligations arising from various regulations
- Conducting information security processes
- Carrying out and following up legal affairs and proceedings
- Performing audit and internal control activities
- Keeping records of transactions
Your personal data are processed based on the legal ground of “necessity for the legitimate interests pursued by the data controller” for the following purposes:
- Improving company business processes
- Conducting audit activities
- Managing marketing strategy activities
- Conducting research and analysis to develop products and services and provide customers with the most suitable offerings
- Ensuring customer satisfaction and improving user experience
- Training and developing artificial intelligence systems
- Taking actions against unauthorized use and misuse
- Conducting reporting and examination activities
- Monitoring vehicles and ensuring fulfillment of obligations
- Conducting surveys, campaigns, and sweepstakes within the scope of corporate customer satisfaction research
- Carrying out marketing, promotion, campaign, and customer loyalty activities for corporate customers
Your personal data are processed based on the legal ground of “explicit consent of the data subject” for the following purposes:
- Conducting surveys, campaigns, and sweepstakes within the scope of individual customer satisfaction research
- Carrying out marketing, promotion, campaign, and customer loyalty activities for individual processes
- Monitoring driver behavior and using telematics systems
Additionally, your special categories of personal data such as Health and Criminal Conviction and Security Measures are processed based on the legal grounds of “explicitly stipulated by law” and “necessity for the establishment, exercise, or protection of a right” for the following purposes:
- Managing vehicle rentals for disabled individuals
- Carrying out damage and recourse processes
- Fulfilling legal rights and obligations arising from various regulations
- Sharing information with authorized public institutions and organizations as required by law
- Conducting storage and archiving activities
- Carrying out and following up legal affairs and proceedings
- Performing audit and internal control activities
METHOD OF COLLECTING PERSONAL DATA
Your personal data may be collected directly from you or from the institution providing you with the vehicle, from authorized public institutions and organizations, social media platforms, law enforcement authorities, insurance companies, complaint portals, business partners, sponsors, group companies, or third parties involved in an accident. Your data are processed either electronically through automated means or verbally/in writing through non-automated means.
THIRD PARTIES TO WHOM YOUR PERSONAL DATA MAY BE TRANSFERRED
Within the requirements of commercial operations, your personal data may be transferred in a connected, limited, and proportionate manner for the purposes listed above, in compliance with the conditions set out in Articles 8 and 9 of KVKK, to the following domestic and international recipients:
- Dealers, service centers, and parking facilities that are our business partners within the scope of rental operations
- Companies providing assistance services, including tow truck and roadside assistance providers
- Banks and financial institutions
- Vehicle rental companies
- Experts and insurance companies
- Parties providing legal, financial, tax, and operational consultancy
- Audit firms
- Campaign partner companies
- Individuals and legal entities with whom we have a power of attorney relationship
- Business partners and suppliers providing various services
- Group companies under Bor Holding A.Ş.
- Authorized public institutions and organizations
- Courier and transportation companies
YOUR RIGHTS REGARDING YOUR PERSONAL DATA
Within the scope of Article 11 of KVKK, you have the following rights regarding the processing of your personal data:
- To learn whether your personal data are processed,
- To request information regarding the processing of your personal data,
- To learn the purpose of processing and whether your personal data are used in line with this purpose,
- To know the third parties to whom your personal data are transferred domestically or abroad,
- To request correction if your personal data are incomplete or incorrectly processed,
- To request deletion or destruction of your personal data,
- To request notification of correction, deletion, or destruction to third parties to whom your personal data have been transferred,
- To object to the occurrence of a result against you through the analysis of your data exclusively by automated systems,
- To request compensation if you suffer damage due to unlawful processing of your personal data.
HOW TO CONTACT US
You can submit your requests regarding your personal data at any time through the “Personal Data Application Form” available on our website, or via different methods in compliance with the “Communiqué on the Principles and Procedures for the Application to the Data Controller.” You can find more detailed information and contact addresses in the form.