1. Data Controller
Pursuant to Türkiye's Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Trabzon Rentacar acting as the data controller, within the scope explained below.
2. Purposes of Processing
The personal data you provide is processed for the following purposes:
- Providing the car-rental service and fulfilling contractual obligations,
- Carrying out reservation, payment and invoicing operations,
- Fulfilling legal obligations (tax, blacklists, official notifications),
- Evaluating customer requests and complaints,
- Resolving legal disputes and using as evidence in judicial proceedings,
- Marketing, campaign and promotional activities (only with explicit consent).
3. Categories of Personal Data Processed
- Identity data: First name, last name, national ID/passport number, date of birth.
- Contact data: Phone, email, address.
- Driving licence data: Licence number, issue date, class.
- Financial data: Credit-card data (stored on a PCI-DSS compliant payment infrastructure), invoicing data.
- Customer transaction data: Reservation history, rental records.
- Visual records: Office and in-/around-vehicle camera footage.
4. Transfer of Personal Data
Your personal data may be shared with insurance companies, payment institutions, legal counsel, financial advisers and authorised public bodies (police, tax offices, courts) within the scope of legal obligations. No transfers are made abroad.
5. Method of Collection and Legal Basis
Personal data is collected through our website, mobile applications, telephone calls, email correspondence, contract processes at our offices and security camera recordings. The legal bases are KVKK Art. 5/2 (establishment/performance of a contract, legal obligation) and Art. 5/1 (where explicit consent is given).
6. Your Rights Under Article 11 of the KVKK
As a data subject, under Article 11 of the Law, you have the right to:
- Learn whether your personal data is being processed,
- Request information if it is being processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Know the third parties to whom data is transferred domestically or abroad,
- Request correction if it has been processed incompletely or incorrectly,
- Request deletion or destruction,
- Request that correction/deletion/destruction operations be communicated to third parties to whom the data was transferred,
- Object to a result against you arising from analysis carried out exclusively by automated systems,
- Request compensation for damages arising from unlawful processing.
7. How to Apply
To exercise your rights above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request together with documents establishing your identity through the channels listed on our Contact page. Your request will be processed within 30 days at the latest.