About Personal Data Protection And Processing
ENERJISA DISCLOSURE ON PROTECTION AND PROCESSING OF PERSONAL DATA
We, at Enerjisa Araç Filo Hizmetleri A.Ş. (hereinafter will be referred to as “ENERJISA”), which is vested with the title of Data Controller, would like to inform you about your personal data processed by ENERJISA with this Disclosure herein as per the Personal Data Protection Law (PDPL) no. 6698.
ENERJISA is engaged in vehicle fleet services as well as other related operations, including the provision and development of any and all kinds of services in the operational vehicle rental sector for customers.
1) What is Personal Data?
As per PDPL, personal data refers to any information relating to an identified or identifiable natural person. This means information such as your name, surname, e-mail address and phone number are considered to be personal data.
The information required by ENERJISA may vary depending on the nature of the rental process, damage status, preference of customer loyalty programs, promotions used, and services requested. The information can generally be found under the following categories:
- ID (Information such as name-surname, signature, Turkish ID number, date of birth, driver's license, ID card, passport photocopies, etc.)
- Contact (Information such as phone number, e-mail address, mail address, etc.)
- Customer Transaction Information (Vehicle delivery form, rental agreement, further details on the rental transaction (information including fuel status, date, use of fast (HGS) or automated (OGS) passage systems, etc.), policy information, replacement vehicle form, rental history in our company, information regarding assistance services, flight information of the contracted companies, etc.)
- Finance (Credit card info, payment info, Findeks (credit score) information)
- Physical Space Security (Surveillance videos in our offices)
- Visual and Audio Records (Call center records)
- Personal Information (Information including profession, title, workplace, etc. as part of customer loyalty programs and promotions)
- Transaction Security Information (Username and password information created for website or mobile application use)
- Marketing (Information such as surveys, cookie records, rental history, preferences for promotions and offers, etc.)
- Legal Procedures, Criminal Convictions and Security Measures (Traffic fines, information regarding criminal investigation processes, records, correspondence by judicial authorities)
- Vehicle (In the event of an accident, damage, etc., information about the damaged vehicle, other vehicles involved in the accident, license plate information, other information regarding vehicle use)
- Damage (Damage information, accident report, photos of the damage, expert report)
- Health (Disability information, information regarding personal health status, including report on substance/alcohol use, health reports, etc. in the event of an accident)
2) What is the Method and Legal Ground of Collecting Personal Data?
Your personal data is collected through manual channels that are partially or fully automatic or provided that these channels are parts of any data system including any and all kinds of verbal, written, digital communication, headquarters of our company, our website, etc.; through any agreements and forms filled out by your party in the physical environment; and via digital channels including phones, mobile applications, call centers, IVR calls, grievance management systems, website cookies. Surveillance videos of our visitors are taken by CCTV at the entrances of our company's buildings, facilities and within the facilities. The purpose of the camera surveillance activities which is carried out in compliance with the Law on Private Security Services and relevant legislation is to improve the quality of the services provided, provide security, ensure safety of the company, customers and third parties, and protect the interests of customers regarding the service provided. ENERJISA may process the data acquired in its premises; also, may transfer the data for below-mentioned purposes; and transfer and process the data in its operations, affiliated companies or partners. Your personal data is collected based on the legal grounds defined under article 5 of PDPL as “Requirement to process personal data of parties of a contract, provided that it is directly related to drawing up or executing the contract,” “Requirement of personal data processing for the legitimate interests of data controller, provided that it does not damage fundamental rights and liberties of the relevant person,” and “Being mandatory for the data controller to fulfill their legal obligations”; and processed as per the legal grounds stated herein.
3) Why Do We Process Your Personal Data?
Your personal data can be processed by our Company to ensure that the products and services are offered in the best possible way, although may vary depending on the product and service or commercial activity offered by ENERJİSA. Therefore, it is of great significance for our Company to collect, use and process your personal data to carry out its activities, in the best possible way. Your personal data can be processed limitedly in order to;
• Provide legal and commercial security,
• Manage legal processes with regulation and compliance,
• Sustain relations with public institutions and other organizations,
• Carry out and execute the processes related to defining human resources policies,
• Carry out liabilities, corporate communication operations with support services,
• Plan and carry out processes related to corporate sustainability, corporate governance, strategic planning and data security,
• Prepare applications,
• Follow up financial issues,
• Proceed litigation and execution processes for debts that our Company is a party to,
• Build, operate and back up an IT and network operation system infrastructure,
• Ensure security and supervision at the Company premises,
• Carry out purchasing, retailing, tender and retail procedures.
Thus, our Company processes personal data based on the legal grounds defined under article 5 of the Law as “Requirement to process personal data of parties of a contract, provided that it is directly related to drawing up or executing the contract,” “Requirement of personal data processing for the legitimate interests of data controller, provided that it does not damage fundamental rights and liberties of the relevant person,” and “Being mandatory for the data controller to fulfill their legal obligations.” The personal data identified under article 6 of PDPL is processed in line with the conditions and purposes of processing mentioned under the same article.
Your personal data is used and processed in compliance with and under the governance of PDPL with utmost confidentiality and the purpose of our Company to provide you service. Our Company follows legislation and ethics while processing your personal data and pays utmost attention to have accurate data, avoid misuse, process in compliance with the legal grounds, keep the data updated and store the data for a reasonable period required for the purpose.
4) Why and To Whom Do We Transfer Your Personal Data?
Your personal data can be shared with the aforementioned purposes, to the extent the legislation allows and is required by our work processes, with the parties that it must be shared with as well as legal authorities, companies that we have parent - affiliate relationships, our partners - subsidiaries nationwide and abroad, banks and financing agencies, organizations that we are provided service, establish partnerships and collaborations to sustain the company activities, employees working at our Company or working and acting on behalf of our Company as a matter of course of the activities we carry out as part of the practices conducted to improve the quality of the service we provide in line with the requirements and purposes of personal data processing defined under articles 8 and 9 of PDPL and the secondary legislation regarding transferring data abroad. Our employees use and process the data in compliance with the law and confidentiality requirements. The data is processed for a period required by our related activities in accordance with our policies and procedures defined in compliance with the By-Law on Erasure, Destruction or Anonymization of Personal Data; and erased when your relationship with our Company ends, and no other legal requirement or compliance exists.
5) Cookies on Our Website
When you visit the website of ENERJISA, data to be processed can be collected via cookies in line with the aforementioned purposes. The technical communication files, called cookies, are small text files sent by the websites to the browsers of the users’ computers or mobile phones.
The purpose of using cookies is to provide convenience to users who visit our website. Cookies can also be used to accelerate the experiences and activities to be carried out through our websites in the future. Cookies are used to understand for which purposes people use our websites and help us enhance the structures and contents of our websites. The information acquired does not include any data to reveal your identity.
The expiration times of cookies vary depending on the browser settings of the user. Many internet browsers are set to automatically accept cookies by default. You can change these settings to block cookies or to be notified when your device receives cookies. Please refer to your browser's instructions or help to get further details on how to manage your browser settings.
6) What Are Your Rights, as Data Owner, As Per Article 11 of PDPL?
Please kindly be informed that as per Article 11 of PDPL you are entitled to;
a) Know whether or not your personal data is processed,
b) Ask further information if your personal data is processed,
c) Request information on the purpose of processing and if your data processed is misused,
d) Know the third parties nationwide and abroad to which your personal data is transferred,
e) Ask your personal data to be revised if there is any information processed is missing or incorrect,
f) Ask your personal data to be erased or destructed in the event that the grounds for the data to be processed are no longer valid, although the data was processed in compliance with the provisions of PDPL and other related legislation,
g) Ask the third parties that data is transferred about the processes carried out pursuant to the aforementioned paragraphs (e) and (f),
h) Object to have an outcome not in your favor by means of exclusive analyses through automatic systems,
i) Ask for compensation of your damages in the event of any damages due to illegal processing.
7) How to Claim Your Rights Related to Your Personal Data Submitted?
As part of article 11 of PDPL, you can claim your right to apply regarding your personal data by sending the documents proving your ID and a petition consisting of the details of your request in written to our Company head office at Barbaros Mah. Begonya Sok. Nida Kule Ataşehir Batı Sitesi No: 1/1 Ataşehir İstanbul or by sending an e-mail to enerjisaaracfilo@hs01.kep.tr with your safe electronic signature or mobile signature or to musteriiliskileri@enerjisa.com by using your previously defined and registered e-mail address in ENERJISA’s system.
Your application must include the following information as per article 5 paragraph 2 of Communique on the Principles and Procedures for the Request to Data Controller (“Communique”);
a) Name, surname and signature, if the request is in writing,
b) For Turkish citizens, Turkish ID number; for foreigners, nationality, passport number or ID number, if exists,
c) Residential and business address for notification,
ç) Electronic mail address, telephone, fax number for notification, if exists,
d) Subject of request
Please use the Data Controller Application Form for related requests. Your application shall be accepted by ENERJISA following the identity verification and the related parties shall be informed in writing or digitally within the legal periods. As per article 7 of the Communique, if your application is to be responded in writing, no fee will be charged up to ten pages. Please kindly be informed that 1 Turkish Lira shall be charged per page over ten pages in compliance with the Communique.
8) Amendments
ENERJISA reserves the right to make any revisions in its policies and procedures to comply with the amendments made in the related legislation.
Sincerely,
We, at Enerjisa Araç Filo Hizmetleri A.Ş. (hereinafter will be referred to as “ENERJISA”), which is vested with the title of Data Controller, would like to inform you about your personal data processed by ENERJISA with this Disclosure herein as per the Personal Data Protection Law (PDPL) no. 6698.
ENERJISA is engaged in vehicle fleet services as well as other related operations, including the provision and development of any and all kinds of services in the operational vehicle rental sector for customers.
1) What is Personal Data?
As per PDPL, personal data refers to any information relating to an identified or identifiable natural person. This means information such as your name, surname, e-mail address and phone number are considered to be personal data.
The information required by ENERJISA may vary depending on the nature of the rental process, damage status, preference of customer loyalty programs, promotions used, and services requested. The information can generally be found under the following categories:
- ID (Information such as name-surname, signature, Turkish ID number, date of birth, driver's license, ID card, passport photocopies, etc.)
- Contact (Information such as phone number, e-mail address, mail address, etc.)
- Customer Transaction Information (Vehicle delivery form, rental agreement, further details on the rental transaction (information including fuel status, date, use of fast (HGS) or automated (OGS) passage systems, etc.), policy information, replacement vehicle form, rental history in our company, information regarding assistance services, flight information of the contracted companies, etc.)
- Finance (Credit card info, payment info, Findeks (credit score) information)
- Physical Space Security (Surveillance videos in our offices)
- Visual and Audio Records (Call center records)
- Personal Information (Information including profession, title, workplace, etc. as part of customer loyalty programs and promotions)
- Transaction Security Information (Username and password information created for website or mobile application use)
- Marketing (Information such as surveys, cookie records, rental history, preferences for promotions and offers, etc.)
- Legal Procedures, Criminal Convictions and Security Measures (Traffic fines, information regarding criminal investigation processes, records, correspondence by judicial authorities)
- Vehicle (In the event of an accident, damage, etc., information about the damaged vehicle, other vehicles involved in the accident, license plate information, other information regarding vehicle use)
- Damage (Damage information, accident report, photos of the damage, expert report)
- Health (Disability information, information regarding personal health status, including report on substance/alcohol use, health reports, etc. in the event of an accident)
2) What is the Method and Legal Ground of Collecting Personal Data?
Your personal data is collected through manual channels that are partially or fully automatic or provided that these channels are parts of any data system including any and all kinds of verbal, written, digital communication, headquarters of our company, our website, etc.; through any agreements and forms filled out by your party in the physical environment; and via digital channels including phones, mobile applications, call centers, IVR calls, grievance management systems, website cookies. Surveillance videos of our visitors are taken by CCTV at the entrances of our company's buildings, facilities and within the facilities. The purpose of the camera surveillance activities which is carried out in compliance with the Law on Private Security Services and relevant legislation is to improve the quality of the services provided, provide security, ensure safety of the company, customers and third parties, and protect the interests of customers regarding the service provided. ENERJISA may process the data acquired in its premises; also, may transfer the data for below-mentioned purposes; and transfer and process the data in its operations, affiliated companies or partners. Your personal data is collected based on the legal grounds defined under article 5 of PDPL as “Requirement to process personal data of parties of a contract, provided that it is directly related to drawing up or executing the contract,” “Requirement of personal data processing for the legitimate interests of data controller, provided that it does not damage fundamental rights and liberties of the relevant person,” and “Being mandatory for the data controller to fulfill their legal obligations”; and processed as per the legal grounds stated herein.
3) Why Do We Process Your Personal Data?
Your personal data can be processed by our Company to ensure that the products and services are offered in the best possible way, although may vary depending on the product and service or commercial activity offered by ENERJİSA. Therefore, it is of great significance for our Company to collect, use and process your personal data to carry out its activities, in the best possible way. Your personal data can be processed limitedly in order to;
• Provide legal and commercial security,
• Manage legal processes with regulation and compliance,
• Sustain relations with public institutions and other organizations,
• Carry out and execute the processes related to defining human resources policies,
• Carry out liabilities, corporate communication operations with support services,
• Plan and carry out processes related to corporate sustainability, corporate governance, strategic planning and data security,
• Prepare applications,
• Follow up financial issues,
• Proceed litigation and execution processes for debts that our Company is a party to,
• Build, operate and back up an IT and network operation system infrastructure,
• Ensure security and supervision at the Company premises,
• Carry out purchasing, retailing, tender and retail procedures.
Thus, our Company processes personal data based on the legal grounds defined under article 5 of the Law as “Requirement to process personal data of parties of a contract, provided that it is directly related to drawing up or executing the contract,” “Requirement of personal data processing for the legitimate interests of data controller, provided that it does not damage fundamental rights and liberties of the relevant person,” and “Being mandatory for the data controller to fulfill their legal obligations.” The personal data identified under article 6 of PDPL is processed in line with the conditions and purposes of processing mentioned under the same article.
Your personal data is used and processed in compliance with and under the governance of PDPL with utmost confidentiality and the purpose of our Company to provide you service. Our Company follows legislation and ethics while processing your personal data and pays utmost attention to have accurate data, avoid misuse, process in compliance with the legal grounds, keep the data updated and store the data for a reasonable period required for the purpose.
4) Why and To Whom Do We Transfer Your Personal Data?
Your personal data can be shared with the aforementioned purposes, to the extent the legislation allows and is required by our work processes, with the parties that it must be shared with as well as legal authorities, companies that we have parent - affiliate relationships, our partners - subsidiaries nationwide and abroad, banks and financing agencies, organizations that we are provided service, establish partnerships and collaborations to sustain the company activities, employees working at our Company or working and acting on behalf of our Company as a matter of course of the activities we carry out as part of the practices conducted to improve the quality of the service we provide in line with the requirements and purposes of personal data processing defined under articles 8 and 9 of PDPL and the secondary legislation regarding transferring data abroad. Our employees use and process the data in compliance with the law and confidentiality requirements. The data is processed for a period required by our related activities in accordance with our policies and procedures defined in compliance with the By-Law on Erasure, Destruction or Anonymization of Personal Data; and erased when your relationship with our Company ends, and no other legal requirement or compliance exists.
5) Cookies on Our Website
When you visit the website of ENERJISA, data to be processed can be collected via cookies in line with the aforementioned purposes. The technical communication files, called cookies, are small text files sent by the websites to the browsers of the users’ computers or mobile phones.
The purpose of using cookies is to provide convenience to users who visit our website. Cookies can also be used to accelerate the experiences and activities to be carried out through our websites in the future. Cookies are used to understand for which purposes people use our websites and help us enhance the structures and contents of our websites. The information acquired does not include any data to reveal your identity.
The expiration times of cookies vary depending on the browser settings of the user. Many internet browsers are set to automatically accept cookies by default. You can change these settings to block cookies or to be notified when your device receives cookies. Please refer to your browser's instructions or help to get further details on how to manage your browser settings.
6) What Are Your Rights, as Data Owner, As Per Article 11 of PDPL?
Please kindly be informed that as per Article 11 of PDPL you are entitled to;
a) Know whether or not your personal data is processed,
b) Ask further information if your personal data is processed,
c) Request information on the purpose of processing and if your data processed is misused,
d) Know the third parties nationwide and abroad to which your personal data is transferred,
e) Ask your personal data to be revised if there is any information processed is missing or incorrect,
f) Ask your personal data to be erased or destructed in the event that the grounds for the data to be processed are no longer valid, although the data was processed in compliance with the provisions of PDPL and other related legislation,
g) Ask the third parties that data is transferred about the processes carried out pursuant to the aforementioned paragraphs (e) and (f),
h) Object to have an outcome not in your favor by means of exclusive analyses through automatic systems,
i) Ask for compensation of your damages in the event of any damages due to illegal processing.
7) How to Claim Your Rights Related to Your Personal Data Submitted?
As part of article 11 of PDPL, you can claim your right to apply regarding your personal data by sending the documents proving your ID and a petition consisting of the details of your request in written to our Company head office at Barbaros Mah. Begonya Sok. Nida Kule Ataşehir Batı Sitesi No: 1/1 Ataşehir İstanbul or by sending an e-mail to enerjisaaracfilo@hs01.kep.tr with your safe electronic signature or mobile signature or to musteriiliskileri@enerjisa.com by using your previously defined and registered e-mail address in ENERJISA’s system.
Your application must include the following information as per article 5 paragraph 2 of Communique on the Principles and Procedures for the Request to Data Controller (“Communique”);
a) Name, surname and signature, if the request is in writing,
b) For Turkish citizens, Turkish ID number; for foreigners, nationality, passport number or ID number, if exists,
c) Residential and business address for notification,
ç) Electronic mail address, telephone, fax number for notification, if exists,
d) Subject of request
Please use the Data Controller Application Form for related requests. Your application shall be accepted by ENERJISA following the identity verification and the related parties shall be informed in writing or digitally within the legal periods. As per article 7 of the Communique, if your application is to be responded in writing, no fee will be charged up to ten pages. Please kindly be informed that 1 Turkish Lira shall be charged per page over ten pages in compliance with the Communique.
8) Amendments
ENERJISA reserves the right to make any revisions in its policies and procedures to comply with the amendments made in the related legislation.
Sincerely,
KAPATMAK İÇİN (ESC)
Kapat
