Car Rental

Financial Information

Credit/debit card information, bank account information, IBAN information, balance information, credit balance, and other financial information.

Sensitive Data

Necessary information about your health condition and disability information that may affect the service received, which is explicitly stipulated in the legislation and where it is necessary for our operations and processed upon your explicit consent.

Marketing Information

Reports showing the likes of the person to be used for marketing purposes, targeting information, cookie records, information derived from data enrichment activities, information, and evaluations obtained as a result of surveys, campaigns, and direct marketing activities.

Transaction Security Information

IP address information, password, password information, cookie information

Other Information

Information on family members and relatives (identity and contact information on children and spouses of the relevant persons), security information on physical space (entry/exit records, visit information, photographs, camera and audio recordings), legal proceedings, and compliance information (information requests from judicial and administrative authorities, etc.).

4. Purposes of Processing Personal Data

In accordance with the KVKK, personal data cannot be processed without the explicit consent of the data subject as a rule. Obilet processes your personal information when and to the extent permitted by the legislation.
In this respect, the purposes of processing your personal data are as follows:

●  To confirm the identity information of the person who buys a ticket on the platform and on whose behalf the ticket is purchased, who rents a car and on whose behalf the car is rented, who makes a hotel reservation and on whose behalf the hotel reservation is made,
●  To save the address and other necessary information for contact,
●  To manage the procedures for the establishment and execution of contracts,
●  To communicate with our customers regarding the conditions, current status, and updates of the concluded contracts under the relevant articles of the Distance Sales Agreement and the Law on the Protection of Consumers, to provide the necessary information, and to fulfill the obligations undertaken in accordance with the concluded contracts,
●  To organize all records and documents that will be the basis of the transaction in electronic or hardcopy format,
●  To be able to provide information to public officials on matters related to public security upon request and in accordance with the legislation,
●  To provide a better service to our customers, to inform our customers about our products that our customers may be interested in, taking into account the interests of our customers, and to share campaigns,
●  To provide information to our customers via email or text message within the framework of the Law on the Regulation of Electronic Commerce and the relevant legislation
●  To increase customer satisfaction, to recognize our customers from the Platform, to use it in customer network analysis, to use it in various marketing and advertising activities, and to organize surveys in electronic and/or physical environments through contracted organizations in this context,
●  To be able to offer suggestions to our customers by our contracted institutions and solution partners and to inform our customers about our services,
●  To evaluate customer complaints and suggestions regarding our services,
●  To carry out goods and services production, operation and sales processes, finance and accounting activities, and archive activities,
●  To ensure information security,
●  To fulfill our legal obligations and to exercise our rights arising from the legislation in force.
In addition, the personal data of our employees may be processed without consent to the extent necessary for business relations. The terms and conditions specified in the Policy on the Protection and Processing of Personal Data of Employees shall apply to the processing of personal data of our employees.

5. Conditions for Processing Personal Data

Personal data are processed and transferred by our Company in accordance with Article 20 of the Constitution and Article 4 of the KVKK, by keeping them for the period stipulated by law or required by the purpose of processing personal data, based on the conditions specified in Articles 5 and 6 of the KVKK under the following conditions;

●  Consistent with the law and good faith,
●  Accurate and up to date,
●  For specific, explicit, and legitimate purposes,
●  Linked to processing purposes,
●  In a limited and measured way.
-
Personal data shared with Obilet is under the supervision and control of Obilet. Obilet has assumed the responsibility as the data controller to establish the necessary organization and to take and adapt technical measures to protect the confidentiality and integrity of the information by the provisions of the relevant legislation in force. Being aware of our obligation in this regard, we would like to state that we have taken the following administrative and technical security measures. In this context, we hereby inform you that we always update our data processing policies.

●  All data received through the platform is transferred from your computer or mobile device to our application servers with a 256-bit RSA SSL certificate compatible with TLS 1.2 standard. Your critical payment information is not stored on our application servers in any way but is encrypted in the standards required by the relevant payment system and transmitted to the relevant bank and/or payment system infrastructure.
●  Penetration tests are performed periodically and the system's resistance to unauthorized access is tested.
●  Access authorization and control matrices for employees have been established to prevent unlawful processing of personal data collected from the Platform.
●  Personal data on paper media are kept in locked cabinets and only authorized persons are allowed access to these media.

Since Obilet must keep the personal data of the relevant persons accurate and up-to-date in accordance with Article 4 of the KVKK, our customers are required to share their accurate and up-to-date data with Obilet to fulfill these obligations. In case your personal data changes in any way, we would like you to update your information by visiting your profile page.
Obilet stores the processed personal data for the periods specified in the legislation. In case no specific period is set in the legislation, the personal data is stored for the period required to be processed in accordance with Obilet's practices and the customs of Obilet's commercial life, depending on the services provided by Obilet while processing the relevant personal data. After this period, the personal data is stored only for the periods required in practice to constitute evidence in possible legal disputes. After the expiration of the specified periods, the personal data in question are deleted, destroyed, or anonymized.

6.Transfer of Personal Data

The sharing of personal data with third parties is realized within the framework of the legislation in force and/or the explicit consent given by the relevant persons. However, personal data is shared with courts and other public institutions due to and limited to our legal obligations. In addition, personal data is transferred to third parties within the framework of a contractual relationship to provide the committed services and to perform quality control of the services provided.

Necessary technical and administrative measures are taken to prevent data breaches during data transfer to third parties. For example, during data transfer; SSL and transport layers are used.

Your personal data may be shared with program partner institutions and organizations that we cooperate with to carry out our activities, with third parties who have the title of service provider and/or intermediary service provider, with our business partners who provide special integrator services, with third parties who provide independent auditing, with domestic/foreign persons and institutions that we receive data storage services in the cloud environment, with domestic/foreign organizations that we have contracted to send commercial electronic messages to our customers, with our financial advisors, with the Interbank Card Center, with our contracted banks, payment service providers and various agencies, advertising companies and survey companies in Turkey and abroad and other third parties in Turkey and abroad, and our related business partners, shareholders and affiliates and third parties, lawyers, consultants and legally authorized public institutions and private law legal entities from which we receive services within the scope of a contractual relationship to provide you with better service and customer satisfaction within the scope of various marketing activities.

7. Rights of the Data Subject

In accordance with Article 11 of the KVKK, the data subject has the following rights:
●  To learn whether personal data about him/her is being processed,
●  To request information if personal data about him/her has been processed,
●  To learn the purpose of processing personal data and whether they are used for their intended purpose,
●  To know the third parties to whom personal data are transferred domestically or abroad,
●  To request correction of personal data in case of incomplete or incorrect processing,
●  To request the deletion or destruction of personal data in case the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the Law and other relevant laws,
●  To request notification of the transactions made as a result of correction, deletion, and destruction requests to third parties to whom personal data are transferred,
●  To object to the emergence of a result to the disadvantage of the person himself/herself by analyzing the processed data exclusively through automated systems,
●  To demand compensation for damages in case of any damage due to unlawful processing of personal data.
-
To exercise these rights, you may submit your request in this direction in accordance with Article 13 of the KVKK and accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to Obilet's Yunus Emre Cad. Topçu İş Merk. Topçu İş Merk. No:1/11 Kat:3 Kağıthane/İstanbul" address, by including your name, surname, signature, and Turkish identity number if you are a citizen of the Republic of Turkey, If not, include your nationality, your passport number, or identification number, if any, your residential or workplace address for notification, your e-mail address and telephone number for notification, and the necessary information and documents to determine the subject of the request and your identity, and/or in writing by using the Application Form, via your e-mail address where your membership is confirmed, or if you do not have any membership, you can apply via e-mail to receive general information about KVKK. Your application will be evaluated by Obilet and finalized free of charge within thirty days. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be requested.
Click here to access the Application Form that you can use to submit your requests.