Categories of Personal Data

Purposes of Processing

Legal Basis for Processing

• Identity Data

(e.g., name-surname, Turkish identification number, trade name of the sole proprietorship, date of birth)

• Communication Data

(e.g., phone number)

• Professional Experience Data

(e.g., information regarding occupation and profession, information on the affiliated institution)

• Legal Transaction Data

(e.g., power of attorney, signature circular)

• Financial Data

(e.g., shareholding information)

• Risk Management Data

(e.g., information on the results of risk analysis and assessment)

• Customer Transaction Data

(in case you are our customer who is a natural person, e.g., purchase transaction information, tender and auction information, payment information, invoice information)

• Business Transaction Data

(in case you are an employee, representative or shareholder of our sole proprietorship or legal entity customer, e.g., purchase transaction information, tender and auction information, payment information, invoice information)

• Vehicle Data

(e.g., license plate information, brand information, model information, damage information)

• Transaction Security Data

(e.g., log records within the scope of Law No. 5651, IP address information of bidding participants and other participants in accordance with the relevant Regulation)

• Compliance with legal obligations expressly provided under applicable laws (e.g., (i) for the purpose of meeting vehicle sale requests, pursuant to the Turkish Prevention of Laundering Proceeds of Crime Law numbered 5549 and the relevant secondary legislation, prior to the execution of a transaction, the identification of the persons conducting the transaction and those on whose behalf or account the transaction is conducted in order to fulfil know your customer (KYC) obligations, the conduct of screening processes within the scope of the prevention of money laundering, the prevention of the financing of terrorism, and the determination of whether such persons are included in sanctions lists, as well as the collection of information and documents and the management of the implementation of other necessary measures, (ii) pursuant to the Regulation on the Trade of Second-Hand Motor Land Vehicles (“Regulation”), the execution of sales processes for second-hand motor land vehicles through tender and auction methods for relevant participants, including contracted insurance companies, the management of bid submission and bid evaluation processes, the creation of the necessary membership and user registrations for the purpose of enabling participation in tenders, the verification of the identity and contact information of the participants, the management of the recording of bid and sales processes and of the processes related to the completion of sales transactions, (iii) the mandatory retention of log records within the framework of the Turkish Law on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications numbered 5651 (“Law numbered 5651”) and the relevant secondary legislation, (iv) the management of the issuance, amendment, return and cancellation of e-invoices and e-archive invoices, and the provision of tax management related to income-based declarations) and
• Execution of retention and archiving activities.

Per article 5/2(a) of the PDPL, it is expressly provided for by the laws

• Identity Data

(e.g., name-surname, trade name of the sole proprietorship)

• Communication Data

(e.g., address, e-mail address, phone number)

• Professional Experience Data

(e.g., information on the affiliated institution)

• Vehicle Data

(e.g., license plate information, brand information, model information, damage information)

• Legal Transaction Data

(e.g., power of attorney, signature circular, notary sale documentation)

• Financial Data

(e.g., bank information)

• Request / Complaint / Suggestion Data

(e.g., request / complaint / suggestion information)

• Customer Transaction Data

(in case you are our customer who is a natural person, e.g., payment information, contract information, information included in the vehicle delivery form)

• Business Transaction Data

(in case you are an employee, representative or shareholder of our sole proprietorship or legal entity customer, e.g., payment information, contract information, information included in the vehicle delivery form)

• Transaction Security Data

(e.g., log records)

• Audiovisual Data

(e.g., photographic records of the vehicle)

• Within the scope of the establishment and/or performance of the contractual relationship for the execution of vehicle sale, tender and auction processes through Carmarket membership, conduct of negotiations related to bids and contracts, and execution and completion of information and document sharing,
• Management of Carmarket membership processes,
• Execution of finance and accounting processes (e.g., management of the issuance, amendment, reconciliation, return and cancellation of e-invoices and e-archive invoices, invoice control, payment approval, and provision of management of bank instructions),
• Execution, auditing and ensuring the continuity of business activities,
• Collection, assessment and resolution of requests, complaints, and/or suggestions,
• Within the scope of the execution, auditing and ensuring the continuity of business activities, sharing of personal data with our suppliers established domestically for the purpose of the procurement of products and/or services,
• Execution of communication activities,
• Conducting information security processes, and
• Execution of retention and archiving activities.

Per article 5/2(c) of the PDPL, processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

• Identity Data

(e.g., name-surname, trade name of the sole proprietorship, date of birth)

• Communication Data

(e.g., phone number)

• Professional Experience Data

(e.g., information regarding occupation and profession, information on the affiliated institution)

• Legal Transaction Data

(e.g., power of attorney, signature circular, records confirming that the privacy statement has been read)

• Financial Data

(e.g., shareholding information)

• Risk Management Data

(e.g., information on the results of risk analysis and assessment)

• Customer Transaction Data

(in case you are our customer who is a natural person, e.g., purchase transaction information, tender and auction information)

• Business Transaction Data

(in case you are an employee, representative or shareholder of our sole proprietorship or legal entity customer, e.g., purchase transaction information, tender and auction information)

• Vehicle Data

(e.g., license plate information, brand information, model information, damage information)

• Transaction Security Data

(e.g., IP address information of bidding participants and other participants in accordance with the relevant Regulation, log records confirming that the privacy statement has been read)

• Compliance with legal obligations (e.g., (i) processing of personal data for the purpose of fulfilling legal obligations pursuant to the Turkish Prevention of Laundering Proceeds of Crime Law numbered 5549 and the relevant secondary legislation, (ii) processing of personal data for the purpose of fulfilling legal obligations pursuant to the Regulation on the Trade of Second-Hand Motor Land Vehicles, within the scope of tender and auction processes for second-hand motor land vehicles) ve
• Execution of retention and archiving activities.

Per article 5/2(ç) of the PDPL, it is necessary for compliance with a legal obligation to which the data controller is subject

• Identity Data

(e.g., name-surname, signature, trade name of the sole proprietorship)

• Communication Data

(e.g., address, e-mail address, phone number)

• Financial Data

(e.g., bank information)

• Risk Management Data

(e.g., information on the results of risk analysis and assessment)

• Legal Transaction Data

(e.g., records and correspondence subject to legal disputes, notary sale documentation)

• Professional Experience Data

(e.g., information on the affiliated institution)

• Vehicle Data

(e.g., license plate information, brand information, model information, damage information)

• Request / Complaint / Suggestion Data

(e.g., request / complaint / suggestion information)

• Customer Transaction Data

(in case you are our customer who is a natural person, e.g., purchase transaction information, information included in the vehicle delivery form)

• Business Transaction Data

(in case you are an employee, representative or shareholder of our sole proprietorship or legal entity customer and/or the person receiving delivery of the purchased vehicle, e.g., payment information, contract information, information included in the vehicle delivery form)

• Transaction Security Data

(e.g., log records)

• Audiovisual Data

(e.g., photographic records of the vehicle)

• Establishment and protection of the rights and interests of our Company in potential dispute proceedings in which our Company is a party and/or involved,
• Planning and execution of legal and consultancy matters, including the management of dispute proceedings in which our Company is a party and/or involved, and
• Execution of retention and archiving activities.

Per article 5/2(e) of the PDPL, data processing is necessary for the establishment, exercise, or protection of any right

• Identity Data

(e.g., name-surname, signature, trade name of the sole proprietorship)

• Communication Data

(e.g., address, e-mail address, phone number)

• Financial Data

(e.g., bank information)

• Legal Transaction Data

(e.g., records and correspondence subject to legal disputes)

• Professional Experience Data

(e.g., information on the affiliated institution)

• Vehicle Data

(e.g., license plate information, brand information, model information, damage information)

• Request / Complaint / Suggestion Data

(e.g., request / complaint / suggestion information)

• Customer Transaction Data

(in case you are our customer who is a natural person, e.g., purchase transaction information, information included in the vehicle delivery form)

• Business Transaction Data

(in case you are an employee, representative or shareholder of our sole proprietorship or legal entity customer and/or the person receiving delivery of the purchased vehicle, e.g., payment information, contract information, information included in the vehicle delivery form)

• Transaction Security Data

(e.g., log records)

• Audiovisual Data

(e.g., photographic records of the vehicle)

• Within the scope of vehicle sale and tender and auction processes for second-hand motor land vehicles, execution and completion of information and document sharing,
• Management of Carmarket membership processes,
• Execution of finance and accounting processes (e.g., invoice control),
• Execution, auditing and ensuring the continuity of business activities,
• Collection, assessment and resolution of requests, complaints, and/or suggestions,
• Planning and/or conducting compliance, communication, audit, and reporting activities in compliance with the global policies and procedures of our group companies, shareholders,
• Planning and conducting audit, internal audit, and reporting activities,
• Execution of communication activities,
• Within the scope of the execution, auditing and ensuring the continuity of business activities, sharing of personal data with our suppliers established domestically for the purpose of the procurement of products and/or services,
• Conducting information security processes, and
• Execution of retention and archiving activities.

Per article 5/2(f) of the PDPL, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject

• Political Opinion

(e.g., politically exposed person (PEP) information)

• Criminal Convictions and Security Measures

(e.g., past conviction information)

• Compliance with legal obligations expressly provided under applicable laws (e.g., for the purpose of meeting vehicle sale requests, pursuant to the Turkish Prevention of Laundering Proceeds of Crime Law numbered 5549 and the relevant secondary legislation, prior to the execution of a transaction, the identification of the persons conducting the transaction and those on whose behalf or account the transaction is conducted in order to fulfil know your customer (KYC) obligations, the conduct of screening processes within the scope of the prevention of money laundering, the prevention of the financing of terrorism, and the determination of whether such persons are included in sanctions lists, as well as the collection of information and documents and the management of the implementation of other necessary measures) and
• Execution of retention and archiving activities.

Per article 6/3(b) of the PDPL, it is explicitly provided by laws

• Establishment and protection of the rights and interests of our Company in potential dispute proceedings in which our Company is a party and/or involved,
• Planning and execution of legal and consultancy matters, including the management of dispute proceedings in which our Company is a party and/or involved,
• Execution of retention and archiving activities.

Per article 6/3(d) of the PDPL, it is necessary for the establishment, exercise, or protection of any right

Recipient Groups

Purpose of Transfer

Categories of Personal Data

Legal Basis for Transfer

Suppliers located abroad, including our group companies acting as service providers (e.g., information technology and data hosting service providers)

For the purpose of the procurement of products and/or services within the scope of the execution, auditing and ensuring the continuity of business activities

• Identity
• Communication
• Professional Experience Financial
• Legal Transaction
• Customer Transaction
• Business Transaction
• Transaction Security
• Risk Management
• Vehicle
• Request / Complaint / Suggestion
• Audiovisual

Per article 5/2(f) of the PDPL, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject

• Political Opinion
• Criminal Convictions and Security Measures

Per article 6/3(b) of the PDPL, it is explicitly provided by laws

Business partners located domestically and/or abroad (e.g., authorized service providers)

Supporting the necessary operational processes within the scope of the execution of services provided through business partners

• Identity
• Communication
• Legal Transaction
• Customer Transaction
• Business Transaction
• Vehicle
• Request / Complaint / Suggestion
• Audiovisual

Per article 5/2(f) of the PDPL, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject

Shareholders and group companies located domestically and/or abroad

Planning and/or conducting compliance, communication, audit, and reporting activities in compliance with the global policies and procedures of our group companies and shareholders

• Identity
• Communication
• Professional Experience Financial
• Legal Transaction
• Customer Transaction
• Business Transaction
• Transaction Security
• Vehicle
• Request / Complaint / Suggestion
• Audiovisual

Per article 5/2(f) of the PDPL, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject

Attorneys and attorney partnerships located domestically

Procurement of services within the scope of the execution of legal and consultancy matters, including the establishment and protection of the Company’s rights and interests in potential dispute processes to which the Company is a party and/or related

• Identity
• Communication
• Professional Experience
• Financial
• Legal Transaction
• Customer Transaction
• Business Transaction
• Transaction Security
• Risk Management
• Vehicle
• Request / Complaint / Suggestion
• Audiovisual

Per article 5/2(e) of the PDPL, data processing is necessary for the establishment, exercise, or protection of any right

Per article 5/2(f) of the PDPL, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject

• Political Opinion
• Criminal Convictions and Security Measures

Per article 6/3(d) of the PDPL, it is necessary for the establishment, exercise, or protection of any right

Competent public authorities and institutions located domestically (e.g., courts, ministries, The Financial Crimes Investigation Board)

Provision of information and documents within the scope of the fulfilment of the Company’s legal obligations and the monitoring of legal matters

• Identity
• Communication
• Professional Experience
• Financial
• Legal Transaction
• Customer Transaction
• Business Transaction
• Risk Management
• Transaction Security

Per article 5/2(a) of the PDPL, it is expressly provided for by the laws

Per article 5/2(ç) of the PDPL, it is necessary for compliance with a legal obligation to which the data controller is subject

• Identity
• Communication
• Professional Experience
• Financial
• Legal Transaction
• Customer Transaction
• Business Transaction
• Transaction Security
• Risk Management
• Vehicle
• Request / Complaint / Suggestion
• Audiovisual

Per article 5/2(e) of the PDPL, data processing is necessary for the establishment, exercise, or protection of any right

• Political Opinion
• Criminal Convictions and Security Measures

Per article 6/3(b) of the PDPL, it is explicitly provided by laws

Per article 6/3(d) of the PDPL, it is necessary for the establishment, exercise, or protection of any right

Postal

:

Ofispark Merkez Mah. Bağlar Cad. No. 14 C Blok K.5 Kağıthane/İstanbul

E-mail Address

:

verikoruma@ayvens.com

KEP Address

:

leaseplan@hs03.kep.tr