**Protection of Personal Data**
**1. Data Controller**
Pursuant to the Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Castle Rent a Car ("Castle Rent A Car" or the "Company") in its capacity as the data controller.
**Company Information:**
Trade Name: Castle Rent a Car Otomotiv San. ve Tic. Ltd. Şti.
Address: Tayakadın Mah. Terminal Cd. Airport Terminal Building No:1 Interior Door No: 820448 Arnavutköy / Istanbul
E-mail: ihl@castle.com.tr
**2. Categories of Personal Data Processed**
Your personal data may be processed under the following categories:
- **Identity Information:** First name, last name, Turkish ID number, date of birth, etc.
- **Contact Information:** Phone number, e-mail address, address, etc.
- **Location Information:** Location data related to taxi reservations and travel processes.
- **Customer Transaction Information:** Reservation records, service requests, payment information.
- **Financial Information:** Payment method, invoice information, transaction details.
- **Transaction Security Information:** IP address, password information, session records, log records.
- **Visual/Audio Records:** Call center conversations, customer support records.
**3. Purposes of Processing Personal Data**
Your personal data is processed within the scope of Articles 5 and 6 of the KVKK for the following purposes:
- Managing membership and reservation processes
- Conducting the Company's activities and commercial operations
- Processing payments, invoicing, and accounting transactions
- Responding to customer requests and providing support services
- Improving service quality and conducting customer satisfaction activities
- Fulfilling legal obligations and responding to requests from official authorities
- Ensuring the security of online platforms and preventing fraud and misuse
- Conducting campaigns, promotions, and informational activities with the customer's consent
**4. Legal Grounds**
Your personal data is processed based on the following legal grounds:
- Establishment and performance of a contract (KVKK Art. 5/2-c)
- Fulfillment of legal obligations (KVKK Art. 5/2-ç)
- Protection of our legitimate interests (KVKK Art. 5/2-f)
- Your explicit consent (KVKK Art. 5/1)
**5. Transfer of Personal Data**
Your personal data may be transferred in accordance with Articles 8 and 9 of the KVKK to:
- Authorized public institutions and organizations,
- Banks, payment service providers, and financial advisory firms,
- IT support service providers,
- Business partners, suppliers, and logistics service providers.
If your personal data is to be transferred abroad, your explicit consent will be obtained, or the transfer will be carried out in accordance with the conditions stipulated by the KVKK.
**6. Retention Period of Personal Data**
Your personal data is retained for the periods prescribed by the applicable legislation. Upon the expiration of the relevant legal retention periods, your personal data will be deleted, destroyed, or anonymized.
**7. Data Security**
To ensure the confidentiality and security of your personal data, the following measures are implemented:
- Technical security systems against unauthorized access,
- Access control and authorization procedures,
- Encrypted storage of data,
- Regular audits and risk assessments.
**8. Your Rights as a Data Subject**
Pursuant to Article 11 of the KVKK, you have the right to apply to our Company and:
- Learn whether your personal data is being processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether it is used in accordance with that purpose,
- Learn the third parties to whom your personal data has been transferred domestically or abroad,
- Request correction if your personal data has been processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the scope of the conditions set forth in the KVKK,
- Request notification of such correction, deletion, or destruction to third parties to whom your personal data has been transferred,
- Object to any outcome that is to your detriment resulting exclusively from the analysis of your personal data through automated systems,
- Request compensation if you suffer damages due to the unlawful processing of your personal data.
**9. Application Methods**
You may submit your requests regarding your rights under the KVKK:
- In writing to: Tayakadın Mah. Terminal Cd. Airport Terminal Building No:1 Interior Door No: 820448 Arnavutköy / Istanbul,
- By e-mail to: ihl@castle.com.tr (using the e-mail address registered in our system),
- Through a notary public or by registered mail with return receipt,
- By contacting our Company.
Your requests will be concluded free of charge within no later than 30 days, pursuant to Article 13 of the KVKK.
**10. Updates**
This Privacy Notice may be amended in line with legal changes or updates to the Company's practices. You may always access the most current version at **www.castle.com.tr**.