Privacy Notice
This Privacy Notice on the Processing of Personal Data (the “Privacy Notice”) has been prepared by Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. (Etiler Mahallesi Arnavutköy Yolu Sok. No:3 Beşiktaş/İSTANBUL) (the “Company”), in its capacity as data controller, in order to fulfil its obligation to inform you regarding the processing of your personal data, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.
This Privacy Notice is addressed to the persons specified in the headings; for other persons such as job applicants, employees, suppliers and their authorised representatives/employees, separate privacy notices have been prepared for each group of data subjects and are disclosed to the relevant data subjects in an appropriate manner.
Data Controller
Your Personal Data may be processed by Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. (Etiler Mahallesi Arnavutköy Yolu Sok. No:3 Beşiktaş/İSTANBUL), in its capacity as data controller, in accordance with the Law and the relevant legislation, within the framework of the purposes stated below and in a manner that is connected, limited and proportionate to those purposes, to the extent described below.
I. Purposes and Legal Grounds for the Processing of Personal Data Processed Through the Mobile Application
We would like to inform you about our data processing activities as defined in the Law, including but not limited to the collection, storage and transfer of your personal data obtained in connection with your use of our mobile application. The information below relates to the personal data processing activities carried out when you visit our Mobile application with internet-enabled devices such as computers, smartphones and tablets, or by telephone, or when you contact us.
1. Visitors who are not members of our Mobile Application
If you have not registered with our Mobile Application or otherwise provided us with personal data, and you only visit our application and its related sub-pages, only your personal data automatically transmitted to our server is collected, and the information specified below is collected and stored in ‘server log files’ until it is automatically deleted:
Data | Purpose of Processing the Personal Data | Legal Grounds (Article of the Law) |
|---|---|---|
Transaction Security Data | ||
IP address Date and time Time zone difference from GMT Content of the request (pages opened) Access status / HTTP status code Amount of data transferred Information on the device from which the request originated Browser Operating system and interface Language and version of the browser software Apple ID Android ID Telephone | Conducting Activities in Compliance with the Legislation Conducting Information Security Processes Conducting Marketing Processes for Products / Services, Conducting Marketing Analysis Studies | 5/2 (a): Being expressly provided for by law 5/2 (ç): Being necessary for the data controller to fulfil its legal obligation 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right |
2. Visitors who contact us via the Contact Form or by e-mail
If you contact us by e-mail or by using the contact form, the personal data you share with us is collected and processed.
Data | Purpose of Processing the Personal Data | Legal Grounds (Article of the Law) |
|---|---|---|
Identity Data | ||
Name Surname | Conducting Communication Activities Following Up Requests / Complaints | 5/2 (ç): Being necessary for the data controller to fulfil its legal obligation 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Contact Data | ||
E-mail address Telephone Address | Conducting Communication Activities Following Up Requests / Complaints | 5/2 (ç): Being necessary for the data controller to fulfil its legal obligation 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
3. Visitors who become members of our Mobile Application by filling in the Membership Form
If you open a user account in order to become a registered user of the Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. mobile application, the mandatory and optional personal data you share with us in this context is collected and processed.
Data | Purpose of Processing the Personal Data | Legal Grounds (Article of the Law) |
|---|---|---|
Identity Data | ||
Name Surname Turkish ID Number Date and Place of Birth Driver Registry No | Conducting Communication Activities Following Up Requests / Complaints Conducting Information Security Processes Conducting Activities in Compliance with the Legislation | 5/2 (a): Being expressly provided for by law 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Visual and Audio Records | ||
Photograph Camera Access | Conducting Communication Activities Conducting Information Security Processes Conducting Activities in Compliance with the Legislation | 5/2 (a): Being expressly provided for by law 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Contact Data | ||
Telephone Address Location | Conducting Communication Activities Following Up Requests / Complaints Conducting Information Security Processes | 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Transaction Security Data | ||
Member Log-ins and Log-outs | Conducting Activities in Compliance with the Legislation Conducting Information Security Processes | 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (ç): Being necessary for the data controller to fulfil its legal obligation 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right |
(Religion information, health data and photograph data contained in driving licences, which are special categories of personal data, are provided by you to the data controller together with the driving licence as a legal obligation. Apart from the fact that obtaining these documents is legally mandatory, our company carries out no additional processing activity in our systems concerning blood group and religion field information, which are considered special categories of data, or concerning information on attire due to the photograph in your identity document. The image of the driving licence is kept in the system; the special categories of personal data written on the photocopy of the driving licence are blacked out in our systems after the photocopy is obtained)
4. Personal Data Processed Through the Mobile Application Concerning Customers/Persons Receiving Products and Services, Purposes of Processing and Legal Grounds
The personal data of our customers is processed within the legal framework as set out below.
Data | Purpose of Processing the Personal Data | Legal Grounds (Article of the Law) |
|---|---|---|
Identity Data | ||
Name Surname Date of Birth Gender Turkish ID Number Serial No Nationality Signature Mother's Name Father's Name Driving Licence | Conducting Communication Activities Following Up Requests / Complaints Conducting Company / Product / Service Loyalty Processes Conducting Goods / Services After-Sales Support Services Conducting Goods / Services Sales Processes Conducting Goods / Services Production and Operation Processes Conducting Customer Relationship Management Processes Conducting Activities Aimed at Customer Satisfaction Organisation and Event Management Conducting Contract Processes Conducting Storage and Archiving Activities | 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Contact Data | ||
E-mail address Address Location Telephone | Conducting Communication Activities Following Up Requests / Complaints Conducting Company / Product / Service Loyalty Processes Conducting Goods / Services After-Sales Support Services Conducting Goods / Services Sales Processes Conducting Goods / Services Production and Operation Processes Conducting Customer Relationship Management Processes Conducting Activities Aimed at Customer Satisfaction Organisation and Event Management Conducting Contract Processes Conducting Storage and Archiving Activities | 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Financial Data | ||
Bank details Credit Card Invoice | Conducting contract processes Conducting Finance and Accounting Affairs Conducting Internal Audit / Investigation / Intelligence Activities | 5/2 (c): Being directly related to the establishment or performance of a contract |
Legal Transaction Data | ||
Information contained in correspondence with judicial authorities | Following Up and Conducting Legal Affairs Conducting contract processes Conducting Internal Audit / Investigation / Intelligence Activities | 5/2 (a): Being expressly provided for by law 5/2 (e): For the establishment, exercise or protection of a right |
Customer Transaction Data | ||
Call centre records Order information Request information | Conducting contract processes Conducting Goods / Services After-Sales Support Services Conducting Goods / Services Sales Processes Conducting Customer Relationship Management Processes Conducting Activities Aimed at Customer Satisfaction Following Up Requests / Complaints | 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Visual and Audio Data | ||
Photograph Camera Access | Conducting contract processes Conducting Goods / Services Sales Processes Identifying the person renting the vehicle/the party to the contract, as required by the car rental procedure Conducting Information Security Processes Conducting Activities in Compliance with the Legislation | 5/2 (a): Being expressly provided for by law 5/2 (c): Being directly related to the establishment or performance of a contract 5/2 (e): Data processing being mandatory for the establishment, exercise or protection of a right 5/2 (f): Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject |
Other Data | ||
Location | Conducting contract processes Conducting Goods / Services Production and Operation Processes Conducting Goods / Services Sales Processes Conducting Goods / Services After-Sales Support Services | 5/2 (c): Being directly related to the establishment or performance of a contract |
Other Data | ||
Licence Plate of the Rented Vehicle Dates and times of use of the Rented Vehicle | Conducting Activities in Compliance with the Legislation Providing Information to Authorised Persons, Institutions and Organisations “KABİS” Rental Vehicle Notification System, the Mandatory Notification System of the General Directorate of Security | 5/2 (ç): Being necessary for the data controller to fulfil its legal obligation |
Other Data | ||
Information contained in the Accident Report | Following Up and Conducting Legal Affairs Conducting Contract Processes | 5/2 (e): For the establishment, exercise or protection of a right |
Other Data | ||
Rating Information Favourite Vehicle Information | Conducting Marketing Analysis Studies Conducting Activities Aimed at Customer Satisfaction Conducting Marketing Processes for Products / Services | 5/2 (e): For the establishment, exercise or protection of a right |
(Religion information, health data and photograph data contained in driving licences, which are special categories of personal data, are provided by you to the data controller together with the driving licence as a legal obligation. Apart from the fact that obtaining these documents is legally mandatory, our company carries out no additional processing activity in our systems concerning blood group and religion field information, which are considered special categories of data, or concerning information on attire due to the photograph in your identity document. The image of the driving licence is kept in the system; the special categories of personal data written on the photocopy of the driving licence are blacked out in our systems after the photocopy is obtained).
5. For detailed information on the use of cookies, you can access our “Cookie Policy” via the following link: https://driveyoyo.com/tr/sayfa/cerez-politikasi
Transfer of Personal Data
Your personal data may be shared, limited to the purposes and legal grounds stated above, with public institutions and organisations authorised to request such data where required by legal obligations or necessities, with natural persons or private legal entities such as our business partners and suppliers, as well as, as required by the system, with the provider that makes the application server available for use, and the data you send us via the contact form with the Gmail Workspace mail service that provides the e-mail server, both domestically and abroad in accordance with Articles 8 and 9 of the Law.
Transfer of Personal Data
Your personal data may be shared, limited to the purposes and legal grounds stated above, with public institutions and organisations authorised to request such data where required by legal obligations or necessities, and with natural persons or private legal entities such as our business partners and suppliers, both domestically and abroad in accordance with Articles 8 and 9 of the Law.
Method of Collecting Personal Data
Your personal data is collected through technical communication files automatically transmitted by computer when you submit data through the application or during your visit, data transmitted through the Call Centre, Mobile Applications, our office and similar channels through which we provide services, physical forms, identity card and driving licence, the content of contracts and insurance policies, information you provide to us during the contractual relationship, and through cooperating institutions and organisations, insurance companies, public authorities, banks and other third parties or by similar means; verbally, in writing or electronically; by fully or partially automated means or by non-automated means as part of any data recording system, and is processed and updated as necessary for as long as you benefit from our products and services.
Your Rights Regarding Your Personal Data
As a data subject, by applying to Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş., you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing of your personal data and whether it is used in accordance with that purpose,
- Know the third parties to whom personal data is transferred domestically or abroad,
- Request the rectification of personal data if it has been processed incompletely or inaccurately, and request that the action taken in this context be notified to third parties to whom the personal data has been transferred,
- Request the erasure or destruction of personal data where the reasons requiring its processing no longer exist, even though it has been processed in accordance with the provisions of the Law and other relevant laws, and request that the action taken in this context be notified to third parties to whom the personal data has been transferred,
- Object to a result arising against the person through the analysis of the processed data exclusively by automated systems,
- Request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.
If you submit your requests regarding the rights listed above to Yoyo Bilgi Teknolojileri ve Turizm Ticaret A.Ş. by an application that complies with the procedures set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, enables your identity to be verified and contains your explicit request, via your E-mail address previously notified to the Data Controller and registered in the Company system, or through a notary, or in writing with a wet signature to the address Etiler Mahallesi Arnavutköy Yolu Sokak No:3 Beşiktaş/İSTANBUL, or with an electronic signature via the KEP address yoyodrive@hs03.kep.tr, or with an electronic or mobile signature via the address merhaba@driveyoyo.com, your request will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature. However, if the action requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
You may submit your applications regarding the rights listed above in relation to your personal data by using the ‘Data Subject Application Form’ available at the www.driveyoyo.com website, or without a form.
This Privacy Notice may be updated in order to comply with the personal data processed, changing conditions and legal regulations, and as a legal obligation.