Privacy Notice (KVKK & GDPR)

This notice explains how your personal data are processed through rentacarbelek.com and at our branch, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR).

1. Data controller [işletme sahibinin adı soyadı] – Secret Rent a Car (sole proprietorship) Address: Belek Mah. Atıf Zengin Cd. A11, 07506 Serik/Antalya, Türkiye Phone: +90 541 548 16 31

2. Personal data we process • Identity: first and last name, date of birth; ID card or passport details for rentals. • Driving licence: number, category and date of issue (car rental only). • Contact: phone, e-mail, place of stay / hotel name. • Transaction: bookings, transfer and quote requests; date, time, route, flight number, number of passengers and bags, your notes. • Financial: amount and status of payment, pre-authorisation record. We do not store card details; they are processed by the payment institution. • Vehicle use: mileage and fuel at pick-up/return, damage and traffic fine records. • Digital: IP address, session and security logs, language and currency preference; Google Analytics measurements only if you consent. We do not ask for special categories of data (health, religion etc.); please do not include such information in your messages.

3. Purposes and legal bases • Receiving and performing bookings, rentals, transfers and quote requests – performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b). • Renter identity and licence checks, rental vehicle notification to the authorities, invoicing and accounting – legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6/1-c). • Damage, traffic fines, toll charges and disputes – establishment, exercise or defence of legal claims (KVKK Art. 5/2-e; GDPR Art. 6/1-f). • Website security, prevention of abuse and fraud – legitimate interest (KVKK Art. 5/2-f; GDPR Art. 6/1-f). • Visitor statistics (Google Analytics) – consent (KVKK Art. 5/1; GDPR Art. 6/1-a). You can withdraw consent at any time via "Cookie settings" at the bottom of the site. We do not send marketing messages unless you separately opt in.

4. How we collect data Through the forms on our website, phone, WhatsApp, e-mail and the rental agreement signed at the branch, and partly by automated means (server logs, cookies).

5. Recipients Your data are shared only for the purposes above and only as necessary with: • Competent public authorities (e.g. the Turkish police rental vehicle notification system, tax offices, courts) – legal obligation. • Insurance companies and loss adjusters – in case of damage. • Payment institutions and banks – payment and pre-authorisation. • Hosting and technical service providers: Google Cloud (server and backups), Google Analytics (only with your consent). International transfers: our server and backups are hosted on Google Cloud infrastructure in the United States, and Google Analytics data are also processed abroad. These transfers rely on the safeguards under KVKK Art. 9 and GDPR Chapter V (standard contracts / standard contractual clauses) and, for Google Analytics, on your consent.

6. Retention Booking and contract records and invoice data are kept for the period required by law (10 years for commercial books and records). Images of driving licences and ID documents are deleted within 180 days at the latest. Quote requests that did not lead to a booking and account data are deleted or anonymised no later than 3 years after your last activity. Google Analytics data are deleted after 14 months.

7. Your rights (KVKK Art. 11, GDPR Arts. 15-22) You have the right to learn whether your data are processed, to request information, to learn the purpose of processing and whether data are used accordingly, to know the recipients, to request rectification, erasure or destruction and notification of these to recipients, to object to an adverse outcome resulting from automated analysis, and to claim compensation for damage caused by unlawful processing. Visitors covered by the GDPR also have the right to restriction of processing, data portability, to object to processing based on legitimate interest and to withdraw consent at any time.

8. How to make a request Send your request in writing to the address above, or contact us at +90 541 548 16 31 to obtain the written request channel. Please state your name, contact details and the subject of your request. Requests are answered free of charge within 30 days. If you are not satisfied, you may lodge a complaint with the Turkish Personal Data Protection Authority or, if you are in the EU, with the data protection authority of your country of residence.

9. Updates This notice may be updated; the current version is always published on this page.