Data Controller: AfiCar Araç Kiralama ve Turizm Sanayi Ticaret Limited Şirketi ("AfiCar" or the "Company")
Address: Oruçreis Mah. Vadi Cad. İstanbul Ticaret Sarayı No:108, İç Kapı No:615, Esenler / İstanbul, Türkiye
Tax Office / Tax No: Atışalanı / 0091860778 · Mersis: 0009186077800001 · İstanbul Trade Registry: 496383-5
Email: info@afinitem.com · Phone: +90 530 849 14 14
This Privacy Notice has been prepared by AfiCar, acting as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform. AfiCar is the car rental company of the Afinitem group. This notice covers the reservation requests, corporate rental quotation requests, contact and newsletter forms you submit through this website (aficar.net, the "Site"), as well as the rental processes carried out at the vehicle handover point.
1. Personal Data Processed
When you visit the Site, use its forms or rent a vehicle from us, the following personal data may be processed:
Identity and Contact Data: Name and surname, date of birth, phone number, email address; for corporate requests, company/organization name and contact person details.
Driver Data: The year your driving licence was issued; at vehicle handover, the details and copies of your ID card/passport and driving licence (these documents are collected at the handover point, not through the Site).
Reservation Data: Pick-up and return location, date and time, selected vehicle class and extras, flight number (optional), your request note.
Financial Data: Records of the security deposit (pre-authorisation) and payment transactions. No payment is taken through the Site and no card details are collected; card transactions are carried out at the handover point via a bank POS terminal, and your card number is not stored in AfiCar's systems.
Vehicle Usage Data: During the rental period, vehicle tracking system (GPS) location records, mileage and fuel level, HGS/OGS toll passage records, parking fee and traffic fine notifications, damage and accident reports.
Transaction Security Data: Hashed IP address, cookie consent records, timestamps.
Marketing Data (subject to consent): Newsletter subscription email address.
2. Purposes of Processing
Your personal data is processed to: (i) receive, evaluate and confirm reservation requests and conclude and perform the vehicle rental agreement; (ii) check driver requirements (age and licence seniority) and verify identity and driving licence documents; (iii) carry out vehicle handover and return procedures; (iv) re-invoice HGS/OGS toll charges, parking fees and traffic fines incurred during the rental period to the renter and make the required driver notifications; (v) manage insurance, damage and accident processes; (vi) prepare corporate rental quotations; (vii) fulfil legal obligations, including notifying renter and vehicle details to law enforcement through the Rental Vehicle Notification System (KABİS) under the Identity Notification Law No. 1774, and obligations under the Highway Traffic Law No. 2918 and tax and commercial legislation; (viii) ensure vehicle security and prevent theft and misuse; (ix) send newsletters where you have given explicit consent; (x) ensure information security; and (xi) determine the Site language (country detection from IP is performed with a local database on our servers; your IP address is never sent to third parties).
3. Legal Grounds
Under Article 5 of the KVKK, your data is processed on the following grounds: processing expressly provided for by law (Art. 5/2-a — Identity Notification Law, Highway Traffic Law, tax legislation); processing directly related to the establishment or performance of a contract (Art. 5/2-c — reservation and vehicle rental agreement); compliance with the controller's legal obligations (Art. 5/2-ç); processing necessary for the establishment, exercise or protection of a right (Art. 5/2-e — follow-up of damage, fines and receivables); the controller's legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f — vehicle security and tracking, information security); and explicit consent for newsletters and non-essential cookies (Art. 5/1).
4. Transfers
Your personal data may be transferred, only to the extent required by the purposes above, to: the payment institution iyzico Ödeme Hizmetleri A.Ş. when online payment is chosen (name, email, phone, ID number, billing address and transaction amount; card data is processed solely by iyzico); insurance companies and loss adjusters (insurance and damage processes); HGS/OGS toll operators and the relevant public authorities (bridge, motorway and tunnel charges); the General Directorate of Security and law enforcement units (KABİS renter notification, driver notification for traffic fines); banks (deposit pre-authorisation and payment transactions); authorised public institutions where legally required; courts, enforcement offices and lawyers in legal proceedings; and the hosting, email infrastructure and vehicle tracking system providers from which we receive services. Where a transfer abroad is required (e.g. foreign insurers, or Google Analytics if you have given consent), the conditions of Article 9 of the KVKK are observed.
5. Collection Method
Data is collected by partially automated means through Site forms, cookies and server records; physically at the handover point through the rental agreement, the handover/return report and document copies; and by automated or partially automated means during the rental period through the vehicle tracking system, HGS/OGS passage records and notifications received from the relevant authorities.
6. Retention Periods
The vehicle rental agreement, handover/return reports, invoices and payment records, together with the related ID and driving licence copies, are retained for 10 years from the end of the agreement under the Turkish Commercial Code No. 6102 and the Tax Procedure Law No. 213; damage, accident and traffic fine records for the limitation period of the related claim or dispute; unconfirmed or cancelled reservation requests and corporate quotation and contact form records for a maximum of 2 years after the request is concluded; vehicle tracking system location records for a maximum of 1 year after the end of the rental, unless a damage, fine or dispute is pending; cookie consent records for the statutory proof period; and newsletter subscriptions until you unsubscribe. At the end of these periods, data is deleted, destroyed or anonymised.
7. Vehicle Tracking System and Location Data
Our rental vehicles may be fitted with a vehicle tracking system (GPS). On the basis of legitimate interest under Art. 5/2-f of the KVKK, the system processes location data to ensure vehicle security, prevent theft and misuse, locate the vehicle in case of loss or accident, and monitor compliance with the rental conditions (ban on taking the vehicle abroad, mileage limits). Location data is not used to profile driver behaviour or for marketing purposes; it is retained only for the period stated above and is not shared with third parties except in cases of damage, theft, fines or legal disputes.
8. Your Rights under Article 11 of the KVKK
You have the right to learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used accordingly; know the third parties to whom it is transferred domestically or abroad; request correction of incomplete or inaccurate data; request deletion or destruction; request notification of these operations to third parties; object to results arising exclusively from automated analysis; and claim compensation for damages arising from unlawful processing.
9. How to Apply
To exercise your rights, you may fill in the Data Subject Request Form on the Site, email info@afinitem.com, or apply in writing to our address above together with documents verifying your identity. Applications are concluded free of charge within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.