KVKK Disclosure Notice

1. Data controller

The data controller in respect of your personal data is:

Lena Mama Yayıncılık Ticaret A.Ş.

The company operates the lenacars.com digital platform under the LenaCars brand.

Registered address: Nişantepe Mah. Nadide Sk. Doğa Ata Konakları Tip A 13. Villa No: 3 M İç Kapı No: 1 Çekmeköy/İstanbul

Phone: 0850 532 79 29

Email: info@lenacars.com

This Disclosure Notice covers the processing of personal data obtained via lenacars.com, LenaCars communication channels and related service processes.

Detailed information on processing activities carried out through cookies and similar technologies is set out in the Cookie Policy.

2. How personal data is collected

Your personal data may be obtained through:

• the website and digital forms
• membership, quote, reservation and payment processes
• phone, email, WhatsApp and customer support communications
• cookies, device information and transaction security records
• the travel agency and related service providers

by fully or partly automated means, or by non-automated means provided that they form part of a data recording system.

Where personal data is not obtained directly from you, the obligation to inform is fulfilled within a reasonable time after the data is obtained, at the time of first communication with you, or, where the data will be transferred to another party, at the latest at the time of the first transfer.

3. Categories of personal data processed

Depending on the nature of the service offered or requested, the following personal data may be processed:

• Identity data: name and surname; where required for the service, date of birth, nationality, Turkish ID number, passport or driving licence details
• Contact data: phone number, email address and address details
• Customer transaction data: request, quote, reservation, contract, rental, delivery, return and customer support records
• Finance and billing data: invoice details and payment, collection and refund transaction records
• Transaction security data: IP address, session, device, access and security records
• Location data: location, delivery, movement and arrival details where preferred by the user or required to perform the service
• Communication preferences: commercial electronic communication and marketing preferences and related consent records

4. Processing purposes and legal bases

Your personal data may be processed for the following purposes and on the legal bases set out in the KVKK:

• Running request, quote, reservation, rental and service processes; where necessary for the establishment or performance of a contract
• Running customer communication, support and operations processes; establishment or performance of a contract and the Company’s legitimate interest
• Running billing, accounting, tax and legal record processes; fulfilment of the Company’s legal obligations
• Running payment, collection and refund processes; establishment or performance of a contract and fulfilment of legal obligations
• Ensuring information security and preventing fraud, misuse and unauthorised transactions; the Company’s legitimate interest and legal obligations
• Managing complaints, disputes and legal claims; establishment, exercise or protection of a right
• Responding to requests of competent public authorities; fulfilment of legal obligations
• Carrying out marketing activities; explicit consent obtained separately where required under the KVKK
• Sending commercial electronic communications; communication consent given separately and voluntarily under commercial electronic communication legislation

Where processing is based on legitimate interest, it is carried out without harming the fundamental rights and freedoms of data subjects.

5. Transfers of personal data

Your personal data may be transferred to the following recipient groups only to the extent necessary to carry out the relevant transaction and service:

• Vehicle rental service providers, for suitability checks, preparing quotes, reservations and performing the rental service
• The travel agency, for assessing, quoting and organising transfer, chauffeur, yacht/boat, private jet and helicopter requests
• Transfer, transport, sea and air mobility service providers, for planning and performing the service
• Payment service providers, for running payment, collection, verification and refund processes
• CRM, communication, customer support, hosting and technical infrastructure providers, for operating the platform, managing requests and running customer communication
• Accounting, legal and audit service providers, for fulfilling legal and financial obligations and protecting rights
• Competent public authorities, for fulfilling statutory obligations and responding to requests of competent authorities

Transfers are carried out in a purpose-limited and proportionate manner, with the necessary technical and organisational security measures in place.

6. Transfers of personal data abroad

Where personal data may be transferred to hosting, communication or technical infrastructure service providers located abroad, the transfer is carried out if one of the conditions under Article 9 of the KVKK is met and the necessary technical and organisational measures are taken.

Where appropriate safeguards are used, related contractual and notification obligations are fulfilled in accordance with the applicable legislation.

7. Data subject rights

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed
• request information if it has been processed
• learn the purpose of processing and whether it is used in line with that purpose
• know the third parties to whom it is transferred domestically or abroad
• request correction of incomplete or inaccurate data
• request deletion or destruction of personal data when the conditions are met
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred
• object to a result against you arising solely from analysis of personal data by automated systems
• claim compensation for damage if you suffer harm due to unlawful processing of personal data

8. How to apply

You may submit your requests under the KVKK:

• in writing to Nişantepe Mah. Nadide Sk. Doğa Ata Konakları Tip A 13. Villa No: 3 M İç Kapı No: 1 Çekmeköy/İstanbul
• to info@lenacars.com from an email address previously notified to the Company and recorded in the Company’s systems
• using other application methods provided for in the applicable legislation

Your application must include:

9. Commercial electronic communications

Campaign, promotional and marketing commercial electronic communications are sent only based on communication consent you give separately and voluntarily.

Commercial electronic communication consent is not a precondition for using LenaCars services. You may withdraw your communication consent at any time.