Privacy Policy and Data Protection Notice

Who We Are and What This Notice Covers

The data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) is [Company Name], which trades as Zuzu Rent A Car (Address: [Address], MERSIS No: [MERSIS No]). This page serves both as our privacy policy and as the information notice we are required to give you under that law.

It applies to anyone who visits our website, creates an account or books without one, collects a car from any of our locations (Trabzon Airport, Trabzon City Centre (Meydan), Istanbul Airport, Sabiha Gökçen Airport, Istanbul City Centre (Kadıköy office) and Istanbul Bus Terminal), is registered as an additional driver, or contacts us by email, phone or any other channel. Any specific terms in your rental agreement apply alongside this notice.

• Data controller: [Company Name]
• Address: [Address]
• MERSIS No: [MERSIS No]
• Contact for data protection matters: [email protected]

The Personal Data We Process

We collect only what we need to provide the service and meet our legal obligations; the exact data depends on how you book and which extras you choose.

Identity and Contact Details

Your name, date of birth, Turkish ID number (or passport details if you are not a Turkish citizen), nationality, phone number, email address and billing address.

Driving Licence Details

Licence number, category, date of issue and validity. We use these to check that the driver meets the age and licence requirements for the chosen class: at least 21 years old with a licence held for at least one year for Economy, and at least 23 years old with a licence held for at least two years for all other classes. If you add a driver, we collect the same details for them.

Booking and Rental Details

Pick-up and return dates, times and locations, the car class you have chosen, any extras (additional driver, baby or child seat, sat nav, mini damage cover, tyre, glass and headlight cover, motorway toll (HGS) package), mileage and fuel level at pick-up and return, vehicle condition reports and any damage records.

Payment Transaction Details

Transaction records such as the amount, date, authorisation code and a masked portion of your card number. Your full card number, expiry date and security code are never stored on our website: payments are taken through a licensed payment institution using 3D Secure. The deposit pre-authorisation placed on your card is handled through that institution and your bank.

Vehicle Use and Location Data

If the car you rent is fitted with a tracking or telematics system, we may process its location, distance travelled and usage information to the extent set out in your rental agreement. It is used only to protect the vehicle, respond to theft or accidents and enforce the agreement.

Website Usage Data

IP address, browser and device information, pages visited and session records. Analytics and marketing cookies are only used if you have agreed to them.

How We Collect Your Data

Most of the data we hold comes directly from you. It is recorded electronically or on paper when you fill in a booking or registration form on our website, show your ID and driving licence at the desk, sign the rental agreement or get in touch with us by email or phone.

Some data arises from the service itself, such as the payment result returned by the payment institution, the condition reports completed at pick-up and return, toll and traffic fine notifications, and technical logs generated when you use our website. If someone else books on your behalf, we ask them to make you aware of this notice before passing your details to us.

Why We Use Your Data

We only process your data for specific, clear and legitimate purposes, and only as much as those purposes require. Our main purposes are:

• Creating, confirming, changing or cancelling your booking and keeping you updated about it.
• Drawing up the rental agreement, checking driver age and licence requirements, and handing the car over to the right person.
• Taking payment, managing the deposit pre-authorisation and refunding your card after a cancellation or where a refund is due.
• Calculating and collecting amounts arising under the agreement, such as excess mileage, missing fuel, damage excess, traffic fines and bridge or motorway tolls.
• Handling insurance matters and notifying the relevant authorities after damage, an accident or theft.
• Issuing invoices, meeting accounting and tax obligations, and responding to requests from competent authorities.
• Answering your customer service requests and dealing with complaints and suggestions.
• Keeping our website secure and working properly, and preventing misuse and fraud.
• With your consent, sending you offers and promotions and analysing how our site is used so we can improve it.

We will not use your data for anything else without telling you and, where required, obtaining your consent. We do not sell or rent your personal data to third parties for marketing.

Our Legal Bases for Processing

Every use of your data relies on one of the legal bases set out in the KVKK. Which one applies depends on the type of data and the purpose. In general terms, we rely on the following:

• Processing that is directly necessary to enter into or perform a contract with you, such as your booking, the rental agreement, payment and handing over the car.
• Processing required by law or needed to comply with our legal obligations, such as invoicing, accounting records and requests from the authorities.
• Processing needed to establish, exercise or defend a legal claim, such as relying on records in a dispute about damage, fines or unpaid amounts.
• Processing necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms, such as site security and fraud prevention.
• Your explicit consent, for activities that depend solely on it, such as analytics and marketing cookies and marketing messages.

Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out lawfully beforehand. Data that is essential for providing the rental does not depend on consent; if you choose not to provide it, we may not be able to complete your booking.

Who We Share Your Data With

We share your personal data only when it is needed for the purposes above and in line with the legislation in force. The recipients may include:

• The licensed payment institution and banks, to take payments, place and release the deposit pre-authorisation and process refunds.
• Insurance companies and loss adjusters, for damage, accident and theft claims under compulsory traffic insurance and comprehensive (kasko) cover.
• Public authorities, the police and the courts, to meet our legal obligations, deal with traffic fine notices and respond to official requests.
• Bridge and motorway operators and toll systems, where tolls need to be charged to the renter.
• Service providers working for us, such as hosting, email delivery, accounting, legal and technical support providers, who act on our behalf and on our instructions.

These parties may use your data only for the task we give them and must protect it appropriately. If a transfer abroad becomes necessary, for example because a service we use has servers outside Türkiye, it will only take place in accordance with the conditions for international transfers set out in the KVKK and related legislation.

How Long We Keep Your Data

We keep your personal data for as long as it is needed for the purpose it was collected for, and for the retention periods laid down in the relevant legislation. Rental agreements, invoices and accounting records, for example, are kept for the periods required by commercial and tax law, while records that may be needed to protect our rights in a dispute are kept with the applicable limitation periods in mind.

Account details are kept while your account is open; once it is closed, everything except records we must legally keep is deleted or anonymised. Data held for marketing on the basis of consent stops being used for that purpose once you withdraw consent. Once a retention period ends, the data is deleted, destroyed or anonymised during our regular reviews.

How We Protect Your Data

We take reasonable technical and organisational measures to prevent your data from being processed or accessed unlawfully and to protect it against loss. These measures are reviewed regularly in light of the nature of the data and the technology available.

• Traffic between your browser and our website is encrypted (SSL/TLS).
• Payments are taken through a licensed payment institution using 3D Secure, and card details are not stored on our website.
• Access to personal data is limited to staff who need it to do their job.
• Paper documents completed at our desks are stored where unauthorised people cannot reach them.
• Our service providers are also required to meet confidentiality and data security obligations.

No system is entirely risk-free. You can help by keeping your account password to yourself and signing out on shared devices. If you notice anything suspicious on your account, please let us know at [email protected].

Your Rights

Under the KVKK, you can contact the data controller to exercise the following rights in relation to your personal data:

• To find out whether we process your personal data and, if so, to request information about it.
• To find out why your data is processed and whether it is being used for that purpose.
• To know the third parties, in Türkiye or abroad, to whom your data has been transferred.
• To ask us to correct data that is incomplete or inaccurate.
• To ask us to delete or destroy your data once the reasons for processing it no longer apply.
• To ask us to tell third parties who received your data about any correction, deletion or destruction.
• To object to an outcome that goes against you where it results solely from automated analysis of your data.
• To claim compensation if you suffer loss because your data has been processed unlawfully.

How to Make a Request

You can send your request by email to [email protected] or in writing to [Address]. Please include your full name, contact details and a clear description of your request. We may ask for further information to verify your identity, so that your data is not disclosed to someone else.

We will deal with your request within the period set by the applicable legislation, depending on what you are asking for, and as a rule free of charge. If you are not satisfied with our response, you retain the right to complain to the Personal Data Protection Board in accordance with the procedure set out in the legislation.

Cookies

We use three categories of cookies on our site. Strictly necessary cookies support core functions such as the booking process, your session and security, and cannot be switched off. Analytics cookies help us understand how the site is used. Marketing cookies help us show content that is relevant to your interests.

Analytics and marketing cookies are only switched on if you agree to them. You can change your choice at any time on our Cookie Preferences page. Your choice is stored in your browser, so you may need to set it again if you use another device or browser, or clear your browser data.

Changes to This Notice and Contact

We may update this notice to reflect changes to our services, our processes or the legislation in force. The current version is always published on this page, and the date at the top shows when it was last updated. Where we make significant changes, we will also let our registered members know if we consider it appropriate.

If you have any questions about your personal data, this notice or privacy in general, please get in touch at [email protected]. Quoting your booking reference helps us respond faster.