GARENTA ULAŞIM ÇÖZÜMLERİ A.Ş.
PRIVACY NOTICE ON PROTECTION AND PROCESSING OF BIOMETRIC SIGNATURE DATA
1) DATA CONTROLLER
Pursuant to the Law No. 6698 on the Protection of Personal Data (“Law”), your biometric signature data will be processed by Garenta Ulaşım Çözümleri Anonim Şirketi as the data controller and the Renter, party to the General Terms and Conditions of this Motorised Land Transport Vehicle Rental Contract, whose trade name is specified at the beginning of the contract (“Company”), within the scope described below.
This Privacy Notice has been prepared in order to inform the customers who wish to use a digital biometric signature (“Digital Signature”) to replace and be equally binding as a wet signature in the transactions to be carried out with ??DealerName?? about the data processing activities carried out by ??DealerName?? as ‘data controller’ within the scope of Digital Signature application and the rights of the customers.
Digital Signature is a paperless application in which behavioral biometric data such as writing speed, surface pressure, writing coordinate and pen grip angle that occur while signing together with the signature image are digitized in accordance with ISO 19794-7 standards and stored encrypted in the signed document in order to sign documents securely in digital environment, which is more difficult to forge and more secure than wet signature.
Within the scope of the application, by using devices such as signature tablets, signature pens, etc., signatures on documents and personal data in handwriting can be digitized, stored and processed. The digital keys used for encryption and decryption of the digitized digital data of the signature are kept in databases to which ??DealerName?? has restricted access and security protocol is defined.
Your biometric signature data may be processed for limited purposes and in the cases specified in this privacy notice in the presence of your explicit consent and in compliance with Article 4 of the Law. Biometric data, which are considered among the special categories of personal data within the scope of the Law, are data that may cause risks that may cause deprivation of rights or transaction security gaps in case of access by unauthorized persons and are inherently closely linked to the data subject. Again, for this reason, in limited cases where biometric data is processed, it becomes quite easy to distinguish people from each other, and therefore, the possibility of confusing the data subjects with each other and the possibility (and related risks) of making transactions based on the consent given by unauthorized persons are highly eliminated. However, it is possible to obtain important behavioral findings about you by unauthorized access to and analysis of such biometric data, and for this reason, it is of utmost sensitivity for our Company to prevent unauthorized access to your biometric signature data and to carry out a limited processing activity for the following purposes, as stated in the Guideline on the Considerations for the Processing of Biometric Data, published by the Personal Data Protection Authority.
In the processing processes involving your biometric signature data, our Company takes organizational and technical measures in parallel with the nature of biometric data determined in the Law and other regulations in order to prevent the above-mentioned risks from arising in your data and processes your personal data in a limited manner for the purposes listed below in accordance with the legislation.
2) PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Your collected personal data may be processed for the purposes set out below (“Purposes”) within the personal data processing conditions and purposes specified in Article 6 of the Law.
Based on your explicit consent;
· Your biometric data, limited to your biometric signature data, for the purpose of obtaining and recording your signature for the establishment of the contract between you and our Company or for the filling of another relevant document (form, etc.) and for the purpose of using it as a binding record.
In the event that you do not give your explicit consent to the processing of your biometric signature data due to the risks related to the processing of biometric data listed in this privacy notice, the necessary approvals can be given by you by using a wet signature. We would like to emphasize that explicit consent is not mandatory, and you can make any choice you wish with your free will and decide whether or not to use a biometric signature in this direction.
3) RECIPIENT PARTIES AND PURPOSES FOR TRANSFERRING PERSONAL DATA
Within the scope of fulfilment of the Purposes, your collected personal data may be transferred to our supplier that provides the technological infrastructure in the biometric signature product based on your explicit consent.
4) METHOD FOR THE COLLECTION OF PERSONAL DATA
Your biometric signature data is collected by the Company through electronic tablets.
5) DATA SUBJECT’S RIGHTS SPECIFIED UNDER ARTICLE 11 OF THE LAW
We hereby declare that as personal data subjects, you are entitled to the following rights, set forth under Article 11 of the Law:
· To learn whether your personal data are being processed,
· To request information if your personal data have been processed,
· To learn the purpose of the processing of your personal data and whether they have been used accordingly,
· To learn which third parties domestic or abroad your personal data has been transferred to,
· To request rectification in case your personal data has been processed incompletely or inaccurately and to demand the operations in this regard be reported to third parties your personal data has been transferred to,
· To demand the erasure or destruction of your personal data in the event that the reasons for the processing no longer exist even though it was processed in accordance with the Law and other relevant provisions and to demand the operations in this regard be reported to third parties your personal data has been transferred to,
· To object to negative consequences to you that are concluded, as a result of analysis of the processed personal data through solely automatic systems,
· To demand compensation for the damages that you have suffered as a result of an unlawful processing of your personal data.
You can submit your applications for your rights listed above to the Company by filling out the Garenta Ulaşım Çözümleri Anonim Şirketi Data Subject Application Form available at https://images.garenta.com.tr/Garenta-Veri-Sahibi-Basvuru-Formu.pdf. Depending on the nature of your request, your applications will be finalized free of charge as soon as possible and within thirty days at the latest; however, if the transaction requires an additional cost, you may be charged a fee according to the tariff to be determined by the Personal Data Protection Board.