-
Information On Protection Of Personel Data
As Garanti Finansal Kiralama A.Ş. (hereinafter "Company"), we respect and care about the security of your personal data and the privacy of your private life. We bring to your attention this clarification text prepared to inform you about the processing, transfer, storage and destruction of your personal data that you have shared with us during the service process offered to you by Garanti Finansal Kiralama A.Ş. and your rights regarding the use and protection of your personal data within the scope of the Personal Data Protection Law No. 6698 ("KVKK"/"Law").
As explained in this clarification text, your personal data and sensitive personal data may be recorded, archived, updated, transferred, classified and processed in the ways listed in the KVKK and the relevant legislation within the scope of the relevant legislation.
I-) DATA CONTROLLER
This clarification is made by Garanti Finansal Kiralama A.Ş. as the data controller in accordance with the provisions of KVKK numbered 6698, Banking Law numbered 5411, Financial Leasing, Factoring, Financing and Savings Finance Companies Law numbered 6361 and other legislation. Within the scope of the Law, "Data Processing" refers to all kinds of operations performed on personal data, such as obtaining, recording, storing, retaining, updating, classifying, sharing with or transferring to third parties permitted by the legislation, in whole or in part, by automatic or non-automatic means provided that it is part of any data recording system.
As the data controller, we keep all kinds of personal data shared by you by acting in accordance with the relevant legislation and by taking all necessary technical and administrative measures to ensure the appropriate level of security for your personal data.
II-) PERSONAL DATA COLLECTED BY US
Within the scope of the relationship we will establish depending on the nature of the products and services you will receive from our Company, personal data, which differ depending on the type, nature, history, method of obtaining the data and the following purposes of the relationship between the Company and the person concerned, and which are processed in accordance with the principles in the Law and our Company's Personal Data Processing and Protection Policies, are generally as follows, including but not limited to:
-ID Information: Name, surname, Turkish ID number, passport number, place of birth, date of birth, gender, marital status, spouse/children information, citizenship status, nationality information registry information
-Visual records: Photograph
-Contact Information: Contact information such as address, e-mail, registered e-mail address, mobile phone, landline phone and fax number, as well as communication records within the scope of telephone calls, video calls and e-mail correspondence, other audio and video data,
-Transaction Security Data: Customer information, IP addresses, passwords and passcodes required for access to electronic channels, location information processed for purposes such as security applications used in these channels and fulfillment of legal obligations, and biometric data processed based on the consent of the persons concerned,
-Marketing Data: Data obtained through shopping history information, surveys, cookie records, campaigns in line with the consent of our customers, prospective customers and other real persons who may be relevant,
-Data on Commercial Life: Various demographic information that identifies the data subject, such as information on real persons in documents for legal entities such as tax certificate, trade gazette, authorization certificate, trade registry documents, qualification documents, signature circular and activity certificate, information on the taxpayer status of the person,
-Banking and Finance Data: Pricing, reconciliation, customer information, uniform numbers for the products and services received by the customer from the Company, credit reference numbers, credit card numbers, account numbers, IBAN, detailed and all kinds of financial data regarding collection and payment activities,
-Information on Education, Work and Professional Life: Occupation, title, employment information, educational background, curriculum vitae information,
-Legal Information: Data such as information in correspondence with judicial authorities, information in the case file, information kept within the scope of alternative dispute resolutions, data in all kinds of administrative and judicial authorities notified to our Company,
-Camera and Entry-Exit Records: Data such as entry and exit records and camera footage of employees and visits in order to ensure physical security in the premises of our Company and our parent/subsidiaries,
III-) PERSONAL DATA COLLECTION METHOD
Your personal data is obtained during the services provided by Garanti Finansal Kiralama A.Ş. and personal data may be obtained during face-to-face meetings, as well as through the call center, website, e-mail, social media channels. Your personal data may be collected verbally, in writing or electronically through channels such as Head Office, Branches, Call Center, Mobile and Internet Branch, as well as through system integrations (such as Identity Sharing System) shared through public institutions and organizations.
Your personal data may be obtained by the following methods:
They can be obtained non-automatically through face-to-face service channels (headquarters and branches, direct sales teams and support service/foreign service organizations, companies whose activities we carry out as agencies).
They can be obtained non-automatically from the Risk Center of the Banks Association of Turkey or companies established by at least five banks or financial institutions (Credit Bureau etc.).
IV-) PURPOSES AND LEGAL REASONS FOR PROCESSING PERSONAL DATA
Your personal data obtained by Garanti Finansal Kiralama A.Ş. is processed primarily for the following purposes and legal reasons, primarily to provide you with safe, effective and quality service:
|
Processing Purposes |
Legal Reasons: |
|---|---|
|
Recording the identity, address and other necessary information in order to recognize the customer, to carry out identification and confirmation procedures, and to identify the information of our customers in the transactions they will carry out, |
Being mandatory for the company to fulfill its legal obligations Explicitly stipulated in the law Data processing being mandatory for the establishment, exercise or protection of a right In case of explicit consent |
|
Providing insurance and financial products, especially foreign trade, credit provision, insurance services, and carrying out, executing, developing, and carrying out operational processes related to these transactions, complying with internal systems, risk monitoring and disclosure obligations, fulfilling the requirements of the contract(s) you have signed with our company |
Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Fulfillment of obligations arising from the Banking Law, Financial Leasing, Factoring, Financing and Savings Finance Companies Law No. 6361, Law on Prevention of Laundering Proceeds of Crime and other legislation, |
Explicitly stipulated in the law Being mandatory for the company to fulfill its legal obligations |
|
Analyzing and developing company systems and conducting information security processes, establishing, managing and implementing information systems infrastructures, |
Being mandatory for the company to fulfill its legal obligations Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Designing the company's business processes and activities, planning and execution of operational processes and procurement operations, |
Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Management of relationships with support service providers, business partners or suppliers, execution of support services after the sale of services, |
Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Developing the Company's reputation and business relations, determining strategies, planning and execution of business activities and operational processes, realization of corporate communication activities, |
Being mandatory for the company to fulfill its legal obligations Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Execution of lawsuits and execution proceedings to which the Company is a party and follow-up and execution of other legal processes; |
Being mandatory for the company to fulfill its legal obligations, Explicitly stipulated in the law |
|
Execution of the Company's business and management of relations with its main shareholder and its branches, subsidiaries and affiliates; |
Being mandatory for the company to fulfill its legal obligations, Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract |
|
Establishing transaction security, protecting customers, the company and the financial system against fraud, forgery and attacks that our customers may be exposed to in any physical or electronic environment, keeping logs in case of using Internet access |
Being mandatory for the company to fulfill its legal obligations Data processing being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Storing, reporting and informing judicial and administrative institutions such as BRSA, CBRT, MASAK, RA, CMB and TBB Risk Center, which are obliged to provide information |
Being mandatory for the company to fulfill its legal obligations Explicitly stipulated in the law |
|
Offering all our products and services, including credit and insurance services, which we intermediate or offer as an agent within the scope of the Banking Law, the Financial Leasing, Factoring, Financing and Savings Finance Companies Law No. 6361 and all applicable legislation, through all channels, including electronic channels, |
Being mandatory for the company to fulfill its legal obligations Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract Explicitly stipulated in the law |
|
Organizing all necessary records and documents, including the processing of location information, in order to complete transactions on paper and verbal media and electronic (internet, mobile and telephone) media, |
Being mandatory for the company to fulfill its legal obligations Provided that it is directly related to the conclusion or performance of a contract, the necessity of processing personal data belonging to the parties to the contract |
|
Planning and implementing product, service and offer activities specific to our customers, making product, service and working model offers, profiling and segmentation for the purposes of improving and updating the products and services offered and renewing them with the developing technology, |
In case of explicit consent Data processing being mandatory for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Recording camera footage and photographs in the company's headquarters building, additional service units and branches, in order to ensure legal and physical security, to provide a basis for the transaction carried out within the scope of the service provided by security and within the scope of the obligations arising from the law, processing of your biometric photograph in your Turkish ID cards for security and identification purposes, |
Explicitly stipulated in the law being mandatory for the company to fulfill its legal obligations Data processing being mandatory for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject |
|
Planning, supervising and implementing our corporate sustainability, corporate governance, strategic planning and information security processes,
|
Explicitly stipulated in the law being mandatory for the company to fulfill its legal obligations Data processing being mandatory for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject |
Your personal data obtained by Garanti Finansal Kiralama A.Ş. is processed primarily for the following purposes and legal reasons, primarily to provide you with safe, effective and quality service:
Your personal data is obtained in all kinds of verbal, written, visual and electronic media for the abovementioned purposes and in order to provide the financial service offered within the legal framework determined and to enable Garanti Finansal Kiralama A.Ş. to fully and duly fulfill its contractual and legal obligations in this context. The legal reason for the collection of your personal data is the provisions of KVKK and other legal legislation. Garanti Finansal Kiralama A.Ş. processes your personal data by automatic and non-automatic methods in case of your explicit consent pursuant to Article 5/1 of the KVKK or based on legal grounds pursuant to Article 5/2 of the KVKK.
Pursuant to Article 6/1 of the KVKK, sensitive personal data may be processed in case of explicit consent. Garanti Finansal Kiralama A.Ş. may process your sensitive personal data by obtaining your explicit consent. Pursuant to Article 6/3 of the KVKK, personal data relating to health and sexual life may be processed by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the data subject. In this context, pursuant to Article 6/3 of the KVKK, personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law. Garanti Finansal Kiralama A.Ş. may process your personal data other than health and sexual life in cases stipulated by law.
In addition, pursuant to Article 6/3 of the KVKK, your personal health and sexual life data may be processed for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
V-) TRANSFER OF PERSONAL DATA
In cases required by the legislation and permitted by you, it is possible to share your personal data with third parties and institutions for the purposes set out in Article III of this Clarification Text by ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with KVKK and other relevant legislation. Although these persons and organizations may change depending on the amendments to be made in the relevant legislation, they are generally the following parties.
Your personal data is transferred to the following parties for the following purposes and legal reasons:
|
Transferred Persons/Organizations |
Purpose of Transfer |
|---|---|
|
Public institutions and organizations and judicial bodies authorized by law to receive information |
For legal reasons such as legal reporting, carrying out regulatory and audit activities, handling complaints and legal processes, etc. |
|
Domestic and foreign banks and financial institutions Persons, organizations, institutions deemed as financial institutions and other third parties permitted by the Banking Law and legislation, public legal entities such as BRSA, CBRT, MASAK, RA, CMB and TBB Risk Center for the legal reporting required to be made
|
In order to carry out banking activities and fulfill legal obligations |
|
Our main shareholder, |
Limited to the exceptional circumstances specified in the Banking Law No. 5411 |
|
Third parties that we act as an intermediary and agency, our subsidiaries (e.g. Eureko Sigorta A.Ş., Garanti Filo Yönetimi A.Ş.) and program partner organizations that we receive services from or cooperate with to carry out our activities, |
For the execution of activities with the parties from which support is received for the execution of services and our subsidiaries |
VI-) YOUR RIGHTS REGARDING THE PROTECTION OF PERSONAL DATA
By applying to our company any time, you may;
In case you use your rights to learn whether personal data is processed, to request information if your personal data has been processed, to access and request your personal data, to learn the purpose of processing personal data and whether they are used in accordance with their purpose, to know the third parties to whom your personal data is transferred domestically or abroad, the information you request will be notified to you in writing, electronically or through the contact information provided by you.
VII-) DATA SECURITY AND RIGHT OF APPLICATION
Your personal data is meticulously protected within the technical and administrative possibilities and the necessary security measures are provided at a level suitable for possible risks, taking into account the technological possibilities.
You may communicate your requests under KVKK;
If your application for these purposes requires an additional cost, you may be required to pay the fee amount in the tariff to be determined by the Personal Data Protection Board. Your requests in your application will be finalized as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request.
You can submit your applications in writing to our branches to benefit from your rights under the Law, and for detailed information, you can visit the website of the Personal Data Protection Authority.
We wish you a good day.
