TOFAŞ TÜRK OTOMOBİL FABRİKASI ANONİM ŞİRKETİ INFORMATION NOTICE ON THE PROCESSING OF CUSTOMERS’ PERSONAL DATA

Pursuant to the Law on the Protection of Personal Data No. 6698 (“Law”), your personal data may be processed by TOFAŞ Türk Otomobil Fabrikası Anonim Şirketi (“Company”) as the data controller, within the scope described below.

You can access detailed information regarding the purposes for which your personal data are processed by our Company in the TOFAŞ Türk Otomobil Fabrikası A.Ş. Personal Data Protection and Processing Policy available at:
www.tofas.com.tr/KisiselVerilerinKorunmasi/Documents/Tofas_KVK_Islenmesi_Politikasi_Koc_V4.pdf

Purposes and Legal Grounds for Processing Personal Data

Your personal data collected may be processed for the purposes (“Purposes”) and on the legal grounds stated below, within the personal data processing conditions and purposes set forth in Articles 5 and 6 of the Law.

Based on the legal ground that processing personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract, and that it is mandatory for the data controller to fulfill its legal obligations:

·       Updating customer contact information,

·       Creating sales records in the system and carrying out invoicing activities related to sales,

·       Providing after-sales support services.

Based on the legal ground that processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject:

·       Managing customer relations,

·       Monitoring financial transactions,

·       Event management,

·       Ensuring that our business units carry out the necessary work to enable individuals to benefit from our products and services, including sales and marketing activities, and to execute related business processes,

·       Conducting necessary operations by our business units for the execution of our Company’s commercial activities and the related business processes,

·       Ensuring the legal, technical, and commercial/operational security of our Company and of individuals in a business relationship with our Company,

·       Determining and implementing our Company’s commercial and business strategies,

·       Conducting video calls with our Customer Contact Center consultants upon your request and recording these calls.

Based on the legal ground that processing is mandatory for the establishment, exercise, or protection of a right:

·       Receiving, evaluating, and resolving your requests and complaints.

Based on the legal ground that processing is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance:

·       Processing your health data through disability data obtained in order to ensure that calls conducted with our Customer Contact Center consultants are carried out in a personalized manner, if applicable.

Based on your explicit consent:

·       Processing your identity, contact, and marketing data for the purpose of carrying out marketing activities for our Company’s products and services, including profiling and analysis, and personalizing and promoting our products and services according to your preferences, usage habits, and needs,

·       Processing your identity and contact data and sending commercial electronic messages (advertisements, promotions, etc.) through your preferred communication channel as part of your communication consent.

Transfer of Processed Personal Data

Your collected personal data may be transferred, within the scope of the above-mentioned Purposes:
to our suppliers within our legitimate interests; to our financial advisors and legally authorized public institutions and private entities when explicitly required by laws and for fulfilling legal obligations related to financial processes; to our business partners and suppliers whose servers are located abroad, based on the standard contractual clauses published by the Personal Data Protection Authority; to service providers engaged in communication and promotional activities based on your explicit consent; and in accordance with the rules on the transfer of personal data set out in Articles 8 and 9 of the Law.

Method of Collecting Personal Data

Your personal data are collected by our Company electronically through our websites, completion of online membership/contact/application forms, call center, mobile applications, SMS, e-mail, and physically during interactions with our Company or via printed forms, within the scope of the Purposes described above.

Rights of the Data Subject Under Article 11 of the Law

Pursuant to Article 11 of the Law, you are entitled to the following rights regarding your personal data:

·       To learn whether your personal data are processed,

·       To request information if your personal data have been processed,

·       To learn the purpose of processing and whether your personal data are used in accordance with that purpose,

·       To know the third parties to whom your personal data are transferred, domestically or abroad,

·       To request the correction of incomplete or inaccurate data and notification of such correction to third parties to whom your data have been transferred,

·       To request the deletion or destruction of your personal data if the reasons for processing no longer exist, and notification of such deletion to third parties to whom your data have been transferred,

·       To object to any result against you arising from the analysis of your data exclusively by automated systems,

·       To request compensation for damages incurred due to unlawful processing of your personal data.

If you submit your requests regarding the above-mentioned rights to our Company by filling out the Data Subject Application Form, which can be accessed at www.tofas.com.tr/KisiselVerilerinKorunmasi/Pages/default.aspx, our Company will finalize your request as soon as possible and at the latest within thirty (30) days free of charge, depending on the nature of the request. However, if the process requires additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.