PRIVACY NOTICE

Martı İleri Teknoloji A.Ş. (“Marti” or “the Company”) acts lawfully, fairly and in a transparent manner on processing, erasure, destruction, anonymization and transfer of personal data. Marti acts as the data controller towards natural persons whose personal data is processed (“Data Subject”).

This Privacy Notice is prepared and submitted in order to inform you that our Company, as data controller, can process your personal data within the scope of your use of the mobile application developed by Marti (“the Application”) as user (“User”).

Scope and Purpose of the Privacy Notice

This Privacy Notice clarifies legal grounds, methods and purposes of processing personal data, the personal data processed through the Application, the transfer of personal data, erasure, destruction, and anonymization of personal data and the rights of the Data Subject.

Credentials of Data Controller

The data controller is Martı İleri Teknoloji Anonim Şirketi registered in the Istanbul Trade Registry with the registration number 166213-5 and the Mersis number 0612137376300001, resident at Maslak Mah. Büyükdere Cad. Noramin İş Merkezi Sitesi No: 237 İç Kapı No:5 Sarıyer/İstanbul.

Your Personal Data Processed by Marti

Identity	Name-surname, date of birth, customer ID, gender, T.R. ID number/passport number, nationality, drivers licence registers no
Contact	Phone number, e-mail address
Finance Legal Process Marketing	IBAN number, Marti wallet balance, debt amount, invoice no, information regarding payments and payment methods Correspondence with judicial authorities, information in the case file Location-based campaign data, usage-based campaign data
Customer Transaction	Membership date, Customer ID, request/complaint information, Marti ride details, Marti usage details, call centre records
Transaction Security	IP address, device operating system and version, device type, device ID, hardware model, User transaction records, traffic data, Application usage information
Location	Location information
Audio Visual Recording	Photograph

Collection Methods of Personal Data

Your Personal Data mentioned above is collected electronically and / or via call centre channels by Marti through the Application and e-mail.

Legal Grounds and Purposes of Processing Personal Data

Marti processes your personal data based on the following purposes and legal grounds stated in Article 5 of the Personal Data Protection Law numbered 6698 (“PDPL”):

In order to provide services to you through our application, to create a membership record, to perform the contract between us and to ensure our Company's compliance with the legislation, Marti processes your name-surname, T.R. ID number / passport number, date of birth, gender, nationality, driver's license registration number, phone number, e-mail address, GPS data to be obtained during service, IP address, device operating system and version, device type, hardware model, user transaction records and traffic data, based on legal grounds that the processing of personal data is necessary for the establishment or performance of a contract signed between you and data controller, and it is clearly stipulated by the law;
In order to provide services to you through our application and to carry out pricing, payment and customer relations processes, Marti processes your name and surname, e-mail address, phone number, Application usage data, location information, device ID, complaint and suggestion records, IBAN number, Marti wallet balance and the information regarding your payment and payment methods that the processing of personal data is necessary for the establishment or performance of a contract signed between you and data controller;
To carry out invoicing processes, to follow up finance and/or accounting works, Marti processes your name-surname, T.R. Identity number, telephone number, IBAN number, debt amount, invoice number, payment and information on payment methods, based on the legal ground that it is mandatory for our Company to fulfil its legal obligation as a data controller;
For the purposes of managing, auditing and improving the Company's services and operations, conducting market research, conducting strategic planning processes, ensuring the security of our service, operation and application, detecting fraudulent or illegal activities, preventing and detecting fraud and campaign abuse Marti processes the correspondence with judicial authorities to carry out the internal operations, internal audit, internal control, legal, financial, reporting and the information in the case file, date of membership, customer ID, complaint and suggestion records, Martı usage details, call centre records, photographs based on the legal ground that data processing is mandatory for the legitimate interests of our Company, provided that your personal data does not harm your fundamental rights and freedoms, to the extent that the application usage information complies with the purpose of processing, proportionality and data minimization;
In order to report traffic accidents experienced during the use of the services and to take necessary actions, Marti processes your name, surname, e-mail address, phone number, location data and accident-related information based on the legal reason that data processing is mandatory for the legitimate interests of our Company, provided that your personal data does not harm your fundamental rights and freedoms, to the extent that the application usage information complies with the purpose of processing, proportionality and data minimization;
Although the services we offer can be used without their explicit consent, in terms of users who give their explicit consent based on their free will, Marti performs non-personalized marketing activities, Marti processes location-based campaign data and usage-based campaign data for creating individual campaigns for users, offering special opportunities by our business partners, determining the target audience, carrying out activities to increase the user experience, personalizing the application, direct and personalized marketing activities based on the legal ground that obtaining the explicit consent of the data subject.

Transfer of Your Personal Data, Legal Grounds of the Transfer and Third Persons to Whom Your Personal Data is Transferred

Marti transfers your personal data to the third parties located in Turkey in accordance with the purposes of this Privacy Policy pursuant to Article 8 of the PDPL.

Marti, transfers the above-mentioned personal data in order to provide information to authorized persons, or organizations, fulfil its legal obligations, conduct legal processes and conduct its activities in accordance with the legislation.

In addition, our Company transfers your personal data to its business partners and suppliers in order to provide the services it undertakes, to carry out the activities, to ensure the safety and satisfaction of the Users, and to control the quality of the services provided.

In case of your explicit consent, our Company will transfer your location-based campaign data, usage-based campaign data, customer ID, mobile phone number, gender, age, date of membership, and Martı usage details to its business partners in order to create individual campaigns, to offer special opportunities, to determine the target audience, to carry out activities to increase the user experience, to personalize the Application, to carry out direct and personalized marketing activities.

The personal data subject to domestic transfer mentioned above is transferred by taking all necessary security and technical measures by Marti and the third parties to whom the personal data is transferred.>Additionally, your personal data is protected within the scope of the data processing contracts conducted between Marti and third parties to whom the Company transfers personal data as the data controller.

Erasure, Destruction and Anonymization of Your Personal Data

Marti processes your personal data collected due to above mentioned purposes and means meticulously and confidentially as stipulated in PDPL. Your personal data will be processed as long as it is necessary for the fulfilment of legal obligations and the achievement the Company’s purpose of data processing activities. Afterwards, your personal data will be anonymized. Only the authorized people can access your personal data as required by the nature of the business.

When the retention period expires, your personal data will be destructed immediately in accordance with relevant provisions of PDPL and Turkish Criminal Law, The Regulation on Deletion, Removal and Anonymization of Personal Data and Company policies.

Your Rights as Data Subject

Within the scope of Article 11 of the PDPL, Data Subjects have the following rights:

a) to be informed whether your personal data is being processed,

b) to request information if your personal data is being processed,

c) to learn the purpose of processing of your personal data and whether it is being used for intended purposes,

d) to be informed of any third person residing within the country or overseas to whom your personal data is transferred,

e) to request the rectification of the incomplete or inaccurate data, if any,

f) to request erasure or destruction of your personal data pursuant to the conditions stipulated in Article 7 of the PDPL,

g) to request that the third persons to whom the data is transferred are informed of the transactions carried out as per paragraphs (e) and (f),

h) to object to an occurrence against you as a result of analysing and processing your personal data exclusively through automated systems,

i) to request compensation for the damage arising from the unlawful processing of his/her personal data.

How to Contact Us

If you have any questions, comments or requests regarding this Privacy Notice, please submit your application in accordance with the Communiqué on Application Procedures and Principles to the Data Controller dated 10.03.2018 and numbered 30356 to the address of "Maslak Mah. Büyükdere Cad. Noramin İş Merkezi Sitesi No: 237 İç Kapı No:5 Sarıyer/İstanbul" together with the documents showing your identity with your signature; or by using your registered e-mail (KEP) address, secure electronic signature, mobile signature or your e-mail address previously notified to Marti and registered in our system to destek@marti.tech. The requests included in your application will be concluded within 30 days at the latest, depending on the nature of the request. Our Company reserves the right to charge a fee based on the fee schedule (if any) determined by the Personal Data Protection Board.