Privacy Notice Regarding Information and Communication Processes

Privacy Notice

In accordance with the General Data Protection Regulation ("GDPR"), you will find below the privacy notice regarding the information and communication processes of Temsa.

In accordance with the Personal Data Protection Law no.6698 ("KVKK"), you will find the privacy notice of Temsa in this link www.temsa.com

This document is intended for you if you are one of our customers, potential customers and/or their representatives.

These persons are hereinafter referred to as "Data Subjects".

This Privacy Notice is subject to change, so please consult it regularly.

1. Data controller

The person responsible for processing your data is:

Temsa Skoda Sabancı Ulaşım Araçları A.Ş

Sarıhamzalı Mahallesi Turhan Cemal Beriker Blv. No: 563 /1 Seyhan/Adana/Türkiye

In its capacity as data controller, Temsa is your contact for any questions relating to this Privacy Notice and the data processing described herein.

You can contact us by e-mail at kvk@temsa.com

2. Personal data collected and processed

We may collect different data about you for different purposes. Please refer to the section(s) relevant to your situation below.

Within the scope of information and communication processes

Your identity information, contact information, work / company information, vehicle information, customer transaction information and/or system security information are processed for the following purposes.

• Meeting, responding, evaluating and reporting all kinds of requests, complaints, questions, demands and opinions regarding Temsa and our products and services,
• Sending information and explanations regarding our Company and our products and services to the contact addresses provided by you upon your request and conducting communication activities with you in this context,
• Execution of goods and services sales and after-sales service processes,
• Execution of authorized dealer and authorized service processes,
• Planning product and service development activities and conducting quality, efficiency, analysis and improvement studies for our products and services,
• Conducting assessment, analysis and risk management activities within legal limits and ensuring business continuity,
• Improving and developing the services offered by our Company, determining and implementing commercial and business strategies,
• Ensuring the legal and commercial security of the products and services offered by our Company and the persons who have a business relationship with our Company and our Company,
• Planning and follow-up of business with business partners, dealers or suppliers,
• Carrying out the storage activities of personal data collected for the above-mentioned activities within the scope of the execution of these processes,
• Carrying out information security processes in the environments where personal data collected within the scope of the above-mentioned activities are stored,
• Carrying out all the above-mentioned activities in accordance with the applicable legislation,
• Providing information to legally authorized institutions and organizations, following up legal affairs and exercising our right to defense when necessary.

Your above-mentioned personal data obtained within the scope of information and communication processes are processed and transferred to the above-mentioned persons and organizations based on the legal grounds of “establishment and performance of the contract”, “expressly stipulated by law”, “fulfillment of our legal obligations” and “existence of our legitimate interest”.

Within the scope of marketing activities

Your identity information, contact information, work/company information, vehicle information, financial information, marketing information, customer transaction information and/or system security information are processed for the following purposes.

• Sending commercial electronic messages through the communication channels you have authorized,
• Planning and execution of discounts, campaigns, advertisements, promotions and other marketing advantages, conducting market research and analysis activities within the scope of marketing activities carried out by our Company,
• Planning and organizing activities and loyalty programs to ensure and/or increase customer loyalty to products and services in order to ensure customer satisfaction,
• Conducting surveys within the scope of marketing activities,
• Control and analysis of customer data in order to plan and monitor employee performance evaluation processes and/or business activities,
• Personalization of products and services according to customers' tastes, interests, usage habits and needs, and conducting segmentation/profiling studies,
• Planning and organizing events, fairs and organizations for customers.
• Carrying out data retention activities within the scope of the execution of the processes related to the activities specified above,
• Conducting information security processes in the environments where the personal data collected within the scope of the aforementioned activities are stored,
• Ensuring that all of the above-mentioned activities are carried out in compliance with the applicable legislation in force,
• Providing information to legally authorized institutions and organizations, following up on legal affairs, and exercising our right of defence where necessary.

3. Methods of Obtaining Your Personal Data

The personal data specified above are collected (i) when submitted by you verbally and/or in writing, in physical and/or electronic form, (ii) through the completion of forms available on our Company’s website and/or through the use of the Connect Digital Assistance platform, (iii) through our authorized dealers and authorized service providers via physical and/or digital environments (e.g., CRM systems), (iv) through our Company’s social media accounts and/or by completing forms available on search engines and social media platforms, (v) through communications conducted with our Company by phone, call center interactions, SMS, e-mail and other communication channels, and/or when provided by you personally during such interactions, and (vi) during events organized or attended by our Company.

4. Data retention period

TEMSA keeps the personal data mentioned above for as long as they are necessary for at least one of the purposes listed.

In the majority of cases, this corresponds to the period during which TEMSA is obliged to retain this data under a legal retention obligation, such as the 10-year legal accounting obligation, or the period during which the data concerned may be necessary for TEMSA to protect itself in the event of litigation or dispute.

The table below gives details of the maximum retention periods that may apply to different types of data.

5. Data access

In view of the purpose of each processing operation, TEMSA takes all necessary steps to ensure that personal data is only accessible by its internal departments that need to know it, third party recipients designated by law or subcontractors required to carry out the processing operations.

Access to data by TEMSA employees and TEMSA affiliates

TEMSA employees may access and process your data within the scope and limits of their respective duties.

The personal data specified above may be shared with the affiliates of Temsa Skoda Sabancı Ulaşım Araçları A.Ş. for the purposes of conducting information and communication processes and marketing activities, where such activities are carried out jointly with or require the participation of these entities.

Access to data by external service providers

We also use external service providers for the purposes listed below. These service providers are likely to consult and/or store some of the personal data mentioned above, to the extent necessary for their mission.

TEMSA may communicate your personal data to organisations in accordance with the law.

TEMSA uses sub-contractors selected by it to carry out all or some of the processing operations indicated at. Exceptionally, TEMSA may use service providers located outside the European Union. Where applicable, TEMSA ensures that the transfer of data outside the European Union benefits from the protection guarantees provided by the GDPR.

For the avoidance of doubt, while the personal data covered under this Privacy Notice may be transferred to any of the parties listed below, such transfers are strictly limited to those parties that are relevant and necessary for the specific information, communication and/or marketing process carried out with the data subject.

Your personal data, obtained within the scope of information and communication processes, are processed and transferred to the persons and organizations indicated above on the legal grounds of “performance of a contract”, “expressly stipulated by law”, “fulfillment of our legal obligations”, and the “existence of our legitimate interests”.

Your personal data, obtained within the scope of information and communication processes and marketing activities, are transferred to our suppliers for the purposes of carrying out storage activities and obtaining technical infrastructure services performed within the framework of these processes, on the legal grounds of the “existence of our legitimate interests”, and are stored within the systems of these companies.

Your personal data are processed and transferred to the persons and organizations indicated above on the legal grounds of your “explicit consent”, for the purposes of conducting marketing activities and sending commercial electronic messages in accordance with your communication preferences.

Your aforementioned personal data may be transferred to legally authorized private persons and organizations, including relevant ministries, courts, enforcement offices, and legally authorized public institutions for the purposes of carrying out the activities in accordance with the applicable legislation, informing legally authorized institutions and organizations, and following up legal affairs and exercising our right of defense when necessary. Your personal data processed for the purposes of carrying out the above-mentioned activities in accordance with the applicable legislation, providing information to legally authorized institutions and organizations and following up legal affairs and exercising our right of defense when necessary are processed and transferred to the above-mentioned persons and organizations based on the legal grounds of “expressly stipulated by law”, “fulfillment of our legal obligations” and “establishment, use or protection of a right”.

Your personal data mentioned above are transferred to and stored by our suppliers, service providers outside of European Union for the purposes of carrying out storage activities and obtaining technical infrastructure services, based on the Standard Contractual Clauses (SCCs) approved by the European Commission, which provide appropriate safeguards for the protection of personal data.

6. Safety measures implemented by TEMSA

TEMSA implements all organisational and technical measures to ensure an appropriate level of security for your personal data, and in particular to prevent any loss of confidentiality, integrity or accessibility of your data.

7. Rights of the person concerned

You have the following rights in relation to the processing of your personal data, which you may exercise by contacting TEMSA.

A right of access

You have the right to ask us for a copy of the personal data we hold about you in a readable and comprehensible format, as well as a copy of this Privacy Notice on a durable medium.

A right of rectification

You have the right to obtain rectification of the data concerning you, to correct it, to complete it or to update it, should it appear to you to be inaccurate, incomplete or obsolete.

If this is the case, we would be grateful if you could provide us, as far as possible, with the new information we need to make the requested corrections, additions or updates.

If you exercise this right, we undertake to communicate any corrections to all recipients of your data as far as possible.

A right to erasure

You may request the deletion of all or part of the data we hold about you if at least one of the following conditions is met:

• You have withdrawn your consent to the processing (in the case of the newsletter), and would also like TEMSA to proceed with the destruction of the data concerned.
• You have objected to the continuation of this processing in accordance with the above, and also wish TEMSA to proceed with the destruction of the data concerned.
• The data concerned no longer appears necessary for any of the purposes set out above.
• You consider that TEMSA has collected and/or processed the data concerned in a manner contrary to the law.
• The deletion of the data concerned is required by law.
• The data concerned relates to a person who was under the age of fifteen (15) when the data was collected.

This right is not absolute and TEMSA is entitled to object to the deletion of certain data for legal or legitimate reasons, where their retention is necessary for particularly important reasons, such as the protection and defence of its interests in legal proceedings.

TEMSA may also choose, as an alternative to deleting data, to make it completely and irreversibly anonymous. In this way, we will be entitled to keep this data in a format that no longer allows you to be identified (for example, for statistical purposes).

A right to object to processing

You have the right to object at any time to the processing of your data for processing based on our legitimate interest, a mission of public interest.

In other words, you may ask TEMSA to cease any or all of these processing operations in relation to you, setting out the specific reasons which justify this request from your point of view.

However, this right is not absolute and TEMSA may for legal or legitimate reasons refuse your request to object, for example if the continued processing is necessary for compelling reasons (for example: if the data concerned is necessary for the protection and defence of TEMSA's rights in a court of law).

Objection (if it is based on valid reasons and there are no compelling reasons against it) will result in the cessation of processing for the future, but not necessarily in the destruction of the data concerned: to obtain this destruction you must exercise your right to erasure under the conditions described above.

The right to restrict processing

You have the right to obtain the limitation of the processing of your data, i.e. TEMSA will be able to keep this data separately, without using it any more (except legal obligations).

You can make such a request if at least one of the following conditions is met:

• The data concerned seems inaccurate to you, and you would like TEMSA to stop using it while you check it and rectify it if necessary.
• You have exercised your right to object as set out above, and you would like TEMSA to stop using the data concerned for the time needed to check that your objection is well-founded.
• You consider that TEMSA has collected and/or processed the data concerned in a manner contrary to the law, but nevertheless prefer that we retain the data rather than delete it.
• The data concerned is no longer required for any of the purposes set out above, but you wish TEMSA to retain it for the purposes of defending your interests in court.

In such cases, we will isolate the data subject to a request for restriction for the necessary period, for example by means of a "Do not use - Right to restriction" mark.

A right to data portability

You have the right to ask us for and receive the data you have provided in a structured, commonly used and machine-readable format, for your personal use or to pass it on to a third party of your choice.

This right only applies where the processing of your data is based on your consent, on a contract or is carried out by automated means.

This right to portability differs from the right of access in that its aim is not to obtain a copy that you can necessarily read yourself, but rather a copy of the data that can be re-used, particularly with a view to changing service providers.

However, TEMSA may refuse to exercise this right if it would require technical resources deemed excessive.

The right to withdraw your consent at any time 

You may withdraw your consent to the processing of your data where the processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent carried out prior to such withdrawal.

In the case of newsletter subscriptions, you may withdraw your consent at any time, without having to provide any justification.

The right to give instructions concerning the fate of your data after your death

You have the right to tell us how you would like us to deal with your data in the unfortunate event of your death.

• In particular, you may ask us to destroy all your data (subject to any overriding conservation requirements we may have, for example to defend TEMSA's rights in court), or to send a copy of all this data to a person of your choice.
• You may also designate any person of your choice to be responsible for carrying out these "last wishes"; this person does not necessarily have to be one of your heirs or even the executor of your estate.

TEMSA will respond to any exercise of rights as soon as possible and in any event within 30 days of receipt of the request.

TEMSA reserves the right to:

• Ask for proof of the applicant's identity if there is reasonable doubt about it, in order to respect the applicant's duty of confidentiality;
• Extend the deadline for a response by two months, informing the applicant of the extension and the reasons for the postponement within one month of receipt of the request;
• To refuse to respond to an exercise of rights if this is considered abusive (in view of their number, repetitive or systematic nature).

Summary table

How to exercise your rights regarding your personal data:

To exercise your rights, please contact us:

Temsa Skoda Sabancı Ulaşım Araçları A.Ş.

Sarıhamzalı Mahallesi Turhan Cemal Beriker Blv. No: 563 /1 Seyhan/Adana/Türkiye

kvk@temsa.com

Back