Data Protection and Privacy Policy (KVKK)

1. Data Protection

Thank you for visiting our website and for your interest in our products. Protecting your personal data is very important to us. This Privacy Policy explains how we collect your personal information, the purposes and legal grounds for which we use it, and the rights available to you on those grounds. We also refer you to the Karel Kalıp Data Protection Policy (PDF).

Our Privacy Notice concerning use of our websites and the Karel Kalıp Data Protection Policy do not apply to your activities on social-network websites or websites of other providers that can be accessed through links on our websites. Please review the data-protection provisions on those providers’ websites.

2. Collection and Processing of Your Personal Data

a. When you visit our websites, we store certain information about the browser and operating system you use, the date and time of your visit, access status, your use of website functions, search terms you may have entered, how frequently you access particular pages, the names of files accessed, the amount of data transferred, the website from which you reached our websites and the website you visit from our websites.

For security purposes, particularly to prevent and detect attacks against our websites or fraudulent activity, we also retain your IP address and the name of your internet service provider for the statutory retention period. This data is processed in accordance with applicable law to conduct information-security processes, secure our site and fulfil our legal obligations. It is securely deleted or anonymised when the relevant statutory retention period ends or the purpose of processing no longer exists.

When you register for an account on our website or software applications, you must provide certain information such as your name and email address. You may optionally provide additional information such as your postal address and phone number. Accounts may store vehicle details, purchase and service history, preferences and programme participation. Business customers may also need to create an account to access certain Karel Kalıp products, services and business applications. In such cases, we may request contact and payment information.

When placing an order or reserving a vehicle, you must provide the information needed to fulfil the request, including your name, address, phone number and payment information. When submitting a question through our contact forms, you must provide information such as your name, email address and, in some cases, phone number. For financing enquiries, we may also collect your date of birth, social security number and employment information. When contacting customer support, you may be asked to provide your name, contact details, location and vehicle information. Calls to our support centres may be recorded for quality-assurance purposes.

b. Other personal data will be processed only if you provide it—for example in connection with registration, a contact form, chat, survey, competition or performance of a contract—and only to the extent permitted on the basis of your consent or under applicable law.

c. You are not legally or contractually required to provide your personal data. However, certain functions of our websites may depend on the provision of personal data. If you do not provide it, some functions may be unavailable or only partially available.

3. Purposes of Processing

a. We use personal data collected during your visit to make our websites as useful as possible for you and to protect our IT systems from attacks and other unlawful activity.

1. Providing Products and Services: Fulfilling orders, managing accounts and providing services you request
2. Communications: Responding to enquiries and providing customer support
3. Connected Vehicle Services: Enabling vehicle-related features and services
4. Marketing and Personalisation: Informing you about products and services that may interest you
5. Product Development: Improving our products, services and the Karel Kalıp Platform
6. Business Administration: Conducting internal operations, fraud prevention and record-keeping processes
7. Security: Protecting our systems, networks and users
8. Legal Compliance: Complying with applicable laws, regulations and legal processes
9. Insights and Analytics: Evaluating information obtained through the sales and marketing channels of the Karel Kalıp Platform with the assistance of artificial-intelligence models, automated systems and inferences in order to make our products and services more relevant and useful

b. If you provide us with additional personal data in connection with registration, chat, a contact form, survey, competition or performance of a contract, we will use that data for the purposes stated above, for customer-management purposes and, where necessary, to process and invoice commercial transactions, in each case only to the extent required.

c. For other purposes—for example, to display personalised content or advertising based on your usage behaviour—we and, where applicable, selected third parties use your data only if you have given consent through our Consent Management Platform. Further information and options are available under “Cookie Settings” in the website footer.

d. We also use personal data to the extent required by law. This includes retaining it to meet commercial-law or tax-law retention obligations and disclosing it in accordance with an official or judicial order.

4. Transfer of Personal Data to Third Parties; Social Plugins; Use of Service Providers

a. Our websites may also include offers from third parties. If you click such an offer, we may transfer data to the relevant provider to the extent necessary. This may include information that you found the offer on our website and, where applicable, other information you previously provided on our websites.

b. When we use “social plugins” from social networks such as Facebook and Twitter on our websites, we integrate them as follows: when you visit our websites, social plugins are deactivated, meaning that no data is transferred to the operators of those networks. If you wish to use a network, click the relevant social plugin to establish a direct connection to that network’s server.

If you have an account with the network and are logged in when you activate the social plugin, the network may associate your visit to our websites with your account. To prevent this, please log out of the network before activating the social plugin.

When you activate a social plugin, the network sends the content made available in this way directly to your browser, which integrates it into our website. Data transfers initiated and controlled by the relevant social network may also take place. The relevant network’s privacy policies apply exclusively to your connection to a social network, data transfers between the network and your system, and your interactions on that platform. The social plugin remains active until you deactivate it or delete your cookies.

c. If you click a link to an offer or activate a social plugin, your personal data may be transferred to providers in countries outside the European Economic Area that, from the European Union’s perspective, do not guarantee an adequate level of protection for personal-data processing. We recommend that you take this into account before clicking a link or activating a social plugin.

d. We use qualified service providers, such as IT service providers and marketing agencies, to operate, optimise and secure our websites. We share personal data with these providers only where necessary to provide and use the websites and their functions, protect legitimate interests, fulfil legal obligations or where you have given consent. Further information about recipients is available through our Consent Management System under “Cookie Settings” in the website footer.

5. Cookies

a. Cookies may be used when you visit our websites. Technically, these are HTML cookies and similar software tools such as Web/DOM storage or Local Shared Objects; we refer to all of them collectively as cookies.

b. Cookies are small files stored on and later read from your desktop computer, laptop or mobile device when you visit a website. They enable websites to recognise whether a connection has previously been established with your device, remember your preferred language or other settings, provide certain functions and identify your interests based on your use. Cookies may also contain personal data.

c. Which cookies are used when you visit our websites depends on the areas and functions you use and on whether you permit cookies that are not technically necessary through our consent-management system. Further information and options are available under “Cookie Settings” in the website footer.

d. Use of cookies also depends on the settings of your web browser. Most browsers are preset to accept certain types of cookies automatically, but you can usually change this setting. You can delete existing cookies at any time. Web/DOM storage and Local Shared Objects can be deleted separately. Please consult the instructions provided by your browser or device manufacturer for guidance.

e. Consent to, rejection of or deletion of cookies is specific to the device and web browser used. If you use more than one device or browser, you must make these choices and settings separately for each one.

f. If you decide against the use of cookies or delete them, you may be unable to use all functions of our websites, or some functions may be available only to a limited extent.

6. Security

We use technical and organisational security measures to protect the data we manage against manipulation, loss, destruction and unauthorised access. We continuously improve our security measures in line with technological developments.

7. Legal Basis for Data Processing and Cookies

a. Where you give us consent to process your personal data, that consent constitutes the legal basis for the processing.

b. The legal basis for processing your personal data in order to enter into or perform a contract with you is the applicable provisions of Türkiye’s Law on the Protection of Personal Data (KVKK).

c. We are authorised to process your personal data to the extent necessary to fulfil our legal obligations.

d. We also process personal data to protect our legitimate interests and the legitimate interests of third parties. These interests include maintaining the functionality of our IT systems, direct marketing of our own and third-party products and services, and legally required documentation of business relationships. When balancing the relevant interests, we consider in particular the type of personal data, the purpose and circumstances of processing, and your interest in the confidentiality of your personal data.

8. Deletion of Your Personal Data

We delete your IP address and the name of your internet service provider at the end of the statutory retention periods for which we retain them solely for security purposes. In all other cases, we delete your personal data when the purpose for which it was collected and processed no longer exists.

After that date, data is retained only where required by laws, regulations or other legal provisions applicable to us in the EU or by the laws of third countries, in each case only where an adequate level of data protection is ensured. If deletion is not possible in a particular case, the relevant personal data is marked so that future processing is restricted.

9. Rights of Data Subjects

a. As a data subject, you have the right to information, rectification and deletion.

b. If you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

c. Right to Object: You have the right at any time, on grounds relating to your particular situation, to object to processing of personal data concerning you under KVKK. If you object, we will continue processing your personal data only if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if processing is necessary to establish, exercise or defend legal claims. Where we process your personal data for direct advertising on the basis of a balancing of legitimate interests, you also have the right to object at any time without stating a reason.

d. Where possible, please send your requests or statements to the following contact address: musteri.iletisim@karea.com

e. If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with the competent data-protection supervisory authority.

10. Newsletter

When you subscribe to a newsletter offered on our website, the data you provide during registration will be used solely to send the newsletter unless you have consented to further use. You can unsubscribe at any time by using the unsubscribe link included in the newsletter.