Personal Data Protection Notice

The following categories of personal data may be processed within Otorento services:

• Identity information such as name, surname, Turkish ID number or passport information where required
• Contact information such as phone number, email, country and city
• Reservation information such as pick-up/return location, date, time, vehicle preference, price and reservation status
• Driver information such as age, licence year, licence country and licence type
• Transaction security data such as IP address, device/browser information and logs
• Payment process information such as payment method, status, invoice and prepayment/remainining payment records
• Support and communication records from call centre, WhatsApp, email, live support and forms
• Cookie and digital usage data according to the Cookie Policy

Personal data may be processed for the following purposes:

• Receiving and creating car rental reservation requests
• Managing reservation, pick-up and return processes
• Communicating with users about reservations and support requests
• Sharing necessary reservation information with supplier rent a car companies
• Managing payment, collection, invoice and accounting processes
• Handling cancellation, refund, change, complaint and support requests
• Managing operational processes such as traffic fines, tolls, damage and insurance
• Improving service quality and user experience
• Preventing fraud, misuse and security risks
• Fulfilling legal obligations and responding to competent authority requests
• Sending marketing communications only where permitted by the user

Personal data may be processed based on legal grounds under Turkish Personal Data Protection Law No. 6698.

• Performance of a contract: creating reservations, sharing required information with suppliers and managing payment/support processes
• Legal obligation: invoices, accounting, official records, authority requests and retention obligations
• Establishment, exercise or protection of a right: disputes, complaints, damage, fines, payment objections and legal claims
• Legitimate interest: service security, abuse prevention, support management and operational improvement
• Explicit consent: non-essential marketing communications, certain cookie categories or other processes that legally require consent

Personal data may be shared only where necessary and limited to the processing purposes.

• Supplier rent a car companies
• Payment service providers and financial institutions
• Technology, hosting, security, email, SMS, WhatsApp, call centre, analytics and support infrastructure providers
• Professional service providers such as legal, accounting and audit advisors
• Competent public institutions, courts, enforcement offices and official authorities where legally required

Some technology, communication, analytics, advertising, email, hosting or support services used by Otorento may be based abroad or may operate through infrastructure located abroad.

Where applicable, international transfers are carried out according to legal requirements and necessary security measures. If explicit consent is required for a transfer, it may be requested separately.

Personal data may be collected through the following channels, automatically, partially automatically or directly from the user.

• Otorento website and mobile web usage
• Reservation forms and vehicle search/reservation screens
• Contact forms, call centre, WhatsApp, email and similar channels
• Supplier feedback and payment service providers
• Cookies and similar digital technologies
• Campaign, survey and customer support processes

Personal data is retained for the period required by the processing purpose and legal retention periods.

When the retention period expires or the processing purpose no longer exists, personal data is deleted, destroyed or anonymized in accordance with applicable legislation.

Under Article 11 of Law No. 6698, data subjects have certain rights, including:

• Learn whether personal data is processed
• Request information if personal data has been processed
• Learn the purpose of processing and whether data is used accordingly
• Know third parties to whom personal data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction where legal conditions are met
• Object to results arising exclusively from automated analysis
• Claim compensation for damages caused by unlawful processing

You may contact Otorento to exercise your rights under Turkish Personal Data Protection Law No. 6698.

Email: info@otorento.com.tr

Phone: 0530 969 36 97

Last Updated: 03.07.2026