PRIVACY NOTICE

Martı İleri Teknoloji A.Ş. (“Martı” or “our Company”) ensures the security of your personal data with the utmost care. With respect to the personal data it processes, Martı acts, towards the persons whose personal data are processed (“Data Subject”), as the “data controller” under Law No. 6698 on the Protection of Personal Data (“KVKK”). In this context, Martı acts with the greatest diligence, in light of the principles set out by the KVKK, in relation to the processing, erasure, destruction, anonymisation and transfer of your personal data, the informing of Data Subjects and the ensuring of data security.

This privacy notice (“Privacy Notice”) has been prepared and presented for your information in order to notify you that your personal data will be processed and retained lawfully in connection with your use of the mobile application developed by Martı as data controller (“Martı Application”) as a user (“User”), and in order to fulfil our Company’s obligation to inform under the KVKK.

Scope and Purpose of the Privacy Notice

This Privacy Notice explains the methods and legal grounds for collecting personal data; which of your personal data are processed where you use the Martı Application; the purposes for which such personal data are used; to whom and for which purposes personal data may be transferred; the circumstances in which personal data are erased, destroyed and anonymised; and the rights of Data Subjects over their personal data and how these rights may be exercised.

Identity of the Data Controller

With respect to the personal data you share through the collection methods set out below, the Data Controller is Martı İleri Teknoloji Anonim Şirketi, registered with the Istanbul Trade Registry under registry number 166213-5, bearing MERSİS number 0612137376300001 and having its registered address at Maslak Mah. Büyükdere Cad. Noramin İş Merkezi Sitesi No: 237 İç Kapı No: 5 Sarıyer/İstanbul.

Your Personal Data That Are Processed

Data Category	Personal Data Processed
Identity	Name and surname (where you log in via an Apple or Google account, the name and surname transmitted to Martı by the relevant provider), date of birth, gender, Turkish ID number/passport number, nationality, driving licence details,
Contact	Telephone number, e-mail address (where you log in via an Apple or Google account, the e-mail address transmitted to Martı by the relevant provider; where Apple’s “Hide My Email” feature is selected, the relay e-mail address generated by Apple instead of your actual e-mail address)
Finance	Martı wallet balance, outstanding amount, invoice details, information relating to payments and payment methods
Legal Transaction	Correspondence with judicial authorities, information contained in case files
Marketing	Ride history, location-based campaign data, usage-based campaign data
Customer Transaction	Date of membership, customer identification number, complaint and suggestion records, Martı ride details, Martı usage details, call centre records, in-app message/call records between Driver–Passenger and Sender–Recipient
Transaction Security	IP address, device identification number, transaction logs, traffic data, application usage information, device operating system and version, device type, hardware model and, where you log in via an Apple or Google account, the persistent user identifier specific to the relevant provider and account-matching transaction logs
Location	GPS data obtained during the performance of the service, ride start and end points, route information, vehicle rental locations
Visual and Audio Records	Photograph contained in the identity card/passport/driving licence

Methods of Collecting Your Personal Data

Your personal data set out in categories above are collected by Martı in electronic form through the Martı Application and e-mail channels and/or through the call centre. In addition, where you choose to log in to the Martı Application using the “Continue with Apple” or “Continue with Google” options, part of the personal data set out above is collected in electronic form and by automated means, by being transmitted to Martı by the relevant providers upon the authorisation granted by you with that provider.

Purposes and Legal Grounds for Processing Your Personal Data

Pursuant to Article 5 of the Law, our Company processes;

a) your name and surname, Turkish ID number/passport number, date of birth, gender, nationality, driving licence details, telephone number, e-mail address, GPS data obtained during the service, IP address, device operating system and version, device type, hardware model, user transaction logs and traffic data, for the purposes of providing you with services through the Martı Application, creating a membership record, preventing fraud, enabling vehicle rental transactions, performing the agreement between us and ensuring our Company’s compliance with legislation, on the legal grounds that the processing of personal data belonging to the parties to a contract is necessary and that such processing is expressly provided for by law;

b) where you log in to the Martı Application using the “Continue with Apple” or “Continue with Google” options, the name and surname and e-mail address transmitted to Martı by the relevant providers (where Apple’s “Hide My Email” feature is selected, the relay e-mail address), the provider-specific user identifier and the telephone number verified by you during the matching process, for the purposes of creating a membership record, verifying your identity, ensuring secure access to your account and matching your account held with the relevant provider with your existing Martı account, on the legal ground that the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract;

c) the provider-specific user identifier, IP address, device identification number and transaction logs, for the purposes of ensuring the security of the log-in and account-matching process carried out via an Apple or Google account and of detecting and preventing unauthorised access and account takeover attempts, on the legal ground that processing is necessary for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms;

d) your name and surname, e-mail address, telephone number, call centre records, Martı Application usage data, location information, device identification number, in-app message/call records following matching, complaint and suggestion records, Martı wallet balance and information relating to payments and payment methods, for the purposes of providing you with services through our Application and carrying out pricing, payment and customer relations processes, and since such data are directly related to the performance of the core service we provide under our user agreement, on the legal ground that the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract;

e) your name and surname, Turkish ID number, telephone number, outstanding amount, invoice number and information relating to payments and payment methods, for the purposes of carrying out invoicing processes and monitoring finance and/or accounting affairs, on the legal ground that processing is mandatory in order for our Company, as data controller, to fulfil its legal obligations;

f) correspondence with judicial authorities, information contained in case files, date of membership, customer identification number, complaint and suggestion records, Martı Application usage details, call centre records, the photograph contained in the identity card/passport/driving licence and Martı Application usage information, for the purposes of managing, auditing and improving our Company’s services and operations, conducting market research, carrying out strategic planning processes, ensuring the security of our services, operations and application, detecting fraudulent or unlawful activities, preventing and detecting fraud and campaign abuse, and carrying out internal audit, internal control, legal, finance, reporting and internal operational processes, to the extent that this is consistent with the principles of relevance to the purpose of processing, proportionality and data minimisation, on the legal ground that processing is necessary for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms;

g) your name and surname, e-mail address, telephone number, location data and information relating to the accident, for the purposes of reporting traffic accidents occurring during the use of the services and taking the necessary actions, on the legal ground that processing is necessary for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms;

h) location-based campaign data and usage-based campaign data, in respect of users who give explicit consent based on their free will even though our services may be used without giving explicit consent, for the purposes of carrying out non-personalised marketing activities, creating individual campaigns for users, offering special opportunities through our business partners, determining target audiences, carrying out activities that enhance the user experience, personalising the Martı Application and carrying out direct and personalised marketing activities, on the legal ground of obtaining the explicit consent of the data subject.

Purposes and Legal Grounds for the Transfer of Personal Data and Third Parties to Whom Personal Data Are Transferred

Martı transfers your personal data to third parties located in Türkiye solely for the purposes set out in this Privacy Notice and in accordance with Article 8 of the KVKK.

Martı transfers your personal data set out above to authorised persons, institutions or organisations for the purposes of providing information to authorised persons, institutions or organisations, fulfilling its legal obligations, conducting legal proceedings and carrying out its activities in compliance with legislation.

In addition, our Company transfers your personal data to its business partners and suppliers in order to provide the services it has undertaken, carry out its activities, ensure the safety and satisfaction of Users and perform quality control of the services provided.

Where you have given your explicit consent, our Company transfers your location-based campaign data and usage-based campaign data, together with your data relating to customer identification number, mobile telephone number, gender, age, date of membership and Martı Application usage details, to its business partners for the purposes of creating individual campaigns for you as users, offering special opportunities through our business partners, determining target audiences, carrying out activities that enhance the user experience, personalising the Application and carrying out direct and personalised marketing activities.

The personal data subject to domestic transfer as set out above are transferred and retained by Martı and by the third parties to whom the transfer is made with all necessary security measures and technical safeguards in place. In addition, your personal data are also legally protected by the data processing agreements concluded with the third parties to whom Martı, as data controller, transfers your personal data.

While the TAG, Martı Taksi and Martı Kurye services are being provided, your first name, the initial of your surname and your instant location information are shared with the person you are matched with, in order to enable the matching and to allow the other party to find you.

Where legal obligations arise, such as a traffic accident, a criminal investigation or a request for information, your personal data may be transferred to the General Directorate of Security, the courts and all relevant public authorities, without being limited to these.

Erasure, Destruction and Anonymisation of Your Personal Data

Your personal data collected for the purposes and by the means explained above will be processed by Martı with care and in confidence, in compliance with the KVKK. Your personal data are processed for as long as required by our Company’s purpose of processing such data and for the period prescribed in the relevant legislation, and are anonymised thereafter. Throughout the period in which your personal data are processed, only persons authorised within our Company will be able to access your personal data, in accordance with the requirements of the work.

The provider-specific user identifier processed where you log in via your Apple or Google account is retained for as long as your membership continues; upon termination of your membership or upon your request for the removal of the link to the relevant provider account, it is destroyed by revoking the authorisation granted to Martı with the relevant provider.

Upon expiry of the prescribed period, your personal data will be destroyed without delay in accordance with the relevant provisions of the KVKK and the Turkish Penal Code, the Regulation on the Erasure, Destruction or Anonymisation of Personal Data and our company policies.

Your Rights as a Data Subject

Under Article 11 of the KVKK, you are granted the following rights as the owner of personal data:

a) to learn whether your personal data are processed,

b) to request information if your personal data have been processed,

c) to learn the purpose of the processing of personal data and whether they are used in accordance with that purpose,

d) to know the third parties to whom personal data are transferred in Türkiye or abroad,

e) to request the rectification of personal data where they have been processed incompletely or inaccurately,

f) to request the erasure or destruction of personal data within the conditions set out in Article 7 of the KVKK,

g) to request that the actions taken pursuant to paragraphs (e) and (f) be notified to the third parties to whom personal data have been transferred,

h) to object to a result arising to your detriment through the analysis of the processed data exclusively by automated systems,

i) to claim compensation for the damage in the event that you suffer loss due to the unlawful processing of personal data.

How You Can Contact Us

If you have any question, comment or request regarding this Privacy Notice, you may apply, in accordance with the procedures and principles set out in the Communiqué on the Procedures and Principles of Application to the Data Controller dated 10.03.2018 and numbered 30356, together with documents evidencing your identity, by wet-signed application to the address "Maslak Mah. Büyükdere Cad. Noramin İş Merkezi Sitesi No: 237 İç Kapı No:5 Sarıyer/İstanbul"; or to destek@marti.tech or tagdestek@marti.tech by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature or the e-mail address previously notified to Martı and registered in our system. The requests contained in your application will be assessed and concluded as soon as possible and in any event within 30 days at the latest. Our Company reserves the right to charge a fee in accordance with the tariff (if any) determined by the Personal Data Protection Board in relation to such requests.