Vehicle Tracking System (GPS) Privacy Notice
As AK FİNANSAL KİRALAMA A.Ş. (“Ak Lease”), acting as the data controller, we take the necessary measures during the retention, processing and transfer of your personal data in accordance with Law No. 6698 on the Protection of Personal Data (“Law” and/or “KVKK”), the principle of protection of private life and individuals’ fundamental rights and freedoms, and the applicable legislation.
As Ak Lease, pursuant to Supplementary Article 3 of the Identity Notification Law No. 1774, we are obliged to keep GPS devices containing the location data of leased vehicles and to retain the location data obtained through such devices for a period of three years. Within this scope, the location data of the leased vehicles are notified to law enforcement authorities in real time and monitored through the system.
We have prepared this Vehicle Tracking System Privacy Notice (“Privacy Notice”) in order to inform the data subjects regarding the processing, retention and transfer of their personal data within the framework of the legal regulations under the Law on the Protection of Personal Data (“KVKK”) and the Identity Notification Law No. 1774. On this page, you may access all information regarding our details as the data controller, the purposes for which personal data will be processed, to whom and for which purposes personal data may be transferred, the method and legal bases for collecting personal data, and your rights set forth under the KVKK.
We may amend this Privacy Notice where necessary. Any amendments shall become effective upon their publication.
Purposes of Processing Your Personal Data and Legal Bases
As Ak Lease, within the scope of our financial leasing activities and operational leasing activities carried out pursuant to the Financial Leasing, Factoring, Financing and Savings Financing Companies Law No. 6361, we have categorized and listed below the purposes of processing, retaining and transferring your personal data.
The Obligation to Install and Maintain a Vehicle Tracking System is regulated under Additional Article 3 of Law No. 1774 and has been imposed to prevent the commission of crimes and to enable the tracking of leased vehicles. Pursuant to the relevant legislation, entities engaged in leasing activities are required to install vehicle tracking systems in leased vehicles, duly record location data relating to such vehicles and make such records available to law enforcement authorities.
Depending on the nature of your relationship with Ak Lease, you may select the relevant section below to obtain information regarding the personal data we process, the purposes of processing and the applicable legal bases.
| Personal Data Category |
Processing Purpose |
Legal Bases |
| Identity, Contact, Risk Management Information, Customer Transaction Information, Professional Experience, Location (Location data) |
• Identification and verification of your identity and address information, • Verification of customer information and ensuring that such information remains up to date, • Conducting risk analyses, • Conducting risk management and information security processes, • Conducting internal audit/ investigation/ intelligence activities, • Conducting analyses, reporting activities and reviews deemed necessary within the scope of the Company's activities, • Conducting and supervising business activities, • Conducting retention and archiving activities, • Conducting finance and accounting operations, • Retaining and reporting information requested by public authorities to which we are subject to information disclosure obligations, including the Banking Regulation and Supervision Agency (BRSA), the Central Bank of the Republic of Türkiye (CBRT), the Financial Crimes Investigation Board (MASAK), the Revenue Administration (RA), the Capital Markets Board (CMB), the Risk Center of the Banks Association of Türkiye, and responding to their requests for information and documentation • Ensuring compliance of all activities with applicable legislation • Installing GPS devices in leased vehicles in compliance with our obligations under Law No. 1774 on Identity Notification • Retention of records relating to location data, |
Explicitly stipulated by laws, Mandatory for the fulfilment of our legal obligations Directly related to the establishment or performance of a contract |
| Identity, Contact, Risk Management Information, Customer Transaction Information, Professional Experience, Financial Data |
• Performance of our obligations and responsibilities in relation to all products and services provided, intermediated or offered by us in our capacity as an agent within the scope of our field of activity, including in particular financial leasing services, and conduct of related contractual processes, • Conducting advertising, campaign and promotional activities relating to our products and services and contacting you for such purposes, • Carrying out product sales, sending newsletters and informational communications, and conducting marketing activities, • Conducting customer satisfaction activities and sharing offers relating to customer services, • Conducting customer relationship management processes, • Conducting product and service procurement processes and related support services, • Improving the quality of products and services, • Conducting investment processes, |
Directly related to the establishment or performance of a contract Mandatory for the fulfilment of our legal obligations Processing of your personal data being mandatory for our legitimate interests, provided that your fundamental rights and freedoms are not harmed |
| Identity, Contact, Risk Management Information, Customer Transaction Information, Professional Experience |
• Ensuring the continuity of all products and services provided by us pursuant to the Financial Leasing, Factoring, Financing and Savings Financing Companies Law and the relevant legislation through our affiliates and business partners, • Developing and improving products and services in line with customer needs and sector-specific requirements, • Conducting other analyses, reporting activities and reviews deemed necessary within the scope of our financial activities, • Conducting strategic planning activities, • Conducting corporate social responsibility and civil society activities, • Receiving and evaluating suggestions aimed at improving business processes |
Processing of your personal data being mandatory for our legitimate interests, provided that your fundamental rights and freedoms are not harmed |
| Identity, Contact, Risk Management Information, Customer Transaction Information, Professional Experience |
• Conducting legal affairs, • Managing and following up on requests and complaints, • Managing legal proceedings relating to outstanding debts and conducting related control activities |
Mandatory for the establishment, exercise or protection of a right |
| Identity, Contact, Risk Management Information, Customer Transaction Information, Professional Experience |
• Offering products and services provided, intermediated or offered by Ak Lease in its capacity as an agent on a personalized basis, conducting marketing analyses and modelling activities, and contacting you in this regard, • Sharing personalized offers relating to our products and services, • Conducting cross-selling activities relating to products and services, • Conducting customer acquisition activities • Conducting analyses, modelling activities and reviews deemed necessary within the scope of our activities, • For the purpose of conducting customer satisfaction activities, such personal data is processed in a manner that is relevant, limited and proportionate to the purposes for which it is processed and in compliance with the principles set out under Article 4 of the KVKK. |
Explicit consent of the data subject |
| Sensitive Personal Data Category |
Processing Purpose |
Legal Bases |
| Biometric Data |
Where a contractual relationship is established through the remote identity verification method and the method of establishing a contractual relationship in an electronic environment |
Explicit consent of the data subject |
| Criminal Conviction Data, Association and Foundation Membership Information |
During the conduct of legal affairs, carrying out controls requested by public authorities to which we are subject to information disclosure obligations, including the BRSA, the CBRT, MASAK, the Revenue Administration, the CMB and the Risk Center of the Banks Association of Türkiye, retaining and reporting the relevant information, and responding to such authorities’ requests for information and documentation, |
Mandatory for the establishment, exercise or protection of a right Explicitly stipulated by laws, Mandatory for the fulfilment of our legal obligations |
Processes Regarding Risk Groups
You, your spouse, your children, and the partnerships in which such persons act as board members or general managers, or which such persons, or a legal entity, individually or jointly, directly or indirectly control, or in which they participate with unlimited liability; and the qualified shareholders, board members and general manager of a bank, and the partnerships which they individually or jointly, directly or indirectly control, in which they are partners with unlimited liability, or in which they act as board members or general managers; as well as natural persons and legal entities between whom suretyship, guarantee or similar relationships exist to such an extent that the payment difficulty of one would result in the payment difficulty of one or more of the others, constitute a risk group.
In addition to the foregoing, other natural persons and legal entities to be included within the scope of a risk group are determined by the Banking Regulation and Supervision Board of the Republic of Türkiye.
Within the scope of our explanations above, even if you are not our customer, your personal data may be processed by our Company, primarily pursuant to the Financial Leasing, Factoring, Financing and Savings Financing Companies Law No. 6361 and other relevant legislation, for the purposes of determining, monitoring, reporting and controlling the risk group in which you will be included, in order to determine the credit limits applicable to financial leasing and operational leasing transactions to be carried out in relation to a risk group.
II- Data Controller and Data Processor
Data Controller
The data controller is the natural person or legal entity who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. In this respect, our Company acts as the Data Controller in relation to the data of our customers, visitors and employees.
Below, you may find information regarding our Company acting as the Data Controller.
| Trade Name |
AK FİNANSAL KİRALAMA A.Ş. |
| Address |
Sabancı Center Kule 2 Kat:8-9 34330 4.Levent/İstanbul |
| MERSIS / Registry No |
0178007230900031 / 250256 |
Our group companies referred to in this Privacy Notice are listed below.
Akbank T.A.Ş.
Aköde Elektronik Para ve Ödeme Hizmetleri A.Ş.
Ak Yatırım Menkul Değerler A.Ş.
Ak Portföy Yönetimi A.Ş
Ak Tech Yazılım Teknolojileri A.Ş.
The insurance companies for which we act as an agent are as follows:
Aksigorta A.Ş.
Data Processor
A data processor is a natural person or legal entity who processes personal data on behalf of the data controller. Such persons may also be a separate natural person or legal entity authorized by the data controller to process personal data.
III- Your Personal Data and Method for Collecting
The personal data processed by our Company are grouped and listed in the table below. Accordingly, you may obtain information regarding the personal data we process.
Your Personal Data
| Personal Data Category |
Personal Data |
| Identity |
e.g. Name-surname, Turkish ID No., gender, nationality, place of birth, date of birth, marital status. |
| Contact |
e.g. e-mail address, residential/business address, phone number. |
| Risk Management Information |
e.g. salary information, asset and income information, educational information, demographic information, opinion notes created by the relevant branch, work type, duration of employment, information obtained from KPS and APS, information obtained from the Credit Bureau (KKB) and the Risk Center of the Banks Association of Türkiye. |
| Customer Transaction Information |
e.g., credit information, deposit account information, overdraft account information, credit card limit and balance information, deposit account transaction records, loan repayment records, Customer Information Repository (“MBB”) records. |
| Risk Management and Tracking Information |
Debt information, delinquency information and the number of days past due, maturity information, information relating to connected persons, asset ownership information (including vehicle ownership and title deed information). |
| Visual and Audio Records |
Call centre voice recordings, CCTV recordings, photographs and other visual and audio data. |
| Legal Proceedings Information |
Information contained in correspondence with judicial authorities, court file information, etc. |
| Location |
Location data relating to your whereabouts. |
| Marketing |
e.g., cookie records, pages viewed through banking applications, purchase history information, information obtained through surveys and campaign activities. |
| Professional Experience |
e.g., diploma information, courses attended, professional training information, certificates, transcript information, work type and duration of employment. |
| Other |
e.g., demographic information, income information, asset information and reporting records. |
Our Collection Methods
As Ak Lease, we collect your personal data in written, verbal and visual formats through electronic and physical methods, by automated, partially automated or non-automated means.
Your personal data obtained through non-automated or partially automated means consist of:
- Information and documents provided by you to Ak Lease during your physical product/service/campaign applications (e.g., at branches),
- Data provided indirectly by your representatives (e.g., attorney, parent, guardian, etc.),
- Data provided by your workplace (for example, for the verification of income information).
- Through automated means, we may obtain information about you by technical support from:
- Applications made by you through digital channels (website, customer contact center, etc.),
- Databases of public institutions and other organizations where your identity and address information is registered (e.g., Identity Sharing System (“KPS”), Address Sharing System (“APS”)),
- Official institutions and organizations where your credit score information is held (e.g., Credit Registry Bureau (“KKB”), Risk Center of the Banks Association of Türkiye (“TBB Risk Center”)),
- Social networks and other technology providers (for example, when you reach us through our advertisements),
- Companies providing data services from which we receive reporting services in order to better understand our customers and evaluate general trends.
IV- Recipients of Transfer
Personal data held by Ak Finansal Kiralama A.Ş. may be transferred, in connection with, limited to and proportionate to the fulfilment of the processing purposes set out below, primarily for the purpose of carrying out financial activities and in accordance with our obligations under the Financial Leasing, Factoring, Financing and Savings Financing Companies Law and the legislation to which we are subject.
In this section, we list the organizational structures to which we transfer personal data and our purposes of transfer.
| Organizations |
Our Purposes |
| Institutions and organizations authorized by law to receive information (e.g., BRSA, CMB, CBRT, MASAK, SSI, CMS, Credit Registry Bureau, Risk Center, Financial Institutions Association, Banks Association of Türkiye, and other authorized institutions and organizations), |
For the purposes of carrying out risk management and risk monitoring activities, making legal reporting, carrying out regulatory and audit activities, and conducting complaint and legal processes, |
| Our domestic/foreign affiliates, shareholders, third parties from which services are received in order to carry out our activities, and organizations with which we cooperate, |
For the purposes of establishing, maintaining and terminating the service relationship with the customer, conducting credit assessments, carrying out consolidated financial statement preparation activities, risk management and internal audit activities, |
| Companies for which we act as an agent, |
For the purpose of carrying out insurance transactions, |
| Suppliers from which we receive outsourced services, our program partners, parties with which we carry out co-branded activities and third parties with which they cooperate, domestic/foreign banks and financial institutions with which a credit relationship is established, independent audit firms and law firms, |
For the purposes of carrying out our activities and receiving support and consultancy services, |
| Banks and financial institutions with which we have a financial relationship in relation to our financial activities, |
For the purpose of carrying out examinations for controls to be conducted during or after transactions relating to the prevention of laundering proceeds of crime and financing of terrorism, |
| Asset management companies and prospective purchasers in connection with the sale of the Company’s receivables and assets. |
For the purpose of carrying out valuation studies within the scope of the sale of the Company’s receivables and assets; and, without being limited to the foregoing, personal data are transferred to natural persons and legal entities to whom data transfer is mandatory, within the scope of the applicable legal grounds. |
V- Rights of the Data Subject
Your rights listed under Article 11 of the KVKK
Pursuant to the provisions of the KVKK, you may exercise the following rights by applying to Ak Finansal Kiralama A.Ş.:
- To learn whether your personal data are processed,
- To request information if your personal data have been processed,
- To learn the purpose of processing your personal data and whether such data are used in accordance with their purpose,
- To know the third parties in Türkiye or abroad to whom your personal data have been transferred,
- To request rectification in case your personal data are processed incompletely or inaccurately,
- To request deletion or destruction of your personal data,
- To request notification of the operations carried out regarding the rectification, deletion or destruction of your personal data to third parties to whom your personal data have been transferred,
- To object to the occurrence of any result to your detriment by means of analysis of the processed data exclusively through automated systems,
- To request compensation for damages in case you incur damages due to the unlawful processing of your personal data.
Requests submitted within this scope shall be concluded by Ak Finansal Kiralama A.Ş. free of charge within thirty days at the latest. However, if a fee is prescribed by the Personal Data Protection Board, the fee set out in the tariff determined by our Company may be charged.
Fulfilment of Your Requests
The KVKK grants data subjects the right to make requests regarding which of their personal data are processed in which processes and the current status of such data.
Pursuant to Article 13 of the KVKK, which regulates “Application to the Data Controller”, the relevant person/data subject must submit their requests regarding the implementation of the Law to the data controller in writing. Therefore, in order for your request to be evaluated, you must submit your application in writing.
Requests received from data subjects are responded to by our Company within 30 days. In this regard, we would like to remind you that your written applications regarding this matter may be accepted following the identity verification to be carried out by us.
Therefore, in order for your request to be evaluated, you may submit your application in writing to our branches or to our Head Office address (Sabancı Center Kule 2 K:8-9 34330 4.Levent/Beşiktaş-İstanbul), send it via notary public, or submit it to akfinansalkiralama@hs03.kep.tr with a secure electronic signature.
If you wish to contact us regarding your requests, you may submit your relevant applications and requests, by using the Data Subject Request Form available under the Information and Request Forms section on our website, through the following methods:
- You may submit your identity documents and your petition containing your request to our branches or to our address at Sabancı Center 34330 4.Levent/Beşiktaş-İstanbul, or send them via notary public,
- You may submit them to akfinansalkiralama@hs03.kep.tr with a secure electronic signature,
- You may submit them directly to our branches or to our Head Office address (Sabancı Center Kule 2 K:8-9 34330 4.Levent/Beşiktaş-İstanbul),
- You may send them via notary public.
If you wish to withdraw the Explicit Consent you have given to our Company, you may submit your request in writing to our Head Office or to our branches.
VI- Law on the Protection of Personal Data
Your security and the privacy of your private life have always been among our most important values as Ak Lease. As a result of the legal regulation adopted in relation to information security, a matter to which we attach great importance, the Law No. 6698 on the Protection of Personal Data, which was enacted for the purposes of protecting individuals’ fundamental rights and freedoms and ensuring the protection of personal data, has entered into force. Accordingly, we would like to inform you about the scope of this Law.
What is the KVKK?
The Law on the Protection of Personal Data (“KVKK” or “Law”) was adopted by the Grand National Assembly of Türkiye on 24.03.2016 and entered into force upon its publication in the Official Gazette dated 07.04.2016 and numbered 29677.
The Law is based on the compliance of all persons and institutions processing data within the framework of its main purposes, such as ensuring the confidentiality and protection of personal data and preventing their unauthorized use. Like all organizations, our Company is obliged to comply with this Law, and all personal data processed in all processes of our Company fall within this scope.
What is Personal Data?
All data or data sets that directly or indirectly identify or make a person identifiable are considered personal data. Identifying information that directly belongs to a person or is generated for a person, such as name, surname, place/date of birth, telephone number, resume, photograph and voice recording, may be given as examples. Data identifying a person, such as customer number and agreement number generated for Company transactions, are also considered Personal Data.
What is Data Processing?
Any operation performed on personal data is considered “data processing”. Accordingly, archiving, storing, modifying, re-organizing, disclosing, transferring, analyzing and classifying data fall within the scope of data processing.
All data controllers are entitled to process data only if one of the legal bases set out under Article 5/2 of the KVKK below exists, or if the data subject has given explicit consent.
Personal data may be processed without seeking the explicit consent of the data subject where one of the following conditions exists:
- Article 5/2(a) of the KVKK: Explicitly stipulated by laws,
- Article 5/2(b) of the KVKK: It is necessary for the protection of the life or physical integrity of the person himself/herself or of another person, where the person is unable to express his/her consent due to actual impossibility or where his/her consent is not legally valid.
- Article 5/2(c) of the KVKK: It is necessary to process the personal data of the parties to a contract, provided that such processing is directly related to the establishment or performance of the contract.
- Article 5/2(ç) of the KVKK: It is mandatory for the data controller to comply with its legal obligation.
- Article 5/2(d) of the KVKK: The personal data have been made public by the data subject himself/herself.
- Article 5/2(e) of the KVKK: Data processing is mandatory for the establishment, exercise or protection of a right.
- Article 5/2(f) of the KVKK: Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Who is the Data Subject / Data Owner?
One of the terms frequently used in the Law and in our corporate policies is “data subject” or “data owner”. This refers to natural persons whose personal data are processed. All our existing and potential customers, as well as natural persons who carry out any transaction before our Company, are data subjects/data owners.
Natural persons who are not our customers but who have been or will be a party to any security transaction under a financial leasing agreement (such as sureties, guarantors, pledge/assignment debtors, or spouses in cases where consent is required under applicable legislation), as well as natural persons who are shareholders, ultimate beneficial owners, board members or representatives/proxies of any company that is our customer, may also be data subjects/data owners.
Policies
In order for you to benefit from our online channels in the most efficient manner, we place cookies in a manner limited to the relevant purposes and in accordance with confidentiality. You may review our Cookie Policy to examine how we use cookies and to learn how you can control cookies.