404

PROTECTION OF PERSONAL DATA

A) Unless otherwise expressly agreed in writing in this Agreement, the Parties acknowledge that, in relation to the Services defined herein: (i) the Lessor is the data controller and the Lessee is the data subject whose data are processed; (ii) if the Lessee processes the personal information of the Lessor’s personnel shared during the vehicle handover process, the Lessee acts as the data processor; (iii) if the Lessee is a legal entity and the rented vehicle is used by an employee of the company, the Lessee shall be considered the data controller only in relation to the data it stores or processes independently of the Lessor (without instruction) in its own database, limited to this specific situation.

B) The Lessor agrees and declares that it will exercise the utmost diligence in processing and storing any personal data belonging to the Lessee (if an individual) or the relevant user (if the Lessee is a legal entity) in compliance with the Personal Data Protection Law No. 6698. The Lessor will promptly respond in accordance with the law to any request made by data subjects regarding how their personal data are stored and protected. The Lessor undertakes to continue storing all personal information in full compliance with legal procedures.

C) The Lessor processes and retains personal data obtained under this Agreement in accordance with Law No. 6698, for legitimate purposes such as signing this Agreement, issuing invoices, tracking sales, rental and other contractual processes, financial and accounting follow-ups, and similar legitimate business needs. These data are processed, stored, and destroyed or anonymized in accordance with applicable legislation and the Company’s Personal Data Processing Policy. The sharing of information such as vehicle, brand, model, license plate, Lessee, user, additional driver, and credit card details with third parties and organizations providing services under legal and contractual obligations shall not be considered a violation of confidentiality. The Lessee or the individual signing the delivery/return form hereby accepts this authority of the Lessor in advance. For detailed information about the measures, methods, and purposes related to the protection of personal data adopted by our company, please review the information notice and company policy published on our website “www.editioncarrental.com”.

D) The Lessor undertakes that the personal data transferred to it will be processed only within the scope of the service subject to this Agreement, limited to the purpose of the Agreement and the related service, and that without the Lessee’s written consent, such data will not be shared with any third party, whether domestic or abroad, other than the Lessor’s service providers, affiliates, suppliers, legal advisors (in case of dispute), and shareholders. The Lessor further undertakes not to perform any operations on the data other than those necessary to carry out the intended services, including anonymization or masking of data. The Lessor shall retain the data only for as long as necessary for the performance of the relevant service and, upon completion, shall return or permanently delete all copies (digital and printed) unless there is a legal obligation to retain them. The Lessor is responsible for preventing unlawful access to and/or unlawful processing of personal data and for ensuring their protection as required by law, maintaining an appropriate level of security, and taking all necessary technical and administrative measures. In the event of a breach caused by the Lessor’s fault, it shall immediately compensate the Lessee and/or the data subjects (including users, vehicle recipients, or deliverers) for any proven direct damages as determined by a final court decision. The Lessor also agrees to take reasonable measures to prevent any further damage resulting from the disclosure of information caused by its own negligence.