Personal Data Protection Law

Lighting on Protection of Personal Data Within the scope of the Law on the Protection of Personal Data No. 6698 ("KVKK"), we are considered as data controller (Yes Oto Kiralama ve Turizm Yatırımları A.Ş.). We would like to inform you about how we process and transfer your personal data. How We Collect Information We may collect your personal data in connection with your transactions with us, through your interactions with our websites, from our physical points, from your mobile device, or from third parties, as legally appropriate. 2. Information Collected About You The personal data we collect from you (including but not limited to your name, age, gender, contact information, location, previous rental information, and credit card information) is proportionate to our processing purposes set out in Section 3 below. 3. How We Use Your Personal Data 3.1 The legal reasons for the processing of your personal data in accordance with Article 5 of the KVKK are as follows: a) You have a clear consent for the processing of your personal data, b) To be clearly prescribed in laws, c) The person who is unable to explain his consent due to actual impossibility or whose consent is not given legal validity, is compulsory for the protection of himself or someone else's life or bodily integrity, d) It is mandatory for the establishment or performance of a contract, e) It is compulsory for us to fulfill our legal obligations, f) The person concerned has been made public by himself, g) Data processing is mandatory for the establishment, use or protection of a right, h) Data processing is mandatory for our legitimate interests, provided that it does not harm your fundamental rights and freedoms. Subject to the conditions set forth in the KVKK, we may use the information we collect for the following purposes (based on your explicit consent and / or legally).

Managing car rental and commercial relationship, contacting you about car rental and helping you with these issues Carrying out customer service activities and making phone calls about customer satisfaction To verify the driving and credit information provided by you (including personal data) for the purposes of fraud prevention, through credit institutions, licensing agencies, fraud prevention agencies / databases and other sources. Contacting you regarding the missing membership form on the internet or your reservation To provide relevant insurance databases with information about the accidents you are involved in. In this context, the processing of personal data may be in question when it is necessary for the creation, implementation of legal requests or defense against legal requests. Communicate with you by e-mail, text message, phone or other means using commercial contact information using your contact information (customer satisfaction surveys, discounts, special offers and / or services and / or marketing promotions, invitations, advertisements, celebrations and survey

Providing you with better products and services To compile statistics and analysis by our customers about the use of our websites, products and services. Protecting our rights and assets Providing you with more specialized and good services Planning and carrying out corporate sustainability activities Planning and performing the marketing processes of goods or services Planning and executing the necessary processes to ensure and increase customer loyalty Providing your personal data to government agencies overseeing road programs to help implement traffic regulation during your rental period Providing your personal data to the relevant tax authority or authority, debt collectors, credit institutions and other relevant institutions Processing / storing personal data related to any event arising from you or the additional authorized driver's relationship with us, where such an incident is thought to pose a risk to future rentals. We may combine the information you provide us with information about your transactions with us, such as rental location and vehicle type. This information will allow us to

How Your Personal Information Can Be Shared and Sharing Purposes In case of your express consent and / or legally permitted, your personal data may be shared with the following parties for the purposes set out in Section 3 above: your personal data, Enterprise Holdings, the Group organization (data as being responsible for, including E Data Services UK Limited) and business partners (including our agents in Turkey), our suppliers and other outside service providers or in the markets of Turkey (information technology including service providers and other consultants). Enterprise Holdings subsidiaries of the Group, Department may use your personal data for specified purposes and 3. your personal data to third-party service providers (in Turkey or abroad) can be transferred. Information, legally necessary and / or in cases permitted in law, you and protect the rights of third parties, provide administrative and technical support, and business partners to carry out your transactions outside Turkey, service providers, government agencies and / or legally authorized other third such special people we can transfer (share) to individuals. Your personal data may be transferred to another company in the event of the transfer, ownership change or restructuring of Enterprise Holdings' subsidiaries or assets (partially or completely). Enterprise Holdings Group means the affiliates and franchising licensees of Enterprise Holdings Inc. located in the EU and USA. You can find a list of organizations in the Enterprise Holdings Group here: https://www.enterprise.com/en/privacy-policy.html?icid=footer.legal-_-privacy-_-ENUS.NULL#DataControllers and https: / /www.enterprise.com/en/privacy-policy/licensees.html. We would like to state that if the location of the recipient of your personal data is considered to be a country that does not have a sufficient level of protection by law, we will provide the necessary levels of protection legally and / or we will obtain your explicit consent to the transfer if legally necessary. 5. Your Rights under the KVKK

In accordance with KVKK, by applying to us, your personal data; a) learning whether it is processed or not, b) requesting information if processed, c) to learn the purpose of processing and whether it is used in accordance with its purpose, d) To know the third persons to whom they are transferred domestically or abroad, e) requesting correction if it is incomplete or incorrectly processed, f) To request deletion or destruction in accordance with the conditions stipulated in Article 7 of the KVKK, g) To request notification of the transactions made in accordance with subparagraphs (e) and (f) to the third parties to which they are transferred, h) To object to the emergence of a result against you, since it is analyzed exclusively by automated systems, i) You have the right to demand that the loss be compensated if you suffer damage due to illegal processing. Your written request in accordance with KVKK Kavacık Jul Motorway Junction, Gürbaş Plaza Floor: 1 Rüzgarlıbahçe - Beykoz / Istanbul / Turkey to address directs or Personal Data Protection, you can exercise your rights with the other methods described above by the Board. Our company will evaluate and finalize your request in accordance with KVKK. In order for us to answer your request correctly, we ask you to clearly state which personal data your request is related to. We will finalize your requests in line with KVKK free of charge within thirty days (if there is no cost) at the latest. However, if the transaction requires a separate cost, the fee in the tariff to be determined by the Personal Data Protection Board may be charged. If the answers to the applications exceed 10 (ten) pages, a transaction fee of 1.00 (one) TL will be charged for each page. If the answer is requested in the recording medium such as CD, flash memory, a fee will be charged according to the cost of the desired recording medium.