Personal Data Protection Law

Korp Software and Information Technologies Company Processing of Personal Data Clarification Text

What is KVKK?

The Law on the Protection of Personal Data (KVKK) was adopted by the Turkish Grand National Assembly on 24.03.2016 and Officially dated 07.04.2016 and numbered 29677 It was published in the Gazette and entered into force.

The law is based on the compatibility of all data processing persons and institutions within the framework of basic purposes such as ensuring the confidentiality of personal data, protecting it and preventing its unauthorized use. Our Bank , like all institutions, is obliged to comply with this Law and personal data processed in all processes of our Bank are within this scope.

What is Data Processing?

Any operation performed on personal data is considered as "data processing". Thus, archiving, storing, changing, rearranging, disclosing, transferring, analyzing and classifying data are within the scope of data processing.

Who is the Relevant Person / Data Owner?

One of the expressions frequently used in the law and in our corporate policies is "relevant person" or "data owner" . Refers to natural persons whose personal data are processed.

Who is the Data Controller?

The data controller is the natural or legal person who determines the purposes and methods of processing personal data and is responsible for the establishment and management of the data recording system. At this point, our Bank; becomes the Data Controller for the data of our customers, visitors and employees.

Who is Data Processor?

Data processors are natural or legal persons who process data on behalf of the data controller. These persons may also be a separate natural or legal person authorized by the data controller to process personal data.

Data Processing Terms

All data controllers have the right to process data only when the following conditions are met or the data subject gives explicit consent:

Korp Software and Information Technologies Limited Company, we attach importance to the security of your personal data. We should inform you that we reserve the right to update the text of this Statement on the Protection of Personal Data at any time within the framework of changes that can be made in the current legislation, Board Decisions, and judicial decisions. With this sensitivity, it is of great importance for our Company that all personal data belonging to all persons related to the Institution, including those who benefit from our services, are processed and preserved in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK Law”) . Your personal data will be processed by our institution and all kinds of operations performed on your information, including obtaining, recording, storing, preserving, changing, disclosing, transferring, making available by automatic or non-automatic means, mean "processing of personal data". We present to your information. Including in this context:

-Law No. 6563 on the Regulation of Electronic Commerce also includes a provision on the protection of personal data.

Penal sanctions have been envisaged in some cases for the protection of personal data through the provisions of the Turkish Penal Code No. 5237.

-As a matter of fact, data must be collected and used in order to fulfill our obligations arising from the Law No. 6502 on the Protection of the Consumer and the Regulation on Distance Contracts.

-Besides, there are data that our institution is obliged to keep in accordance with the Law No. 6769. Pursuant to this responsibility, as defined in the KVKK Law, we process your personal data as “Data Controller” as explained below and within the limits set by the legislation.

After the examination of this clarification text by you and the notification regarding it to our institution, a consent text will be submitted by our institution so that all kinds of personal data can be used, limited to the requirements of this relationship, within the scope of the business and commercial relationship that our institution is a party to. It should be noted that it is not necessary to sign the relevant consent text. In this context, it is essential for the validity of the consent text to be approved, if deemed appropriate, after this clarification text is examined in detail and adequately, and after all your questions, if any, are forwarded to our institution.

1) Data Controller and Representative

In accordance with the KVKK Law, your personal data; As the data controller, it can be processed by our Institution within the scope described below.

2) Collection, Processing and Processing Purposes of Personal Data

Your personal data, in order to ensure that the activities performed by our Institution are carried out in accordance with the relevant legislation and the procedures of our Institution, all relevant national/international legislation and secondary regulations published by the national/international competent authorities based on them, or in relation to them or related to their activities. In order to fulfill its obligations and commitments under the contracts to which it is a party;

• Identity Information (name and surname , mother - father name, mother's maiden name, date of birth, place of birth, marital status, copy of identity card and serial number , TR identity number , passport information (for foreigners);
• Contact Information (address, e-mail address, contact address, registered e-mail (KEP) address, telephone number )
• Location information (location information of its location)
• Customer Transaction (call center records, invoice, promissory note, check information, information in box office receipts, order information, request information)
• Risk Management (information processed to manage commercial, technical and administrative risks)
• Finance (balance sheet information, financial performance information, credit and risk information, asset information)
• Audio and Audio Recordings (visual and audio recordings)
• Physical Venue Security (employees and visitors entry and exit registration information, camera recordings)
• Transaction Security (IP address information, website login and exit information, password and password information)
• Marketing (shopping history information, survey, cookie records, information obtained through campaign work) and in addition to this information;

Establishing contracts for all kinds of products and services you request from our institution, arranging all other records and documents (on paper or electronically), making customer satisfaction calls, fulfilling sms / mail sending requests, presenting the products and services in question, and uninterruptedly as required. To continue, to carry out the necessary activities in terms of service and product, to perform participant and customer transactions, to process in accordance with the Terms of Service or the contract specific to the relevant product, to resolve complaints in terms of the services offered and to improve the services, Fulfilling the instructions of the customers that are found in accordance with the law and the contract, Human resources policies of our Institution and processes, determination of the scope of service, product and marketing activities, determination and evaluation of customers' purchasing habits, determination and statistics of the marketing and service delivery process and results 5, 6 of the KVKK Law for the purposes of being able to be evaluated and executed as a legal entity, to be used as evidence in case of a legal dispute, to fulfill our obligations in accordance with the legislation and international rules to which our institution is subject, to protect and store the data that are required to be protected and stored by the administration for certain periods. .,8. and within the scope of the personal data processing conditions and purposes specified in Articles 9.

3) To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your collected personal data; In order to ensure that the activities carried out by our Institution are carried out in accordance with the relevant legislation and the procedures of our Institution, all relevant national/international legislation and secondary regulations published by the national/international competent authorities based on them, or in relation to them or in relation to their activities;

• Confirming the identity information of the shopper/shopper via the website, mobile applications,
• Establishment of the contract requested by the Customer in terms of service and product,
• Recording the address and other necessary information for communication,
• To communicate with the customers about the conditions, current status and updates of the contracts concluded under the relevant articles of the Law on the Protection of the Consumer in order to establish a distance sales contract and/or sales contract, and to provide the necessary information,
• Arrangement of all records and documents that will be the basis of the transaction in electronic or paper environment,
• Fulfilling the necessary obligations in accordance with the national/international legislation to which our institution is subject,
• Fulfilling the obligations to which our institution is subject in accordance with the contract concluded in the context of national/international legislation to which our institution is subject,
• To be able to provide information to public officials, upon request and in accordance with the legislation, on matters related to public safety,
• In order to provide customers with a better shopping experience, providing information to customers about products and services that customers may be interested in by taking into account their preferences, informing customers about campaigns, conducting activities to increase user experience by monitoring consumer movements, market research, planning and implementation of after-sales service activities and management of relations. organization and implementation,
• Increasing customer satisfaction, making customer satisfaction calls, fulfilling sms / mail sending requests, determining the purchasing habits of customers who shop from the website and / or mobile applications, conducting direct and indirect marketing, personalized marketing and remarketing activities to be arranged according to the preferences of the customer to use it in marketing and advertising activities on behalf of, and within this scope, to provide information in electronic and/or physical environment through contracted organizations, to determine the target audience, to make cross-selling, to carry out activities such as personalized segmentation, target setting, analysis and internal reporting,
• D studies of the operation of the website and mobile application of our institution and personalizing it according to consumer requests, preferences and needs,
• Fulfilling its obligations (identification, information storage, reporting, informing) and commitments within the scope of contracts to which our institution is a party;
• Elimination of customer complaints and improvement of services in terms of the services offered by our institution,
• Fulfilling the instructions of the customers, which are found in accordance with the law and the contract,
• Planning the human resources policies and processes of our institution,
• Determining the scope of service, product and marketing activities, determining the results and statistically evaluating and executing them,
• It can be used as evidence in case of a legal dispute,
• Fulfilling our obligations in accordance with the national and international legislation and rules to which our institution is subject,
• In addition to the sales and marketing activities of products and/or services, within the framework of planning and maintaining, improving, determining and developing alternative production techniques, developing and/or increasing loyalty to the products and/or services offered by our organization,
• The data, which are required to be protected and stored for certain periods by the Administration, are processed in accordance with the consent of the customers and the provisions of the legislation for the purposes of protecting and storing the data for the periods specified in the relevant legislation.

Any personal data available within the scope of the above-mentioned may be submitted to the authorities of the institution, third parties, domestic and foreign business partners, solution partners, suppliers, legally authorized public institutions and private persons, as corporate, commercial and data controllers and/or data processors, completely or partially obtaining, recording, storing, changing, updating, periodically checking, rearranging, classifying, keeping for the period required for the purpose for which they are processed or for the period stipulated in the relevant law, in case of legal or service-related actual requirements, with which our institution works or In accordance with the legislation that our Institution is subject to, including sharing it with the public institutions and organizations that it is legally obliged to and/or with 3rd party service providers, supplier companies residing in Turkey or abroad, and transferring it abroad in case of legal or service-related actual requirements. requested and authorized to obtain It can be transferred to individuals and institutions within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK Law.

4) Method and Legal Reason for Personal Data Collection

Although your personal data may vary depending on your relationship with our Institution; It can be collected verbally, in writing or electronically through automatic or non-automatic methods, units and offices of our Institution, website, social media channels, mobile applications and similar means. Your personal data collected in this way can also be processed and transferred for the purposes specified in Articles (2) and (3) of this text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK Law. In addition, when you use our website to use the services of our Agency, when you visit our Agency or our website, and when you attend trainings, seminars or organizations organized by our Agency, your personal data may be processed for the purposes stated in article 3.

Again, if you use our institution's website; stores the information collected by our institution in order to form an opinion about your preferences. In order to make special promotions for you on the website of our institution, to organize promotional and marketing activities, to improve the content of the website and/or to determine your preferences; can monitor your browsing information and/or your usage history on the site.

Again, our customers who shop via the website of our institution and/or mobile with their credit card, by using the credit card, bank transfer, payment system; They are deemed to have consented to sharing their personal data with Ziraat Bank, Garanti Bank, Kuveytturk Bank, Transferwise , Paypal , Webmoney , Alipay , Stripe , from which this service is purchased, and the processing by the payment company, whichever is chosen as the payment method. In this respect, it is also necessary to read and examine the payment policy page of the relevant payment systems before shopping with a credit card. Our institution's website can provide links to websites belonging to third parties and institutions other than our institution. Although these links are used for the purpose of providing convenience for obtaining information and/or providing a service, you should also review the privacy rules and cookie policies of these sites if you are directed to the links of other websites, companies and individual institutions other than our institution's website.

In similar cases; Our institution has no responsibility for the acquisition and processing of your personal data by websites other than its own website. In order to be informed about the current business and transactions of the relevant persons and institutions in terms of confidentiality and personal data, it is necessary to examine the information on the relevant sites first and to convey your questions, if any, to the relevant site management.

5) How Long Will Your Personal Data Be Processed?

Our institution determines the storage periods of personal data by taking into account the national and international legislation in force and the purposes of processing the data subject to the process. In accordance with KVKK , your personal data processed for the purposes specified in this Clarification Text, KVKK art. Your personal data will be deleted, destroyed or anonymized and continued to be used by us after 24 months, when the purpose for which it is to be processed in accordance with 7/f.1. ceases to exist and/or all the periods, including the statute of limitations, for which we are required to process your data in accordance with the legislation, expire.

6) Your Rights Enumerated in Article 11 of the KVKK Law as Personal Data Owner;

As personal data owners, if you submit your requests regarding your rights to our Institution through the methods set out below in this Clarification Text, our Institution will finalize your request as soon as possible, depending on the nature of the request. In this context, personal data owners;

• Learning whether personal data is processed or not,
• If personal data has been processed, requesting information about it,
• Learning the purpose of processing personal data and whether they are used in accordance with its purpose,
• Knowing the third parties to whom personal data is transferred at home or abroad,
• Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
• Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing have disappeared, although it has been processed in accordance with the provisions of the KVKK Law and other relevant laws, and requesting the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
• Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• In the event that personal data is damaged due to unlawful processing, it has the right to demand the compensation of the damage.

Pursuant to paragraph 1 of Article 13 of the KVKK Law, you can send your request to exercise your above-mentioned rights in writing to the address of Korp Yazılım ve Bilgi Teknolojileri Limited Şirketi, Beşevler Mahallesi Yıldırım Caddesi 274/1C Nilüfer/Bursa. In order to fulfill these requests, if our institution requires an expense, the article titled "Application to the Data Controller" of the KVKK . We reserve the right to demand from you according to the tariff specified in 13. Since the Personal Data Protection Board has not determined any method at this stage, you must submit your application to our Institution in writing in accordance with the KVKK Law. In this framework, the channels and procedures to submit your application in writing to our Institution within the scope of Article 11 of the KVKK Law are explained below.

Your request, including the necessary information identifying your identity to exercise your above-mentioned rights, and your explanations regarding your right that you request to exercise from the rights specified in Article 11 of the KVKK Law; Korp Software and Information Technologies Limited Company, you can personally send your identity documents to Beşevler Mahallesi Yıldırım Caddesi 274/1C Nilüfer/Bursa, send your request through a notary public or other methods specified in the KVKK Law, or send your request securely to [email protected]. electronically signed. If you would like to receive more detailed information regarding the information given above, you can contact us at 0090 850 888 90 60 or by e-mail at [email protected] for detailed information.

Without prejudice to the cases stipulated in Article 28 of the Law titled Exceptions, your rights that you can exercise by applying to our Company within the framework of article 11 of the Law are as follows:

• Learning whether your personal data is processed,
• If your personal data has been processed, requesting information about it,
• To learn the purpose of processing your personal data and whether they are used in accordance with the purpose,
• Knowing the third parties to whom your personal data is transferred, in the country or abroad,
• Requesting correction of your personal data in case of incomplete or incorrect processing, requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• Requesting notification of the transactions made pursuant to clauses (d) and (e) above, to third parties to whom your personal data has been transferred,
• Objecting to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• Requesting compensation for your damage in case you suffer damage due to unlawful processing of your personal data.

We would like to point out that we reserve the right to demand the expenses to be incurred by our company in order to fulfill your requests, according to the tariff specified in Article 13 of the Law, titled Application to the Data Controller.

Official dated 7 April 2016 and numbered 29677 Law No. 6698 on the Protection of Personal Data, published in the Gazette and entered into force

Complaint Notification - E-Mail: [email protected]

Complaint Notification - Phone: 0090 850 888 90 60

Complaint - Address: BEŞEVLER MAHALLESİ YILDIRIM AVENUE 274/1C NILUFER/BURSA