| Personal Data Category | Purpose | Legal Basis |
Identity Information, Contact Information, Customer Transaction Information, Professional Experience Information | Meeting identification and know-your-customer requirements by recording details such as address, occupation, income status, and the purpose of transactions. | Article 5/2-a of the PDPL: Explicitly stipulated by law.
Article 5/2-ç of the PDPL: It is mandatory for the data controller to fulfill their legal obligations. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Professional Experience Information | Processing and evaluating financing applications, assessing creditworthiness, and reviewing the financing history and credit conditions of the individual owners, partners, and managers of commercial customers. This includes handling information processes related to the banking products you utilize, as well as providing services and transactions through mobile applications and/or internet banking,
Conducting collateral evaluations, managing collateral processes, and performing information research related to lending. This involves overseeing and controlling credit monitoring, follow-up, intelligence, and collection processes, drafting and finalizing pledge contracts, and restructuring debt when necessary. | Article 5/2-a of the PDPL: Explicitly stipulated by law.
Article 5/2-c of the PDPL: Processing personal data of the parties involved in a contract is necessary if it is directly related to the conclusion or performance of that contract.
Article 5/2-ç of the PDPL: It is mandatory for the data controller to fulfill their legal obligations. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Professional Experience Information | Handling and evaluating credit card applications, measuring creditworthiness, and managing the allocation and operational processes of credit cards. This includes fulfilling the contractual obligations, managing collateral processes related to the card, conducting post-product operational tasks, delivering your card, and providing services and transactions related to your credit card via mobile applications and/or internet banking. | Article 5/2-c of the PDPL: Processing personal data of the parties involved in a contract is necessary if it is directly related to the conclusion or performance of that contract. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information | Conducting processes for detecting and reporting suspicious transactions. | Article 5/2- f of the PDPL: It is necessary for the legitimate interests of the data controller, provided it does not infringe upon the fundamental rights and freedoms of the data subject. |
Identity, Contact.
Finance, Professional Experience, Risk Management | Monitoring and reporting financial and accounting work, making improvements to the products offered to you.
| Article 5/2- f of the PDPL: It is necessary for the legitimate interests of the data controller, provided it does not infringe upon the fundamental rights and freedoms of the data subject. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Process Security | Managing legal processes related to outstanding debts, conducting control activities, overseeing litigation and enforcement proceedings, collecting debts owed to the Bank, protecting and exercising property and other rights, and selling movable and immovable properties acquired as offsets for debts. Managing contracts, initiating legal proceedings, and following legal processes for debt collection through contracted law firms and/or transferring receivables to asset management companies. Managing the Bank's legal, financial, commercial, compliance, and reputation risks; taking necessary actions to protect our rights in disputes; developing our restructuring policy for debt collection; and conducting risk monitoring and analysis processes. Transferring your information to any company to which your debt is or may be transferred, following the assignment of our receivable from you. | Article 5/2-e of the PDPL: It is essential for the establishment, exercise, or protection of a right.
Article 5/2- f of the PDPL: It is necessary for the legitimate interests of the data controller, provided it does not infringe upon the fundamental rights and freedoms of the data subject. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Legal Action Information, Location | Conducting valuation efforts for the sale of the Bank's assets or securities based on them; performing valuation, rating, and support services; and conducting independent audit activities and service procurements. Analyzing, developing, and maintaining the application management operations of Bank systems; conducting and planning information security processes; and establishing, managing, auditing, and implementing the information systems infrastructure, Conducting segmentation for improving the products and services offered to you | Article 5/2- f of the PDPL: It is necessary for the legitimate interests of the data controller, provided it does not infringe upon the fundamental rights and freedoms of the data subject. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Legal Transaction Information, Professional Experience Information, Audiovisual Information, Process Security, Physical Location Security | In accordance with Law No. 6415 on the Prevention of Financing Terrorism and Law No. 5549 on the Prevention of Laundering Proceeds of Crime, our institution ensures compliance with all obligations and activities set forth by both national and international legislation. Exchanging information with institutions, organizations, banks, potential buyers, and the risk center as required by the provisions of the Banking Law No. 5411; preparing consolidated financial statements for parent companies; and conducting risk management and internal audit practices. | Article 5/2-a of the PDPL: Explicitly stipulated by law.
Article 5/2-ç of the PDPL: It is mandatory for the data controller to fulfill their legal obligations. |
Identity Information, Contact Information, Customer Transaction Information, Financial Information, Legal Action Information, Process Security, Physical Location Security. | We comply with obligations under the Banking Law, the Law on Bank Cards and Credit Cards, the Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, and related regulations. This includes obtaining approval for commercial electronic messages as per the Law on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, using the Commercial Electronic Message Management System (IYS) to manage the right to refuse and handle complaints, and cooperating with regulatory bodies and law enforcement agencies. To comply with the requirements of the Banking Regulation and Supervision Agency, Central Bank of the Republic of Türkiye, Capital Markets Board, Financial Crimes Investigation Board, Banks Association of Türkiye, Revenue Administration, Undersecretariat of Treasury, Social Security Institution, Merkezi Kayıt Kuruluşu A.Ş., KOSGEB, Republic of Türkiye Ministry of Treasury and Finance, Credit Bureau, Risk Center, and other authorities, we adhere to information storage, reporting, and disclosure obligations as specified by the Undersecretariat of Treasury and other authorities, and fulfill the requirements of the Regulation on Banks' Information Systems and Electronic Banking Services. Adhering to risk monitoring and disclosure obligations; planning financial risk processes; fulfilling the control responsibilities stipulated by legislation, particularly those related to internal systems, and sharing necessary information with relevant authorities when required. Fulfilling information storage, reporting, and disclosure obligations as required by authorized persons, institutions, and organizations. | Article 5/2-a of the PDPL: Explicitly stipulated by law. Article 5/2-ç of the PDPL: It is mandatory for the data controller to fulfill their legal obligations. |
Identity Information, Contact Information, Customer Transaction Information, Audiovisual Information, Professional Experience Information, Location, Financial Information, | Improving the quality of our products and services through promotional activities, marketing campaigns, and outreach efforts. This includes making calls for advertising and campaign purposes, sending SMS notifications, gathering your feedback through surveys and other methods, utilizing call records from the call center to enhance service quality, conducting analyses based on behavioral modeling, and providing you with tailored offers, products, and services | Article 5/1 of the PDPL: Having explicit consent. |