Information Notice on the Processing of Personal Data

This information notice has been prepared by TURK Elektronik Para A.Þ. (“Company”) in its capacity as data controller, in accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data (“Law”) and the Communiqué on the Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform, in order to fulfill the obligation to inform regarding the processing of your personal data.

Your Processed Personal Data, Purposes and Methods of Processing

The personal data you may share via param.com.tr include:

• Identity Data (name, surname),
• Contact Data (phone number, email address),
• Financial Data (account activity, transaction details, etc.),
• Usage Data (information about which services and features you use and how you use them—personal preferences, technical data generated through your use of the services such as webpage response times, download errors, and date and time of use),
• Call Center Interactions (recorded phone and video calls, audio and video recordings, chat conversations [via chatbot, etc.], and email correspondence),
• Special Categories of Personal Data (your biometric data including face, voice, signature, which are processed during identity verification through video call as part of biometric verification),
• Mobile App Data (all content you upload to the app such as photos or receipts, Param Card account information including card number, IBAN, national ID number, and other required account opening details; location data if permitted, browser usage information, websites visited),
• Public or Company-Followed Social Media Activity (information related to your profile from your social media accounts),
• Cookies (targeting, marketing, and advertising cookies used to promote products and services both on our website and other platforms, to display personalized ads in cooperation with our partners, and to measure ad campaign effectiveness. Statistical data about ads encountered by the website user and data obtained through marketing cookies may be shared with other institutions or advertisers). (For more detailed information about cookies, please refer to our Cookie Policy.)

Your personal data are processed based on the legal grounds specified in Article 5 of the Law:

• “It is necessary to process personal data of the parties of a contract, provided that it is directly related to the establishment or performance of the contract,”
• “It is expressly stipulated by law” and,
• “It is necessary for the data controller to fulfill its legal obligation,”

They are processed for the following purposes:

• Use in all products and services provided as an electronic money institution,
• Identity verification,
• Execution of business and contractual processes,
• Verification of the identities of individuals performing transactions or on whose behalf transactions are conducted before processing,
• Retention, reporting, and provision of requested information to public authorities such as the BRSA, CBRT, MASAK for at least 10 years as legally required,
• Planning and execution of promotional and recommendation activities tailored to user preferences and habits,
• Measuring customer satisfaction,
• Planning and/or execution of audit activities,
• Monitoring legal processes and fulfilling legal obligations,
• Managing finance, accounting, and invoicing processes.

Special categories of personal data (such as biometric data for identity verification via liveness test) are processed based on your explicit consent in accordance with Article 6 of the Law.

Your personal data for commercial communication purposes (name, surname, phone number, email) will be processed based on your explicit consent under the Law on the Regulation of Electronic Commerce, Article 6, and the KVKK, in order to send marketing communications, advertisements, promotions, and campaign notifications via SMS, email, or phone calls.

Method of Collecting Personal Data

Your personal data are collected lawfully, accurately, and kept up to date when necessary, processed for explicit, legitimate purposes, and retained for as long as required by relevant legislation or the purpose for which they are processed. Data are collected through our websites and payment pages, uploaded into CRM and financial systems via automated methods.

Transfer of Your Personal Data

Your personal data may be shared—based on the legal grounds specified in Article 5 of the Law:

• “Necessary for the performance of a contract,”
• “Necessary for the legitimate interests of the data controller, provided that the data subject’s fundamental rights and freedoms are not harmed,”
• “Necessary for compliance with legal obligations,”

With the following parties:

• Regulatory and supervisory authorities such as BRSA, CBRT, MASAK and other public institutions upon request or to fulfill legal/administrative obligations,
• Business partners/service providers with whom we collaborate in connection with electronic money issuance,
• Suppliers from whom we procure services to fulfill or improve our services on param.com.tr,
• IYS (Message Management System), a subsidiary of the Union of Chambers and Commodity Exchanges of Turkey, for the secure storage of commercial communication permissions and for handling complaints, based on your explicit consent,
• CRM service providers for the integration of commercial communication permissions, based on your explicit consent,
• Our main shareholder, domestic affiliates, or shareholders, under the relevant provisions of the Turkish Commercial Code and other applicable legislation for fulfillment of legal obligations.

Your Rights as a Data Subject

Pursuant to Article 11 of the Law, you have the right to:

a) Learn whether your personal data are being processed,
b) Request information if your data have been processed,
c) Learn the purpose of processing and whether they are used appropriately,
ç) Learn about third parties to whom data are transferred locally or internationally,
d) Request correction of incomplete or inaccurate data,
e) Request deletion or destruction of your personal data within the framework of Article 7 of the Law,
f) Request notification to third parties to whom your data have been transferred about the actions taken under (d) and (e),
g) Object to outcomes against you arising from analysis exclusively via automated systems,
ð) Request compensation if you suffer damage due to unlawful processing.

You can submit your requests, along with identity verification information, in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller", in writing to TURK Elektronik Para A.Þ. (MERSIS No: 0871053107900001) at Prof. Dr. Ahmet Taner Kýþlalý Mahallesi 2405 Sokak No: 5 Çankaya/Ankara, or via registered electronic mail to [email protected].