Personal Data Protection

Personal Data Processing Disclosure Statement

As Türk Ticaret Bankası A.Ş., we attach great importance to the privacy and protection of your personal data. With an awareness of this responsibility, we carry out the processes of processing, transferring, storing, destroying, and protecting your personal data in full compliance with the Personal Data Protection Law No. 6698 ("PDPL") and all other applicable legislation.

The primary purpose of the PDPL is to protect individuals' fundamental rights and freedoms, especially the right to privacy, in the processing of personal data. Within this scope, our Bank takes all necessary technical and administrative measures to ensure the protection and security of the personal data processed.

The "Personal Data Processing Disclosure Statements" presented below have been prepared to inform you, within the scope of the Personal Data Protection Law No. 6698, about the personal data processed by Türk Ticaret Bankası A.Ş., the methods by which your personal data are collected, the legal grounds and purposes for processing your personal data, the persons/institutions to whom your personal data are transferred and the purposes of such transfers, as well as the rights of natural persons whose personal data are processed.

We would like to emphasize that we diligently fulfill our legal obligations in all processes concerning the protection of your personal data.

CUSTOMER ONBOARDING / ACCOUNT OPENING PERSONAL DATA PROCESSING DISCLOSURE STATEMENT

1. DATA CONTROLLER

Data Controller Title	Türk Ticaret Bankası Anonim Şirketi
Address	Barbaros Mah. Mor Sümbül Sok. WBC İş Merkezi No:9 Ataşehir / İstanbul
Mersis (Central Registration System) No. / Registry No.	0876005425600014 / 2883

2. PERSONAL DATA PROCESSED BY US

PERSONAL DATA CATEGORY	PERSONAL DATA
Identity Information	First Name, Last Name, Mother's and Father's Name, Date of Birth, Place of Birth, Marital Status, Identity Card Serial Number, Turkish ID Number, Signature Declaration, etc.
Contact Information	Address Number, E-mail Address, Contact Address, Registered Electronic Mail (KEP) Address, Telephone Number, etc.
Risk Management Information	Information Processed for Risk Management, TBB Risk Center Data, etc.
Professional Experience Information	Workplace Working Type, Workplace Employment Period, Information Regarding Your Workplace, etc.
Transaction Security Information	IP address information, Website Login and Logout Information, Password Information, etc.
Customer Transaction Information	Deposit Account Transactions, Limit and Balance Information, Customer Information, etc.
Audio and Visual Records	Call Center Voice Recordings, Video Interview Recordings, etc.
Family Members and Relatives Information	Marital Status Information, Parent and Child Information, etc.
Financial Information	Asset Information, Balance Sheet Information, Financial Performance Information, etc.
Legal Proceedings and Compliance Information	Information Required for Correspondence with Judicial Authorities, Information in Lawsuit or Enforcement Files, Encumbrance Information, etc.
Audit and Inspection Information	Internal Control and Inspection Information, etc.
Marketing Information	Cookie Records, Campaign Activities, etc.
Request and Complaint Management Information	Customer Request and Complaint Records, etc.
Location Information	Address, Information Regarding Your Location, etc.

 METHOD OF COLLECTING PERSONAL DATA

Our Bank collects personal data from the relevant individual or third parties through the following methods:

Through face-to-face service channels (Head Office and branches, support service/external service providers and other institutions from which we receive services, companies operating as intermediaries/agents, public opinion research companies) by non-automated methods,

Through recordings of interviews conducted with our Customer Communication Center by automated methods,

Through our Bank's mobile applications, website, internet banking applications, and ATMs by automated methods,

Through forms, instructions, agreements, telephone, e-mail, fax, SMS, courier, and postal services in electronic and/or physical environments,

Through companies established by the Banks Association of Türkiye Risk Center or by at least five banks or financial institutions (such as Bankalararası Kart Merkezi, Kredi Kayıt Bürosu, etc.) by automated methods,

From public institutions and organizations, official authorities (Identity Sharing System, Address Sharing System, Notaries, etc.),

Institutions and organizations that are parties to our Bank's products and for whose payments we act as intermediary,

From our business and program partners through automated and non-automated methods, via system integration, e-mail, and forms in electronic and/or physical environments.

3. PURPOSES OF PROCESSING PERSONAL DATA AND LEGAL GROUNDS

Personal data are processed by our Bank for the following purposes and based on the following legal grounds:

Data Categories	Processing Purposes	Legal Grounds
Identity, Contact, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Audio and Visual Records, Family Members and Relatives Information	Receiving and evaluating applications for account opening and related products and services Providing products and services related to account opening	Being directly related to the establishment or performance of a contract Being mandatory for the fulfillment of our legal obligations Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Identity, Contact, Professional Experience, Customer Transaction, Audio and Visual Records	Identification and verification of our customers Ensuring customer information is accurate, complete, and up to date	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law
Identity, Contact, Legal Proceedings and Compliance, Audio and Visual Records, Transaction Security, Family Members and Relatives Information	Execution of our contractual processes	Being directly related to the establishment or performance of a contract Being mandatory for fulfilling our legal obligations Explicitly provided for by law
Identity, Contact, Location, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Audio and Visual Records, Request and Complaint Management Information, Audit and Inspection Information, Legal Proceedings and Compliance Information, Family Members and Relatives Information	Conducting activities in compliance with legislation	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law
Identity, Contact, Location, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Marketing, Audio and Visual Records, Request and Complaint Management Information, Audit and Inspection Information, Legal Proceedings and Compliance Information	Receiving and evaluating suggestions for improving business processes Conducting analyses Carrying out infrastructure, maintenance, repair, analysis, and development processes of banking systems Managing information systems and transaction security processes Ensuring operational security	Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms Where your explicit consent is obtained
Identity, Contact, Visual and Audio Records	Carrying out corporate communication and event activities	Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms Where your explicit consent is obtained
Identity, Contact, Location, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Marketing, Audio and Visual Records, Request and Complaint Management Information, Audit and Inspection Information, Legal Proceedings and Compliance Information	Carrying out storage and archiving activities	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law Where processing is necessary for the establishment, exercise, or protection of a legal right
Identity, Contact, Customer Transaction, Finance	Conducting budgeting, finance, and accounting processes	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Identity, Contact, Location, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Marketing, Audio and Visual Records, Request and Complaint Management Information, Audit and Inspection Information, Legal Proceedings and Compliance Information, Family Members and Relatives Information	Monitoring and conducting legal affairs; Providing information and reporting to authorized persons, institutions, and organizations (BRSA, Banks Association Risk Center, FCIB, BKM, Courts, etc.) within the scope of legal regulations and obligations	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law Where processing is necessary for the establishment, exercise, or protection of a legal right Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Identity, Contact, Customer Transaction, Risk Management, Financial, Audio and Visual Records, Legal Proceedings and Compliance Information	Collection of our Bank's receivables, administrative or legal follow-up procedures	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law Where processing is necessary for the establishment, exercise, or protection of a legal right Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Financial, Contact, Identity, Professional Experience, Customer Transaction, Marketing	Conducting segmentation studies to determine customer service standards and products to be offered accordingly Determining or improving strategies related to the provision of products and services	Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Identity, Contact, Location, Customer Transaction, Transaction Security, Professional Experience, Risk Management, Financial, Audio and Visual Records, Request and Complaint Management Information, Audit and Inspection Information, Legal Proceedings and Compliance Information	Conducting risk management and audit activities	Being mandatory for the Bank to fulfill its legal obligations Explicitly provided for by law
Identity, Contact, Customer Transaction, Professional Experience, Risk Management, Marketing, Financial, Location, Family Members and Relatives Information	Conducting our marketing processes Creating loyalty to our products or services Conducting cross-selling, digital and/or other marketing and promotional/advertising activities Organizing campaigns or promotions Conducting data analytics and modeling studies	Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms Where your explicit consent is obtained

TO WHOM AND FOR WHAT PURPOSE PERSONAL DATA MAY BE TRANSFERRED

Personal data are transferred to the parties listed below for the following purposes and legal grounds:

Recipient Persons/Organizations	Transfer Purposes	Legal Grounds
Business Partners (Refers to parties established domestically and/or abroad with whom the Bank has cooperation, partnership, program partnership, co-branding, or agency relationships for purposes such as the sale, promotion, marketing, after-sales support of the Bank's products and services, and joint customer loyalty programs.)	Provision of the products and services you request from our Bank Fulfillment of contractual obligations, requests, and instructions concluded with our Bank	Being directly related to the establishment or performance of a contract Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Institutions Whose Transactions We Intermediate (Refers to companies whose activities are intermediated in accordance with capital markets regulations.) Fulfillment of our legal obligations; Provision of our Bank's services; Performance of agency and intermediary activities	Explicitly provided for by law Being mandatory for fulfilling our legal obligations Being directly related to the establishment or performance of a contract Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Suppliers (Refers to all third-party service providers from whom goods and services are procured, such as support institutions, outsourcing providers, law firms, consultancy providers, courier companies, for the provision of banking services and conduct of our activities.)	Enabling service providers to provide support and consultancy services to our Bank	Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Legally Authorized Institutions and Organizations (Refers to private and public institutions and organizations authorized to request information and documents due to applicable legal regulations or legal proceedings, institutions to which information transfer is mandatory under legislation, and institutions with which we verify information to ensure legal transaction security. For example: BRSA, CMB, CBRT, FCIB, The Banks Association of Türkiye Risk Center, KOSGEB, GİB (Revenue Administration), Treasury Undersecretariat, SSI, judicial authorities, etc.)	Fulfillment of legal reporting and information requests Conducting legal audit activities Managing legal processes Ensuring compliance with legislative requirements	Explicitly provided for by law Being mandatory for fulfilling our legal obligations Where processing is necessary for the establishment, exercise, or protection of a legal right
Domestic and Foreign Banks, Payment Service Providers, and Institutions and Organizations within International or Domestic Payment Systems (Refers to payment service providers, financial institutions and organizations, and institutions within payment systems with which we cooperate.) Conducting banking activities and fulfilling our legal obligations	Being directly related to the establishment or performance of a contract Processing being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Institutions and Organizations that are Parties to Our Bank's Products/Services and for Whose Payments We Act as Intermediary (Refers to natural and legal persons who may be parties to the relevant products and services offered through our Bank.) Provision of the products and services you request from our Bank; Fulfillment of contractual obligations, requests, and instructions concluded with our Bank	Being directly related to the establishment or performance of a contract Processing of your personal data being necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms
Natural Persons or Private Legal Entities Specified in Your Instructions upon Your Instruction to Our Bank	Fulfillment of your instructions	Being directly related to the establishment or performance of a contract

5- YOUR RIGHTS

Pursuant to Article 11 of the PDPL, you have the following rights regarding your personal data:

To learn whether your personal data are processed,

To request information if your personal data have been processed,

To learn the purpose of processing your personal data and whether they are used in accordance with that purpose,

To know the third parties to whom your personal data have been transferred domestically or abroad,

To request correction of your personal data if they are incomplete or inaccurate and request notification of such correction to third parties to whom the personal data have been transferred,

To request the deletion or destruction of your personal data if the reasons requiring processing cease to exist despite having been processed in accordance with Law No. 6698 and other relevant legislation, and to request notification of such action to third parties to whom the personal data have been transferred,

To object if you believe that a result against you has arisen through the analysis of your processed data exclusively by automated systems,

To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

To exercise the rights listed above, you may submit your requests to our Bank by:

Visiting our branches for identity verification,

Through a notary public to: Barbaros Mah. Mor Sümbül Sok. WBC İş Merkezi No:9 Ataşehir / İstanbul,

By secure electronic signature turkticaretbankasi@hs01.kep.tr,

By using the e-mail address registered in our Bank's system and sending your request to kvkk@turkbank.com.tr.

Your application must include:

a) Your name, surname, and signature if the application is submitted in writing,

b) Republic of Türkiye ID Number for Turkish citizens; nationality, passport number, or identity number if available for foreigners,

c) Residential or workplace address for notification,

ç) E-mail address, telephone number, and fax number, if any, for notification,

d) The subject of your request.

Your request will be concluded free of charge as soon as possible and no later than thirty (30) days. If processing your request requires an additional cost, the fee determined by the Board's tariff may be charged to you.

BANKING LAW RISK GROUP PERSONAL DATA PROCESSING DISCLOSURE STATEMENT

Within the scope of the Banking Law No. 5411, you, your spouse, your children, and partnerships in which these persons are members of the board of directors or general managers, or which they or a legal entity jointly or individually, directly or indirectly control or participate in with unlimited liability; as well as the qualified shareholders, members of the board of directors, general manager, deputy general managers of a bank, managers serving in positions equivalent to or higher than these by virtue of their authority and duties even if employed under different titles, together with their spouses and children, and partnerships which they jointly or individually, directly or indirectly control or in which they are unlimited liability partners or members of the board of directors or general managers, and natural and legal persons having suretyship, guarantee, or similar relationships of such magnitude that the financial difficulty of one would result in the financial difficulty of one or more others, constitute a risk group. In addition, other natural and legal persons who will fall within the scope of the risk group shall be determined by the Banking Regulation and Supervision Agency (BRSA) of the Republic of Türkiye.

Within this scope, you may access detailed information regarding your personal data processed and your rights in the Information Notice on the Processing of Personal Data of Persons Subject to the Risk Group.