Data Privacy Notice Regarding Investment Activities

DenizBank A.Ş. Privacy Notice Text for Investment Services and Investment Transactions

This Privacy Notice Text Regarding Investment Services and Investment Transactions (“Privacy Notice Text”) offered together by DenizBank A.Ş. and Deniz Yatırım Menkul Kıymetler A.Ş, in which the bank operates as an intermediary in order transmission, within the scope of the Personal Data Protection Law (LPPD) No. 6698 for transaction brokerage, portfolio brokerage, services provided within the scope of custody activities and all kinds of investment services offered by Denizbank and activities related to investment services (collectively, “Investment Services”) without being limited to those listed, and your personal data we process during all transactions to be made by you within the scope of Investment Services (collectively “Investment Transactions”), has been prepared to inform you about the methods of obtaining your personal data, the legal reasons and purposes of processing your personal data, the persons/institutions to which your personal data is transferred and the purposes of the transfer and your rights.

As DenizBank A.Ş. we act as Data Controller in accordance with the LPPD, and we take the necessary measures to ensure the appropriate level of security in order to ensure that your personal data is processed and preserved in accordance with the law.

You can access the privacy notice texts of our Bank through the link https://www.denizbank.com/kvk

The table below shows information on our Bank that processes your personal data.

Address	Büyükdere Cad. No:141 Esentepe 34394 Şişli / İSTANBUL
Central Registry System / Registry No.	0292-0084-4960-0341 / 368587

Your personal data processed by our bank are listed in the table below on the basis of categories.

Data Category	Personal Data
Identity	Name-surname, mother’s and father’s name, mother’s maiden name, date of birth, place of birth, marital status, ID card serial number, Republic of Turkey ID number, etc.
Contact Information	Address number, e-mail address, contact address, registered e-mail address (KEP), telephone number, etc.
Legal Proceedings	Data such as information in correspondence with judicial authorities obtained due to legal disputes to which Denizbank A.Ş and Deniz Yatırım Menkul Kıymetler A.Ş are a party, information in the case file, information held within the scope of alternative dispute resolution, Data in all kinds of administrative and judicial authorities notified to our Bank,
Customer Transactions	Call center records, request and instruction information, transactions performed in our investment products and documents provided during the application for investment products (general and product-based risk notification forms, etc.), investment account movements, transactions carried out in our investment products and fees and commissions received related to these transactions, numbers for products and services received from our Bank or our subsidiaries, all capital market tools defined in Capital Markets Law numbered 6362, account numbers for products such as share certificates, MKK and Takasbank registration numbers, margin loan reference numbers, credit card numbers, account numbers, IBAN number, data regarding collection and payment activities etc.
Risk Management	Information processed to manage commercial, technical and administrative risks etc. (Ex. Risk monitoring and follow-up information, wealth data (vehicles and houses)), asset-income data, demographics, data obtained from Risk Center, Turkish Central Bank, Revenue Administration, Credit Bureau, KPS and APS, Credit Bureau indebtedness data, scoring data, information used for checking against fraud and money laundering, results of the Eligibility and Suitability tests applied so that you can benefit from the products and services within the scope of Capital Markets instruments (During these tests, information such as your age, education level, profession/commercial activity, work experience, experience in capital markets is obtained)
Finance	Balance sheet information, financial performance information, credit and risk information, wealth information, etc.
Professional Experience	Profession, title, work information, education status, etc.
Marketing	Shopping history, survey records, cookie records, other information that distinguishes digital identity, information obtained through campaigns, data obtained from the organizations with which we cooperate in advertising and marketing, etc.
Process Security	IP address information, electronic banking channels log in – log out information, password and passcode information, etc.
Video and Audio Records	Visual and Audio Records, etc. (e.g. call centre records, video-call records, photos, etc.)

We collect, use, share and keep your data in order to provide you with the products and Investment services you requested from us and share information. Your personal data may be collected directly from you or from third persons via methods that are automated, or not automated.

(i) Methods of Collecting Your Personal Data From You:

Your personal data in the categories of Identity, Contact Information, Legal Transactions, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records are obtained from you with automated methods and through physical environments (head office, branches, etc.) or digital media (mobile banking, website, customer communication center, etc.) in cases where you apply for our investment products.

(ii) Methods of Collecting Your Personal Data From Third Parties;

We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance, Marketing through the below entities and institutions or persons via automated methods:

System integrations shared through public institutions and organizations (eg. Identity Sharing System (“KPS”), Address Sharing System (“APS”) ,
Official institutions and organizations where your credit score information is available (eg Credit Bureau (“KKB”), Risk Center of the Banks Association of Turkey (“TBB Risk Center”)”,
Deniz Yatırım Menkul Kıymetler A.Ş; within the scope of the intermediation in the transmission of orders,
Parties, payment service providers, from whom our Bank receives services that are complementary or extensions of its activities, which mediate the establishment of a contractual relationship with our Bank, contracted organizations and support service and foreign service organizations and organizations from which we receive support or external service such as dealers, sales offices, electronic commerce sites (Ex: Mastercard),
Organizations with which we cooperate in advertising and marketing, such as websites that offer comparison opportunities, We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance through the below entities and institutions or persons via non-automated methods:
Revenue Administration, Social Security Institution and other public institutions and organizations and judicial authorities.

Personal Data Category	What we use your personal data for	Legal basis for doing so
Identity, Contact Information, Finance, Risk Management, Customer Transactions, Visual and Audio Records	To receive your application request regarding investment services and activities, to provide investment services and activities, to carry out operational processes and to evaluate your request	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(c) of LPPD; Processing of personal data belonging to the parties to the agreement is required, on condition that it is directly related to the establishment or performance of such agreement. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations. As per article 5/2(e) of LPPD; Data processing is mandatory to establish, exercise or protect a right.
Identity, Contact Information	To make necessary notifications regarding the product
Identity, Contact Information, Finance, Risk Management, Customer Transactions, Professional Experience, Visual and Audio Records	To fulfill the procedures regarding the products and services provided within the scope of intermediation for forwarding orders, general custody service, intermediation for transactions, intermediation for portfolio services and our limited custody activity permits, and to execute or develop the operational processes related to these so that these services or the related transactions can be provided and performed
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Process Security, Professional Experience	To check national and international lists as per legislation on the Prevention of Laundering Proceeds of Crime and Financing of Terrorism along with the Prevention of Weapons of Mass Destruction that our Bank is subject to, to fulfil know-your customer principle by identification, to ensure compliance with internal systems, risk monitoring and notification obligations, execute compliance processes,	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(c) of LPPD; Processing of personal data belonging to the parties to the agreement is required, on condition that it is directly related to the establishment or performance of such agreement. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations.
Identity, Finance, Contact Information, Legal Proceedings, Risk Management, Customer Transactions, Professional Experience, Process Security	To fulfill all our obligations such as reporting, storing and informing arising from the Banking Law, the Capital Markets Law, the Law on the Prevention of Laundering Proceeds of Crime, the Communiqué on Investment Institutions and other relevant legislation.	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations.
Identity, Finance, Marketing, Customer Transactions, Contact Information, Professional Experience, Risk Management	Concerning the banking, insurance, retirement, finance and capital market activities (including investment) products and services of our bank, its direct or indirect subsidiaries and shareholders and their subsidiaries and affiliates, and other entities the aforementioned companies do business with or act as an intermediate or an agency for, and all the other products and services provided by Denizbank A.Ş together with the aforementioned companies; For the purposes of explaining, promoting and marketing the related products and services, planning and implementing the promotion and communication activities, Providing offers containing data, audio and video content from all channels, including digital environments, social media channels, telephone, call center, electronic mail and short message services carrying out promotion, marketing, cross-selling and campaign activities and designing customized marketing and promotional activities for me, carrying out data analytics studies for credits, behavioral scoring, market research and marketing purposes in order to identify and develop suitable products and services for me, carrying out studies on customer satisfaction and experience and conducting surveys and statistics, Reviewing and analyzing your data, making the marketing messages/advertisements that you receive more relevant and attractive, following up on the advertising and marketing, Providing information on the products, services, campaigns, rewards, proposals, promotions, loyalty programs and contests that you may be interested in, Designing product, service and business models towards developing banking product and services and conducting works on segmentation	As per article 5(1) of LPPD; personal data cannot be processed without the explicit consent of the data subject. As per article 5/2(f) of LPPD; data processing is obligatory for the legitimate interests of the data controller

Your personal data is shared with the below parties in accordance with the Articles 8 and 9 of the LPPD, for the below reasons:

In order to be able to fulfill our regulatory reporting liabilities, carry out the regulatory and audit activities and to fulfill all other legal liabilities based on the provisions of the Banking Law, the Law on the Prevention of Laundering Proceeds of Crime, the Capital Markets Law and other applicable legislation; Financial Crimes Investigation Board and Revenue Administration, Banking Regulation and Supervision Agency, Personal Data Protection Agency, Capital Markets Board, Central Bank of the Republic of Turkey, MASAK, Banks Association of Turkey, Information Technologies and Communication Agency, Central Registry Agency, Electronic Data Storage Authority and other legally authorized public institutions and organizations, judicial authorities,
In order to carry out banking and capital market activities and to provide you with our products and services in connection with and limited to your investment request, institutions from which we receive support or outsourcing services, institutions we cooperate with, subcontractors, institutions that mediate collection payments, mobile phones authorized by the Information Technologies and Communication Authority, service providers, domestic and international banks and financial institutions,
With Risk centers or institutions established by at least five banks or financial institutions (Interbank Card Center, Credit Bureau, etc.) for the purpose of managing risk management and risk monitoring activities,,
Within the scope of Investment Services, primarily for Deniz Yatırım Menkul Kıymetler A.Ş. and Deniz Portföy Yönetimi A.Ş., third parties that we mediate in order transmission and/or act as agents, and our subsidiaries, domestic or foreign investment institutions and other institutions and organizations that we receive services or cooperate with to carry out capital market activities,
To ensure that your applications are put into process accurately and to make inquiries in the systems for your security within the framework of know your customer obligations (ID Sharing System, Address Based Population Registration System, etc.) through system integrators,
Our main shareholder and companies in Denizbank financial services group within the framework of Article 73 of the Banking Law and other relevant legislation, BRSA activity expansion permits and Laundering of Proceeds of Crime legislation (https://www.denizbank.com/hakkimizda/denizbankin-iliskili-kuruluslari )
In scope of LPPD articles numbered 8 and 9.

Pursuant to article 11 of the Personal Data Protection Law, you have the following rights related to your personal data:

a) to learn whether your personal data are processed or not,

b) to request information if your personal data are processed,

c) to learn the purpose of your data processing and whether this data is used for intended purposes,

d) to know the third parties to whom your personal data is transferred at home or abroad,

e) to request correction if your personal data were processed incompletely or inaccurately and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope

f) Despite being processed as per the provisions of the Law numbered 6698 and other relevant laws, in the event that reasons requiring the processing have disappeared, to request the erasure or destruction of your personal data and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope,

g) to object to the processing, exclusively by automatic means, of your personal data, which leads to an unfavorable consequence for you,

h) to request compensation for the damage arising from the unlawful processing of your personal data.

In line with the Law on the Protection of Personal Data No. 6698, you can submit your requests within the scope of your rights regarding your personal data via,

Provided that you verify your identity through a written petition, via our Head Office at Büyükdere Cad. No: 141 34394 Esentepe – ISTANBUL or any of our branches or via notary in writing,
By e-mail to denizbank.haberlesme@hs04.kep.tr, using your registered e-mail address,
To oncemusteri@denizbank.com by e-mail, including secure electronic signature or mobile signature,
By using your e-mail address that you have previously reported to our bank and registered in our system, to oncemusteri@denizbank.com

Your application must include the following:

a) Your name, surname, and signature if your application is in writing,

b) (For Republic of Turkey citizens) Your Republic of Turkey ID Number, (for foreigners) your nationality, passport number or ID number, if any,

c) Your residential or work address that is the basis for the notification,

ç) Your e-mail address, telephone number, fax number, if any, that is the basis for such reporting,

d) Subject matter is mandatory.

Your request shall be finalised as soon as possible and within thirty (30) days at the latest, free of charge. If transactions pertaining to your request entail a separate cost, a fee may be charged from you as per the tariff stated by the Personal Data Protection Board.

Accounts

Cards

Loans

Digital Products

Our Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding Investment Activities

About DenizBank

Investor Relations

Accounts

Loans

Calculators

Cards

Digital Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding Investment Activities

1. Your Processed Personal Data

2. Methods of Collecting Your Personal Data

3. What we use your personal data for and the legal basis for doing so

4. Who we will share your personal data with and For What Purposes

5. Your Rights