Privacy Policy

1. POLICY STATEMENT

DenizBank A.Ş. (“Bank”) processes personal data so as to conduct banking activities in an effective way, to provide and improve products and services, to ensure that the services are provided uninterruptedly, and to fulfill its legal obligations etc. This Privacy Policy (“Policy”) contains information about the personal data collected by the Bank, the methods of collecting and processing personal data, and the purposes of processing.

In line with the applicable legal regulations, the Bank processes personal data in compliance with the relevant legislation (“Regulations”), particularly the Banking Law No. 5411 and the Personal Data Protection Law No. 6698, (“Law”), and takes technical and administrative measures necessary to ensure confidentiality and security of personal data.

Personal data is obtained; during visits to the head office building or branches, or while using ATM, internet branch, call center, and mobile channels such as MobilDeniz and DenizKartım (“Mobile Application”), from you or third parties such as our service providers and business partners regarding the services that we provide, and are processed within the scope of Regulations.

2. PURPOSE

The purpose of this Policy is to ensure that the applicable obligations of the Bank within the scope of Regulations are fulfilled, and all personal data are processed in compliance with legislation and in a way that does not harm individuals’ rights and freedoms.

3. GENERAL PRINCIPLES ON PROCESSING PERSONAL DATA

The Bank processes personal data in accordance with the general principles regarding the processing of personal data set out in Article 4 of the Law.

The Bank acts in accordance with the principles set forth in the relevant legislation while processing personal data. In this respect, the Bank performs the necessary and proportionate data processing activity for intended purposes by taking measures to ensure that any rights are not abused, the right of privacy of the data subject is not violated, only necessary data is processed, and reasonable expectations of the data subject are regarded.

Within the scope of the principle regarding that the purposes of processing personal data are specified, legitimate and explicit; it is ensured that,

The data subject clearly understands the activities of processing personal data,
The legal basis for processing personal data is determined,
The personal data processing activity and the purpose of this activity must be sufficiently defined to provide certainty.

4. OBLIGATION TO INFORM

The Bank fulfills its obligation to inform in order to inform the data subjects regarding the data processing activity. The privacy notices prepared by the Bank provide all necessary and legal information about the intended purpose of the Bank and the legal basis for processing personal data.

The bank fulfills its obligation to provide information by presenting the privacy notices to individuals in soft copy during the collection of personal data, directing them to the website where the privacy notice is located, sending them a link to access the privacy notice via text message or email, etc.

Updated versions of our privacy notices, prepared by the bank taking into account the nature of the activity, the channel through which the data was obtained, etc., primarily regarding customer acquisition, credit processes, investment activities, request and complaint management, and matters related to individuals subject to risk groups, are available at Personal Data Protection | Life is Beautiful in Deniz! | DenizBank | Hayat Deniz'de Güzel!

Information regarding personal data processed for the purpose of ensuring physical premises security during visits to our branches and head office is provided on the notice boards located in our branches and head office, and in the “Data Privacy Notice on Customers and Visitors” section at the address Personal Data Protection | Life is Beautiful in Deniz! | DenizBank | Hayat Deniz'de Güzel!

During the visit to our bank's website at https://www.denizbank.com/, personal data is processed through the cookies used on our website. Detailed information about the cookies used on our website, their purposes, and how you can manage them is available in the “Cookie Information Text” located in the cookie panel on our website and in the “Legal Warnings | Life is Beautiful in Deniz! | DenizBank | Hayat Deniz'de Güzel! section at the bottom of the page.

Personal data is processed during the use of Mobile Applications in order to provide functionality of the application, ensure security of the application, develop applications and improve user experience. The detailed information about personal data processing activity performed in Mobile Applications is included under the “MobilDeniz Application Privacy Policy – Mobile Application Disclosure Statement” title at Personal Data Protection | Life is Beautiful in Deniz! | DenizBank | Hayat Deniz'de Güzel!

5. PERSONAL DATA RETENTION

The Bank retains personal data for a period of time required to accomplish the objective of collecting the aforesaid data or for the period specified in the relevant legislation.

Personal data for which the intended purpose of use is no longer available and/or the legal retention period expires is disposed using the appropriate disposal method specified by the Bank in accordance with the rules defined in the policies and procedures regarding the disposal.

6. ACCOUNTABILITY

As required by the nature, scope, context, and purposes of data processing, the Bank regularly performs risk assessments and information security audits in order to identify, evaluate, measure and track the impact of data processing, and minimize the risk. The Bank applies the adequate and appropriate technical and administrative measures in order to comply with the Regulations, and records that such measures have been taken.

The Bank carries out the necessary activities accordingly under the following titles:

The policies and procedures have been created where the necessary framework is outlined in order for employees to understand their roles and responsibilities regarding data protection and to conduct and audit the relevant processes.
The policies and procedures are periodically updated and their compliance with the Bank’s activities and Regulations is checked.
The policies and procedures are available for the access of all employees.

The Bank, in the capacity of a data controller, informs the data subject of their rights set forth in Article 11 of the Law.
The channels through which the data subject may convey their requests regarding these rights are established.
The organization flows necessary to review, evaluate and meet the requests in due time within the Bank are defined.
The appropriate systems and procedures are created to fix the incorrect entries, complete the missing entries or, when required, insert additional explanations.

The privacy notice texts that contain the personal data processed, the method of obtaining the data, the purpose of processing, the parties to whom data are transferred, the rights of the data subject, and the application channels have been included in the processes.
The registry systems that may prove that the privacy notices have been submitted to the data subject in due time have been created.
The information provided to the data subject are periodically reviewed to ensure that they are accurate, up-to-date and effective.
The privacy notices are published digitally in electronic media such as the Bank’s webpage, mobile applications and internet banking platforms, and physically in environments such as branches and the head office.

Legal basis for processing data is determined based on the purpose of the personal data processing, and is checked regularly in accordance with the amendments and developments in legislation.
In cases where the legal basis for processing personal data is explicit consent, the necessary structures are established to ensure that explicit consent will be granted based on information and with their free will.
The structures are established where the data subject may change/retrieve their explicit consent preferences at any time.

The Bank determines the risks regarding personal data and puts the appropriate policies, procedures and controls into effect to manage such risks.
To manage risks, privacy principles are applied by design and by default.
The rules have been set for acceptable use of software (systems or applications) that process or store the data, and risk assessments and controls are performed on the applications.
Internal and external audits are conducted regarding the activity of processing personal data.

It is ensured that the records are created and kept in compliance with the standards with respect to data confidentiality and security.
The controls and measures are taken to provide data security during the internal circulation of data within the Bank or external transfer.
Retention periods for personal data are identified, and the data is reviewed periodically in compliance with the relevant policies and procedures depending on the stipulated period of time. Upon the expiration of the retention period, the data is disposed in the registry environment.
Access to personal data is limited to the authorized personnel, and the access rights of users are regularly reviewed.
The necessary technical and administrative measures are taken to prevent unauthorized access to registry environments.
Physical areas are made secure to prevent unauthorized access, destruction, and intervention in personal data.
There are recovery plans against serious outages, and systems and applications for protection against the loss of personal data. Backups are also performed in registry environments.

The Bank procedures are available in order to identify and manage personal data breach cases, minimize and/or eliminate their impacts, and record them in the most appropriate way.
In the event of a data breach, a data breach response plan has been established, covering matters such as determining responsibilities, reporting to relevant units within the Bank, notifications to be made in accordance with the Law, and assessing the potential consequences of the data breach. This plan is reviewed at regular intervals.
The Bank shall notify the breach to Personal Data Protection Board without delay and within 72 hours at the latest from the date it becomes aware of the breach. Affected individuals shall be identified, and notification shall be made to the data subject’s contact address directly if possible, or by other means if not, within the shortest reasonable timeframe.
Information regarding data breaches, their impacts, and the measures taken are recorded.

7. DATA SUBJECT RIGHTS

The Bank, as the data controller, informs the data subjects about their rights under Article 11 of the Law, establishes channels for data subjects to submit requests regarding these rights, and responds to submitted requests within the specified timeframe. The rights of data subjects under Article 11 of the Law are as follows:

to learn whether his/her personal data are processed or not,
to demand for information as to if his/her personal data have been processed,
to learn the purpose of the processing of his/her personal data and whether these personal,
data are used in compliance with the purpose,
to know the third parties to whom his personal data are transferred in country or abroad,
to request the rectification of the incomplete or inaccurate data, if any,
to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,
to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,
to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
to claim compensation for the damage arising from the unlawful processing of his/her personal data.

8. UP-TO-DATENESS OF THE POLICY

This Policy is reviewed and updated as necessary, either on a regular basis or when amendments are required due to legal developments, changes in the operating environment, or changes in the business model.

The up-to-date version of the Policy is available via our webpage.

Accounts

Cards

Loans

Digital Products

Our Products

Accounts

Cards

Loans

Digital Products

1. POLICY STATEMENT

2. PURPOSE

3. GENERAL PRINCIPLES ON PROCESSING PERSONAL DATA

4. OBLIGATION TO INFORM

5. PERSONAL DATA RETENTION

6. ACCOUNTABILITY

7. DATA SUBJECT RIGHTS

8. UP-TO-DATENESS OF THE POLICY

About DenizBank

Investor Relations

Currency Converter

Accounts

Loans

Cash Management

Calculators

Cards

Digital Products

Morning Call

Accounts

Cards

Loans

Digital Products

Privacy Policy

1. POLICY STATEMENT

2. PURPOSE

3. GENERAL PRINCIPLES ON PROCESSING PERSONAL DATA

3.1 Lawfulness and fairness

3.2 Being accurate and up-to-date where necessary

3.3 Being processed for specified, explicit and legitimate purposes

3.4. Being relevant, limited and proportionate to the purposes for which they are processed

3.5. Retention for a period of time stipulated in the related legislation or required for the purpose of processing

4. OBLIGATION TO INFORM

4.1. Activity-Based Privacy Notices

4.2 Physical Space Security

4.3. Cookie Privacy Notice Text

4.4. Mobile Applications and Internet Branch

5. PERSONAL DATA RETENTION

6. ACCOUNTABILITY

6.1. Policies and Procedures

6.2. Training and Awareness

6.3. Rights of Data Subject

6.4. Transparency

6.5. Ensuring Legal Compliance

6.6. Risk Management

6.7. Registry Management

6.8. Breach Management

7. DATA SUBJECT RIGHTS

8. UP-TO-DATENESS OF THE POLICY