Data Privacy Notice Regarding Personal Data Processing for Account Opening Purposes

1. Purpose and Scope

This Data Privacy Notice Regarding Personal Data Processing for Customer and Potential Customers (Privacy Notice) has been prepared in accordance with the Law on Protection of Personal Data (LPPD) numbered 6698 in order to inform you on your personal data processed by DenizBank A.Ş. (the Bank or Denizbank), methods of collecting your personal data, legal basis and purpose of processing your personal data, persons/institutions where your personal data are transferred to, purpose of transfer and the rights of the natural persons whose personal data are processed.

As DenizBank A.Ş. we act as data controller in accordance with the LPPD, and we take the necessary measures to ensure the appropriate level of security in order to ensure that your personal data is processed and preserved in accordance with the law.

The table below shows information on our Bank that processes your personal data.

Address	Büyükdere Cad. No:141 Esentepe 34394 Şişli / İSTANBUL
Central Registry System / Registry No.	0292-0084-4960-0341 / 368587

DenizBank Financial Services Group entities under this Notice refers to direct and indirect domestic and foreign subsidiaries of DenizBank and other shareholders including the shareholder together with their sister companies and subsidiaries.

Your personal data processed by our bank are listed in the table below on the basis of categories.

Data Category	Personal Data
Identity	Name, surname, mother's and father's name, mother's maiden name, date of birth, place of birth, marital status, ID card serial number, Republic of Turkey ID number, etc.
Contact Information	Address number, e-mail address, contact address, registered e-mail address (KEP), telephone number, etc.
Location	Location information etc.
Legal Proceedings	Information in correspondence with judicial authorities, information in court files, etc.
Customer Transactions	Call center records, invoices, bills, checks, information on the bank statements, customer request and instruction information, etc.
Transaction Security	IP address information, electronic banking channels log in – log out information, password and passcode information, etc. (Collected in case digital channels are used.)
Risk Management	Information processed to manage commercial, technical and administrative risks etc. (e.g.demographic information, data obtained from KKB, KPS and APS, score information, etc.)
Finance	Balance sheet information, financial performance information, credit and risk information, wealth information, etc.
Professional Experience	Profession, title, work information, education status, etc.
Marketing	Information on shopping history, surveys, cookie logs, other data segregating digital identity, information obtained via promos, etc.
Visual and Audio Records	Visual and Audio Records, etc. (e.g. call centre records, video-call records, photos, etc.)
Criminal Convictions and Security Measures	Information on criminal conviction, information on security measures, etc.
Health	Information about disability status

We collect, use, share and keep your data in order to provide you with the products and services you requested from us and share information. Your personal data may be collected directly from you or from third persons via methods that are automated, or not automated.

(i) Methods of Collecting Your Personal Data From You:

With automated methods:

Your personal data in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records are obtained from you through physical environments (head office, branches, etc.) or digital media (mobile banking, website, customer communication center, etc.) of our banks.

If you use our ATMs, kiosks or digital services, in order to ensure your transaction security, the IP address of your device, your internet banking login and exit information, the type of device you use, your operating system type information, your password and password information, which are included in the location and transaction security data category, we may obtain information about how you access and use these services. If you use our digital services (such as mobile application or website), we can collect cookie records in the marketing data category and other information that distinguishes digital identity in order to carry out our marketing activities and transaction security. (You can access the Cookie Privacy Notice text of our Bank from the link https://www.denizbank.com/yasal-uyari). Also, by obtaining your data in the location data category, we may offer you services such as the weather where you are and the nearest ATM, upon your consent (If you use your mobile applications, your location information is obtained according to the permission preference in your operating system (IOS, Android, etc.).

(ii) Methods of Collecting Your Personal Data From Third Parties;

With automated methods:

We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance, Marketing, Visual and Audio Records and Criminal Convictions and Security Measures through the below entities and institutions or persons via automated methods:

Turkish Banks Association Risk Centre, or companies established by at least five banks or financial institutions as well as institutions that combat laundering proceeds of crime, financing of terrorism, corruption, bribery, fraud; private and public institutions that provide information from public or private databases – (ID Sharing System, Address Sharing System, Centralized Registry System, National Judicial Network IT System, Revenue Administration, Trade Registry Office Records, Title Deed Registry Systems, Credit Bureau, Interbank Card Centre, etc.),
Contracted hardware or software services and contracted institutions that help us improve your personal data and enable us to offer you more relevant and attractive products and services,
Merchants and POS devices,
Payment service providers associated with your payments/collections, Persons and organizations such as TR Ministry of Treasury and Finance, General Directorate of Highways, invoice producing institutions, payment service providers,
International money transfer intermediators,
Our Bank's service providers, contracted organizations and support services, external service organizations, dealers and sales offices,
Publicly available data such as media news and online records or directories.

With non-automated methods:

We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Risk Management, Finance, Professional Experience through the below entities and institutions or persons via non-automated methods:

Unions and associations such as trade and artisan chambers
Joint account holders
Persons assigned to act on your behalf
Companies you own or you are associated with – investment companies, partnerships or business partnerships along with their executives, shareholders, trustees, authorised persons or proxies
Employers
Companies whose activities we carry out with the capacity of intermediary and agency
Judicial Bodies and other official institutions

We must have a legal basis (lawful reason) to process your personal data. In scope of the LPPD, when we process your personal data, we need to fulfil at least one legal basis defined for processing.

Cases whereby your personal data may be processed without seeking your explicit consent have been stipulated in paragraph 2 of Article 5 and article 6. Accordingly:

5/2: In the presence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject:

5/2(a) It is expressly envisaged in the laws.

5/2(b) It is obligatory for the protection of life or bodily integrity of the person himself or herself or of any other person, who is unable to express his or her consent due to factual impossibility or whose consent is not considered legally valid at all.

5/2(c) Processing of personal data belonging to the parties to the agreement is required, on condition that it is directly related to the establishment or performance of such agreement.

5/2(ç) It is mandatory for the data controller to fulfil its legal obligations.

5/2(d) It must be made public by the data subject themselves.

5/2(e) Data processing is mandatory to establish, exercise or protect a right.

5/2(f) Data processing is mandatory for the legitimate interests of the data controller, on condition that such processing does not violate the fundamental rights and freedoms of the data subject.

Processing sensitive personal data is prohibited as per article 6(3). However, this type of data can be processed on following conditions:

6/3(a) If the data subject has consent,

6/3(b) If it is explicitly stipulated by the Laws,

6/3(c) If it is obligatory for the protection of life or bodily integrity of the person himself or herself or of any other person, who is unable to express his or her consent due to factual impossibility or whose consent is not considered legally valid at all,

6/3(ç) If it relates to personal data that the data subject has made public by his/her own will,

6/3(d) If data processing is obligatory to establish, exercise or protect a right,

6/3(e) for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing by those under the obligation to keep secrets or by the authorized institutions and organizations,

6/3(f) If it is necessary to process this data in order to fulfill legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance, and

6/3(g) If foundations, associations, and other non-profit organizations established for political, philosophical, religious or trade union purposes are processing sensitive personal data of their current or former members and persons with whom they are in regular contact, subject to compliance with their incorporation objectives and the applicable legislation, and limited to their areas of activity, without disclosure to third parties.

The legal reasons for our personal data processing activities and our purposes for processing your data are explained in the table below.

PERSONAL DATA CATEGORIES	WHAT WE USE YOUR PERSONAL DATA FOR	THE LEGAL BASIS FOR DOING SO
Identity, Finance, Visual and Audio Records, Contact Information, Customer Transactions, Transaction Security, Risk Management, Professional Experience	Primarily for banking services, cash management services, foreign trade services, agency services and intermediary services; to offer you our banking and finance products as per transactions given under article 4 of Banking Law numbered 5411, to fulfil, carry out, improve open banking services and all transactions therein, to execute operational process and also for the execution of agreements we enter into with you or with third parties in order to offer you our Banking products and services	LPPD a.5/2(a) LPPD a.5/2(c) LPPD a.5/2(ç) LPPD a.5/2(f)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Transaction Security	To contact you to provide legal notifications about our products or services, and to assist you with about regulatory matters and our service processes	LPPD a.5/2 (a) LPPD a.5/2 (c) LPPD a.5/2 (ç) LPPD a.5/2 (f)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions	To manage all complaints and requests including customer relations, experience, satisfaction, complaint, objection, request and proposal along with follow up and execution of legal processes	LPPD a.5/2 (ç) LPPD a.5/2 (e)
Identity, Finance, Visual and Audio Records, Contact Information, Location, Customer Transactions	To check your instructions to us, to analyse, assess and improve our services, and for training and quality Control purposes	LPPD a.5/2 (ç) LPPD a.5/2(f)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Security of Physical Venue, Transaction Security, Risk Management, Professional Experience	To check national and international lists as per legislation on the Prevention of Laundering Proceeds of Crime and Financing of Terrorism along with the Prevention of Weapons of Mass Destruction that our Bank is subject to, to fulfil know-your customer principle by identification, recording information such as occupation, income status and purpose of transaction to detect and confirm ID and addresses, execute compliance processes as per foreign legislation	LPPD a.5/2 (a) LPPD a.5/2 (c) LPPD a.5/2 (ç)
Identity, Customer Transactions, Transaction Security	To use the data to provide better services for you, calculate product and service priority and determine points of service (for instance, use of Q-matics)	LPPD a.5/2(f)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Transaction Security, Risk Management	To make debt collection and exercise our other rights as per any agreements we enter into with you; also to protect ourselves against possible damages to our property rights and interests	LPPD a.5/2(a) LPPD a.5/2 (c) LPPD a.5/2 (ç)
Identity, Finance, Contact Information, Customer Transactions	Upon your request and consent, in order to provide you with your consolidated information regarding one or more payment accounts at our bank or other payment service providers on the online platform (“account information” service) ; again upon your instruction, in order to benefit from the open banking payment services offered by our Bank by completing the payment transaction on the online platform regarding the payment account held by another payment service provider ("payment order initiation" service) (When information is requested on account movements by account holder customers at our bank and/or intermediaries they authorize with whom you have collection or payment relations via products such as money transfer, cheque, bill payment (for instance, your data (such as ID number/tax number) are indirectly sent to the counterparty through our account movement integration product))	LPPD a.5/2 (c) LPPD a.5/2 (ç) LPPD a.5/2(e)
Identity, Finance, Contact Information, Legal Proceedings, Customer Transactions, Security of Physical Venue, Transaction Security, Risk Management	To comply with currently enforced legislation and collaborate with regulatory authorities and police department (to fulfil obligations arising from Banking Law, Debit Cards And Credit Cards Law, Laws And Regulations On Payment And Securities Reconciliation Systems, Payment Services And Electronic Money Institutions and legislation and to keep to legislation on AML and Preventing Terrorism Financing besides domestic and international legislation) to utilize the system (“İYS”) that enable to receive commercial electronic notification approvals as per Law on Regulation of Electronic Trade numbered 6563 and the underlying Regulation on Commercial Communication and Commercial Electronic Notifications, to exercise right to refuse and manage complaint processes, Banking Regulation and Supervision Agency, Capital Markets Board, Central Bank of the Republic of Turkey, MASAK, Banks Association of Turkey (TBB), KOSGEB, Revenue Administration, Social Security Institution, Central Registry Agency A.Ş. In order to comply with the information storage, reporting and information obligations stipulated by the Credit Registration Bureau Inc, TBB Risk Center and other authorities, To fulfill our identity and access obligations set out in the Regulation on Banks' Information Systems and Electronic Banking Services, in case you use our digital services, to fulfill our obligations set forth in the Law No. 5651 on Regulation of Broadcasts Made on the Internet and Fighting Against Crimes Committed Through These Broadcasts.	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Contact Information, Transaction Security	To create a user profile so you can use our digital channels, to provide you with a better user experience by improving the design and functionality of our digital channels by understanding how you use them	LPPD a.5/2(c) LPPD a.5/2(f)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Transaction Security	As per article 42 of Banking Law numbered 5411 and in accordance with article 17 of Regulation on Terms and Conditions of Accounting Principles of Banks and Safekeeping of Documents and based on other legislation the bank is bound by; for arranging and safekeeping all electronic (SWIFT, internet/mobile banking, head office units, branches, kiosks, ATMs, internet branch, call centre and all other similar channels) and paper records and documents associated with transactions based on the legal obligation of our bank to keep them for 10 years,	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Contact Information, Customer Transactions, Transaction Security, Risk Management	To carry out the support services given as per the permission of BRSA on extending services and the risk, audit and operational services conducted with subsidiaries in accordance with Banking Law and other legislation for planning relations or risk management with shareholders along with preparing consolidated financial statements for main shareholders as per article 73/4 of Banking Law	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Contact Information, Customer Transactions, Risk Management	For appraisal studies to be made by potential buyers for the purpose of 10% or more of shares in capital which are acquired directly or indirectly as per article 73/4 of Banking Law or for valuation studies to be made for assets including credits or asset backed securities	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Customer Transactions, Risk Management	For appraisal, rating and independent audit activities as per article 73/4 of Banking Law	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Visual and Audio Records, Contact Information, Location, Transaction Security	To notify the closest branch/ATM to your location through our website or other applications upon your request; to notify weather forecast for your location, video calls you make with agents to answer questions or carry out transactions or to develop and offer you new technologies like voice activated chatbot	LPPD a.5/2(c) LPPD a.5/2(e) LPPD a.5/2(f) For location data: LPPD a.5/1
Identity, Finance, Contact Information, Legal Proceedings, Customer Transactions, Risk Management	After the restructuring, sale or purchasing of any DFSG companies or debts; to transfer your information to the organization to where your account is/will be transferred	LPPD a.5/2(ç) LPPD a.5/2(e)
Identity, Finance, Contact Information, Customer Transactions, Transaction Security, Risk Management	As per article 5 of Regulation on Compliance Program towards Obligations on Preventing Laundering Proceeds of Crime and Financing of Terrorism; to ensure that the compliance program of DenizBank Financial Services Group is applied across the financial group and to share information on know-your-customer, account and transactions within the group,	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Security of Physical Venue, Transaction Security, Risk Management	To share your information with Turkish or other related tax authorities, Banks Association of Turkey Risk Centre and companies founded by at least five banks or financial institutions, companies that combat fraud, regulatory bodies and authorities in Türkiye	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Contact Information, Customer Transactions, Transaction Security	For the management, planning and realization of relations and processes established with support service organizations and external service providers, business partners or suppliers within the scope of the Regulation on Banks' Information Systems and Electronic Banking Services	LPPD a.5/2 (c) LPPD a.5/2 (ç)
Identity, Finance, Visual and Audio Records, Contact Information, Location, Customer Transactions, Transaction Security, Risk Management	Analyzing and developing Banking systems, maintaining information security processes, establishing, managing and executing information systems infrastructures, executing/planning internal systems, information technologies, operations, audits, internal control, risk monitoring, risk management, ethics activities and financial risk processes	LPPD a.5/2(a) LPPD a.5/2(ç)
Identity, Finance, Marketing, Customer Transactions, Transaction Security, Contact Information, Professional Experience, Risk Management	Concerning the banking, insurance, retirement, finance and capital market activities (including investment) products and services of our bank, its direct or indirect subsidiaries and shareholders and their subsidiaries and affiliates, and other entities the aforementioned companies do business with or act as an intermediate or an agency for, and all the other products and services provided by Denizbank A.Ş together with the aforementioned companies; For the purposes of explaining, promoting and marketing the related products and services, planning and implementing the promotion and communication activities, Providing offers containing data, audio and video content from all channels, including digital environments, social media channels, telephone, call center, electronic mail and short message services carrying out promotion, marketing, cross-selling and campaign activities and designing customized marketing and promotional activities for you, carrying out data analytics studies for credits, behavioral scoring, market research and marketing purposes in order to identify and develop suitable products and services for you, carrying out studies on customer satisfaction and experience, Conducting studies, including surveys and statistical studies, Reviewing and analyzing your data, making the marketing messages/advertisements that you receive more relevant and attractive, following up on the advertising and marketing, Providing information on the products, services, campaigns, rewards, proposals, promotions, loyalty programs and contests that you may be interested in, Designing products, services and working models for the development of banking products and services, and working on segmentation	As per article 5/1 of LPPD; personal data cannot be processed without the explicit consent of the data subject LPPD a. 5/2(f)
Criminal Convictions and Security Measures	In order for you to open a cheque account at our Bank in accordance with the Cheque Law No. 5941, Conducting studies, including surveys and statistical studies, To carry out the controls required by the public institutions to which we are obliged to provide information such as BRSA, Turkish Central Bank, MASAK, Revenue Administration, CMB and BAT Risk Center, to store and report the information, and to meet the information and document requests of these institutions.	LPPD a. 6/3(b) LPPD a. 6/3(d)
Health	To fulfill our legal obligations in accordance with the Regulation on Accessibility of Banking Services	LPPD a. 6/3(b)

*We carry out data processing activities on condition that we do not harm your fundamental rights and freedoms, in line with purposes and to a limited extent, as long as there is a compulsory legal reason to process the data as the data controller, as per article 5/2 (f) of LPPD.

The parties to which your personal data is transferred are listed in the table below.

DenizBank Financial Services Group Entities: Your personal data is transferred to Denizbank Financial Services Entities for the following purposes: As per article 73/4 of banking law; in order for carrying out the consolidated financial statement preparation, risk management and evaluation studies of the parent companies, and processing them into the central information system of our main shareholder in internal audit practices; Pursuant to Article 5 of the Regulation on the Program of Compliance with Obligations Regarding the Prevention of Laundering of Proceeds of Crime and the Financing of Terrorism, the compliance program of DenizBank Financial Services Group is implemented on a financial group basis, as well as sharing information on customer recognition, accounts and transactions within the group; With the parties and purposes allowed within the scope of the information sharing permissions given to our Bank by the BRSA; these data can be transferred within the framework of the conditions specified in Article 8 of the LPPD regarding the transfer of personal data and Article 9 regarding the transfer of personal data abroad, for the purposes of performing the support services provided within the framework of the activity expansion permits given to our Bank by the BRSA. You can access the title, country and address information of our bank's domestic and international subsidiaries, our main shareholder, holding companies and subsidiaries of our main shareholder and our risk group via the following link: https://www.denizbank.com/kvk/deniz-ve-destek-hizmeti-kuruluslari.aspx
Domestic and International Banks and Financial Institutions and Merchants: Your Personal Data, which are required for electronic transfer messages regarding all kinds of money transfers to domestic and foreign accounts, including transactions to be made through banks and/or using the swift system, foreign trade transactions, sharing secure financial transaction messages; worldwide payment and credit transactions and electronic transactions, liquidation of domestic and international guarantee transactions and payment transactions and all other transactions connected with all these transactions, may be transferred to correspondent banks, international or domestic banks, merchants and financial institutions or processed for this purpose.
Support Service Companies/Institutions and Outsource Companies/Institutions: Your personal data can be shared with support services companies, contracted consultants, institutions, parties, suppliers, outsource providers, cloud service providers, mobile service providers authorized by IT and Communications Authority, attorneys, law offices, notaries, company auditors, independent audit, rating and appraisal companies and other professional consultants and contracted companies that complement our bank services or act as an extension for the purposes given below. Your data can be shared with these persons and companies in order to design, develop and sustain internet based tools and applications; receive application or infrastructure (cloud) services; manage marketing activities or events and customer communication; prepare reports and statistics; confirm and detect contact information; printing materials and designing products; advertisements in applications and websites; receive legal, audit services or other specialized services; follow up and manage legal processes; audit our activities for legislative compliance; give postal services by our agencies; archive physical records; manage securitizations; offer or receive intermediary collection services. Support Service Institutions can be classified categorically as archive services, information systems, operational services, call centre, marketing, collection management and security and you can reach them via https://www.denizbank.com/kvk/deniz-ve-destek-hizmeti-kuruluslari.aspx Support Service Institutions can be classified categorically as archive services, information systems, operational services, call centre, marketing, collection management and security and you can reach them via https://www.denizbank.com/kvk/deniz-ve-destek-hizmeti-kuruluslari.aspx .
Your personal data can be shared with our business partners who offer services with, agencies and brokers who act on our behalf or who we provide products and services collectively such as insurance and intermediary, agency companies to fulfil our obligations arising from intermediary, agency activities. (for instance, hotel or airline business partners, business partners for card programs or those that have their name or logos on our credit cards or debit cards). Your data can be shared with other service providers and agencies that serve on behalf of our business partners.
Your personal data may be shared with Payment Service Providers, financial institutions that are members of the payment program, and international or domestic payment systems institutions and organizations in order to provide the products and services you have requested (for example, to initiate a payment order or account information service) or to fulfill your request. (card payment system companies that are established abroad or domestically and are included in Law numbered 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions and other legislation including Europay INT.SA, Moneygram Group (Moneygram Payment Systems Inc. and Moneygram Turkey Ödeme Sistemleri A.Ş.), MasterCard INT.INC., Visa INC., JCB CO., LTD., Maestro, Electron)
Your personal data may be shared with the institutions and organizations whose payments we mediate, and with the natural or legal persons you specify in your order, if you have given an instruction to our bank. For example, For instance, your personal data can be shared with Ministry of Treasury and Finance for your tax debt payments, with invoice production companies for invoice payments, with companies offering games of chance for lottery payments, with Directorate General for Highways, Post and private build/operate/transfer companies for bridge/toll payments, with persons and entities that you have relations with for your payments/collections to fulfill your requests.
Public Bodies and Authorities: If we are legally obliged, your data will be shared with Banking Regulation and Supervision Agency, Personal Data Protection Authority/Board, Capital Markets Board, Central Bank of Republic of Türkiye, MASAK, Banks Association of Türkiye, KOSGEB, Revenue Administration, Ministry of Treasury and Finance, Social Security Institution, Information Technologies and Communications Institution, ministries, judicial bodies, police, public prosecutors, courts and arbitration/intermediary organs that are legally authorized public or private bodies and persons indicated in article 73 of banking law.
Your personal data can be shared with anyone we transfer or assign (or may transfer and assign) our rights and obligations, as much as permitted by terms and conditions in any of your agreements signed with us.
Your personal data can be shared with anyone we transfer or assign (or may transfer and assign) our rights and obligations, as much as permitted by terms and conditions in any of your agreements signed with us.
Your personal data can be shared with the consultants you authorized to represent you (accountants, attorneys and other professionals) or any other person you indicate as authorized to place orders on your behalf and utilize accounts, products and services (e.g. with Power of attorney).
Your personal data can be shared with Turkish and foreign regulatory authorities, police department and authorized bodies in relation to combating crimes (directly or through third parties like the credit bureau) or for social and economic statistical research.
Risk centre or companies established by at least five banks or financial institutions (Interbank Card Centre, Credit Bureau etc.) Your personal data can be shared to manage risk management and monitoring activities.
System integrations used via public entities and institutions (ID Sharing System, Address Based Population Registration System, etc.): Your personal data can be shared to ensure that your applications are put into process accurately and to make enquiries in the systems for your security within the framework of know your customer obligations.
US and/or EU Corporations and Institutions: In case of being a US and/or EU real person or legal entity or trading in US and/or EU markets or being subject to the tax laws of US and/or EU or due to various legal requirements, Data on account numbers, ID information, address, scope of activity and all accounts, transactions with U.S Internal Revenue Service (IRS), European Capital Market Authority (ESMA) and/or all other US and/or EU institutions in scope of laws and regulations of United States of America (USA) Dodd Frank (Dodd Frank Wall Street Reform and Consumer Protection Act) and FATCA (Foreign Account Tax Compliance Act), ISDA (International Swaps and Derivatives Association) and European Union (EU) EMIR (European Market Infrastructure Regulation) and CRS (Common Reporting Standard), It can be transferred to the Internal Revenue Service (IRS), European Capital Markets Authority (ESMA) and/or all other relevant US and/or EU institutions and organizations and processed for this purpose. Laws and regulations may oblige us to share your account information with tax authorities directly or through local tax offices. These tax offices, which we share the information with, may share the said information with other suitable tax authorities.
Domestic and international independent audit companies, rating agencies and specialized enterprises: Your data can be shared for audit, rating and credit restructuring processes and for executing assessments on the applicability of restructuring and detecting financial conditions.

As per the article 42 of the Banking Law no. 5411 and provision 17 of the Article of Regulation on Terms and Procedures Regarding the Accounting Practices of the Banks and Retention of Documents, it is a legal obligation of our Bank to retain the information and documents regarding you for a period of ten years. In the event that you request that your personal data to be erased or destructed , in case you are the customer of only DenizBank A.Ş., your personal data shall be erased at the end of a 10-year retention period, if all the conditions requiring processing of your data have disappeared. In case you do not want to work with Denizbank A.Ş. but would like to continue to actively receive services from another subsidiary of Denizbank Financial Services Group; Denizbank A.Ş. will continue to process your data only for the purposes of being able to provide the operational support services that we provide to all our subsidiaries and to consolidate risk as the main shareholder. At the end of our legal retention period of 10 years, provided that you stop receiving services from Denizbank A.Ş. or another company established within the Denizbank Financial Services Group and all situations requiring the processing of your data disappear, your data will be deleted, anonymized or destructed.

Pursuant to article 11 of the Personal Data Protection Law, you have the following rights related to your personal data:

a) to learn whether your personal data are processed or not,

b) to request information if your personal data are processed,

c) to learn the purpose of your data processing and whether this data is used for intended purposes,

d) to know the third parties to whom your personal data is transferred at home or abroad,

e) to request correction if your personal data were processed incompletely or inaccurately and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope

f) Despite being processed as per the provisions of the Law numbered 6698 and other relevant laws, in the event that reasons requiring the processing have disappeared, to request the erasure or destruction of your personal data and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope,

g) to object to the processing, exclusively by automatic means, of your personal data, which leads to an unfavorable consequence for you,

h) to request compensation for the damage arising from the unlawful processing of your personal data.

You can submit your requests within the scope of your rights regarding your personal data via:

A written petition to the attention of our branches or our Head Office located in Büyükdere Cad. No: 141 Esentepe 34394 Şişli / İSTANBUL, provided that you verify your identity, or through notary public.
By e-mail to denizbank.haberlesme@hs09.kep.tr, using your registered e-mail address, with electronic or mobile signature.
By e-mail to oncemusteri@denizbank.com using your e-mail address that you have previously reported to our bank and registered in our system,
By filling out the form that appears when you do the following selection in the link https://www.denizbank.com/iletisim/musteri-memnuniyeti-formu “Notification type: Complaint - Subject: Retail Banking - Sub-Subject: Personal Data Protection Law Complaint Notifications”.

Your application shall be finalized as soon as possible and within thirty (30) days at the latest, free of charge. If transactions pertaining to your request entail a separate cost, a fee may be charged from you as per the tariff stated by the Personal Data Protection Board.

You can access this data privacy notice and all other data privacy notice texts of our bank from the link https://www.denizbank.com/kvk or by scanning the QR code below on your mobile phone.

Accounts

Cards

Loans

Digital Products

Our Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding Personal Data Processing for Customer and Potential Customers

About DenizBank

Investor Relations

Accounts

Loans

Calculators

Cards

Digital Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding Personal Data Processing for Customer and Potential Customers

2. Your Processed Personal Data

3. Methods of Collecting Your Personal Data

4. What we use your personal data for and the legal basis for doing so

5. Who we will share your personal data with and For What Purposes

6. Storing your Personal Data

7. Your Rights Regarding Your Personal Data