Data Privacy Notice Regarding the Credit Processes

DenizBank A.Ş. Data Privacy Notice Regarding the Credit Processes

This Data Privacy Notice Regarding the Credit Processes (Privacy Notice) has been prepared in accordance with the Law on Protection of Personal Data (LPPD) numbered 6698 in order to inform you on your personal data processed during all your credit applications (commercial, SME, investment, general purpose, vehicle, housing, credit cards, overdraft loans, loan inquiry regarding multiple credit products at the same time etc.- to be collectively referred to as “credit”) submitted to our bank, methods of collecting your personal data, legal basis and purpose of processing your personal data, persons/institutions where your personal data are transferred to, purpose of transfer and your rights.

As DenizBank A.Ş. we act as data controller in accordance with the LPPD, and we take the necessary measures to ensure the appropriate level of security in order to ensure that your personal data is processed and preserved in accordance with the law.

The table below shows information on our Bank that processes your personal data.

Address	Büyükdere Cad. No:141 Esentepe 34394 Şişli / İSTANBUL
Central Registry System / Registry No.	0292-0084-4960-0341 / 368587

Your personal data processed by our bank are listed in the table below on the basis of categories.

Personel Data Category	Personal Data
Identity	Name, surname, mother’s and father’s name, mother’s maiden name, date of birth, place of birth, marital status, ID card serial number, Republic of Turkey ID number, etc.
Contact Information	Address number, e-mail address, contact address, registered e-mail address (KEP), telephone number, etc.
Legal Proceedings	Information in correspondence with judicial authorities, information in court files, etc.
Customer Transactions	Call centre records, information in request and order forms, information in the credit documents (the credit form uploaded into the system, contracts or other similar documents, credit information, deposits information, overdraft account information, credit card limit and balance information, deposit account movements, credit repayment movements, etc.
Risk Management	Information processed to manage commercial, technical and administrative risks etc. (Ex. Risk monitoring and follow-up information (debt data, delinquency and default data, maturity data, information regarding related people, assets (vehicles and title deeds), surety information, salary information, income information, demographics, vehicle dealer information, opinions of the branches, data obtained from the Risk Center, Turkish Central Bank, Revenue Administration, Credit Bureau, KPS and APS, Credit Bureau borrowing information, score information, in case the house or vehicle is shown as collateral, information on the house/vehicle, appraisal information (address, value, type, model, brand, license plate, chassis, etc.), control data on fraud and AML.
Finance	Balance sheet information, financial performance information, credit and risk information, wealth information, Farmers Register System certificate, Social Security Insurance records, etc.
Professional Experience	Profession, title, work information, education status, etc.
Marketing	Information on shopping history, surveys, cookie logs, other data segregating digital identity, information obtained via promos, etc.
Transaction Security	IP address information, electronic banking channels log in – log out information, password and passcode information, etc.
Visual and Audio Records	Visual and Audio Records. etc. (e.g. call centre records, video-call records, photos, etc.)

We collect, use, share and keep your data in order to provide you with the credit products you requested from us and share information. Your personal data may be collected directly from you or from third persons via methods that are automated, or not automated.

(i) Methods of Collecting Your Personal Data From You:

Your personal data in the categories of Identity, Contact Information, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records are obtained from you with automated methods and through physical environments (head office, branches, etc.) or digital media (mobile banking, website, customer communication center, etc.) in cases where you apply for our credit products.

(ii) Methods of Collecting Your Personal Data From Third Parties;

We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance, Marketing through the below entities and institutions or persons via automated methods:

System integrations shared through public institutions and organizations (eg. Identity Sharing System (“KPS”), Address Sharing System (“APS”) ,
Official institutions and organizations where your credit score information is available (eg Credit Bureau (“KKB”), Risk Center of the Banks Association of Turkey (“TBB Risk Center”)”),
Support service organizations including service providers that mediate the establishment of a contractual relationship with our bank, outsource service providers and other parties from which we receive services, payment service providers and contracted dealers, sales offices, electronic commerce sites and other organizations providing services to our bank,
Our business and program partners

We can collect your personal information in the categories of Identity, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Finance through the below entities and institutions or persons via non-automated methods:

Revenue Administration, Social Security Institution and other public institutions and organizations and judicial authorities

Personal Data Category	What we use your personal data for	Legal basis for doing so
Identity, Contact Information, Finance, Risk Management, Customer Transactions, Visual and Audio Records	For the purposes receiving your credit application and for credit assessment	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(c) of LPPD; Processing of personal data belonging to the parties to the agreement is required, on condition that it is directly related to the establishment or performance of such agreement. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations. As per article 5/2(e) of LPPD; Data processing is mandatory to establish, exercise or protect a right.
Identity, Contact Information, Risk Management, Customer Transactions, Visual and Audio Records	For the purposes of disbursement, collection and fulfillment of transactions related to credit products, measurement of creditworthiness and determination of the appropriate limit, management of the credit allocation process of credit sales, allocation, follow-up, intelligence and monitoring processes, the execution of all kinds of collateralization of the loan
Identity, Contact Information	For the purposes making necessary notifications regarding the product
Identity, Contact Information, Risk Management, Customer Transactions, Finance, Legal Proceedings	For the purposes managing the legal proceedings and controling activities with regard to the outstanding debts,	As per article 5/2(e) of LPPD; Data processing is mandatory to establish, exercise or protect a right.
Identity, Finance, Visual and Audio Records, Contact Information, Legal Proceedings, Customer Transactions, Risk Management, Transaction Security, Professional Experience	For the purposes of checking national and international lists as per legislation on the Prevention of Laundering Proceeds of Crime and Financing of Terrorism along with the Prevention of Weapons of Mass Destruction that our Bank is subject to, fulfillment of identification and know-your customer obligations, and execution of compliance processes.	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(c) of LPPD; Processing of personal data belonging to the parties to the agreement is required, on condition that it is directly related to the establishment or performance of such agreement. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations.
Identity, Contact Information, Finance, Customer Transactions, Risk Managementt	When any commercial customer requests a loan and/or investment product;for the purposes of assessing the loan history, credibility and loan conditions of the owner, partner and manager of the natural person commercial customer in order to assess the request
Identity, Finance, Contact Information, Legal Proceedings, Risk Management, Customer Transactions	For the purposes establishing our restructuring policy for debt collection purposes, maintaining the risk monitoring and analysis processes,
Identity, Finance, Contact Information, Legal Proceedings, Customer Transactions, Risk Management	After assignment of our receivables from you, for the purposes of transferring your information to the company to which your debt has been or will be transferred	As per article 5/2(ç) of LPPD, As per article 5/2(e) of LPPD,
Identity, Finance, Contact Information, Legal Proceedings, Risk Management, Customer Transactions, Professional Experience, Transaction Security	For the purposes fulfilling obligations arising from Banking Law, Debit Cards And Credit Cards Law, Law on Prevention of Laundering Proceeds of Crime, Laws And Regulations On Payment And Securities Reconciliation Systems, Payment Services And Electronic Money Institutions, Sub-regulations published by the Banking Regulation and Supervision Agency on the management of banks' credit processes and other applicable legislation	As per article 5/2(a) of LPPD; It is expressly envisaged in the laws. As per article 5/2(ç) of LPPD; being mandatory for the data controller to fulfill its legal obligations.
Identity, Finance, Marketing, Customer Transactions, Contact Information, Professional Experience, Risk Management	Concerning the banking, insurance, retirement, finance and capital market activities (including investment) products and services of our bank, its direct or indirect subsidiaries and Other shareholders and their subsidiaries and affiliates, and other entities the aforementioned companies do business with or act as an intermediate or an agency for, and all the other products and services provided by Denizbank A.Ş together with the aforementioned companies; For the purposes of explaining, promoting and marketing the related products and services, planning and implementing the promotion and communication activities, Providing offers containing data, audio and video content from all channels, including digital environments, social media channels, telephone, call center, electronic mail and short message services carrying out promotion, marketing, cross-selling and campaign activities and designing customized marketing and promotional activities for me, carrying out data analytics studies for credits, behavioral scoring, market research and marketing purposes in order to identify and develop suitable products and services for me, carrying out studies on customer satisfaction and experience, Conducting studies, including surveys and statistical studies, Reviewing and analyzing your data, making the marketing messages/advertisements that you receive more relevant and attractive, following up on the advertising and marketing, Providing information on the products, services, campaigns, rewards, proposals, promotions, loyalty programs and contests that you may be interested in, Designing products, services and working models for the development of banking products and services, and working on segmentation	As per article 5(1) of LPPD; personal data cannot be processed without the explicit consent of the data subject. As per article 5/2(f) of LPPD Processing of data is being necessary for the legitimate interests pursued by the data controller.

Your personal data is shared with the below parties in accordance with the Articles 8 and 9 of the LPPD, for the below reasons:

To fulfil obligations arising from Banking Law, Law on Prevention of Laundering Proceeds of Crime and other legislation that we are subject to; With public institutions and organizations, ministries and judicial authorities which are authorized to receive information by law including Financial Crimes Investigation Board, Revenue Administration, Banking Regulation and Supervision Agency, Personal Data Protection Authority, Capital Markets Board, Central Bank of Republic of Türkiye, MASAK, The Banks Association of Türkiye, Ministry of Treasury and Finance, Information Technologies and Communication Institution, Social Security Institution, Insurance Information and Observation Center and other legally authorized institutions,
To be able to perform banking activities and offer you the suitable products and services in connection and to be limited with your request; With the institutions that we receive support services or external services such as stores, dealers, sales offices, electronic commerce sites that mediate the establishment of a contractual relationship with our bank (eg. Mastercard, courier companies, etc.), program partner organizations we cooperate with, suppliers from which we receive service, support service organizations, subcontractors, your workplace, card providers such as Visa and Mastercard, institutions that mediate collection payments, Mobile service providers authorized by the Information Technologies and Communications Authority; in case you have a house loan or mortgage loan at our bank which is collateralized, with your spouse for spousal consent, with your sureties and/or guarantors; with third parties who give collateral (such as mortgage, cash blockage, etc.) for your loan utilized from our bank, with real estate valuation companies,
In order to fulfill your request with Payment Service Providers, financial institutions that are members of the payment program, and international or domestic payment systems institutions and organizations (card payment system companies that are established abroad or domestically and are included in Law numbered 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions and other legislation including Europay INT.SA, Moneygram Group (Moneygram Payment Systems Inc. and Moneygram Turkey Ödeme Sistemleri A.Ş.), MasterCard INT.INC., Visa INC., JCB CO., LTD., Maestro, Electron)
With Risk centers or institutions established by at least five banks or financial institutions (Interbank Card Center, Credit Bureau, etc.) for the purpose of managing risk management and risk monitoring activities,
To ensure that your applications are put into process accurately and to make inquiries in the systems for your security within the framework of know your customer obligations (ID Sharing System, Address Based Population Registration System, etc.) through system integrators,
If a loan you utilize from our bank is allocated to you through us indirectly from a foreign financial institution (EIB, EBRD, GGF, EFSE, IFC, EIF, AFD, Proparco; AIIB) or if funds that domestic financial institutions TKB, Turkish Eximbank, TSKB secure from abroad are allocated to you through us as an intermediating financial institution; your personal data can be shared with these financial institutions and the third parties to whom they are obliged to give information in order to carry out internal audit, internal control, risk management, risk monitoring, credit lending and credit restructuring activities,
With asset management companies or other companies to which we have sold our receivables, so that assessment studies can be performed for our receivables and the assignment of our receivables can be realized,
If you use your debit or credit card in different bank devices and pos, with the bank that owns the device and pos in order to be able to realize the transaction that you would like to realize,
Within the framework of Article 73 of the Banking Law, BRSA operating expansion permits and Laundering of Proceeds of Crime legislation, with Denizbank Financial Services group.

Pursuant to article 11 of the Personal Data Protection Law, you have the following rights related to your personal data:

a) to learn whether your personal data are processed or not,

b) to request information if your personal data are processed,

c) to learn the purpose of your data processing and whether this data is used for intended purposes,

d) to know the third parties to whom your personal data is transferred at home or abroad,

e) to request correction if your personal data were processed incompletely or inaccurately and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope

f) Despite being processed as per the provisions of the Law numbered 6698 and other relevant laws, in the event that reasons requiring the processing have disappeared, to request the erasure or destruction of your personal data and to request that third persons, to whom your personal data are transferred, get notified about the transactions carried out within this scope,

g) to object to the processing, exclusively by automatic means, of your personal data, which leads to an unfavourable consequence for you,

h) to request compensation for the damage arising from the unlawful processing of your personal data.

You can submit your requests within the scope of your rights regarding your personal data via:

A written petition to the attention of our branches or our Head Office located in Büyükdere Cad. No: 141 Esentepe 34394 Şişli / İSTANBUL, provided that you verify your identity, or through notary public.
By e-mail to denizbank.haberlesme@hs09.kep.tr, using your registered e-mail address, with electronic or mobile signature.
By e-mail to oncemusteri@denizbank.com using your e-mail address that you have previously reported to our bank and registered in our system,
By filling out the form that appears when you do the following selection in the link https://www.denizbank.com/iletisim/musteri-memnuniyeti-formu “Notification type: Complaint - Subject: Retail Banking - Sub-Subject: Personal Data Protection Law Complaint Notifications”.

Your application shall be finalized as soon as possible and within thirty (30) days at the latest, free of charge. If transactions pertaining to your request entail a separate cost, a fee may be charged from you as per the tariff stated by the Personal Data Protection Board.

You can access this data privacy notice and all other data privacy notice texts of our bank from the link https://www.denizbank.com/kvk or by scanning the QR code below on your mobile phone.

Accounts

Cards

Loans

Digital Products

Our Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding the Credit Processes

About DenizBank

Investor Relations

Accounts

Loans

Calculators

Cards

Digital Products

Accounts

Cards

Loans

Digital Products

Data Privacy Notice Regarding the Credit Processes

1. Your Processed Personal Data

2. Methods of Collecting Your Personal Data

3. What we use your personal data for and the legal basis for doing so

4. Who we will share your personal data with and For What Purposes

5. Your Rights Regarding Your Personal Data