Consent Form Regarding Personal Data Processing

1. The role of our company as data controller:
As per Law No. 6698 on the Protection of Personal Data (“PD Law”), our company iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico” or “Company”) qualifies as a “data controller” in regard to the personal data of its users. The objective of this Explicit Consent Form Regarding Personal Data Processing is to inform users about the personal data processing activities carried out by iyzico in accordance with the PD Law and to obtain their express consent for circumstances set out in Article 3 below.

2. The purpose of the processing of user’s personal data:
The personal data of users is processed within the scope of the conditions and purposes set out in Articles 5 and 6 of the PD Law, which include: the execution of necessary works and respective work processes by business units in order to allow relevant persons to benefit from services offered by iyzico; the carrying out of works by business units that are necessary for the performance of commercial activities of iyzico and the execution of related work processes; the planning and execution of iyzico’s commercial and/or business strategies; ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico; and the planning and execution of activities that are necessary to market and offer the services offered by iyzico by personalising such services according to the liking, habits and needs of relevant persons.

3. Personal data to be processed on the basis of explicit consent of users and the purpose of processing:
In circumstances where the conditions for personal data processing set out in Articles 5/2 and 6/3 of the PD Law are not met, the explicit consent of user’s must be obtained for iyzico to process personal data.
Accordingly, the personal data of users for the purposes of developing campaigns directed at users, cross-selling, identifying a target audience, implementing activities that enhance user experience through tracking users’ movements, developing the operation of iyzico’s website, user panel and mobile application and personalising them according to the needs of users, executing direct and indirect marketing, customised marketing and re-marketing activities, executing customised segmentation, targeting, re-targeting, analysis and inter-corporate reporting activities, planning and executing the sales and marketing processes offered by iyzico including with the intent of planning and executing user satisfaction activities and user relationship management processes, planning and implementing processes of generating and/or increasing loyalty to the services offered by iyzico may only be processed, submitted to third persons and shared with parties set out in this Explicit Consent Form Regarding Personal Data Processing.

Additionally, our company, in order to provide you with better service and enable you to benefit from Open Banking services, will collect and process your personal data within the framework of Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions ("Law") and the Directive on Payment Services and Electronic Money Issuance and Payment Service Providers (“Directive”), as well as in the manner foreseen in Law No. 6493, as a "Payment Service Provider," based on your request and consent.

There are two types of Payment Service Providers within the scope of payment services and data sharing services: Account Information Service Provider (AISP) and Payment Initiation Service Provider (PISP).

3.1. Processing of Your Personal Data under Account Information Service
Our company, as an Account Information Service Provider within the scope of Article 12.1/g of Law No. 6493, compiles information related to your accounts held with other Account Service Providers (ASP) and presents them collectively on our company's online platforms.

While benefiting from this service, you will be able to access your relevant demand deposit accounts for a period of 0-6 months, within the framework of the consent you provide under Law No. 6493 and the Directive, only for display purposes. You can withdraw your consent to this service at any time.

3.2. Processing of Your Personal Data under Payment Initiation Service
Within the scope of payment initiation service, a licensed Payment Initiation Service Provider facilitates the initiation of payments from the payment accounts of payment service users at another payment service provider (ASP). Under Article 12.1/f of Law No. 6493, you will be able to directly initiate payment orders through our company without accessing your account at the ASP where your account is located.

3.3. Processing of Your Personal Data under Qualified or Value-Added Services
Our company, in accordance with Articles 12.1/f and 12.1/g of Law No. 6493, will provide services to support the financial situation and financial awareness of individuals, such as budget management, invoice management, account verification, and payment reminders for our individual customers; and for our corporate customers, services facilitating administrative and operational processes such as commercial debt and receivable management, accounting, invoicing, product, inventory, and supply chain management, within the scope of the 9th paragraph of Article 15 of the Directive.

Regarding the processing purposes within the scope of Open Banking, we process your Identity Information, Contact Information, Customer Transaction Information, and Device Information for the purposes of initiating payment orders and providing account information services, directly related to the establishment or performance of the contract under the scope of Law No. 6493, and to fulfill our legal obligations as required by law.

4. The transfer of user’s personal data
The personal data of users may be transferred to Company authorities, our affiliates, business partners, suppliers, shareholders, legally authorised public institutions and organisations and private entities and ASP regarding open banking services pursuant to the personal data processing conditions and purposes set out in Articles 8 and 9 of the Law which include the following: the execution of necessary works by business units in order to allow relevant persons to benefit from the services offered by iyzico and the execution of relevant work processes; the execution of necessary works by business units to perform commercial activities carried out by iyzico and the execution of related work processes; the planning and implementation of iyzico’s commercial and/or business strategies; ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico; and the planning and execution of activities that are necessary to market and offer the services offered by iyzico by personalising such services according to the liking, habits and needs of relevant persons.

5. The method and legal purpose of personal data collection:
The personal data of users is collected either electronically or physically in case of iyzico’s request. Personal data collected for legal reasons stipulated above may be processed and transferred for purposes set out in Articles 5 and 6 of the PD Law and this Explicit Consent Form Regarding Personal Data Processing.

In the scope of providing Open Banking Services, your personal data is collected by our company through automatic methods using our internet branch and mobile application, as well as databases of other ASPs (Account Information Service Providers) and other organizations ("other organizations"). For more information about "other organizations," please visit our Privacy & Personal Data Policy at iyzico.com.

6. The rights of users as personal data subjects:
Pursuant to Article 11 of the PD Law, a data subject is entitled to: (i) learn whether or not his or her personal data have been processed, (ii) request information as to processing where his or her data have been processed, (iii) learn the purpose of personal data processing and whether the personal data is used in accordance with such purpose, (iv) know the third parties in the country or abroad to whom personal data have been transferred, (v) request rectification in case personal data have been processed incompletely or inaccurately and request the notification of the operations in this regard to third parties to whom personal data have been transferred, (vi) despite having been processed in accordance with the provisions of the Law or other related regulations, request the erasure or destruction of such personal data in case the reasons necessitating their processing cease to exist and request notification of the operations in this regard to third parties to whom personal data have been transferred, (vii) object against any result that is to his or her detriment occurring from the analysis of personal data exclusively through automated systems, (viii) request compensation in case the data subject incurs any damage due to the unlawful processing of personal data.

The claims with respect to such rights may be submitted by means of the methods set forth in the iyzico Privacy Policy available at https://www.iyzico.com/gizlilik-politikasi. iyzico will assess and determine such requests within 30 days. iyzico reserves the right to request a reasonable fee on the basis of the rate specified by the Personal Data Protection Board in relation to such requests.

7. Giving Explicit Consent
By giving consent to this Explicit Consent Form Regarding Personal Data Processing, you authorize iyzico or authorized data processors empowered by iyzico as the data controller to process your personal data for the purposes listed above and in connection with payment, electronic money, and open banking services provided by iyzico, as well as ancillary services that facilitate these services in order to provide iyzico's users with the products and services under the best conditions, ensure the reliable and uninterrupted provision of products or services, maximize customer satisfaction, process payments, fulfill various transactions related to these services, conduct and improve operations, and conduct promotional, marketing, advertising, and campaign activities for the said products and services or different products and services, and to inform users about opportunities, campaigns, and other services, and to fulfill the requirements of contracts concluded with users.

You acknowledge and declare that your identity information, address information, contact information, and other personal data directly or indirectly related to the aforementioned purposes may be processed in accordance with the general principles stated in Article 4 of the PD Law, including the principle of retention for the period required by the legislation or for the purpose for which they were processed, and that they may be obtained, recorded, securely stored physically or electronically for the appropriate period for processing purposes, retained, modified, reorganized, disclosed in accordance with the legislation, transferred, taken over, classified, processed, or prevented from being used.

You further acknowledge and declare that you have been informed by iyzico regarding the above-mentioned matters and that you have explicit consent within the framework of the PD Law