Information Notice Regarding Personal Data Processing

Data Controller: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico” or “Company”)

Contact Information:

iyzico:
Legal Title: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.
MERSİS Number: 0483034315700019
Address: Altunizade Mah. İnci Çıkmazı Sokak, No: 3 İç Kapı No: 10 Üsküdar İstanbul
E-mail: [email protected]
Telephone: +90216 599 01 00

We, as iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico” or “Company”) attach importance to the protection of personal data and, as the data controller, we take the necessary security measures prescribed by relevant legislation regarding your personal data. In this Information Notice, we would like to inform you about personal data processing by iyzico within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”).

1. The Purpose of The Processing of User’s Personal Data:

User’s (Customers or people visiting our website) personal data shall be processed;

- In the manner prescribed by the rule of law and in good faith
- In connection, limited and proportionately with the processing purposes,
- In an accurate and updated manner,
- For specified, explicit, and legitimate purposes.

As iyzico, we process Users’ personal data in accordance with the Articles 5 and 6 of the KVKK for the following purposes:

i. The execution of necessary works and respective work processes by business units in order to allow relevant persons to benefit from services offered by iyzico,

ii. The carrying out of works by business units that are necessary for the performance of commercial activities of iyzico and the execution of related work processes,

iii. The planning and execution of iyzico’s commercial and/or business strategies,

iv. Ensuring the legal, technical and commercial safety of iyzico and relevant persons having a professional relation with iyzico,

2. The Transfer of Users’ Personal Data

Users’ personal data may be transferred to the Company authorities, our affiliates, business partners, suppliers, shareholders, legally authorised public institutions and organisations and private entities pursuant to the personal data processing conditions set out in Articles 8 and 9 of the Law (KVKK) and within the scope of above-mentioned purposes.

3. The Method and Legal Ground of Personal Data Collection:

The personal data of Users is collected either electronically or physically in case of iyzico’s request. Personal data collected for legal ground stipulated above may be processed and transferred for the purposes specified in this Information Notice and pursuant to the Articles 5 and 6 of the Law.

4. Storage of Your Personal Data
In the event of expiration of the consent period or cancellation of consent by you, your acquired data will continue to be stored and processed, subject to obtaining your consent, in order to provide value-added services related to administrative and operational processes to our corporate and merchant customers, and to provide qualified services to our individual customers.

5. The Rights of Users As Data Subjects:

Within the scope of Article 11 of Law (KVKK), Users have right to;

i. Learn whether or not his or her personal data have been processed
ii. Request information as to processing where his or her data have been processed,
iii. Learn the purpose of personal data processing and whether the personal data is used in accordance with such purpose,
iv. Know the third parties in the country or abroad to whom personal data have been transferred,
v. Request rectification in case personal data have been processed incompletely or inaccurately and request the notification of the operations in this regard to third parties to whom personal data have been transferred,
vi. Despite having been processed in accordance with the provisions of the Law or other related regulations, request the erasure or destruction of such personal data in case the reasons necessitating their processing cease to exist and request notification of the operations in this regard to third parties to whom personal data have been transferred,
vii. Object against any result that is to his or her detriment occurring from the analysis of personal data exclusively through automated systems,
viii. Request compensation in case the data subject incurs any damage due to the unlawful processing of personal data.

6. Requests and Applications

To exercise the rights mentioned above:

• You can perform identity verification and contact our Call Center,
• You can send your requests to our Company through a notary via the address "Altunizade Mah. İnci Çıkmazı Sk. No:3 İç Kapı No:10 Üsküdar İstanbul",
• You can also send your requests to [email protected] using your secure electronic mail address.

iyzico will assess and determine such requests within 30 days. iyzico reserves the right to request a reasonable fee on the basis of the rate specified by the Personal Data Protection Board in relation to such requests.

7. Processing of Your Personal Data within the Scope of Open Banking Services and Its Legal Basis

Open Banking, established under the legal framework by the Central Bank of the Republic of Turkey (“CBTR”), enables the tracking of demand TL and foreign currency accounts through the applications and websites of other banks and licensed institutions, as well as initiating payments from relevant accounts.

Our company, in order to provide you with better service and enable you to benefit from Open Banking services, will collect your personal data as the "Payment Service Provider" within the framework determined by Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions ("Law") and the Directive on Payment Services and Electronic Money Issuance and Payment Service Providers (“Directive”), and as foreseen in the Law, based on your request and consent.

There are two types of Payment Service Providers within the scope of payment services and data sharing services: Account Information Service Provider (AISP) and Payment Initiation Service Provider (PISP).

i. Processing of Your Personal Data under Account Information Service

Our company, as an Account Information Service Provider within the scope of Article 12.1/g of the Law, compiles information related to your accounts held with other Account Service Providers (ASP) and presents them collectively on our company's online platforms.

While benefiting from this service, you will be able to access your relevant demand deposit accounts for a period of 0-6 months, within the framework of the consent you provide under the Law and Directive, only for display purposes. You can withdraw your consent to this service at any time.

ii. Processing of Your Personal Data under Payment Initiation Service

Within the scope of payment initiation service, a licensed Payment Initiation Service Provider facilitates the initiation of payments from the payment accounts of payment service users at another payment service provider (ASP). In the scope of Article 12.1/f of the Law, you will be able to directly initiate payment orders through our Company without accessing your account at the ASP where your account is located.

iii. Processing of Your Personal Data under Qualified or Value-Added Services

In accordance with Articles 12.1/f and 12.1/g of the Law, our company will provide services to support the financial situation and financial awareness of individuals, such as budget management, invoice management, account verification, and payment reminders for our individual customers; and for our corporate customers, services facilitating administrative and operational processes such as commercial debt and receivable management, accounting, invoicing, product, inventory, and supply chain management, within the scope of the 9th paragraph of Article 15 of the Directive.

iv. Processing Purposes and Parties of Your Personal Data

Your personal data shared with our Company within the scope of Open Banking services are collected and processed by our Company for the purposes and methods explained below, and are processed based on the legal grounds listed below. In all cases, our Company processes your personal data in accordance with the principles specified in Article 4 of the Law, in a manner that is relevant, limited, and proportionate to the purpose of processing.

The personal data you share with our Company within the scope of Open Banking services will only be used to provide the requested service, send notifications related to changes, information, usage, and maintenance services, and renewal of the contract, and will not be shared with third parties and institutions except as required by law or with your consent.

v. Methods of Collecting Your Personal Data

Your personal data within the scope of Open Banking Services is collected through automatic methods by our Company via our internet branch and mobile application, other ASPs, and databases of other institutions ("other institutions" for more information, visit our Privacy & Personal Data Policy / iyzico.com).

vi. Processed Personal Data and Processing Purposes

In order to provide you with open banking services and enable you to better benefit from our Company's other products and services through open banking services, we process your Identity Information, Contact Information, Customer Transaction Information, and Device Information for the purposes of initiating payment orders and providing account information services, directly related to the establishment or performance of the contract under the scope of the Law; and for our Company to fulfill its legal obligations and be mandatory under the laws.

vii. Transfer to Third Parties

As mentioned above, your personal data will only be shared with organizations and ASPs where your payment account is located, in accordance with the principles of being relevant, limited, and proportionate to the purpose of processing your personal data, as required for our Company to fulfill its legal obligations within the framework of legislation or outside of your consent. For more information about the transfer of your personal data to third parties, you can visit our Privacy & Personal Data Policy / iyzico.com