Protection of Personal Data

TEB YATIRIM MENKUL DEĞERLER ANONİM ŞİRKETİ PUBLIC DISCLOSURE TEXT ON PROTECTION OF PERSONAL DATA

Pursuant to the provisions of Article 10 "Disclosure Liability of Data Supervisor" of the Law on Protection of Personal Data, no. 6698, as well as "Communiqué on Procedures and Principles To Be Followed In Fulfillment of The Obligation To Inform" published in the Official Gazette edition 30356 on 10 March 2018, we hereby wish to inform you about your personal data that we process per the provisions of the Law and Communiqué both of which aim to protect the basic rights and freedoms of individuals, especially the right of privacy, in processing of personal data, and to determine the obligations of natural persons or legal entities processing personal data.

1. IDENTITY OF DATA SUPERVISOR

As TEB YATIRIM MENKUL DEĞERLER ANONİM ŞİRKETİ (“TEB Yatırım”, “We” or “Company”), we act as “Data Supervisor” under the Law. You can contact us through different channels by using the information provided below:

Address : Saray Mahallesi, Sokullu Cd D:No: 7/A - 7/B, 34768 Ümraniye/İstanbul
Telephone : +90 (216) 636 44 44
Fax : +90 (216) 631 44 00
E-mail : tebyatirim@tebyatirim.com.tr

2. WHY DO WE PROCESS PERSONAL DATA?

Within the scope of the relationship between you and our Company, (i) your identity information such as name and surname, birth place, birth date, age, photograph, identity card, identity number; (ii) your contact details such as work address, home address, e-mail, telephone, mobile phone, record of place of residence, record from address registration system; (iii) information about marital status, number of children, husband/wife and other relatives (your family-related data such as identity, financial situation, and education level); (iv) your financial data such as bank account number and IBAN; (v) information regarding the security of Company campus such as CCTV records, visitor details, entrance and exit to the Company's premises; (vi) cyber security-related data and logs such as usernames, passwords, audit trails, IP address, web page access logs, warnings, and any other related data and logs; and (vii) any data and voice records of yours which may be processed for audit and inspection purposes according to the applicable legislation shall be processed for the purposes stated hereinbelow:

Planning, supervision, and enforcement of information security processes,
Installation and management of information technologies infrastructure,
Tracking of finance and/or accounting works and activities,
Management of contracts and establishment and tracking of legal processes and procedures,
Assurance of security of the Company premises and employees,
Performance of efficiency and/or conformability analyses of our business activities as well as planning and conducting of such business activities,
Definition and application of commercial and business strategies,
Full, appropriate and adequate performance of our contractual and legal responsibilities,
Assessment of and response to your suggestions, demands, complaints, and failure notices communicated to our Company via relevant channels including Internet, mobile applications and call center; and carrying out improvement works as per the said notifications,
Opening of accounts for individual customers, update of customer details, and sending of monthly account statement to customers,
Exchange of stock certificate, transfer of capital market instruments and cash,
Meeting the information requests from the Capital Markets Board, Borsa Istanbul, Finance Ministry, and other public institutions,
Notification of Capital Markets Board and Financial Crimes Investigation Board about suspicious transactions,
Management of financial security processes (such as Know Your Customer (KYC) Principles, Anti-Money Laundering (AML), Anti-Fraud, and any other measures against corruptive offenses),
Recording and storage of conversations and dealings between a customer and Bank staff under the applicable laws and regulations, and sharing of such with relevant units if necessary,
Monitoring, assessment, and review of market abuse cases, and taking necessary actions against such,
Performance of internal control activities,
Comparing customer database with international lists of prohibited persons at account openings and at certain times periodically,
Reporting and monitoring activities,
Managing public offering procedures and processes,
Performance of stock trade and investment credit transactions,
Marketing activities.

Furthermore, information and data regarding (i) your race, ethnicity, political opinion, philosophical belief; (ii) your religion, religious sect, and other beliefs, your appearance and mode of dressing; (iii) your health and sexual life; (iv) your membership of associations, foundations or unions; (vi) criminal convictions and security measures of persons; and (vii) your biometrical and genetic data which are considered “specific personal data” under the Law can be processed for the purposes listed below:

Meeting our legal obligations,
Providing relevant information necessitated by laws and regulations to authorized institutions,
Taking workplace health and safety measures,
Ensuring security,
Opening bank accounts for individual customers,
Providing investment credits,
Realizing marketing activities,
Carrying out audit and inspection processes.

3. TO WHOM DO WE TRANSFER YOUR PROCESSED PERSONAL DATA? AND WHY?

For the purposes stated in the 2^nd section of this Public Disclosure Text within the scope of the provisions of the Law related to the transfer of personal data and transfer of such to abroad, your personal data can be shared with domestic or international official organizations and institutions, law enforcement officers, courts and execution offices, our related third-party natural persons and legal entities, service provider firms and their officials, business partners, banks, our Company’s shareholders, our group companies and subsidiaries, suppliers and support service providers, particularly Capital Markets Board, Central Securities Depository, Financial Crimes Investigation Board, Finance Ministry, Credit Registration Bureau, Turkish Central Bank, Takasbank Istanbul Settlement and Custody Bank A.Ş., and Borsa Istanbul A.Ş..

In the event of transfer of your personal data to abroad, your express consent shall be required; or your personal data may be transferred to abroad without your express consent providing that there exists one of the conditions specified in the Law for the processing of your personal data and that the foreign country to which personal data will be transferred;

Has adequate means for the protection of personal data, or
Has not adequate means for the protection of personal data but TEB Yatırım and the relevant data supervisors in the concerned foreign country provide a guarantee in writing for adequate protection, and Personal Data Protection Board authorizes and approves such a procedure.

4. HOW DO WE COLLECT YOUR PERSONAL DATA? WHAT IS THE LEGAL CAUSE?

4.1. PERSONAL DATA COLLECTION METHOD

Our Company collects your personal data by employing different methods on physical, oral, written or electronic means and using requests and applications sent via internet, telephone, e-mail, mobile channels, and bank branches through all relevant organizations and institutions, Public Disclosure Platform, Takasbank Istanbul Settlement and Custody Bank A.Ş., and Central Securities Depository in particular, at the time of establishment of the legal relationship between you and our Company, and over the course of such relationship, during display of our website, creation of log records, use of cookies, use of services provided on our website and through our mobile applications; and accordingly, our Company takes required measures within the scope of the relevant legislation in order to ensure privacy and security of the relevant personal data.

4.2. LEGAL CAUSE OF PERSONAL DATA COLLECTION

Based on one or some of the causes of justification listed hereinbelow, your personal data is collected, stored, and processed, and can be transferred to take adequate precautions:

You state your express consent,
It is explicitly stipulated by the laws and regulations to which our Company is subjected, including but not limited to Capital Markets Law, Law on Prevention of Laundering of Crime Revenues, Banking Law, Law on Payment and Securities Reconciliation Systems, Payment Services and Electronic Money Institutions,
Our Company should comply with national and international principles and rules regarding knowing customers as well as meeting its obligations stipulated by the legislation and official authorities related to data storage, reporting, and informing,
It is required for the protection of a person’s or another person’s life or bodily integrity when a person is not in a state to give his/her consent due to practical impossibility or whose consent is not considered legally valid,
Providing that it is directly related to establishment or performance of a contract, processing of personal data of contracting parties is necessary; our Company should provide required products and services, and meet the provisions of contracts it entered into,
It is compulsory for the performance of legal obligations,
Personal data is made public by the concerned person himself/herself,
Processing of personal data is required for establishment, use or protection of a right,
Processing of personal data should be required for the protection of legitimate interests of the data supervisor on the condition that the related person’s basic rights and freedoms are not violated.

Specific personal data such as data relating to race, ethnical origin, political thought, philosophical belief, religion, sect or other beliefs, attire and appearance, membership in associations, foundations or workers' unions, health, sexual orientation or life, criminal convictions and security measures of persons, and their biometrical and genetic data may be processed based on the causes of justification listed hereinbelow:

You give your express consent,
As for the specific personal data except for data on health and sexual life, data processing can be done without your express consent in cases stipulated by the legislation,
As for data on health and sexual life, such data may be processed only by persons or authorized institutions and official authorities subject to secrecy and confidentiality obligations without seeking for an express consent of the related Person, only for the sake of protection of public health, preventive medicine, provision of medical diagnosis, treatment, and care services, and planning and management of healthcare services and financing thereof.

5. WHAT ARE YOUR RIGHTS AS THE CONCERNED PERSON WITHIN THE SCOPE OF LAW?

Under the law, you have the rights stated herein below:

To learn whether your personal data is processed or not,
If your personal data is processed, to request information about such processing,
To learn the purpose of the processing of your personal data and whether your personal data is used for the intended purposes or not,
To learn the identity of third parties to whom personal data is transferred in your home country or abroad,
If your personal data is processed incompletely or inaccurately, to request completion or correction of the same,
To request deletion or destruction of your personal data within the frame of conditions set forth in the Law,
To request completion or correction if and when your personal data is processed incompletely or inaccurately, and to demand notification of third parties to whom personal data is transferred if and when your personal data is deleted or destructed within the frame of conditions stipulated in the Law,
To raise an objection against probable consequences in disfavor of yourself that may be obtained through analysis of the processed personal data solely and exclusively by automatic systems,
To claim indemnification of your damages and losses, if any, suffered due to illegal and unlawful processing of personal data.

Your personal data shall be processed through the periods of time required by the purposes of processing personal data explained herein. Upon expiration of said periods of time, on the condition that there are other provisions of laws and regulations or any other legal cause enabling the processing of the relevant data for extended or longer periods, the processing of your personal data will also continue through these periods of time. However, upon expiration of these periods of time, your personal data will immediately be deleted, destroyed or anonymized.

In line with the rights defined hereinabove, you may personally bring your letter of request together with your letter of application or send it via a notary public to “TEB Kampüs D Blok Saray Mahallesi Sokullu Caddesi No:7B Ümraniye 34768 İSTANBUL”. Additionally, you may send the said documents to tebyatirimmenkuldegerler@hs03.kep.tr – registered electronic mail addresses of our Company pursuant to Article 5 of “Communiqué on Procedures and Principles of the Application to the Data Supervisor” – or to kvkk-basvuru@tebyatirim.com.tr by signing the said documents with “secure electronic signature” as defined in the Electronic Signature Law no. 5070, or with mobile signature or hand-written signature, or by using the electronic mail address which has previously been designated and notified by yourself to our Company and is therefore registered in our system. Please click here for a sample Application Form for the Use of Personal Data Rights.

The following information must be included in the application: (i) name, surname, and signature if the application is in writing; (ii) T.R. identity number if the applicant is a Turkish citizen; if the applicant is a foreign national, nationality, passport number or identity number, if any; (iii) residence or office address used for notifications; (iv) if any, electronic mail address, telephone and facsimile numbers usable for notices and correspondences; and (v) subject of request.

All of your applications duly transmitted to our Company shall, be resolved as soon as possible and in any case within no later than thirty days after receipt of the request by us, depending on the nature and kind of the request. Applications are essentially responded free of charge; however, applications of data owners can be charged under certain conditions within the frame of tariffs published by the Board.

It is of importance that your stored personal data is correct, true, and up-to-date. Therefore, please notify us in case of any change in your personal data.

TEB YATIRIM MENKUL DEĞERLER ANONİM ŞİRKETİ
AS DATA SUPERVISOR