QNBPAY ÖDEME HİZMETLERİ ANONİM ŞİRKETİ
PROCESSING OF PERSONAL DATA INFORMING TEXT

IDENTITY OF DATA CONTROLLER

This Informing Text provides information about which of and for which purposes your personal data is processed, as well as the third parties with whom your personal data is shared, your rights and how to contact QNBPAY ÖDEME HİZMETLERİ ANONİM ŞİRKETİ (hereinafter shortly referred to as “QNBPAY” or the “COMPANY”) acting as Data Controller. The Informing Text has been prepared in accordance with Article 10 of Personal Data Protection Law no. 6698 (“KVKK”) with the purpose of processing personal data of customers of QNBPAY transparently.             
As the Data Controller, QNBPAY takes all the required measures to prevent the illegal use of personal data, store this data and ensure an appropriate level of security as per the legislation in data processing and transfer processes. Your personal data is processed by considering especially the Personal Data Protection Law, Turkish Code of Obligations, Turkish Commercial Code, Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, Law on the Regulation of Electronic Commerce, Law on Prevention of Laundering Proceeds of Crime and other relevant legislative provisions.   
Your personal data is processed in accordance with the principles set forth below as per Article 4 of the Personal Data Protection Law depending on the service provided or product offered by QNBPAY or commercial operation carried out: 

1. 1. Lawfulness and fairness
   2. Being accurate and kept up-to-date where necessary
   3. Being processed for specified, explicit and legitimate purposes
   4. Being relevant, limited and proportionate to the purpose for which the data is processed
   5. Being stored for the period laid down by relevant legislation or the period required for the purpose for which personal data is processed

GROUPS OF DATA SUBJECTS WHOSE DATA IS PROCESSES

The personal data of individual representatives/individual employees of our natural or legal customers who wish to benefit from the products and services provided by our Company, buy these products and services may be processed in line with the purposes and legal grounds explained below.

PROCESSED PERSONAL DAT

THE PURPOSE AND LEGAL GROUND FOR PROCESSING YOUR PERSONAL DATA

1. The personal data falling under the categories of Identity, Communication, Legal Transaction, Finance, Customer Transaction Information is processed for the purposes set forth below on the grounds that it is expressly provided for by the laws under Article 5/2-a of the Personal Data Protection Law no. 6698, processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract under Article 5/2-c, it is necessary for compliance with a legal obligation to which the Data Controller is subject under Article 5/2-ç, processing of data is necessary for the legitimate interests pursued by the Data Controller, provided that this processing shall not violate the fundamental rights and freedoms of the Data Subject under Article 5/2-f:

• Carrying out communication activities and providing necessary information under the contract
• Selling products and services of our company, receiving orders, drawing up sales agreement and fulfilling legal obligations
• Creating customer records and ensuring business continuity
• Carrying out collection transactions after product and service sales, making payments, following up current account and carrying out accounting activities, invoicing, refunding or changing products when necessary
• Informing our customers about our products and services, submitting requests for proposal and carrying out communication activities
• Conducting identification and identity verification processes
• Verifying the accuracy of customer information and updating such information
• Managing risk assessment processes for prospective customers
• Fulfilling requests from government agencies (including, but not limited to, public institutions such as BRSA, CBRT and Financial Crimes Investigation Board (MASAK) to which we have the obligation to give information)
• Determining and developing strategies for offering products or providing services of our company
• Following up and addressing requests and complaints, improving service quality for customer satisfaction
• Managing investment processes

2. The personal data falling under the categories of Identity, Communication, Customer Transaction Information, Information Processing, Visual Recordings (The personal data of our customers who sign up for the website is processed within this scope.) is processed for the purposes set forth below on the grounds that processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract under Article 5/2-c of the Personal Data Protection Law no. 6698, it is necessary for compliance with a legal obligation to which the Data Controller is subject under Article 5/2-ç, processing of data is necessary for the legitimate interests pursued by the Data Controller, provided that this processing shall not violate the fundamental rights and freedoms of the Data Subject under Article 5/2-f:

• Registering merchant on the website
• Managing processes for creating and closing a website profile
• Managing information security processes, providing legal and commercial security of the parties, fulfilling legal obligations, managing business processes of our Company

3. With the aim of determining whether the parties fulfill their contractual and legislative obligations, exercising legal rights in case of potential disputes and storing the information which constitutes an evidence, providing legal and commercial security of the parties, the personal data falling under the categories of Identity, Communication, Finance, Legal Transaction, Information Processing, Customer Transaction Information, Risk Management may be processed on the grounds that data processing is necessary for the establishment, exercise or protection of any right under the Personal Data Protection Law no. 6698.

4. With the aim of building potential customer portfolio, informing you about campaigns and offers, carrying out profiling, targeting and advertisement activities, presenting you with offers best suited to your previous preferences, conducting surveys to measure customer satisfaction, informing you about campaigns, carrying out promotional, advertisement and marketing activities related to our Company’s products and services and carrying out communication activities within this scope, sending celebration and congratulation messages on special days, sending commercial electronic messages (SMS, E-mail, call, etc.) to conduct surveys, the personal data falling under the data categories of Identity (Name, Surname), Communication (Mobile Phone Number and E-mail Address), Customer Transaction Information, Marketing shall be processed on the grounds that “explicit consent” set forth in Article 5/1 of the Personal Data Protection Law.

With the aim of managing processes for product/service sales agreement and carrying out corporate communication activities, name, surname, signature, e-mail address, mobile phone number, address and signature circulars information of individual representatives of our legal customers and name, surname, e-mail address, mobile phone number, title information of individual employees of our natural and legal customers may be processed on the grounds that processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract under Article 5/2-c of the Personal Data Protection Law, it is necessary for compliance with a legal obligation to which the Data Controller is subject under Article 5/2-ç, processing of data is necessary for the legitimate interests pursued by the Data Controller, provided that this processing shall not violate the fundamental rights and freedoms of the Data Subject under Article 5/2-f.

METHOD OF COLLECTING PERSONAL DATA

Within the scope of the services provided to you, purposes of data processing mentioned in this Informing Text and legal grounds, QNBPAY collects and processes your personal data through our Company’s communication channels and other third-party channels you have disclosed, in compliance with the Personal Data Protection Law and the relevant legislative provisions. 

Your personal data may be collected and processed through the channels mentioned below in order to meet your requests and provide our services to you:

• Contracts signed by and between you and our Company during commercial processes, bid and the relevant information/declaration forms, copies of documents such as identity card, passport, driving license, etc., partnership document, signature circulars, signature declaration, tax board, authorization certificate, certificates of activity, trade registry certificates,
• Application screens on our website, forms on the member profile, communication forms, communication channels, business e-mail addresses of our Company, calls by our Call Center, official correspondences, electronic storage media where your personal data is recorded and protected, software and programs, accounting programs, social media accounts, customer meetings, SMS channels, business partners of Group Company, verbal, written and electronic media, invoices, receipts, written documents

TRANSFER OF YOUR PERSONAL DATA

Your collected personal data may be transferred within the scope of the conditions for processing personal data set forth in Articles 8 and 9 of the Personal Data Protection Law.

1. Your personal data may be transferred to authorized public institutions and organizations requesting information including authorized public institutions and lawfully authorized private institutions and judicial authorities (public authorities such as CBRT, Financial Crimes Investigation Board (MASAK), Ministry of Treasury and Finance, Turkish Revenue Administration, Undersecretariat of Treasury, regulatory and supervisory authorities, Merchant Registration System, tax authorities, legal authorities such as prosecutor's office, courts and arbitral institutions or relevant law enforcement forces upon request) with the aim of fulfilling the obligations arising from the legislation to which our Company is subject and establishing its rights, meeting legal reporting and information requests, carrying out legal audit activities, to public accountant / accounting companies, independent auditors and advisors with the aim of carrying out accounting and financial transactions and fulfilling other obligations arising from the legislation on the grounds that “it is expressly provided for by the laws” set forth in Article 5/2 (a) of the Personal Data Protection Law and “data processing is necessary for our Company to fulfill its legal obligation” set forth in Article 5/2 (ç) of the Personal Data Protection Law. In addition, permissions received from you, your mobile phone number or e-mail address and commercial electronic message information must be recorded in Commercial Electronic Message Management System with the aim of fulfilling legal obligations, sending commercial electronic messages to you and carrying out our advertisement and marketing activities. Therefore, we may transfer your personal data to the Commercial Electronic Message Management System and to our suppliers and business partners from which we receive services with the aim of conducting registration processes. For detailed information about the Commercial Electronic Message Management System, please visit https://iys.org.tr.

2. Your personal data may be transferred to the relevant banks, payment system institutions and organizations and our business partners with the aim of providing payment services and carrying out necessary payment and collection transactions, to cargo companies from which we receive services with the aim of carrying out cargo/courier transactions on the grounds that “the establishment and performance of the contract” set forth in Article 5/2 (c) of the Personal Data Protection Law.

3. Your personal data may be transferred to law offices and other advisors with the aim of constituting an evidence in case of potential disputes, receiving legal consultancy and technical support, performing the contract and checking whether the parties comply with their obligations on the grounds that “data processing is necessary for the establishment, exercise or protection of any right” set forth in Article 5/2 (e) of the Personal Data Protection Law.

4. Your personal data may be transferred to the Bank’s subsidiaries with the aim of conducting necessary audits to provide the Company’s services, ensuring business continuity, carrying out risk management and internal audit activities, receiving necessary support during financial/accounting/operational processes, to the suppliers from which our Company receives services through accounting program, the relevant software and online platforms with the aim of providing commercial security, protecting your personal data securely, benefiting from accounting program and archiving services, creating and storing customer records, ensuring business continuity, using necessary software and platforms during communication processes, carrying out website activities and providing our services to you, to domestic archiving companies from which we receive services with the aim of receiving electronic storage and infrastructure server services and providing backup services or systems on the grounds that “the legitimate interests pursued by the Data Controller” set forth in Article 5/2 (f) of the Personal Data Protection Law.

PROTECTION OF YOUR PERSONAL DATA

Your personal data is stored based on one of the conditions for processing data stated in Article 5 of the Personal Data Protection Law and in compliance with general principles stated in Article 4 of the Personal Data Protection Law, especially for the period laid down by relevant legislation or the period required for the purpose for which personal data is processed, by taking into account the periods stated in the Storage and Destruction Policy formed as per Article 7 of the Personal Data Protection Law and is destructed within the destruction period.

YOUR RIGHTS ON YOUR PERSONAL DATA

As the Data Subject, you shall have the right to

• learn whether your personal data is processed or not,
• request information as to if your personal data is processed,
• learn the purpose of the processing of your personal data and whether your data is used in accordance with the purpose,
• know the third parties in the country or abroad to whom your personal data is transferred,
• request rectification of the incomplete or inaccurate data, if any, and request reporting of these operations carried out to the third parties to whom your personal data is transferred,
• request erasure or destruction of your personal data despite being processed in compliance with the provisions of the Law no. 6698 and other relevant laws, in the event that conditions for processing no longer exist and request reporting of these operations carried out to the third parties to whom your personal data is transferred,
• object to occurrence of any result against you by analyzing personal data processed solely through automated systems,
• claim compensation for the damage arising from the unlawful processing of your personal data.

REQUEST TO DATA CONTROLLER

If you send your requests relating to your rights to the Company in written as per paragraph 1 of Article 13 of the Personal Data Protection Law or with the methods set forth in the  Communiqué on the Principles and Procedures for the Request to Data Controller (https://www.resmigazete.gov.tr/eskiler/2018/03/20180310-6.htm) as the Data Subject, our Company will conclude the request within the shortest time and within 30 days at the latest by taking into account the nature of the request free of charge. However, if the action requires an extra cost, the Company will charge the fee in the tariff determined by Personal Data Protection Authority.

Contact US

QNBPAY ÖDEME HİZMETLERİ ANONİM ŞİRKETİ

Address: Esentepe Mahallesi Büyükdere Caddesi QNB Kristal Kule Binası No:215 Şişli İstanbul

Telephone: 0 212 319 23 70 | 0850 222 07 70

E-Mail: iletisim@qnbpay.com.tr

REM Address: qnbpay@hs05.kep.tr