Protection Of Personel Data

In order to provide you with our products and services continuously and securely both in Turkey and abroad, we may collect, process and transfer your personal data to third parties when necessary.

We take the highest level of security precautions to protect your personal data’s confidentiality while collecting, processing, transferring and retaining them in accordance with law.

We would like to inform you of your rights, methods of retrieving your personal data and legal basis for its processing in the most transparent manner.

a) Data Controller

Your personal data will be collected and processed pursuant to the Law on the Protection of Personal Data No.6698 (Law No.6698) by TÜRKİYE İŞ BANKASI A.Ş. (our Bank) as the data controller within the scope described below.

b) Purposes for Processing of Personal Data

Your personal data will be processed for purposes of the performance of contracts to which you are party or in order to take steps at your request; conducting necessary evaluations in order to provide you with our services; creditworthiness assessments; compliance with domestic and international legislation including but not limited to, banking, insurance, anti-money laundering, capital market, tax, social security, consumer law; compliance with obligations of risk monitoring and notification; the fulfillment of information sharing, reporting and notification obligations specified by the Credit Bureau, Interbank Card Center, Banking Regulation and Supervision Agency, Central Bank of the Republic of Turkey, Capital Markets Board of Turkey, Financial Crimes Investigation Board, The Banks Association of Turkey, Ministry of Finance Revenue Administration, Republic of Turkey Prime Ministry Undersecretariat of Treasury and other authorities; fulfillment of legal record keeping obligations arising from law; prevention of fraud; security; business planning and conducting statistical analyses; setting business strategies; carrying out financial, communication, market research and purchasing operations; continuous management of system and application operations; administration of legal processes; carrying out corporate social responsibility projects; maintaining service quality, reliability and availability in accordance with the conditions and purposes of the processing of personal data as specified in articles 5 and 6 of the Law No.6698.

In addition, your personal data may be processed for the purposes of providing goods and services tailored for you, communicating to you about our services and products; moreover, introducing and offering our services and products to you, carrying out marketing activities and campaign operations in case your consent is obtained, developing services and products that are suitable to you, carrying out customer satisfaction studies, current or new product development processes of ours or our affiliates, conducting market research and determining target customer groups.

Within the context of contracts our Bank entered into or activities carried out together with third parties, which may be real persons or legal entities, your personal data may be processed for purposes of fulfilling legal and commercial obligations of our Bank arising from contracts, establishing a right, protecting rights, conducting commercial and legal assessment processes as well as legal and commercial risk analyses and carrying out financial operations.

c) The Recipients and Purposes of Personal Data Transfers

Within the framework of primarily Banking Law and other relevant legislation, limited to carrying out aforementioned purposes and fulfillment of the obligations arising from legislation, your personal data may be transferred to authorities such as Banking Regulation and Supervision Agency, Central Bank of the Republic of Turkey, Capital Markets Board of Turkey, Financial Crimes Investigation Board, The Banks Association of Turkey, Ministry of Finance Revenue Administration, Republic of Turkey Prime Ministry Undersecretariat of Treasury; to legally authorized public institutions such as ministries and judicial authorities; to institutions such as Interbank Card Center, Credit Bureau (KKB) and FINDEKS; to domestic and international business associates of our Bank; to shareholders; to affiliates and to companies on behalf of whom our Bank acts as an agency or to whom provides intermediary services; to support service institutions from which our Bank has received services which are complementary to or an extension of its core business and to its other contractual parties; to consultants and institutions with whom it has collaborated to the extent allowed by applicable law; to financial institutions; to independent auditing companies; to payment systems companies such as Europay Int. SA, Western Union, Mastercard Int. INC, Visa INC, JCB Int. Co., Maestro, and Electron; to other card issuing companies and banks in accordance with the conditions and purposes of the processing of personal data as specified in article 8 of Law No.6698 regarding the transfer of personal data and article 9 regarding the international transfers of personal data.

d) Method of and Legal Basis for Collection of Personal Data

Your personal data is collected via channels through which our Bank or organizations entitled to represent our Bank have communicated or might communicate with you such as İş Bankası General Directorate, its Branches, ATMs, website, the internet branch, mobile or digital applications, social media, call centers, companies on behalf of whom our Bank acts as an agency or to whom provides intermediary services, contractual vendors, customer interviews, SMS, requests directed to ours or other websites, direct sales teams, merchants and Point of Sale terminals of the merchants such as member stores or e-commerce websites, support service institutions including but not limited to call center services, by collecting data from the market for assessing creditworthiness, through access to databases of various institutions to the extent allowed by applicable law or as agreed in a contract or obtaining your consent where required by applicable law.

Your personal data collected by aforementioned methods can be processed and transferred for the purposes specified in articles (b) and (c) of this notice in accordance with the conditions and purposes of the processing of personal data as specified in articles 5 and 6 of Law No.6698.

e) Rights of Data Subject as Specified in Article 11 of the Law No.6698

Based on article 11 of Law No.6698, as a data subject you have the rights to:

• learn whether or not your personal data have been processed,
• request information concerning the processing if your personal data have been processed,
• learn the purpose for the processing of your personal data and whether your personal data have been used in accordance with the purpose,
• know the third parties within Turkey or abroad to whom personal data have been transferred,
• request rectification in case your personal data have been processed incompletely or inaccurately and request notification of the operations made within this context to third parties to whom your personal data have been transferred,
• request deletion or destruction of your personal data in case the reasons necessitating their processing cease to exist, despite your personal data have been processed in accordance with Law No.6698 or other relevant laws, and request notification of the operations made within this context to third parties to whom your personal data have been transferred,
• object to occurrence of any result deriving from a decision based solely on automated processing and that is to your detriment,
• request compensation for the damages in case you incur damages due to unlawful processing of personal data

Once your request regarding your aforementioned rights is received by our Bank, depending on nature of your request, we will respond to you free of charge without undue delay and not later than thirty days. However, in case the operation necessitates an additional cost, the fee in the tariff designated by Personal Data Protection Board may be collected. Pursuant to Article 13 paragraph 1 of Law No.6698, you may forward the request to exercise your aforementioned rights in writing or via other methods that the Personal Data Protection Board will specify. The procedures through which you may forward your request regarding article 11 of Law No.6698 are explained below.

In order to exercise your rights specified above you shall submit or forward your original ink signed request to;

• our branches with additional documents that verify your identity,
• the address “İş Kuleleri 34330 Levent Beşiktaş-İstanbul” via notary public,
• isbankasi@hs02.kep.tr with a secure electronic signature subject to Turkish Electronic Signature Law No. 5070.

Last Update: 11.05.2018

Institution Information General Directorate Address: İş Kuleleri 34330 Levent Beşiktaş-İstanbul Phone: 90(212) 316 00 00 Fax: 90(212) 316 09 00

Hosting Provider Türkiye İş Bankası A.Ş.

Authorized Auditing Body Banking Regulation and Supervision Agency (BRSA) Postal Address: Büyükdere Caddesi No:106 Şerbetçi İş Merkezi Esentepe Şişli/İstanbul Phone: (212) 214 50 00 Fax: (212) 216 09 92 Website: www.bddk.org.tr