PERSONAL DATA PROCESSING AND PROTECTION POLICY
1. INTRODUCTION
Within the framework of this Personal Data Protection and Processing Policy (“Policy”), the principles adopted in the personal data
processing activities carried out by Kayaport Ödeme Kuruluşu A.Ş. (“Company”) through www.kayaport.com (“Site”) are explained in terms
of compliance with the regulations set out in the Turkish Personal Data Protection Law No. 6698 (“Law”). Our Company processes personal
data in accordance with this Policy and applicable legislation and protects it by taking the necessary administrative and technical measures.
2. PURPOSE OF THE POLICY
The main purpose of this Policy is to explain the fundamental principles regarding the processing of personal data by Kayaport Ödeme Kuruluşu A.Ş.,
to inform relevant persons within a general framework, and to present the Company’s approach to personal data security.
While carrying out its activities as a payment institution, the Company processes personal data in accordance with the principles of lawfulness,
purpose limitation, and data minimization within the scope of applicable legislation, regulations in the field of payment services, and obligations
related to the protection of personal data.
3. SCOPE OF THE POLICY
This Policy relates to the groups of data subjects whose personal data are processed, which we categorize under the headings “Our Customers, website visitors,
and other third parties whose data we process.” This Policy does not aim to publish the entire detailed inventory or internal procedures related to all of the
Company’s business processes; it is of a general informative nature.
4. DEFINITIONS
The definitions used in this Policy are provided below:
Explicit consent
Consent that is specific, informed, and freely given
Anonymization
Rendering personal data impossible to associate with an identified or identifiable natural person, even when matched with other data
Personal data
Any information relating to an identified or identifiable natural person
Processing of personal data
Any operation performed on personal data, wholly or partly by automated means or otherwise as part of a data filing system, such as obtaining, recording,
storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of such data
PDPL (KVK) Law
Turkish Personal Data Protection Law No. 6698
PDPL Board
Personal Data Protection Board
PDPL Authority
Personal Data Protection Authority
Special categories of personal data
Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership of
associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data
Data subject
A natural person whose personal data are processed, referred to as the “relevant person” under the PDPL Law
Data controller
The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system
Data processor
The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller
Data Controllers’ Registry
The data controllers’ registry (VERBİS) kept by the Presidency under the supervision of the Personal Data Protection Board
Data Inventory
The inventory created and detailed by “Kayaport Ödeme Kuruluşu A.Ş.” by associating its personal data processing activities carried out depending on its business
processes with the purposes of processing personal data, the recipient group to which personal data are transferred, and the relevant data subject group
5. CATEGORIES OF PROCESSED PERSONAL DATA
IP Address
Identifies the virtual address of the devices connecting your device to the internet.
Session Information
Defined as the process in which user information is stored on any page opened in a browser on your device.
Device Language
The language option of the country selected automatically or manually on your device.
Device Model
Brand and model information of your device.
6. DATA SUBJECT GROUPS
Website Visitors
Natural persons who have requested or shown interest in using the products and services of “Kayaport Ödeme Kuruluşu A.Ş.”, or who are assessed, in accordance with
commercial practice and the rules of good faith, as likely to have such interest.
7. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
Our Company processes personal data in accordance with applicable legislation, primarily the Constitution and the Turkish Personal Data Protection Law No. 6698,
and within the framework of lawfulness and the rules of good faith. Personal data are processed for explicit, specific, and legitimate purposes; in a manner that is
relevant, limited, and proportionate to the purpose of processing; their accuracy is ensured and they are kept up to date when necessary; and they are retained only for
the period stipulated in the legislation or required by the purpose of processing. When the retention period expires or the reasons for processing cease to exist,
personal data are deleted, destroyed, or anonymized in accordance with our Company’s Data Disposal Policy.
8. TRANSFER OF PERSONAL DATA
Kayaport Ödeme Kuruluşu A.Ş. shall not transfer the personal data of data subjects to third parties and will share such data only with official authorities in case of
force majeure.
8.1. Recipients to Whom Personal Data Are Transferred
Kayaport Ödeme Kuruluşu A.Ş. (“Company”) does not transfer personal data to any third party group. Personal data may be shared only with authorized public institutions and
organizations within the scope of applicable legislation.
8.2. Domestic Transfer of Personal Data
In accordance with Article 8 of the PDPL Law, the domestic transfer of personal data shall be possible provided that one of the conditions specified in Section 8 of this
Policy titled “Conditions for Processing Personal Data” is met.
8.3. Transfer of Personal Data and Special Categories of Personal Data Abroad
“Company” does not transfer any personal data or special categories of personal data abroad.
9. RIGHTS OF DATA SUBJECTS
Data subjects may apply to the Company to exercise their rights recognized under Article 11 of the PDPL Law regarding their personal data.
Data subjects may apply within the scope of Article 11 of the PDPL Law by submitting information and documents that will identify them and by using the methods specified
below or other methods determined by the Personal Data Protection Board, through the PDPL application form available on the website. [Data Subject Application Form]
10. CONFIDENTIALITY AND DATA SECURITY MEASURES
All personal data processed within the Company are confidential, and the Company takes all necessary technical and administrative measures to prevent unlawful processing
of personal data, to prevent unlawful access to personal data, and to ensure the safeguarding of personal data, as set out in Article 12 of the Law, in line with the purposes.
The security of personal data is the responsibility of employees, units, and the Company, respectively. Employees may carry out collection, processing, transfer, use, deletion,
destruction, and anonymization activities on personal data only within the scope of the authority assigned to them.
10.1. Technical and Administrative Measures Taken to Ensure Lawful Processing of Personal Data and to Prevent Unlawful Access
Kayaport Ödeme Kuruluşu A.Ş. takes all necessary technical and administrative measures to ensure the security of personal data and continuously improves these measures against
current risks. In this context, network and application security is ensured, closed system networks are used, security measures are applied in the procurement, development,
and maintenance processes of information technology systems, and the security of data stored in the cloud is ensured. Access rights are restricted within the framework of an
authorization matrix; access and transaction logs are kept regularly in a manner closed to user intervention; and, where necessary, data masking and encryption methods are used.
Up-to-date anti-virus software, firewalls, intrusion detection and prevention systems, and data loss prevention solutions are kept active; regular penetration tests are conducted;
and cybersecurity measures are continuously monitored. Personal data are securely backed up; access to physical environments is controlled; and transfers are carried out via KEP
(registered e-mail) or corporate e-mail accounts. Encryption is also applied to transfers made via portable media; service providers acting as data processors are regularly audited
in terms of data security and their awareness is increased. Where access to data is provided through software, user authorizations are implemented; security tests of the relevant
software are carried out regularly and recorded; and, in cases where remote access is required, at least two-factor authentication is used.
10.2. Measures to Be Taken in Case of Unlawful Disclosure of Personal Data
If processed personal data are obtained by others through unlawful means, our Company will notify the relevant data subject and the Board as soon as possible (within a maximum
of 72 hours).
11. CONDITIONS FOR DISPOSAL OF PERSONAL DATA (DELETION, DESTRUCTION, AND ANONYMIZATION)
Personal data are retained for reasonable periods determined, provided that they are relevant, limited, and proportionate to the purposes of processing. If the reasons requiring
the processing of personal data cease to exist, such data shall be deleted, destroyed, or anonymized ex officio or upon the request of the relevant person in accordance with the legislation.
12. EXECUTION
An organizational structure has been established by Kayaport Ödeme Kuruluşu A.Ş. to ensure that this Policy is implemented in compliance with the PDPL Law regulations.
Within Kayaport Ödeme Kuruluşu A.Ş., a Personal Data Protection Committee (“Committee”) has been established pursuant to the decision of the Company’s senior management to manage this Policy
and other policies related to and associated with this Policy.
13. UPDATE AND EFFECTIVE DATE
The Company may update this Policy in line with legislation and operational needs. The current text shall be effective as of the date it is published on the Company’s website.
14. DATA SUBJECT RIGHTS
All rights under Article 11 of the PDPL are reserved.
