Personal Data Protection Law

PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA

FOR AK YATIRIM WEBSITES AND APPLICATIONS

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), which is enacted to protect the fundamental rights and freedoms of individuals, particularly the privacy of private life, your personal data may be processed, transferred, and stored in accordance with the law under the Data Controller Ak Yatırım Menkul Değerler A.Ş. (“Ak Yatırım” or the “Company”), located at Sabancı Center, 4. Levent-Beşiktaş/ Istanbul, in order to carry out the necessary activities.

This Privacy Notice on The Protection of Personal Data for Ak Yatırım Websites and Applications (“Privacy Notice”) has been prepared to inform you about the personal data processed and the activities carried out within the scope of KVKK regarding your use of Ak Yatırım’s websites and applications.

Scope

Your personal data is processed by Ak Yatırım within the framework of the Capital Markets Law No. 6362 (“CML”) and the relevant legislative regulations, in relation to the investment services and activities we provide.

Your data may also be collected through electronic channels, including online transactions, via channels such as our website and mobile applications, in writing, verbally, or electronically, for the purposes of fulfilling legal obligations, executing business processes, and improving our services.

In cases where you provide your personal data, such data may be shared with authorized institutions, organizations, and legally permitted business partners to the extent necessary, and always in line with the principles of data minimization and security under KVKK. This Privacy Notice has been prepared to inform you transparently about how your personal data is collected, processed, and shared.

Categories of Processed Personal Data

The data we process is grouped in the table below. This allows you to obtain information about the data we process.

Methods of Collecting Your Personal Data

As Ak Yatırım, acting as the Data Controller, we collect the personal data of our customers/ potential customers/ third parties, either directly from themselves and/or from their authorized representatives (e.g., Proxy, representative, etc.) in written, verbal, visual, or electronic formats through automatic or non-automatic methods via our channels (Head Office, branches, websites, telephone line, social media channels), through our affiliates and communication intermediaries such as Akbank, which conducts our activities and provides support services, or through institutions and organizations we collaborate with.

We process the personal data collected for the purposes specified below, in connection with the related legal compliance grounds, in a measured and limited manner, and in accordance with the principles set out in Article 4 of KVKK, while ensuring its security and confidentiality.

Purposes of Processing and Legal Basis

Your personal data is processed for the purposes of fulfilling our legal obligations and/or where processing is mandatory for the establishment, exercise, or protection of our legitimate interests, provided that it does not infringe on your fundamental rights and freedoms. These purposes include:

• Verification and identification of your identity and address,
• Confirming the accuracy and currency of your information,
• Conducting customer analysis,
• Managing risk assessment and information security processes,
• Performing internal adult, investigation, and inspection activities,
• Executing marketing and communication activities to provide you with relevant services,
• Ensuring the execution of our operational and financial activities,
• Compliance with obligations arising from the Capital Markets Board of Türkiye (CMB),
• Reporting and fulfilling obligations to institutions such as:
  • Central Securities Depository (YTM),
  • Turkish Capital Markets Association (TSPB),
  • Borsa İstanbul A.Ş. (BIST),
  • İstanbul Settlement and Custody Bank (Takasbank),
  • and Central Registry Agency (MKK), Banking Regulation and Supervision and Supervision Agency (BDDK), Central Bank of the Republic of Türkiye (TCMB), Ministry of Trade, Financial Crimes Investigation Board (MASAK), Revenue Administration (GİB), The Union of Chambers and Commodity Exchanges of Türkiye (TOBB), The Bank Association of Türkiye (TBB) Risk Center, and similar institutions to which we have reporting obligations, for the purposes of:
  • Storing and reporting the requested information,
  • Responding to document requested from such institutions,
  • Conducting all activities in compliance with applicable legislation.
• In cases where the establishment or performance of a contract with our Company is directly related and the processing of your personal data is necessary for fulfilling our legal obligations:
• Executing our contractual processes and fulfilling our responsibilities regarding investment services and related to our products and services and contracting you for these purposes,
• Performing product/ service sales, notifications, and marketing activities,
• Carrying out customer satisfaction initiatives and sharing proposals related to our services,
• Managing customer relationship processes,
• Executing product and service purchasing processes and related support services,
• Improving product and service quality,
• Managing investment processes.
• Provided that your fundamental rights and freedoms are not infringed, if the processing of data is necessary for the legitimate interests of the data controller:
• Sharing certain information obtained within the scope of investment services and relates ancillary services carried out under the framework of the CMB and relevant legal regulations with our parent company and business partners,
• Developing solutions to meet customer and sector needs,
• Conducting other necessary analysis and reporting studies, as well as reviews and examinations, within the scope of investment services and ancillary services,
• Executing strategic planning activities,
• Carrying out social responsibility and civil society activities,
• Considering suggestions for the improvement of business processes and conducting evaluations.
• If the processing of data is required for the establishment, exercise, or protection of a right:
• Monitoring legal proceedings,
• Following up on requests and complaints.
• Such data are processed in connection with, limited to, and proportionate to these purposes, and in compliance with the principles set forth under Article 4 of the KVKK.

Transfer of Personal Data

Personal data held by Ak Yatırım, in the context of carrying out investment services and activities, are processed for the purposes communicated above in line with our obligations under the CMB and applicable legislation, and are transferred in a connected, limited, and proportionate manner to:

• Authorized institutions or organizations entitled to Access such information (e.g., CMB, YTM, TSPB, MASAK, BIST, Takasbank, MKK, BDDK, TCMB, GİB, Ministry of Trade, TOBB, TBB), for purposes including risk management and execution of operations and preparation of statutory reports, conducting regulatory and supervisory activities, handling complaints, and managing legal processes,
• Establishing, operating, terminating domestic and/or overseas branches and units, as well as shareholder (partners) relationships for the purpose of providing customer and service infrastructure,
• Collaborating with business partners (e.g., banks, financial institutions) to offer our company’s products and services,
• Receiving external services, including legal consultancy to our company.

These and similar data transfers are carried out to natural and legal persons to the extent necessary, for purposes that are lawful and legitimate.

Right of Data Subjects

In accordance with the KVKK and applicable legislation, data subjects have the right to:

• Learn whether their personal data are being processed,
• Request information regarding the processing,
• Learn the purpose of processing and whether the data are being used for their intended purpose,
• Know the third parties to whom the data are transferred domestically or abroad,
• Request rectification in case the data is incomplete or inaccurate, and to request notification of such corrections to third parties,
• Request deletion or destruction of personal data under the conditions stipulated in KVKK Articles 7 and 11, and to request notification of such actions to third parties,
• Object to the occurrence of a result against themselves due to processed data being analysed exclusively through automated systems,
• Demand compensation in the event of damages arising from unlawful processing of their personal data.

All applications submitted under the KVKK will ve evaluated and finalized by Ak Yatırım within 30 (thirty) days at the latest.

Contact for Requests

Within the scope of the KVKK, if you wish to contact us, submit a notification, or direct your questions, you can submit a written application including your identification details and request to:

Sabancı Center, 34330, 4th Levent- Beşiktaş/ İstanbul

Alternatively, you may submit your request via notary channels or as a securely signed electronic message to akyatirim@hs03.kep.tr.

PURPOSE

The purpose of this Policy is to provide an explanation regarding the Company’s Personal Data Processing activities—which it conducts in compliance with the law in its capacity as a Data Controller—and the related systems; to inform Data Subjects; and thereby ensure transparency regarding Personal Data Processing activities. In this context, the Company explains its Personal Data processing activities under the Law and details the rights of Data Subjects regarding such processing in this Policy.

The Company’s compliance with this Policy is regularly monitored by its internal audit teams, and such monitoring is conducted in accordance with performance tracking and monitoring criteria established by the Company.

SCOPE

This Policy provides the necessary information by setting forth the comprehensive set of rules governing the processing of Personal Data by Ak Yatırım Menkul Değerler A.Ş., the data controller.

DEFINITIONS

Refers to a statement of consent regarding a specific matter, based on information provided and expressed of one’s own free will.

Akbank: Refers to Akbank T.A.Ş., in which Ak Yatırım Menkul Değerler A.Ş. holds a stake.

Data Subject(s): Refers to the natural person(s) whose Personal Data is processed. Destruction: Refers to the erasure, destruction, or anonymization of Personal Data. Law: Refers to the Law on the Protection of Personal Data No. 6698.

Personal Data Inventory: We have documented the personal data processing activities carried out in connection with the Company’s business processes; by associating them with the purposes and legal basis of the processing, the data category, the group of recipients to whom the data is transferred, and the group of data subjects; and which details the maximum retention period necessary for the purposes for which the Personal Data is processed, the Personal Data intended for transfer to foreign countries, and the measures taken regarding data security.

Processing of Personal Data: Refers to any operation performed on Personal Data, such as the collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or restriction of use of such data, whether performed in whole or in part by automated means or by non-automated means as part of a data filing system.

Personal Data: Refers to any information relating to an identified or identifiable natural person.

Board: Refers to the Personal Data Protection Board.

Legislation: Refers to the Law and the entire body of secondary regulations based on the Law.

Policy: Refers to this Personal Data Protection and Privacy Policy.

Deletion: Refers to the process of rendering Personal Data inaccessible and unusable in any way by the relevant users.

Company: Refers to Ak Yatırım Menkul Değerler A.Ş.

VERBİS: Refers to the Data Controllers Registry Information System (VERBİS), which is a record-keeping system where Personal Data is processed according to specific criteria.

Data Controller: Refers to the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for establishing and managing the data recording system.

Destruction: Refers to the process of rendering Personal Data inaccessible, unrecoverable, and unusable by anyone in any way.

RESPONSIBILITIES

All business units within the Company’s organization are responsible for the implementation of this Policy, while the Legal and Regulatory Affairs Unit is responsible for updating it without delay.

IMPLEMENTATION

General Principles Regarding the Processing of Personal Data

The Company adopts the following principles regarding the processing of Personal Data within the scope of the purposes specified in the second paragraph of Article 4 of the Law and in the “Purposes of Processing Personal Data” section of this Policy:

• Compliance with the law and the principles of good faith,
• Accuracy and, where necessary, timeliness,
• Processing for specific, explicit, and legitimate purposes,
• Processing that is relevant, limited, and proportionate to the purpose for which it is processed,
• Retention for the period prescribed by law or as necessary for the purpose of processing.

Personal Data Processed by the Company

Personal Data is processed within the Company through explicit consent obtained from Data Subjects or in light of activities that may be carried out without explicit consent pursuant to Articles 5 and 6 of the Law; this data is processed within the framework of the purposes specified in the “Purposes of Processing Personal Data” section of this Policy. The categories of Personal Data—which vary and differ depending on the type and nature of the relationship between the Company and Data Subjects, the communication channels used, and the aforementioned purpose—and which are processed in accordance with the principles set forth in this Policy, are as follows:

• Other identifying information specific to the products owned by the individual,
• Personal Data used for the purpose of identification and verification,
• Identifying information created by our Company,
• Information regarding financial status,
• Communication information and records,
• Information about natural persons contained in documents related to legal entities,
• Identifying and descriptive information generated by the Company regarding job applicants and employees,
• Detailed financial information regarding transactions conducted by customers through the Company’s channels,
• Personal Data processed for the purpose of ensuring the security and integrity of operations conducted by the Company,

These data are defined on VERBİS via the Personal Data Inventory.

Purposes of Processing Personal Data

Personal Data may be processed by the Company for the purposes listed below and may be retained for as long as required by these purposes and the relevant statutory retention periods:

• The full and proper conduct of capital market activities,
• The conduct of activities in accordance with legal and administrative obligations,
• The negotiation, drafting, and performance of contracts,
• Providing support to Data Subjects in response to requests and inquiries,
• Conducting promotional and marketing activities,
• Gathering the opinions of Data Subjects through surveys and polls and ensuring customer satisfaction,
• Identifying product groups tailored to customers,
• Conducting risk analysis studies in accordance with the Company’s risk criteria,
• Making improvements tailored to customer and industry needs,
• Conducting candidate evaluation and hiring processes,
• Managing the Company’s human resources,
• Planning and implementing corporate sustainability activities,
• Providing support for the execution of corporate and partnership law transactions for Group companies and Akbank, in which the Company holds a stake, and conducting commercial activities,
• Ensuring the legal and commercial security of the Company and individuals with whom the Company has a business relationship,

Conducting commercial activities for the purpose of determining and implementing Company strategies. These purposes are detailed on VERBİS via the Personal Data Inventory.

Transfer of Personal Data

The Company transfers data to public institutions and organizations, affiliates and subsidiaries, natural persons or legal entities under private law, suppliers, and customers within the scope of the purposes exemplified in the “Purposes of Processing Personal Data” section of this Policy and in accordance with Articles 8 and 9 of the Law. Personal Data may be processed and stored on servers and other electronic media used for this purpose.

Collection of Personal Data

In order to fulfill the purposes exemplified in the “Purposes of Processing Personal Data” section of this Policy, the Company collects Personal Data belonging to customers, potential customers, and third parties—directly from them and/or their authorized representatives (e.g., agent, representative, guardian) in any written, oral, or visual format, using both electronic and non-electronic methods, through automated or non-automated means, in person or remotely via various channels (Main Office, branches, websites, telephone, social media channels), as well as through Akbank—in which the Company holds a stake and which acts as an intermediary for order transmission—and other institutions and organizations from which support services are obtained or with which the Company has business partnerships.

Retention Period of Personal Data

Personal data is retained within the Company for the duration of the applicable legal retention periods or for as long as necessary to carry out the activities related to such data and to fulfill the purposes specified in this Policy. Personal data for which the purpose of use has ended and the statutory retention period has expired is destroyed in accordance with Article 7 of the Law and the Company’s Data Retention and Destruction Policy.

Rights of Data Subjects Under the Law

Article 11 of the Law sets forth the rights of the Data Subject, and pursuant to this article, Data Subjects have the following rights with respect to our Company:

• The right to learn whether Personal Data is being processed,
• The right to request information regarding the processing of Personal Data, if it has been processed,
• The right to learn the purpose of the processing of Personal Data and whether it is being used in accordance with that purpose,
• The right to know the third parties to whom Personal Data has been transferred, whether within or outside the country,
• The right to request the correction of Personal Data if it has been processed incompletely or incorrectly,
• The right to request the erasure or destruction of Personal Data if the grounds for its processing no longer exist,
• The right to request that third parties to whom your Personal Data has been transferred be notified of any corrections or deletions,
• The right to object to a decision made solely through the automated analysis of processed data that adversely affects you,
• The right to request compensation for damages incurred as a result of the unlawful processing of your Personal Data.

Requests submitted by the Data Subject to exercise any of the above rights will be addressed by the Company within 30 (thirty) days at the latest.           These requests may be submitted via the Data Subject Request Form available at https://www.akyatirim.com.tr/pdf/akyatirim_KVKK_veri_Sahibi_Basvuru_Formu.pdf  using the methods specified in the form.

Security of Personal Data

The Company places great importance on protecting the confidentiality and security of Personal Data. Accordingly, the necessary technical and administrative security measures are taken to protect Personal Data against unauthorized access, damage, loss, or disclosure. To this end, the necessary system access controls, data access controls, secure transfer controls, business continuity controls, and other necessary organizational controls are implemented.