Personal Data Protection Law

PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA

FOR AK YATIRIM WEBSITES AND APPLICATIONS

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), which is enacted to protect the fundamental rights and freedoms of individuals, particularly the privacy of private life, your personal data may be processed, transferred, and stored in accordance with the law under the Data Controller Ak Yatırım Menkul Değerler A.Ş. (“Ak Yatırım” or the “Company”), located at Sabancı Center, 4. Levent-Beşiktaş/ Istanbul, in order to carry out the necessary activities.

This Privacy Notice on The Protection of Personal Data for Ak Yatırım Websites and Applications (“Privacy Notice”) has been prepared to inform you about the personal data processed and the activities carried out within the scope of KVKK regarding your use of Ak Yatırım’s websites and applications.

Scope

Your personal data is processed by Ak Yatırım within the framework of the Capital Markets Law No. 6362 (“CML”) and the relevant legislative regulations, in relation to the investment services and activities we provide.

Your data may also be collected through electronic channels, including online transactions, via channels such as our website and mobile applications, in writing, verbally, or electronically, for the purposes of fulfilling legal obligations, executing business processes, and improving our services.

In cases where you provide your personal data, such data may be shared with authorized institutions, organizations, and legally permitted business partners to the extent necessary, and always in line with the principles of data minimization and security under KVKK. This Privacy Notice has been prepared to inform you transparently about how your personal data is collected, processed, and shared.

Categories of Processed Personal Data

The data we process is grouped in the table below. This allows you to obtain information about the data we process.

Methods of Collecting Your Personal Data

As Ak Yatırım, acting as the Data Controller, we collect the personal data of our customers/ potential customers/ third parties, either directly from themselves and/or from their authorized representatives (e.g., Proxy, representative, etc.) in written, verbal, visual, or electronic formats through automatic or non-automatic methods via our channels (Head Office, branches, websites, telephone line, social media channels), through our affiliates and communication intermediaries such as Akbank, which conducts our activities and provides support services, or through institutions and organizations we collaborate with.

We process the personal data collected for the purposes specified below, in connection with the related legal compliance grounds, in a measured and limited manner, and in accordance with the principles set out in Article 4 of KVKK, while ensuring its security and confidentiality.

Purposes of Processing and Legal Basis

Your personal data is processed for the purposes of fulfilling our legal obligations and/or where processing is mandatory for the establishment, exercise, or protection of our legitimate interests, provided that it does not infringe on your fundamental rights and freedoms. These purposes include:

·         Verification and identification of your identity and address,

·         Confirming the accuracy and currency of your information,

·         Conducting customer analysis,

·         Managing risk assessment and information security processes,

·         Performing internal adult, investigation, and inspection activities,

·         Executing marketing and communication activities to provide you with relevant services,

·         Ensuring the execution of our operational and financial activities,

·         Compliance with obligations arising from the Capital Markets Board of Türkiye (CMB),

·         Reporting and fulfilling obligations to institutions such as:

-          Central Securities Depository (YTM),

-          Turkish Capital Markets Association (TSPB),

-          Borsa İstanbul A.Ş. (BIST),

-          İstanbul Settlement and Custody Bank (Takasbank),

-          and Central Registry Agency (MKK), Banking Regulation and Supervision and Supervision Agency (BDDK), Central Bank of the Republic of Türkiye (TCMB), Ministry of Trade, Financial Crimes Investigation Board (MASAK), Revenue Administration (GİB), The Union of Chambers and Commodity Exchanges of Türkiye (TOBB), The Bank Association of Türkiye (TBB) Risk Center, and similar institutions to which we have reporting obligations, for the purposes of:

o   Storing and reporting the requested information,

o   Responding to document requested from such institutions,

o   Conducting all activities in compliance with applicable legislation.

In cases where the establishment or performance of a contract with our Company is directly related and the processing of your personal data is necessary for fulfilling our legal obligations:

·         Executing our contractual processes and fulfilling our responsibilities regarding investment services and related to our products and services and contracting you for these purposes,

·         Performing product/ service sales, notifications, and marketing activities,

·         Carrying out customer satisfaction initiatives and sharing proposals related to our services,

·         Managing customer relationship processes,

·         Executing product and service purchasing processes and related support services,

·         Improving product and service quality,

·         Managing investment processes.

Provided that your fundamental rights and freedoms are not infringed, if the processing of data is necessary for the legitimate interests of the data controller:

·         Sharing certain information obtained within the scope of investment services and relates ancillary services carried out under the framework of the CMB and relevant legal regulations with our parent company and business partners,

·         Developing solutions to meet customer and sector needs,

·         Conducting other necessary analysis and reporting studies, as well as reviews and examinations, within the scope of investment services and ancillary services,

·         Executing strategic planning activities,

·         Carrying out social responsibility and civil society activities,

·         Considering suggestions for the improvement of business processes and conducting evaluations.

If the processing of data is required for the establishment, exercise, or protection of a right:

·         Monitoring legal proceedings,

·         Following up on requests and complaints.

Such data are processed in connection with, limited to, and proportionate to these purposes, and in compliance with the principles set forth under Article 4 of the KVKK.

Transfer of Personal Data

Personal data held by Ak Yatırım, in the context of carrying out investment services and activities, are processed for the purposes communicated above in line with our obligations under the CMB and applicable legislation, and are transferred in a connected, limited, and proportionate manner to:

·         Authorized institutions or organizations entitled to Access such information (e.g., CMB, YTM, TSPB, MASAK, BIST, Takasbank, MKK, BDDK, TCMB, GİB, Ministry of Trade, TOBB, TBB), for purposes including risk management and execution of operations and preparation of statutory reports, conducting regulatory and supervisory activities, handling complaints, and managing legal processes,

·         Establishing, operating, terminating domestic and/or overseas branches and units, as well as shareholder (partners) relationships for the purpose of providing customer and service infrastructure,

·         Collaborating with business partners (e.g., banks, financial institutions) to offer our company’s products and services,

·         Receiving external services, including legal consultancy to our company.

These and similar data transfers are carried out to natural and legal persons to the extent necessary, for purposes that are lawful and legitimate.

Right of Data Subjects

In accordance with the KVKK and applicable legislation, data subjects have the right to:

·         Learn whether their personal data are being processed,

·         Request information regarding the processing,

·         Learn the purpose of processing and whether the data are being used for their intended purpose,

·         Know the third parties to whom the data are transferred domestically or abroad,

·         Request rectification in case the data is incomplete or inaccurate, and to request notification of such corrections to third parties,

·         Request deletion or destruction of personal data under the conditions stipulated in KVKK Articles 7 and 11, and to request notification of such actions to third parties,

·         Object to the occurrence of a result against themselves due to processed data being analysed exclusively through automated systems,

·         Demand compensation in the event of damages arising from unlawful processing of their personal data.

All applications submitted under the KVKK will ve evaluated and finalized by Ak Yatırım within 30 (thirty) days at the latest.

Contact for Requests

Within the scope of the KVKK, if you wish to contact us, submit a notification, or direct your questions, you can submit a written application including your identification details and request to:

Sabancı Center, 34330, 4th Levent- Beşiktaş/ İstanbul

Alternatively, you may submit your request via notary channels or as a securely signed electronic message to akyatirim@hs03.kep.tr.