Data Controller Identification: BPN Payment and Electronic Money Services Inc., located at Maslak Mah. AOS 53. Sok. No:7/1 İç Kapı No:2-No:3 Sarıyer/İstanbul, registered with Maslak Tax Office, tax number 1870640545 ("BPN" or "Company").

Data Categorization:

The personal data provided by you, as the data controller, BPN, may be processed, recorded, stored, classified, updated, and, within the scope of the purposes described in Article 2 and limited thereto, may be disclosed/transferred to third parties in compliance with the law and principles of honesty.

Purposes of Data Processing:

Your collected personal data may be processed for the purposes set forth in Articles 4, 5, and 6 of the Law on Protection of Personal Data No. 6698 ("KVKK") and in compliance with the procedures and principles regulated therein:Identification of the Customer, conducting identity verification and authentication processes, creating user accounts, executing user account registration, account upgrading, secure login, and account management processes,

• Sale and delivery of personalized prepaid cards, registration to platforms such as Masterpass, management of cancellations and information security processes,
• Execution of physical or electronic money transfer transactions, loading money into user accounts, provision of payment services including but not limited to payment and electronic money services, execution of related transactions, operations management, fulfillment of the requirements of the contracts signed with our Company,
• Physical and/or electronic storage of user records, tracking and updating records,
• Preservation of information in accordance with the current legislation, carrying out copying and backup activities to prevent data losses, ensuring the accuracy and currency of data, planning and conducting audit activities and controls to ensure the consistency of information,
• Establishing transaction security, protecting customers and payment and information systems against fraud, counterfeiting, attacks in any physical or electronic environment,
• Storage and reporting of information requested by administrative institutions such as CBRT, MASAK, Revenue Administration, and/or Turkey Payment and Electronic Money Institutions Union, and responding to information-document requests from these institutions,
• Conducting multi-layered identity verification in compliance with legal obligations, monitoring and tracking transactions, assessing, determining, and managing risk levels, performing suspicious transaction reporting and user controls, ensuring information and operational security,
• Fulfillment of obligations arising from laws such as the Law on Prevention of Laundering Proceeds of Crime, Law on Payment and Securities Settlement Systems, Law on Payment Services and Electronic Money Institutions, and other legislation,
• Analysis and development of payment systems, operation of information security processes, establishment, management, and implementation of information systems infrastructure,
• Designing business processes and activities, planning and conducting operational processes,
• Execution of tasks related to support service providers, business partners, representatives, or suppliers and management of relationships,
• Pursuit and execution of lawsuits, execution proceedings, and other legal processes,
• Execution of financial and accounting processes, monitoring, financial reconciliation with business partners,
• Planning, auditing, and implementing our corporate sustainability, corporate governance, strategic planning, and information security processes,
• Conducting post-sales support services, recording, tracking, necessary information, and guidance,
• Management of user consent processes in the application,
• Execution of advertising, campaign, and promotion processes, management of processes such as marketing analysis and statistical studies, identification of trends,
• Management of prize acquisition, participation in contests, or similar activities and provision of information to relevant institutions and organizations,
• Determining the nearest ATMs and/or representative points to the user's location,

and are processed in a secure manner in physical or electronic media within an appropriate period for the purpose of processing. Within the scope of these activities, all obligations envisaged in the relevant legislation, especially the KVKK, regarding the protection of personal data by our Company are fulfilled. For detailed information about our Company's data processing policy, you can review the BPN Personal Data Protection and Privacy Policy at https://www.bpn.com.tr/gizlilik-ve-kvk-hakkindabilgilendirme  

To Whom and for What Purposes Personal Data Can Be Transferred:

Data Transfer Abroad

The personal data processed by BPN in accordance with the law may be transferred to our business partners abroad, primarily Western Union Network (France) SAS and its group companies, due to the presence of situations foreseen in Article 5/2 and Article 6/3 of the Law on the Protection of Personal Data, without obtaining your explicit consent, within the scope of carrying out our activities."

Methods of Collecting Your Personal Data

Your personal data is collected by BPN through various means for the purposes stated above, including but not limited to:

• Face-to-face service channels (BPN authorized representatives) where you provide statements or deliver documents belonging to you through non-automatic channels.
• Using our company's information technology systems, applications, websites, creating accounts, entering contracts, and communicating via email and/or SMS.
• Obtained and processed through system integrations shared by public institutions and organizations (such as Identity Sharing System).

In this context, your personal data may be processed or transferred without obtaining explicit consent based on legal grounds such as "explicit provisions of the laws," "necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract," "fulfillment of legal obligations of the data controller," "protection of vital interests of the data subject or of another natural person," and "pursuance of legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject are not harmed," as well as in accordance with the principles envisaged in Article 4/2 of the Law on the Protection of Personal Data (KVKK).

The rights of the data subjects regarding their personal data and information on how to exercise these rights are as follows:

Under Article 11 of the Personal Data Protection Law (KVKK), you can apply to us as the data subject to request your rights within the scope of the law.

For all your requests, you can fill out the Data Subject Application Form available at our website https://www.bpn.com.tr/Veri_Sahibi_Basvuru_Formu.pdf or apply in writing to our address at Maslak Mah. AOS 53.Sok. No:7/1 İç Kapı No:2 – No:3 Sarıyer/İstanbul, or via email at [email protected]. For more detailed information on additional application methods, you can review the Data Subject Application Form.

Applications made by you to BPN under Article 11 of the KVKK will be evaluated promptly, effectively, and comprehensively, and depending on their nature, your request will be concluded free of charge as soon as possible and in any case within thirty (30) days at the latest. However, if the procedures required for the examination and conclusion of your application necessitate an additional cost, you will be invoiced according to the fees specified by the Board.

The rights you have under the aforementioned article are as follows:

• Learning whether your personal data is processed by BPN,
• Requesting information if your personal data has been processed,
• Learning the purpose of processing your personal data and whether they are used for their purpose,
• Knowing the third parties to whom your personal data are transferred domestically or abroad,
• Requesting correction of your personal data if it is incomplete or incorrectly processed, and requesting notification of this correction to third parties to whom your personal data have been transferred,
• Requesting the deletion or destruction of your personal data if the reasons requiring their processing cease to exist, even if they have been processed in accordance with the KVKK and other relevant laws, and requesting notification of this deletion or destruction to third parties to whom your personal data have been transferred,
• Objecting to the result of the analysis of your personal data exclusively by automated systems, if it leads to a result against you,
• Requesting compensation for any damages you may incur due to the processing of your personal data contrary to the relevant legislation.

If your application requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

Request for Updating Information

Your personal data processed by BPN must be accurate and up to date. Therefore, if any changes occur in your personal data, you can notify us in writing or through the methods specified in the Data Subject Application Form available on our website https://www.bpn.com.tr/Veri_Sahibi_Basvuru_Formu.pdf.