In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), Şekerbank Türk Anonim Şirketi (“Şekerbank”), acting as the data controller in the processing of personal data, hereby wishes to inform you pursuant to Article 10 of the Law, titled “The Data Controller’s Obligation to Provide Information.” Şekerbank takes the utmost care to ensure the confidentiality and security of personal information it receives from its customers and/or customer representatives.
This privacy notice has been prepared to provide information regarding the methods of collecting personal data processed under the KVKK, the legal grounds and purposes of personal data processing, the individuals or entities to whom personal data is transferred and the purposes of such transfers, and the rights of data subjects as set forth in the KVKK.
| Company Name | Şekerbank Türk Anonim Şirketi |
| Address | Emniyet Evleri Mh. Eski Büyükdere Cd. No: 1/1A, 34415 Kâğıthane / İstanbul |
| Mersis/Registry No. | 536973 |
Processed Data and Collection Method:
Your personal data processed by our bank is classified according to the categories listed in the Data Controllers Registry Information System (VERBİS) of the Personal Data Protection Authority, in accordance with the Personal Data Protection Law (KVKK). This information includes:
Identity:
First and last name, mother’s and father’s names, date of birth, place of birth, Turkish ID number, passport number, etc.
Contact Information:
Mailing address, email address, registered electronic mail address (KEP), phone number, etc.
Location:
Location data of the individual’s current location, etc.
Personnel Records:
Payroll information, disciplinary investigation records, employment contract records, asset declaration information, resume information, performance evaluation reports, etc.
Legal Proceedings:
Information from correspondence with judicial authorities, information from court case files, etc.
Customer Transactions:
Call center records, information on invoices, promissory notes, and checks, information on teller receipts, order information, request information, etc.
Physical Premises Security:
Entry and exit records of employees and visitors, camera recordings, etc.
Transaction Security:
IP address information, website login and logout information, password information, etc.
Risk Management:
Information processed for the management of commercial, technical, and administrative risks, etc.
Finance:
Balance sheet information, financial performance information, credit and risk information, asset information, etc.
Professional Experience:
Degree information, courses taken, on-the-job training information, certificates, and transcript information, etc.
Marketing:
Purchase history information, surveys, cookie records, and information obtained through marketing campaigns, etc.
Visual and Audio Recordings:
Visual and audio recordings, etc.
In addition, as part of our banking operations, we process your data classified as “special-category personal data” under the Personal Data Protection Law (KVKK). This data is limited to the following categories: Foundation Membership (foundation membership information), Union Membership (union membership information), Health Information (information regarding disability status), and Biometric Data (facial recognition information).
Your personal data listed above may be obtained through the following methods.
Methods of Obtaining Personal Data from You;
- Through your application, instruction, or visit submitted via in-person service channels (headquarters and branches, sales teams and support services/external service providers, companies with which we operate as intermediaries or agents, and authorized dealers)—using non-automated methods; Data in the following categories: Identity, Contact Information, Legal Transactions, Customer Transactions, Physical Premises Security, Risk Management, Finance, Professional Experience, Marketing, Foundation Membership, Union Membership, Health Information, and Visual and Audio Recordings.
- Automatically through your use of our digital channels, such as our website, ATMs, and mobile applications; Data in the following categories: Location, Transaction Security, Biometric Data, and Visual and Audio Records.
Methods of Obtaining Personal Data from Third Parties;
- The Turkish Banks Association Risk Center or companies established by at least five banks or financial institutions (Interbank Card Center, Credit Bureau), organizations/companies from which we receive support services via digital channels, and public or private institutions that provide information from public or private databases (e.g., Identity Sharing System, Address Sharing System, Central Registry System, Land Registry and Cadastre Information System) via automated methods: data falling under the categories of Identity, Contact, Legal Transactions, Customer Transactions, Risk Management, Finance, Marketing, and Audio and Video Records.
- Within the scope of our banking activities, from public or private institutions/organizations with which we have agreements (e.g., associations and unions such as Chambers of Commerce and Industry), from legal entities of which you are the owner or a partner, from persons, agents, guardians, and organizations authorized to conduct transactions at our Bank pursuant to an agreement or your instructions, from your employer, and from judicial authorities—using non-automated methods; Data in the Identity, Contact, Legal Transactions, Risk Management, Finance, and Professional Experience categories.
Purpose and Legal Basis for the Processing of Personal Data
Şekerbank processes personal data in accordance with the conditions for personal data processing set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK), based on the purposes and legal grounds listed in Article 5 of the KVKK as specified below.
Explicit provision in laws as specified in Article 5/2(a) of the KVKK; Necessity for the establishment or performance of a contract as specified in Article 5/2(c) of the KVKK; fulfilling our bank’s legal obligations as specified in Article 5/2(ç) of the KVKK; the data having been made public by the data subject themselves as specified in Article 5/2(d) of the KVKK; establishing, exercising, or protecting a right as specified in Article 5/2(e) of the KVKK; and Article 5/2 (f) where the processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject—the data categories and processing purposes are specified in the table below based on these legal grounds.
Your personal data as customers;
| Data Categories | Purposes for Processing Data | Legal Grounds |
| Identity, Contact Information, Personnel Records, Finance, Professional Experience, Risk Management, Visual Records | Ensuring that banking operations are conducted in accordance with the Bank’s procedures and/or applicable legislation; fulfilling our obligations arising from the legislation to which our Bank is subject, such as the Banking Law, the Bank Cards and Credit Cards Law, the Law on Payment and Securities Settlement Systems, Payment Services, and Electronic Money Institutions, and the Law on the Prevention of Laundering Proceeds of Crime; Conducting legal proceedings in which our Bank is a party; planning and executing corporate sustainability, corporate governance, and strategic processes; planning and/or executing investment processes; planning and executing the Bank’s audit, internal audit, internal control, investigation, and ethics activities; ensuring that your data is kept accurate and up-to-date; To the extent permitted by law, planning or conducting processes related to products and services offered jointly by the Bank in its capacity as an agent or in collaboration with its affiliates or partner organizations; planning and/or executing evaluation and/or intelligence and/or collateral and collection activities related to the allocation of banking products and services. | It is expressly provided for by law. It is necessary for the data controller to fulfill its legal obligation. |
| Identity, Contact Information, Location, Personnel Records, Legal Transactions, Customer Transactions, Transaction Security, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records | Establishing application processes for products or services; establishing allocation or evaluation processes; establishing and/or monitoring disbursement processes; and executing risk management processes; planning and executing banking activities and operational processes; conducting effectiveness/efficiency or compliance analyses of these activities and planning and executing them; implementing our Bank’s information security processes and establishing the information technology infrastructure; ensuring the security of Bank branches or facilities; planning or executing emergency or incident management processes; establishing the contract and ensuring that the obligations under it are properly fulfilled; Planning or executing the sales processes for products and/or services; recording, evaluating, and resolving reports such as complaints, objections, requests, suggestions, and satisfaction feedback in our report management system to provide you with better service; and planning and implementing access permissions to the necessary information for employees and business partner employees. | The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. Data processing is mandatory for the establishment, exercise, or protection of a right. |
| Physical Premises Security | Recording of camera footage at our bank’s ATMs and branches for security reasons and in accordance with our legal obligations; | It is expressly provided for by law. It is necessary for the data controller to fulfill its legal obligation. |
| Identity,
Contact Information, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing | Conducting financial and accounting operations; carrying out activities to ensure business continuity; planning and executing corporate communications activities; planning and/or executing logistics activities related to banking operations; managing relationships with business partners and/or suppliers; fulfilling data retention, reporting, and disclosure obligations as required by authorized individuals, institutions, and organizations; and preparing all records and documents that will serve as the basis for processing, whether in electronic or paper form. | It is expressly provided for by law. The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. It is necessary for the data controller to fulfill its legal obligation. Data processing is necessary for the establishment, exercise, or protection of a right |
Your personal data as company officials, executives, and partners;
| Data Categories | Purposes for Processing Data | Legal Grounds |
| Identity, Contact Information, Personnel Records, Legal Transactions, Customer Transactions, Physical Premises Security, Transaction Security, Risk Management, Finance, Professional Experience, Visual and Audio Records. | Establishing application processes for products or services; establishing allocation or evaluation processes; establishing or monitoring disbursement processes; and executing risk management processes; Planning and executing banking activities and operational processes; conducting effectiveness, efficiency, or compliance analyses of such activities and planning and executing these activities; planning and/or executing evaluation and/or intelligence and/or collateral and collection activities related to the allocation of banking products and services. | It is expressly provided for by law. The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. It is necessary for the data controller to fulfill its legal obligation. Data processing is necessary for the establishment, exercise, or protection of a right |
| Identity, Contact Information. | Recording, evaluating, and resolving reports such as complaints, objections, requests, suggestions, and feedback in our report management system to provide you with better service, as well as planning and implementing access permissions for employees and business partner staff to the necessary information; Managing the user identification process to enable legal entities to conduct transactions through the online branch. | The
processing of personal data belonging to the parties to a contract is
necessary, provided that such processing is directly related to the conclusion or performance of the contract. Data processing is necessary for the establishment, exercise, or protection
of a right |
If you are a third party providing collateral, your personal data;
| Data Categories | Purposes for Processing Data | Legal Grounds |
| Identity, Contact Information, Personnel Records, Customer Transactions, Legal Proceedings, Risk Management, Finance, Visual and Audio Records, Criminal Convictions, and Security Measures | Ensuring that banking activities are conducted in accordance with the Bank’s procedures and/or applicable regulations; ensuring the formation of the Agreement and the proper fulfillment of obligations under it; Establishing application processes for products or services, establishing allocation or evaluation processes, establishing or monitoring disbursement processes, and executing risk management processes; planning and/or executing evaluation and/or intelligence gathering and/or collateral and collection activities related to the allocation of banking products and/or services. | It is expressly provided for by law. The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. It is necessary for the data controller to fulfill its legal obligation. Data processing is necessary for the establishment, exercise, or protection of a right |
| Identity, Customer Transactions, Risk Management, Finance, Visual and Audio Records. | Planning and executing banking activities and operational processes; conducting effectiveness, efficiency, or compliance analyses of these activities, and planning and executing them; Implementing our Bank’s information security processes and establishing the information technology infrastructure; ensuring the security of Bank branches or facilities; planning or executing emergency or incident management processes; and fulfilling the information retention, reporting, and disclosure obligations prescribed by authorized individuals, institutions, and organizations. | The
processing of personal data belonging to the parties to a contract is
necessary, provided that such processing is directly related to the conclusion
or performance of the contract. Data processing is necessary for the establishment, exercise, or protection
of a right |
If you wish to use any of our bank’s products or services, or if you are an
individual, organization, or a person associated with them to whom the bank
intends to offer a product or service, or if you are not a customer of ours but
wish to conduct a transaction at our branch, your personal data;
| Data Categories | Purposes for Processing Data | Legal Grounds |
| Identity, Contact Information, Location, Personnel Records, Customer Transactions, Transaction Security, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records. | In accordance with the regulations to which our bank is subject, fulfilling our obligations regarding customer identification; Establishing application processes for products or services, establishing allocation or evaluation processes, establishing or monitoring disbursement processes, and executing risk management processes; To the extent permitted by law, planning or executing processes related to products and services offered jointly by entities in which the Bank holds an interest, with which it collaborates, for which it acts as an intermediary, or for which it serves as an agent; Fulfilling our obligations arising from the legislation to which our Bank is subject, such as the Banking Law, the Bank Cards and Credit Cards Law, the Law on Payment and Securities Settlement Systems, Payment Services, and Electronic Money Institutions, and the Law on the Prevention of Laundering Proceeds of Crime; Processing and transferring data to companies operating as intermediaries or agents, third parties from whom we obtain services to conduct our banking operations, institutions, organizations, domestic and foreign banks, funds, and partner organizations, as required by legal obligations and for the performance of the contract. | It is expressly provided for by law. The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. It is necessary for the data controller to fulfill its legal obligation. Data processing is necessary for the establishment, exercise, or protection of a right |
| Identity, Transaction Security, Risk Management, Finance, Visual and Audio Records. | Planning and executing banking activities and operational processes; conducting analyses of the effectiveness, efficiency, or compliance of these activities, and planning and executing them; planning and executing the Bank’s audit, internal audit, internal control, investigation, and ethics activities. | It is expressly provided for by law. The processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract. It is necessary for the data controller to fulfill its legal obligation. |
| Physical Premises Security | Recording of camera footage at our bank’s ATMs and branches for security reasons and in accordance with our legal obligations; | It is expressly provided for by law. It is necessary for the data controller to fulfill its legal
obligation. |
Your personal data and special-category personal data processed on the
legal basis of your explicit consent pursuant to Article 5(1) of the KVKK, and
our purpose for processing such data;
| Data Categories | Purposes for Processing Data |
| Identity, Contact Information, Location, Legal Proceedings, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records. | Use in the products and services we can offer you in our capacity as an agent; conducting processes related to campaigns tailored to you and volume growth, and offering suitable products; planning and carrying out sales, marketing, promotional, and advertising activities; conducting social responsibility and civil society activities; analyzing your potential product preferences; |
| Foundation Membership, Union Membership, Health Information, Biometric Data | Ensuring that banking operations are conducted in accordance with the Bank’s procedures and/or applicable regulations; planning and executing the Bank’s audit, internal audit, internal control, investigation, and ethics activities; establishing application processes for products or services, establishing allocation or evaluation processes, establishing or monitoring disbursement processes, and executing risk management processes. |
Your Personal Data Regarding Individuals in the Same Risk Group
You, your spouse, your children, and the persons listed above, as well as partnerships in which they serve as board members or managing directors, or which they—or a legal entity—control jointly or individually, directly or indirectly, or in which they participate with unlimited liability; and the qualified shareholders, board members, and managing director of a bank, as well as partnerships in which they, jointly or individually, directly or indirectly, exercise control or in which they are partners with unlimited liability, or in which they serve as board members or managing directors; and natural and legal persons with surety, guarantee, or similar relationships of such a magnitude that the financial distress of one would result in the financial distress of one or more others—constitute a risk group. In addition, other individuals and legal entities falling within the scope of a risk group are determined by the Banking Regulation and Supervision Agency of the Republic of Türkiye. Even if you are not our customer, our Bank may process your personal data for the purposes of identifying, monitoring, reporting, and controlling the risk group to which you belong—in order to determine credit limits to be extended to a risk group in accordance with banking regulations.
Receivers of Processed Personal Data & Purpose of Transfer
Your personal data is transferred to the parties listed below for the following purposes and on the following legal grounds:
| Receiving Persons / Institutions of Data Transferred | Our Purpose of Transfer |
| Public institutions and organizations authorized by law to obtain information, as well as judicial authorities (e.g., the Banking Regulation and Supervision Agency, the Ministry of Treasury and Finance of the Republic of Türkiye, the Financial Crimes Investigation Board, the Capital Markets Board, the Central Bank of the Republic of Türkiye, and judicial authorities) | Disclosures made for legal reasons necessary for statutory reporting, the conduct of regulatory and audit activities, and the handling of complaints and legal proceedings. |
| As defined by the Banking Law and related legislation: individuals, entities, institutions classified as financial institutions, and public legal entities, as well as foreign/international institutions and organizations and payment service providers (e.g., TBB Risk Center, Domestic Banks, Independent Audit Firms, Correspondent Banks, MasterCard, Visa) | Disclosures made to enable the conduct of banking operations and the fulfillment of legal obligations. |
| Our Shareholders | Disclosures made on a limited basis under the Banking Law No. 5411. |
| Third parties for whom we act as intermediaries or agents, our affiliated companies, and our Business Partners, Suppliers, and contracted Support Service Providers with whom we collaborate or from whom we obtain services to conduct our banking operations. | Information shared to facilitate the conduct of business with third parties from whom we receive support and with our affiliates in order to provide banking services. |
Rights of Data Subjects Whose Personal Data Is Processed
Your rights regarding your personal data under Article 11 of the KVKK;
- Learning whether personal data has been processed
- Requesting information regarding the processing of personal data, if it has been processed
- Learning the purpose of the processing of personal data and whether it is being used in accordance with that purpose
- Knowing the third parties to whom personal data has been transferred, whether within the country or abroad,
- If your personal data has been processed incompletely or incorrectly, requesting that it be corrected and, in this context, requesting that the third parties to whom your personal data has been transferred be notified of the action taken;
- Despite being processed in accordance with Law No. 6698 and other relevant laws, requesting the deletion or destruction of your personal data if the grounds for processing no longer exist, and requesting that the third parties to whom your personal data has been disclosed be notified of this action,
- Objecting to a decision made solely through the automated analysis of your processed data if you believe such a decision has resulted in an adverse outcome for you,
- Requesting compensation for any damages you may have suffered as a result of the unlawful processing of your personal data.
You may submit your requests under Article 11 of the KVKK, which “regulates the rights of the data subject,” in accordance with the “Communiqué on the Procedures and Principles for Applications to the Data Controller,” along with documents verifying your identity (In applications made on behalf of another person, the applicant must submit a power of attorney or authorization document proving their authority in this matter; requests made by unauthorized third parties on behalf of others will not be considered.) and a written request outlining your request to our branches or in person at the address: Emniyet Evleri Mah., Eski Büyükdere Cad., No: 1/1A, 34415 Kağıthane, Istanbul, or submit it via a notary public.
In this context, written applications regarding this matter will be accepted following identity verification by our office, and responses will be provided to the relevant parties within the statutory timeframes.
Customer Onboarding/Account Opening Privacy Notice
In accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”), regarding the processing of personal data, Şekerbank Türk Anonim Şirketi (“ŞEKERBANK,” “Our Bank”), acting as the data controller, hereby informs you in accordance with Article 10 of the Law titled “The Data Controller’s Obligation to Provide Information.”
ŞEKERBANK takes the utmost care to ensure the confidentiality and security of personal information it receives from its customers and/or customer representatives.
This privacy notice has been prepared to provide information regarding the methods of collecting personal data processed under the Personal Data Protection Law (KVKK), the legal grounds and purposes of personal data processing, the individuals or entities to whom personal data is transferred and the purposes of such transfers, as well as the rights of data subjects whose personal data is processed as set forth in the KVKK.
Processed Personal Data and Collection Methods:
1-Processed Personal Data
Your personal data processed by our Bank is classified according to the categories listed in the Data Controllers Registry Information System (VERBİS) of the Personal Data Protection Authority, in accordance with the KVKK. This information includes:
Identification Information: First and last name, mother’s and father’s names, date of birth, place of birth, Turkish ID number, passport number, etc.
- Contact Information: Mailing address, email address, phone number, etc.
- Legal Proceedings: Information from correspondence with judicial authorities, information in court case files, criminal record, etc.
- Customer Transactions: Call center records, invoices, promissory notes, check information, information on teller receipts, order information, request information, etc.
- Transaction Security: IP address information, website login and logout information, password and PIN information, etc.
- Risk Management: Information processed for the management of commercial, technical, and administrative risks, etc.
- Finance: Credit risk information, financial performance data, asset information, etc.
- Professional Experience: Degree information, courses taken, on-the-job training details, certificates, transcript information, etc.
- Visual and Audio Records: Audio recordings, video and photo recordings, etc.
- Marketing: Purchase history information, surveys, cookie records, information obtained through marketing campaigns, etc.
- Your health information: Your health information related to disability,
- Your information regarding criminal convictions and security measures: Processing of your criminal record to open a check account in accordance with the Check Law No. 5941.
- Biometric Data: Facial Recognition Information (for the purpose of verifying identity if a remote identity verification method is selected)
Your personal data is collected through automated methods:
Data related to an individual’s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs, attire, membership in associations, foundations, or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data. As part of our banking activities, we process your data classified as “special category personal data” under the Personal Data Protection Law (KVKK). This information includes:
Your personal data listed above may be collected through written and/or verbal communication channels, either electronically and/or physically, using methods that are fully or partially automated, or using non-automated methods provided they form part of a data recording system, as specified below. Your personal data is collected through the following methods:
- Through applications you submit via online service channels (use of our bank’s mobile and internet banking channels, customer contact center, IVR, and other digital channels),
- From the Turkish Banks Association Risk Center or companies established by at least five banks or financial institutions (Interbank Card Center, Credit Bureau, Turkish Banks Association, etc.), international money transfer intermediaries, organizations/companies providing support services through digital channels, public institutions or organizations, judicial and administrative authorities, and institutions that provide information from the databases of private institutions/organizations (For example, the Identity Sharing System, Address Sharing System, Central Registry System, Land Registry and Cadastre Information System, Social Security Institution (SGK), Revenue Administration (GİB), Land Registry and Cadastre Information System, Notaries, etc., and their system integrations),
- Through applications you submit via e-Government,
- Through cookies and other tracking technologies used on our mobile app and website,
- From public institutions, organizations, or entities with which we have agreements within the scope of our banking activities; from government agencies; or from private institutions/organizations (such as chambers of commerce and industry, associations, and similar bodies); from member businesses and POS terminals; and from institutions and organizations that are parties to our Bank’s products and for which we facilitate payments.
Through partially automated or non-automated methods;
- In accordance with the Banking Law No. 5411 and other relevant legislation/regulations to which we are subject, through all contracts, information forms, and other documents related to banking transactions executed with your consent and/or signature at the time your legal relationship with our Bank is established and/or during the term of this legal relationship,
- Through face-to-face service channels (Head Office, Regional Offices, Branches, and other service units; ATMs; kiosks; sales teams; organizations from which we receive support or outsourced services; companies with which we conduct business in an intermediary or agency capacity; and authorized dealers), via your interactions, applications, instructions, or visits,
- From legal entities of which you are the owner or partner, from third parties authorized to conduct transactions on your behalf and for your account (such as representatives, agents, guardians, or trustees), and from your workplace or employer,
- Through application forms, contracts, telephone calls, and via courier or mail,
- Records of conversations you have with our Customer Contact Center.
ŞEKERBANK processes personal data in accordance with the conditions for personal data processing set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK), based on the purposes and legal grounds listed below in Articles 5 and 6 of the KVKK.
Data Categories | Purpose of Data Processing | Legal Grounds |
Identity Contact Information Personnel Records Customer Transactions Risk Management Finance Professional Experience Legal Proceedings | Ensuring that banking
operations are conducted in accordance with the Bank’s procedures and/or
relevant legislation; Fulfilling our obligations
arising from the legislation to which our bank is subject, such as the Banking
Law, the Bank Cards and Credit Cards Law, the Law on Payment and Securities
Settlement Systems, Payment Services, and Electronic Money Institutions, and
the Law on the Prevention of Laundering of Proceeds of Crime; Conducting legal proceedings
in which our bank is a party; Corporate sustainability,
corporate governance, planning and execution of strategic processes, Execution of Goods and
Services Sales Processes Execution of Product and
Services Marketing Processes Planning and/or execution of
investment processes; Planning and execution of the
Bank’s audit, internal audit, internal control, investigation, and ethics
activities; Ensuring that your data is
kept accurate and up-to-date; To the extent permitted by
law, planning or executing processes related to products and services offered
jointly by the Bank or by entities with which the Bank has a partnership or
collaboration, acting in the capacity of an agent;
Planning and/or executing
evaluation and/or intelligence and/or collateral and collection activities
related to the allocation of banking products and services. | Necessity for the
bank to fulfill its legal obligation, Explicit provision
in the law, Direct relevance to the formation or performance of the contract, |
Identity, Contact Information, Location, Personnel Records, Legal Proceedings, Customer Transactions, Transaction Security, Risk Management, Finance, Professional Experience, Marketing, Visual and Audio Records | Establishing application
processes for products or services; establishing allocation or evaluation
processes; establishing and/or monitoring disbursement processes; and conducting
risk management processes; Planning and executing banking
activities and operational processes; conducting effectiveness, efficiency, or
compliance analyses of these activities, and planning and executing them; Executing our Bank’s
information security processes and establishing the information technology
infrastructure; ensuring the security of Bank branches or facilities; and
planning or executing emergency or incident management processes;
Establishing the contract and
ensuring that the obligations under it are properly fulfilled; Planning or executing the
sales processes for products and/or services; The recording, evaluation, and resolution of feedback such as complaints, objections, requests, suggestions, and expressions of satisfaction in our feedback management system, as well as the planning and implementation of access permissions for employees and business partner staff to the necessary information, in order to provide you with better service. | The necessity of
processing personal data belonging to the parties to a contract, provided that
such processing is directly related to the conclusion or performance of the
contract. The necessity of
data processing for the establishment, exercise, or protection of a right. Processing is
expressly provided for by law |
Physical Premises Security | Recording of camera footage at our bank’s ATMs and branches for security reasons and in accordance with our legal obligations; | It is expressly provided for
by law. It is necessary for the data controller to fulfill its legal obligations. |
Identity, Contact Information, Customer Transactions, Risk Management, Finance, Professional Experience, Marketing Special Category Personal Data: | Conducting finance and accounting operations;
carrying out activities to ensure business continuity; Planning and executing corporate communications
activities; planning and/or executing logistics activities related to banking
operations; managing relationships with business partners and/or suppliers; In order to fulfill the data retention,
reporting, and disclosure obligations prescribed by authorized individuals,
institutions, and organizations; The organization of all records and documents that will serve as the basis for processing, whether in electronic or paper form. | It is expressly
provided for by law. The processing of personal data belonging to the parties
to a contract is necessary, provided that it is directly related to the
conclusion or performance of the contract. It is necessary
for the data controller to fulfill its legal
obligations. Data processing is necessary for the establishment,
exercise, or protection of a right |
Health Data | Processing of your health data based on your disability information for the purpose of carrying out the necessary procedures to evaluate and finalize your application to become a customer, in accordance with the Regulation on Accessibility of Banking Services | It is expressly provided for by law; legal obligations; legitimate interests; explicit consent |
Data on Criminal Convictions and Security Measures | Processing of your criminal record to open a check account in accordance with the Check Law No. 5941. | It is expressly provided for by law Legal obligations it is necessary for the fulfilment of a legal obligation |
Biometric Data | Processing of your criminal record to open a check account in accordance with the Check Law No. 5941. | It is expressly provided for by law It is necessary for the data controller to be able to fulfill its legal obligation. |
Transfer of Your Personal Data
For the purposes specified above, to public institutions and organizations authorized by law to receive such information, as well as to judicial authorities (e.g., Banking Regulation and Supervision Agency, Ministry of Treasury and Finance of the Republic of Turkey, Financial Crimes Investigation Board, Capital Markets Board, Central Bank of the Republic of Turkey, Judicial Authorities, Revenue Administration) for the purposes of legal reporting, the conduct of regulatory and supervisory activities, and the handling of complaints and legal proceedings; as determined by the Banking Law and related legislation; individuals, organizations, institutions classified as financial institutions, and public legal entities, as well as foreign/international institutions and organizations and payment service providers (e.g., TBB Risk Center, domestic banks, independent audit firms, correspondent banks, MasterCard, Visa) to conduct banking activities and fulfill legal obligations; To share information with our shareholders within the limited scope permitted by the Banking Law No. 5411; with third parties for whom we act as intermediaries or agents, our affiliated companies, our business partners and suppliers from whom we obtain services or with whom we collaborate to conduct our banking activities, and notaries; and contracted support service providers—as well as with parties from whom we receive support to conduct banking services and our affiliated companies—may be shared in accordance with the legal grounds for personal data processing set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK) and the provisions regarding the transfer of personal data specified in Articles 8 and 9 of the KVKK.
You may exercise the following rights regarding the processing of your personal data by submitting a request to Şekerbank. Requests submitted within this scope will be resolved by Şekerbank free of charge within thirty days at the latest. However, if the written response we provide regarding your request exceeds 10 pages and/or requires delivery on a storage medium such as a CD or flash drive, it will be subject to the fee determined by the Personal Data Protection Board in accordance with the provisions of the “Communiqué on the Procedures and Principles for Applications to the Data Controller.”
In this context, as a data subject, your rights are as follows:
- Learning whether personal data has been processed
- Requesting information regarding the processing of personal data, if it has been processed
- Learning the purpose of the processing of personal data and whether it is being used in accordance with that purpose
- Knowing the third parties to whom personal data has been transferred, whether within the country or abroad
- Requesting the correction of personal data if it has been processed incompletely or incorrectly
- Requesting the deletion or destruction of personal data in accordance with the conditions set forth in the KVKK legislation
- Requesting that third parties to whom personal data has been transferred be notified of actions taken in response to a request for the correction, deletion, or destruction of personal data
- Objecting to a decision made solely through the automated processing of personal data that adversely affects the individual
- Requesting compensation for damages suffered as a result of the unlawful processing of personal data
You must submit your requests under Article 11 of the Personal Data Protection Law (KVKK), which “regulates the rights of the data subject,” in accordance with the “Communiqué on the Procedures and Principles for Applications to the Data Controller.” alongwith your documents proving your identity (in requests made on behalf of another person, the applicant must provide a document proving their authority in this matter; requests made by unauthorized third parties on behalf of others will not be considered.) accompanied by your written request. You may submit these in person to our Branches or to the address: Emniyet Evleri Mah. Eski Büyükdere Cad. No:1/1A 34415 Kağıthane/Istanbul, or you may have them delivered via a notary public.
In this context, written applications regarding this matter will be accepted following identity verification by our office, and responses will be provided to the relevant parties within the statutory timeframes.
Privacy Notice Regarding the Protection of Personal Data in Credit Processes
In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), as Şekerbank Türk Anonim Şirketi (“Şekerbank”), registered in the Trade Registry Gazette under registration number 536973, with its registered office at Emniyet Evleri Mh., Eski Büyükdere Cd., No: 1/1A, 34415 Kâğıthane/Istanbul, and acting as the data controller, we hereby inform you in accordance with Article 10 of the Law, titled “The Data Controller’s Obligation to Provide Information,” regarding the processing of personal data in credit processes.
Şekerbank exercises the utmost care to ensure the confidentiality and security of personal information it receives from its customers and/or customer representatives.
This privacy notice has been prepared to provide information regarding the methods of collecting personal data processed under the KVKK, the legal grounds and purposes of personal data processing, the individuals/entities to whom personal data is transferred and the purposes of such transfers, as well as the rights of data subjects whose personal data is processed, as set forth in the KVKK.
Processed Data and Collection Method:
When you apply for credit products through our bank’s mobile app, website, or at our branches, your data—which falls under the categories of identification, contact information, customer transactions, finance, risk management, professional experience, visual and audio recordings, transaction security, marketing, and legal proceedings—will be processed. This information includes your first name, last name, place and date of birth, tax identification number, passport number, foreign identification number, Turkish ID serial number, Turkish ID number, residential address, phone number, email address, your nationality, your income, your occupational information, camera recordings obtained at our headquarters and branches, recordings of phone/video calls or conversations, your call center records, your credit score, your salary information, your Social Security Registration and Service Records, your payment history, information regarding real estate, properties, and vehicles registered in your name, your credit history, your credit capacity, your tax status, your income and other sources of income and/or the financial products you hold, whether you are registered in a credit registry, information regarding payment delays and your income, electronic payment instrument data such as your card information, your demographic data, your Findeks Credit Score from KKB and data obtained from KPS and APS, your title, your occupation, length of employment, educational background, cookies and other tracking technology logs, and—if you conduct transactions via digital channels or customer service—your video, audio, digital records, and transaction details. This information will be collected and processed directly through Şekerbank Mobile, online banking, our branches, or customer service channels, either automatically or upon your login.
Your personal data may be collected electronically through call center and video call recordings, telephone, ATMs, our website and mobile banking applications, email, and KEP channels; and physically through our branches and our Head Office, as well as through system integrations shared via public institutions and organizations, for the purposes listed below.
If you wish to purchase insurance for credit products, your information in the “Health Information” category will be processed subject to your explicit consent in accordance with Article 5/1 of the Personal Data Protection Law (KVKK).
- Identity Information:
- First and last name, mother’s and father’s names, date of birth, place of birth, Turkish ID number, passport number, etc.
- Contact Information:
- Mailing address, email address, phone number, etc.
- Legal Proceedings:
- Information in correspondence with judicial authorities, information in court files, criminal record, etc.
- Customer Transactions:
- Call center records, invoices, promissory notes, check information, information on teller receipts, order information, request information, etc.
- Transaction Security:
- IP address information, website login and logout information, password and PIN information, etc.
- Risk Management:
- Information processed for the management of commercial, technical, and administrative risks, etc.
- Finance:
- Credit risk information, financial performance information, asset information, etc.
- Professional Experience:
- Degree information, courses taken, on-the-job training information, certificates, transcript information, etc.
- Visual and Audio Records:
- Audio recordings, visual recordings (video and photo recordings, etc.)
- Marketing:
- Purchase history information, surveys, cookie records, information obtained through marketing campaigns, etc.
- Health Information:
- Information regarding disability status, blood type, personal health information, information on devices and prosthetics used, etc.
Purpose and Legal Basis for the Processing of Personal Data
Şekerbank processes personal data in accordance with the conditions for personal data processing set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK), based on the purposes and legal grounds listed in Articles 5 and 6 of the KVKK, as specified below.
Data Categories | Purposes for Processing Data | Legal Grounds |
Identity
Information | Receiving and evaluating your credit application, establishing a credit limit, and finalizing your application; conducting customer identification, verification, and authentication procedures; ensuring the accuracy and timeliness of data; preventing fraud and deception; planning and executing the Bank’s audit, internal audit, internal control, investigation, and ethics-related activities; Planning and executing banking activities and operational processes; conducting effectiveness, efficiency, or compliance analyses of these activities and planning and executing them; managing requests and complaints; responding to requests from government agencies; Providing information requested by authorized institutions; Carrying out legal and administrative procedures for debt collection; Conducting financial reporting and budgeting processes; Managing requests and complaints | It is necessary for the bank to fulfill its legal obligation, |
Visual and audio recordings Transaction Security | The creation of audit trail records in accordance with the Banking Law and related regulations, | Data processing is necessary for the establishment, exercise, or protection of a right |
Marketing | Conducting Marketing Processes for Products/Services | If you have given your explicit consent |
In this context, as a data subject, your rights are as follows:
- Learning whether personal data has been processed
- Requesting information regarding the processing of personal data, if it has been processed
- Learning the purpose of the processing of personal data and whether it is being used in accordance with that purpose
- Knowing the third parties to whom personal data has been transferred, whether within the country or abroad
- Requesting the correction of personal data if it has been processed incompletely or incorrectly,
- Requesting the deletion or destruction of personal data,
- Requesting that third parties to whom personal data has been transferred be notified of actions taken in response to a request for the correction, deletion, or destruction of personal data,
- Objecting to a decision made solely through the automated processing of personal data that adversely affects the individual
- Requesting compensation for damages suffered as a result of the unlawful processing of personal data
Transfer of Your Personal Data
For the purposes stated above, to the extent permitted by law and required by our business processes, your personal data may be shared with companies from which we receive services to conduct our banking activities, as well as with the Banking Regulation and Supervision Agency, the Ministry of Treasury and Finance, the Financial Crimes Investigation Board, the Central Bank of the Republic of Türkiye, the Turkish Banking Association (TBB) Risk Center, the Social Security Institution, the Credit Registry Bureau, administrative and public authorities, tax authorities, judicial investigation authorities, notaries, payment processing service providers, and other financial institutions, our affiliates, asset management companies, independent audit firms, public legal entities authorized to receive personal information, such as support service providers or third parties, in accordance with the legal grounds for the processing of personal data set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK) and the provisions regarding the transfer of personal data specified in Articles 8 and 9 of the KVKK.
Rights of Data Subjects Whose Personal Data Is Processed:
You may exercise the following rights regarding the processing of your personal data by submitting a request to Şekerbank. Requests submitted within this scope will be resolved by Şekerbank free of charge within thirty days at the latest. However, if the written response we provide regarding your request exceeds 10 pages and/or requires delivery on a storage medium such as a CD or flash drive, it will be subject to the fee determined by the Personal Data Protection Board in accordance with the provisions of the “Communiqué on the Procedures and Principles for Applications to the Data Controller.”
Under the Personal Data Protection Law (KVKK), you may exercise your rights regarding your personal data by submitting documents proving your identity and a written request to our branches or in person at the address: Emniyet Evleri Mah., Eski Büyükdere Cad., No: 1/1A, 34415 Kağıthane/Istanbul, or by sending them via a notary public. In this context, written requests regarding this matter will be accepted following identity verification by us, and responses will be provided to the relevant parties within the statutory timeframes.
Company: Şekerbank T.A.Ş.
Chamber of Commerce: Istanbul
Trade Registry Number: 536973/0
Headquarters Address: Emniyet Evleri Mh. Eski Büyükdere Cd. No. 1/1A, 34415 Kağıthane/Istanbul
Phone: 0850 222 78 78
Privacy Notice Regarding The Protection of Personel Data Related to Investment Products
In accordance with the Personal Data Protection Law No. 6698 (KVKK) regarding the processing of personal data, Şekerbank Türk Anonim Şirketi, located at Emniyet Evleri Mh., Eski Büyükdere Cd., No: 1/1A, 34415 Kâğıthane/Istanbul, and registered in the Commercial Register Gazette under registration number 536973 (Şekerbank), acting as the data controller, hereby informs you in accordance with Article 10 of the Law titled “The Data Controller’s Obligation to Provide Information.”
Şekerbank takes the utmost care to ensure the confidentiality and security of personal information it receives from its customers and/or customer representatives.
This privacy notice has been prepared to provide information regarding the methods of collecting personal data processed under the Personal Data Protection Law (KVKK), the legal grounds and purposes of personal data processing, the individuals or entities to whom personal data is transferred and the purposes of such transfers, as well as the rights of data subjects whose personal data is processed as stipulated in the KVKK.
Processed Data and Collection Methods:
Through our Bank’s mobile app, website, or by applying at our branches, your data falling under the categories of identification, contact, personal profile, customer transaction information, transaction security, risk management, finance, professional experience, marketing, and visual records related to Investment Products will be processed. This information includes your first name, last name, place and date of birth, tax identification number, passport number, foreign identification number, Turkish ID serial number, Turkish ID number, residential address, phone number, email address, nationality, income, professional information, investment and savings products you hold, your educational background, cookies and other tracking technology logs, and your Central Registry Agency registration number. If you conduct transactions through our branches, digital channels, or customer service, your video, audio, digital records, and transaction details will be collected and processed directly through Şekerbank Mobile app, internet banking, our branches, or customer service channels, either automatically or upon your login.
Purpose and Legal Basis for Processing Personal Data:
Şekerbank processes personal data in accordance with the conditions for personal data processing set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK), based on the purposes and legal grounds specified below.
Data Categories | Purpose of Processing Data | Legal Grounds |
Identity Information, Contact Information, Personnel Records, Customer Transaction Information, Risk Management, Finance, Professional Experience, Marketing | Providing portfolio brokerage and
investment fund share trading brokerage services by executing our customers'
buy and sell orders/instructions as the counterparty, and safekeeping the
products covered by the contract, Conducting customer due diligence,
identity verification, and confirmation procedures, Ensuring the accuracy and timeliness
of data, Preventing fraud and deception, Planning and executing the Bank’s
audit, internal control, investigation, and ethics activities, Planning and executing banking
activities and operational processes, or conducting effectiveness and
efficiency compliance analyses, and planning and executing these activities, Executing marketing processes for products and services | When it is necessary for the bank to
fulfill its legal obligations, When it is expressly provided for by
law, When you have given your explicit consent, |
Visual and audio recordings Transaction Security | The creation of audit trail records
in accordance with the Banking Law and related regulations, The implementation of our Bank’s information security processes and the establishment of its information technology infrastructure. | Where data processing is necessary
for the establishment, exercise, or protection of a right, Where the data subject has given explicit consent. |
Transfer of Your Personal Data:
For the purposes specified above, to the extent permitted by law and as required by our business processes, your personal data may be transferred to companies from which we receive services to conduct our banking operations, as well as to the Capital Markets Board, the Banking Regulation and Supervision Agency, the Financial Crimes Investigation Board, the Central Bank of the Republic of Türkiye, and TEFAS (Türkiye Electronic Fund Trading Platform), TAKASBANK, our affiliates, independent audit firms, support service providers or third parties, and public legal entities authorized to receive personal data—such as the Central Securities Depository (MKK)—in accordance with the legal grounds for the processing of personal data set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK) and the provisions regarding the transfer of personal data specified in Articles 8 and 9 of the KVKK.
Rights of Data Subjects Whose Personal Data Is Processed:
You may exercise the following rights regarding the processing of your personal data by submitting a request to Şekerbank. Requests submitted within this scope will be resolved by Şekerbank free of charge within thirty days at the latest. However, if the written response we provide regarding your request exceeds 10 pages and/or requires delivery on a storage medium such as a CD or flash drive, it will be subject to the fee determined by the Personal Data Protection Board in accordance with the provisions of the “Communiqué on the Procedures and Principles for Applications to the Data Controller.”
In this context, as a data subject, your rights are as follows:
- Learning whether personal data has been processed
- Requesting information regarding the processing of personal data, if it has been processed
- Learning the purpose of the processing of personal data and whether it is being used in accordance with that purpose
- Knowing the third parties to whom personal data has been transferred, whether within the country or abroad
- Requesting the correction of personal data if it has been processed incompletely or incorrectly
- Requesting the deletion or destruction of personal data
- Requesting that third parties to whom personal data has been transferred be notified of actions taken in response to a request for the correction, deletion, or destruction of personal data
- Objecting to a decision made solely through the automated processing of personal data that adversely affects the individual
- Requesting compensation for damages suffered as a result of the unlawful processing of personal data
Under the Personal Data Protection Law (KVKK), you may exercise your rights regarding your personal data by submitting documents proving your identity and a written request to our branches or in person at the address: Emniyet Evleri Mah., Eski Büyükdere Cad., No: 1/1A, 34415 Kağıthane/Istanbul, or by sending them via a notary public. In this context, written requests regarding this matter will be accepted following identity verification by us, and responses will be provided to the relevant parties within the statutory timeframes.
Company : Şekerbank T.A.Ş.
Chamber of Commerce: Istanbul
Trade Registry Number: 536973/0
Headquarters Address: Emniyet Evleri Mh. Eski Büyükdere Cd. No. 1/1A, 34415 Kağıthane/Istanbul
Phone: 0850 222 78 78