Yapı Kredi Dünyam

In accordance with the Personal Data Protection Law No. 6698 (“Law”), your personal data may be processed by Yapı ve Kredi Bankası A.Ş. (“Bank”) as the data controller within the scope described below. Our Bank aims to provide digital assistant services to you by artificial intelligence technology in your transactions related to our Digital Assistant applications and the platforms on which these services are offered.

Personal Data Category	Individual Personal Data
Identity Information	First name, last name, mother’s name, father’s name, gender, date of birth, place of birth, information on the ID card other than blood type and religion field, driver’s license information other than blood type, marital status, ID number, copy of ID document, citizenship information, age, professional identification documents
Contact Information	Address, phone number, mobile phone number, email address
Transaction Security Information	Computer ID, cookie records (technical), system and application user account information (usernames, email accounts, last login dates, IP information), all security-related log records for systems, authentication information (password, token), security-related restrictions, internet access logs (for everyone accessing the internet via the Bank’s network), device information
Financial Information	Account balance, bank account information, loan balance, invoice information, payment information (IBAN, account number), payment details (amount, method, date), credit card number, donation information
Customer Transaction Information	Customer ID, customer instructions, customer requests, lease agreement, number of steps
Vehicle Information	Vehicle license plate, vehicle registration, vehicle chassis number, vehicle make and model, type of parking lot

Based on the legal basis that it is explicitly provided for by law and is necessary for the data controller to fulfill its legal obligations;

Your identity, contact, financial, transaction security, vehicle and customer transaction data may be processed for the purposes of providing information and reporting to authorized persons, institutions and organizations (such as the BRSA, Banks Association of Türkiye Risk Center, MASAK, BKM and courts) within the scope of legal and regulatory obligations,

Based on the legal ground that the processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the conclusion or performance of the contract;

·	Your identity, contact, financial, vehicle and customer transaction data may be processed for the purpose of providing digital assistant services to you,

Based on the legal ground that the processing of data is necessary for the legitimate interests of the data controller, provided that it does not infringe upon the fundamental rights and freedoms of the data subject;

·	Your identity, contact, financial, transaction security, vehicle, and customer transaction data for the planning, monitoring, and execution of information security and access authorization processes,
·	Your communication and identity data for the design, development, and management of our Bank’s systems and programs,
·	Your identity, contact, financial, vehicle, and customer transaction data will be processed for the purpose of planning or executing processes and activities aimed at enabling our Bank’s customers to benefit from products and services.

To Whom and for What Purpose Personal Data May Be Disclosed

Our Bank may transfer personal data to suppliers from whom we receive services in order to fulfill the Purposes specified above. Any transfers of personal data to suppliers are carried out in accordance with the legal grounds underlying the aforementioned Purposes, within the scope of fulfilling those Purposes.

In addition, your collected personal data; may be transferred to our business partners for the purpose of conducting our business operations within the scope of our legitimate interests in line with the fulfillment of the aforementioned Purposes; to legally authorized public institutions and private individuals, as explicitly provided by law and to fulfill our legal obligations, to fulfill legal reporting and information requests, to conduct legal audit activities, to authorized public institutions and private entities as required by law for the purpose of conducting legal proceedings and ensuring compliance with statutory requirements, and to our suppliers located abroad from whom we receive services based on the Standard Contract Clauses published by the Personal Data Protection Board, in accordance with the data processing conditions set forth in Article 5 of the Law and the rules regarding the transfer of personal data specified in Articles 8 and 9 of the Law.

The Data Subject’s Rights Under Article 11 of the Law

To exercise your rights regarding your personal data as listed in Article 11 of the Law;

·	through our Branches following identity verification,
·	by verifying your identity through our Digital Channels or Call Center,
·	by notary public to the address Yapı Kredi Plaza D Block 34330 Levent – Beşiktaş – Istanbul,
·	yapikredi@yapikredi.hs02.kep.tr by sending a securely electronically signed document to the address,
·	or by using the email address registered in our Bank’s system,

In your application:

·	first name, last name, and signature if the application is in writing,
·	Turkish Republic ID number for Turkish citizens, or nationality, passport number, or ID number (if available) for foreigners,
·	the residential or business address for service of process,
·	if available, the email address, phone number, and fax number to be used for notifications, and
·	the subject of the request.

Your request will be processed free of charge as soon as possible and no later than thirty (30) days. If the processing of your application incurs separate costs, a fee in accordance with the schedule determined by the Board may be charged to you.